Synthesis of sensor deception attacks for systems modeled as probabilistic automata

We study the security of control systems in the context of the supervisory control layer of stochastic discrete-event systems. Control systems heavily rely on correct communication between the plant and the controller. In this work, we consider that such communication is partially compromised by a malicious attacker. The attacker has the ability to modify a subset of the sensor readings and mislead the supervisor, with the goal of inducing the system into an unsafe state. We consider this problem from the attacker's viewpoint and investigate the synthesis of an attack strategy for systems modeled as probabilistic automata. Specifically, we quantify each attack strategy based on the likelihood of successfully reaching an unsafe state. The solution methodology that we develop uses techniques from the area of stochastic graph-games, specifically turn-based one-player stochastic reachability games.