Optimization Algorithm

1
Intrusion Detection in Controlled Discrete Event
Systems David Thorsley1 and Demosthenis
Teneketzis2 1Department of Electrical
Engineering, University of Washington, Seattle,
WA, thorsley_at_u.washington.edu 2Department of
Electrical Engineering and Computer Science,
University of Michigan, Ann Arbor, MI,
teneketzis_at_eecs.umich.edu
Abstract The constituent controllers in a
supervisory control system may sometimes fail as
a result of an intruder interfering with the
feedback performance of the system. The
intrusion may allow the system to execute traces
that the supervisor wishes to prevent from
occurring. We derive conditions under which a
supervisor can detect the presence of an intruder
in time to prevent the execution of an illegal
trace. In situations where it is not possible to
block all illegal strings, we use a language
measure method to assess the damage caused by a
particular set of controllers failing. We also
use the language measure technique to determine
the optimal behavior of the controlled system in
the presence of an intrusion.

• Damage Assessment
• Problem 2 If the language Lm- is not disarmable,
  how can we quantify the damage caused by the
  presence of an intruder?
• To do this we apply the language measure
  technique developed in (Wang and Ray, Signed
  Real Measure of Regular Languages, ACC 2002)
• To assign a measure to a string we use the
  following rules
• Assign a terminal cost in (0,1 to each state
  reached by a string in K and in -1,0) for each
  state reached by a string in Lm-
• Assign values to the state transitions such that
  the sum of all the transition values out of a
  given state is strictly less than 1
• Compute the cost of a string by multiplying its
  transition values and terminal cost
• The language of undesirable strings that are
  reachable if an intruder is present is
• The damage caused by an intruder is defined as

Information States An information state for this
problem consists of a set of strings consistent
with the observations made by and control actions
performed by the supervisor. An optimal
supervisor consists of a control action g(?) for
each information state ? that can be reached. In
order to find an optimal specification using
dynamic programming, we determine the set of
information states that are reachable under at
least one possible supervisor and order the
information states according to how many more
observations are possible. First we define The
set of all reachable information states is Y0
Y1 Ynmax where each Yn is given by
System Model The system is modeled by a
partially observed supervisory control system
with a supervisor defined as The system
generates a language L. The controller achieves
(in ideal operating conditions) a given
specification K and prevents the execution of a
set of undesirable language Lm-. Some of the
controllers are unreliable. There is a set ?uc,f
µ ?c of controllable events that become
uncontrollable if an intruder is present.
Optimization Algorithm For all information
states ? whose observation sequence corresponds
to nothing in the specification, the optimal
action is to disable all possible events and the
cost of such an information state is For each
information state we search over the set of
admissible control actions Theorem An optimal
control policy is found using a dynamic
programming algorithm which is computed
first for elements of Y0, then Y1, and so on.
Avoiding Undesirable Strings Problem 1 For a
given ?uc,f can the supervisor SP achieve the
specification K while preventing the execution of
any string in Lm-? Definition Lm- is disarmable
with respect to ?c, ?o, ?c,f, K, and L if where
Ldisable is defined as Theorem SP can achieve
K and prevent the execution of Lm- under
intrusion if and only if Lm- is disarmable.

• Optimizing the Specification
• Problem 3 Given the presence of an intruder,
  how can we find an optimal specification that
• Maximizes the rewards achieved by the
  specification
• Minimizes the damage an intruder can inflict
• We use K to denote the specification consisting
  of all strings that result in a positive reward
  and assume that K is acyclic. We define the
  performance criterion as
• Find a K such that for all other controllable
  and observable K0 µ K

• Future Directions
• Related problems in this framework include
• Probabilistic knowledge of an intruders
  capabilities
• Intrusion detection in decentralized supervisory
  control systems
• Intrusions affecting the supervisors observation
  sequence