From: Deriving invariant checkers for critical infrastructure using axiomatic design principles
No. | Test | Target | Launch state | Attack intent and description |
---|---|---|---|---|
 | category | component(s) |  |  |
1 | SAOS | MV-101 | At time t, LIT-101 is above 900mm | Damage or reduce reliability of MV-101 |
 |  |  | and MV-101 is turned off | At time t++, an attacker begins manually turning MV-101 on |
 |  |  | (Fig. 7) | and off several times. |
2 | SAOS | P-101 | At time t, LIT-301 is below 450mm, | Damage or reduce reliability of P-101 |
 |  |  | MV-201 is opened, and P-101 is | At time t++, an attacker manually stops P-101 for 10 seconds. |
 |  |  | turned on (Fig. 8) | Then the attacker manually turns on P-101 for another 10 seconds. |
 |  |  |  | The whole scenario is repeated a few times. |
3 | MAOS | Water pipes | At time t, LIT-301 is above 900mm, | Damage water pipes at stage two |
 |  |  | MV-201 is closed, P-101 is | At time t++, an attacker manually turns P-101 on. Next, the |
 |  |  | switched off and P-102 is switched | attacker manually turns pump P-102 on. |
 |  |  | off. (Fig. 8) |  |
4 | MAMS | P-101, P-102, | At time t, LIT-301 is above 900mm, | Damage or reduce reliability of P-101, P-102, and MV-201 |
 |  | MV-201 | MV-201 is closed, and | At t++, an attacker manually turned on MV-201. |
 |  |  | P-101 and P-102 are switched off. | Next, the attacker manually starts pump P-102. |
 |  |  | (Fig. 8) | Then the attacker manually starts pump P-101. |
 |  |  |  | The test scenario is repeated several times. |
5 | SAMS | LIT-301,MV-201 | At time t, LIT-301 is above 900mm, | Damage or reduce reliability of LIT-301 sensors, P-101, and MV-201. |
 |  | P-101 | MV-201 is closed and | At t++ where x>3, an attacker changes the LIT-301 value |
 |  |  | P-101 and P-102 are switched off. | to 400mm. At t+2x the value of LIT-301 is set to above 800mm. |
 |  |  | (Fig. 8) | This procedure is repeated several times. |
 |  |  |  | These causes the LIT-301 sensors to sense sudden change |
 |  |  |  | in readings, MV-201 to open and close repeatedly, |
 |  |  |  | and P-101 to start and off many times. |
6 | SAOS | P-203 | At time t, MV-201 is opened, | Damage or reduce reliability of P-203 |
 |  |  | P-203 is turned on, | At time t++, an attacker turns off and on |
 |  |  | AIT-202 analyses water pH is | P-203 several times. |
 |  |  | above 8. (Fig. 9) |  |
7 | SAOS | P-203 | At time t, MV-201 is opened, | Damage or reduce reliability of P-203 and AIT-202 |
 |  | AIT-202 | P-203 is turned on, | At time t++, an attacker changes pH value from above 8 to 6 |
 |  |  | AIT-202 analyses water pH is | in AIT-202. This causes P-203 to switch off. |
 |  |  | above 8. (Fig. 9) | The attacker repeatedly changes these pH values. |
 |  |  |  | These caused P-203 to switch on and off several times. The |
 |  |  |  | sensor in AIT-202 needs to calculate the sudden change |
 |  |  |  | in pH several times. |
8 | SAOS | Water pipes | At time t, P-401 and P501 are | Damage water pipes at stage four |
 |  |  | switched on. (Fig. 10) | At time t++, an attacker physically turns P-402 on. |
 |  |  |  | Now both P-401 and P-402 are pumping water to |
 |  |  |  | stage five which add extra water pressure |
 |  |  |  | to the pipes. |
9 | SAOS | FIT-501 | At time t, P-401 is | Damage or reduce reliability of FIT-501. |
 |  |  | switched on. (Fig. 11) | At time t++, an attacker drastically |
 |  |  |  | increases the value of FIT. This procedure |
 |  |  |  | is repeated several times. |