Skip to main content
# Table 11 Attacks launched on SWaT to test our invariant checkers

From: Deriving invariant checkers for critical infrastructure using axiomatic design principles

No. | Test | Target | Launch state | Attack intent and description |
---|---|---|---|---|

category | component(s) | |||

1 | SAOS | MV-101 |
At time t, LIT-101 is above 900mm
| Damage or reduce reliability of MV-101 |

and MV-101 is turned off |
At time t++, an attacker begins manually turning MV-101 on
| |||

(Fig. 7) | and off several times. | |||

2 | SAOS | P-101 |
At time t, LIT-301 is below 450mm,
| Damage or reduce reliability of P-101 |

MV-201 is opened, and P-101 is |
At time t++, an attacker manually stops P-101 for 10 seconds.
| |||

turned on (Fig. 8) | Then the attacker manually turns on P-101 for another 10 seconds. | |||

The whole scenario is repeated a few times. | ||||

3 | MAOS | Water pipes |
At time t, LIT-301 is above 900mm,
| Damage water pipes at stage two |

MV-201 is closed, P-101 is |
At time t++, an attacker manually turns P-101 on. Next, the
| |||

switched off and P-102 is switched | attacker manually turns pump P-102 on. | |||

off. (Fig. 8) | ||||

4 | MAMS | P-101, P-102, |
At time t, LIT-301 is above 900mm,
| Damage or reduce reliability of P-101, P-102, and MV-201 |

MV-201 | MV-201 is closed, and |
At t++, an attacker manually turned on MV-201.
| ||

P-101 and P-102 are switched off. | Next, the attacker manually starts pump P-102. | |||

(Fig. 8) | Then the attacker manually starts pump P-101. | |||

The test scenario is repeated several times. | ||||

5 | SAMS | LIT-301,MV-201 |
At time t, LIT-301 is above 900mm,
| Damage or reduce reliability of LIT-301 sensors, P-101, and MV-201. |

P-101 | MV-201 is closed and |
At t++ where x>3, an attacker changes the LIT-301 value
| ||

P-101 and P-102 are switched off. |
to 400mm. At t+2x the value of LIT-301 is set to above 800mm.
| |||

(Fig. 8) | This procedure is repeated several times. | |||

These causes the LIT-301 sensors to sense sudden change | ||||

in readings, MV-201 to open and close repeatedly, | ||||

and P-101 to start and off many times. | ||||

6 | SAOS | P-203 |
At time t, MV-201 is opened,
| Damage or reduce reliability of P-203 |

P-203 is turned on, |
At time t++, an attacker turns off and on
| |||

AIT-202 analyses water pH is | P-203 several times. | |||

above 8. (Fig. 9) | ||||

7 | SAOS | P-203 |
At time t, MV-201 is opened,
| Damage or reduce reliability of P-203 and AIT-202 |

AIT-202 | P-203 is turned on, |
At time t++, an attacker changes pH value from above 8 to 6
| ||

AIT-202 analyses water pH is | in AIT-202. This causes P-203 to switch off. | |||

above 8. (Fig. 9) | The attacker repeatedly changes these pH values. | |||

These caused P-203 to switch on and off several times. The | ||||

sensor in AIT-202 needs to calculate the sudden change | ||||

in pH several times. | ||||

8 | SAOS | Water pipes |
At time t, P-401 and P501 are
| Damage water pipes at stage four |

switched on. (Fig. 10) |
At time t++, an attacker physically turns P-402 on.
| |||

Now both P-401 and P-402 are pumping water to | ||||

stage five which add extra water pressure | ||||

to the pipes. | ||||

9 | SAOS | FIT-501 |
At time t, P-401 is
| Damage or reduce reliability of FIT-501. |

switched on. (Fig. 11) |
At time t++, an attacker drastically
| |||

increases the value of FIT. This procedure | ||||

is repeated several times. |