Supervisory Control of Discrete-event Systems under Attacks

We consider a supervisory control problem for discrete-event systems, in which an attacker corrupts the symbols that are observed by the supervisor. We show that existence of a supervisor enforcing a specification language, in the presence of attacks, is completely characterized by controllability (in the usual sense) and observability of the specification (in a new appropriately defined sense). The new notion of observability takes into account the attacker’s ability to alter the symbols received by the attacker. For attacks that correspond to arbitrary insertions/removals of symbols, the new notion of observability can be tested by checking the usual notion of observability for a set of discrete-event systems with appropriately redefined observation maps. Focusing on attacks that replace and/or remove symbols from the output strings, we construct observers that are robust against attacks and lead to an automaton representation of the supervisor. We also develop a test for observability under such replacement-removal attacks by using the so-called product automata.