Worst-case innovation-based integrity attacks with side information on remote state estimation

In this paper, we study the worst-case consequence of innovation-based integrity attacks with side information in a remote state estimation scenario where a sensor transmits its measurement to a remote estimator equipped with a false-data detector. If a malicious attacker is not only able to compromise the transmitted data packet but also able to measure the system state itself, the attack strategy can be designed based on the intercepted data, the sensing data, or alternatively the combined information. Surprisingly, we show that launching attacks using the combined information are not always optimal. First, we characterize the stealthiness constraints for different types of attack strategies to avoid being noticed by the false-data detector. Then, we derive the evolution of the remote estimation error covariance in the presence of attacks, based on which the worst-case attack policies are obtained by solving convex optimization problems. Furthermore, the closed-form expressions of the worst-case attacks are obtained for scalar systems and the attack consequences are compared with the existing work to determine which strategy is more critical in deteriorating system performance. Simulation examples are provided to illustrate the analytical results.