Skip to main content

Table 11 Attacks launched on SWaT to test our invariant checkers

From: Deriving invariant checkers for critical infrastructure using axiomatic design principles

No. Test Target Launch state Attack intent and description
  category component(s)   
1 SAOS MV-101 At time t, LIT-101 is above 900mm Damage or reduce reliability of MV-101
    and MV-101 is turned off At time t++, an attacker begins manually turning MV-101 on
    (Fig. 7) and off several times.
2 SAOS P-101 At time t, LIT-301 is below 450mm, Damage or reduce reliability of P-101
    MV-201 is opened, and P-101 is At time t++, an attacker manually stops P-101 for 10 seconds.
    turned on (Fig. 8) Then the attacker manually turns on P-101 for another 10 seconds.
     The whole scenario is repeated a few times.
3 MAOS Water pipes At time t, LIT-301 is above 900mm, Damage water pipes at stage two
    MV-201 is closed, P-101 is At time t++, an attacker manually turns P-101 on. Next, the
    switched off and P-102 is switched attacker manually turns pump P-102 on.
    off. (Fig. 8)  
4 MAMS P-101, P-102, At time t, LIT-301 is above 900mm, Damage or reduce reliability of P-101, P-102, and MV-201
   MV-201 MV-201 is closed, and At t++, an attacker manually turned on MV-201.
    P-101 and P-102 are switched off. Next, the attacker manually starts pump P-102.
    (Fig. 8) Then the attacker manually starts pump P-101.
     The test scenario is repeated several times.
5 SAMS LIT-301,MV-201 At time t, LIT-301 is above 900mm, Damage or reduce reliability of LIT-301 sensors, P-101, and MV-201.
   P-101 MV-201 is closed and At t++ where x>3, an attacker changes the LIT-301 value
    P-101 and P-102 are switched off. to 400mm. At t+2x the value of LIT-301 is set to above 800mm.
    (Fig. 8) This procedure is repeated several times.
     These causes the LIT-301 sensors to sense sudden change
     in readings, MV-201 to open and close repeatedly,
     and P-101 to start and off many times.
6 SAOS P-203 At time t, MV-201 is opened, Damage or reduce reliability of P-203
    P-203 is turned on, At time t++, an attacker turns off and on
    AIT-202 analyses water pH is P-203 several times.
    above 8. (Fig. 9)  
7 SAOS P-203 At time t, MV-201 is opened, Damage or reduce reliability of P-203 and AIT-202
   AIT-202 P-203 is turned on, At time t++, an attacker changes pH value from above 8 to 6
    AIT-202 analyses water pH is in AIT-202. This causes P-203 to switch off.
    above 8. (Fig. 9) The attacker repeatedly changes these pH values.
     These caused P-203 to switch on and off several times. The
     sensor in AIT-202 needs to calculate the sudden change
     in pH several times.
8 SAOS Water pipes At time t, P-401 and P501 are Damage water pipes at stage four
    switched on. (Fig. 10) At time t++, an attacker physically turns P-402 on.
     Now both P-401 and P-402 are pumping water to
     stage five which add extra water pressure
     to the pipes.
9 SAOS FIT-501 At time t, P-401 is Damage or reduce reliability of FIT-501.
    switched on. (Fig. 11) At time t++, an attacker drastically
     increases the value of FIT. This procedure
     is repeated several times.