Covert System Identification Under Timing Constraints: A Static Linear Model and Its Detectability Implications

arXiv:2611.12579v1 [eess.SY] 9 Nov 2026

Covert System Identification Under Timing Constraints: A Static Linear Model and Its Detectability Implications Victor Mattos1 , Guilherme Sobreira1 , Amit Bhaya1 , Alan Oliveira de Sá5 , Charles B. Prado4 , Raphael Machado2,4 , Gaurav Srivastava3 , and Daniel S. Menasche1 1

Universidade Federal do Rio de Janeiro (UFRJ), Rio de Janeiro, Brazil victor.mattos@coppe.ufrj.br 2 Universidade Federal Fluminense (UFF), Niterói, Brazil 3 Siemens, Princeton, NJ, USA 4 Instituto Nacional de Metrologia, Qualidade e Tecnologia (Inmetro), Brazil 5 LASIGE, Faculdade de Ciências, Universidade de Lisboa, Lisbon, Portugal

Abstract. This paper studies covert system identification in cyberphysical systems, where an attacker infers plant dynamics while attempting to remain stealthy. We introduce a lightweight static linear model in which the time to execute a setpoint change is proportional to the commanded speed difference. On a Siemens PROFINET testbed this gain captures the drive’s ramp response accurately but not its terminal overshoot. That omitted transient becomes the attacker’s main exposure: on real traces, the residual left by the linear masking procedure is detected by two anomaly monitors, Process-Aware Stealthy-Attack Detection (PASAD) and the CUSUM change detector. Across the cascade identification and staircase attack strategies defined in the paper, the stealth boundary relates to the plant’s own settling transients, a structural limit for this class of models under the adopted detector-calibration regime. Comparison against dynamic models obtained by N4SID, trained at multiple excitation amplitudes, shows that the evaluated N4SID models do not improve stealth over the structure-informed ramp model. Since percycle computation is negligible for both procedures, the binding trade-off is not inference cost but whether the attacker can acquire and refresh a model without injecting detectable perturbations.

Keywords: System identification · Covert attacks · Industrial control system (ICS) security · Man-in-the-middle · Real-time constraints

1

Introduction

System identification is a fundamental tool in cyber-physical systems, enabling the estimation of plant dynamics from observed input-output data. Although traditionally used for control and monitoring, it can also serve an attacker who infers system behavior to support stealthy manipulation [5].

2

V. Mattos et al.

In this paper, we study covert system identification, that is, system identification performed under strict stealth constraints. We consider an attacker deployed as a man-in-the-middle (MitM) bridge between a controller and an actuator. The attacker’s objective is two-phase: first acquire and refine a model of the plant under stealth constraints, then use that model to mask a covert manipulation, such as an unauthorized change to the motor’s commanded speed, while attempting to remain undetected. This setting poses an apparent trade-off. A lightweight model is computationally cheap to deploy in real-time but may be too simple to reproduce the plant’s behavior, leaking modeling error to an anomaly detector. A more complex model would capture more of the real behavior but is more expensive to compute, and computation inside a real-time loop itself can be observable. We begin with the lightweight end: a simple static linear gain model relating setpoint variation to execution time, computationally efficient and empirically accurate through the commanded ramp, but unable to capture the overshoot. This paper makes the following contributions: – We study covert system identification under timing constraints and introduce a lightweight static linear gain model for attacker-side inference, accurate through the commanded ramp (R2 ≈ 0.999) on a Siemens PROFINET testbed, deviating only at the plant’s transient overshoot. – We introduce two covert strategies: cascade identification, an incremental masked model-refinement scheme, and the staircase attack, a large covert speed change decomposed into small masked increments. Across both, the masked residual exposes the attacker to two anomaly detectors — ProcessAware Stealthy-Attack Detection (PASAD) and CUSUM. – We compare the static linear gain model against dynamic linear models obtained by N4SID, trained at seven active-identification amplitudes, and show that none of the evaluated N4SID masks extends the static map’s stealth boundary in the attack phase. – We quantify the computational side of the trade-off and show that per-cycle inference cost is negligible for both masks; the relevant difference between the static and dynamic models lies in identification cost and in the active perturbations needed to keep a model current. The remainder of the paper is organized as follows. Section 2 reports related work. Section 3 describes the system architecture and experimental setup. Section 4 introduces the linear model and evaluates its accuracy. Section 5 covers detectability at the control layer: it defines the overshoot residual, introduces two detectors, and evaluates both the identification phase (cascade strategy, Section 5.3) and the attack phase (staircase strategy and N4SID comparison). Section 6 connects the detection results to the identification-cost trade-off, and Section 7 concludes and outlines future work.

Covert System Identification Under Timing Constraints

2

3

Related Work

Our work sits at the intersection of two lines of work: on the attacker’s side, covert attacks on cyber-physical systems and system identification under operational constraints; on the defender’s side, intrusion detection. We review them in turn: first, attacker-side model acquisition and covert feedback manipulation; second, defender-side process monitoring and the role of model complexity in determining detectability. 2.1

Covert and System Identification Attacks

Smith [11] introduced covert misappropriation, a covert attack in which an agent inserted in the feedback loop uses a model of the system to cancel its own effect on the sensor signal, so that the controller observes a fabricated yet consistent signal that hides an otherwise visible manipulation. We adapt this construction. De Sá et al. [5] propose a taxonomy of covert attacks on networked control systems and instantiate it with a two-stage attack: a metaheuristic system-identification stage that estimates the plant and controller transfer functions from observed loop signals, followed by a MitM stage that uses the identified model to degrade the process covertly. Our own prior work [8] designed and detected covert MitM attacks on a water-treatment testbed. The present paper specializes that line of work to the system-identification phase itself, asking not only whether a covert feedback model can evade detection once deployed, but whether acquiring that model under PROFINET’s strict timing constraints is itself detectable, and at what complexity-versus-stealth trade-off. When the process is already excited by routine setpoint changes, the attacker can identify it passively and remain covert [4]. Our hardware study in this paper addresses the more difficult steady-state regime, where identification must be actively excited, and thus subject to possible detection. 2.2

Detection and Model Complexity

On the defensive side, detectors that monitor the physical process, rather than network traffic alone, have proven effective against attacks that are stealthy at the network layer. PASAD [2] is the representative case used here: it is processaware, it builds a subspace model of the plant’s normal dynamics and scores each new observation window by its departure from that subspace. This posture responds to a line of work on stealthy attacks in networked control systems. Teixeira et al. [12] characterize when a model-aware adversary can stay undetected, and what a defender must monitor to reveal it; false-data-injection attacks [6] formalize the null-space stealth condition that motivates process-side monitoring; and risk-and-detection frameworks for process control [3] situate such detectors operationally. The attacker is evaluated against PASAD and, as a baseline, a classical CUSUM change detector [9] applied to the same residual (Section 5). The dynamic alternative to our static model is a classical system-identification [7] tool:

4

V. Mattos et al.

N4SID [13] recovers state-space dynamics at a substantially greater identification cost. This spectrum, from a static linear map to a fitted state-space model, is exactly the complexity-versus-cost space in which the trade-off is examined. Our contribution connects an attacker-side modeling decision—linear and memoryless versus higher-order dynamic—to its detectability under monitoring and to the cost of maintaining a sufficiently accurate model under real-time constraints.

3

System Overview and Experimental Setup

The experimental educational platform, shown in Fig. 1, consists of a control system for an industrial induction motor. The main components are: 1. Programmable Logic Controller (PLC): The PLC (Siemens S7-1214C) communicates with the Variable Frequency Drive (VFD) via the PROFINET industrial Ethernet protocol. In this experimental topology, the PLC acts as a supervisory controller: it transmits speed setpoints to the VFD and relays the drive’s feedback to the operator without acting on the actual-speed word, so the covertness results below assume no PLC interlock is keyed on the motor’s actual speed—no control or safety logic that would act on the very word the attacker rewrites [10, Chapter 3]. The drive is responsible for the internal closed-loop regulation. Additionally, acceleration and deceleration ramp profiles are configured and executed locally within the VFD. 2. Variable Frequency Drive (VFD) — the Inverter: The VFD (Siemens SINAMICS G120) is configured in Speed Control mode utilizing Sensorless Vector Control (SLVC). 3. Induction Motor: WEG W22, three-phase, rated power 0.55 kW, rated voltage 220 V, and nominal current 2.77 A. 4. Network Infrastructure: TP-Link SG108E Easy Smart Switch, used to interconnect the PLC, VFD, and the attacker’s station. 5. Attacker Station: A workstation running Ubuntu 24.04.3 LTS on an Intel Core i5-12450H with 16 GB of RAM, using two physical Ethernet ports, one facing the PLC and one facing the switch. The same machine performs the packet interception and, in Section 6, the cost measurements.

3.1

PROFINET Process Data: Standard Telegram 1

The PLC and the VFD exchange data cyclically at a 2-ms rate, through the PROFIdrive profile using Standard Telegram 1, defined in the drive function manual [10, Chapter 3]. Table 1 lists the two 16-bit words (PZD-2/2) each cycle carries in each direction. The attacker considered in this work observes and rewrites exactly these four words. – STW1 (Control Word 1, 16-bit) drives the inverter state machine. Bit 3 (enable operation), for example, is a field an attacker could rewrite to inject a covert setpoint even when the motor is not enabled; the experiments reported here do not exercise this capability, and forward STW1 unmodified.

Covert System Identification Under Timing Constraints

5

Fig. 1. The experimental testbed. From left to right: induction motor; the didactic panel carrying the VFD and an operator HMI touch panel; the panel carrying the PLC; and the switch, which interconnects the PLC and the VFD. The workstation at right provides supervisory access. No MitM is present in this baseline configuration. Table 1. Standard Telegram 1 (PZD-2/2): four words exchanged each cycle. Direction

PZD01

PZD02

Setpoint (PLC → VFD) Feedback (VFD → PLC)

STW1 (control word) ZSW1 (status word)

NSOLL A (speed setpoint) NIST A (actual speed)

– NSOLL A (Speed Setpoint, 16-bit) carries the reference speed as a normalized fraction of a configured reference, with 4000h (16384) denoting 100% of the configured reference, here 1800 RPM. – ZSW1 (Status Word 1, 16-bit) reports the inverter state (e.g. ready, operation enabled, fault active, quick-stop active). It is likewise forwarded unmodified in the experiments reported here. – NIST A (Actual Speed, 16-bit) is the measured motor speed, in the same normalization as NSOLL A.

3.2

Man-in-the-Middle Attack

The attack uses a physical Man-in-the-Middle topology, illustrated in Fig. 2. The attacker’s station is inserted between the PLC and the network switch that connects the VFD, and the Linux network stack bridges the two Ethernet interfaces, making the interception transparent to the PROFINET protocol. Deploying this attack requires physical insertion into the PLC–VFD link, but no credentials, engineering software, or knowledge of the drive’s configuration. The two physical ports are joined into a single layer-2 bridge with no IP address of their own, so the station is not individually addressable on the segment. The attack proceeds in three stages:

6

V. Mattos et al.

Fig. 2. Logical schematic diagram of the Man-in-the-Middle attack. The network switch is omitted to emphasize the logical data flow interception by the attacker between the PLC and the VFD.

1. Interception: A Python script intercepts PROFINET frames in real time and edits them in place, without disrupting the bridge flow. 2. False Data Injection (FDI): The script locates the cyclic Telegram 1 frames and rewrites their process-data words in real time. Two capabilities follow from the word layout above: – Downlink (setpoint and control). The attacker overwrites the setpoint to command a speed change. – Uplink (feedback masking). To keep the manipulation invisible to the operator, the attacker simultaneously rewrites the feedback word so that the SCADA/HMI observes the response expected for the unmodified command. The model-based masking considered here requires an estimate of the plant response. 3. Forwarding: The modified frames are reinjected. PROFINET cyclic monitoring declares a connection fault after the three consecutive missed cycles configured here. The uplink masking step is the crux. In the model-based construction studied here, whether the goal is to hide a fault or, as evaluated below, to hide a covert speed change, the quality of the feedback spoof depends on how accurately the attacker models the plant response. The remainder of this paper studies that identification and the residues it leaves behind. In summary, the attacker can rewrite cyclic traffic in both directions, but the defender evaluated throughout this paper observes only the PLC-side feedback stream and does not jointly validate it against the setpoint; this asymmetry is revisited when the defender’s scope is stated explicitly in Section 5.

Covert System Identification Under Timing Constraints

4

7

Linear Model for Covert System Identification

Unlike theoretical scenarios where the attacker has full access to the plant’s states, our attacker relies solely on data exposed over the PROFINET network, so Smith’s covert misappropriation [11] cannot be applied in its original form. In our topology, the attacker observes only PROFINET frames; the VFD drives the motor through internal signals that do not appear on the network. The relevant plant is therefore the combined VFD–motor system: whereas an induction motor in isolation is conventionally modeled as a first- or second-order LTI system, the VFD’s acceleration ramp function dominates the combined system’s response to commanded setpoint steps, imposing a rate limit—a nonlinearity that no LTI model can represent. For the covert setpoint changes considered here, the VFD executes each command at an approximately constant slew rate, i.e., an approximately constant rate of speed change. The measured speed therefore rises almost linearly from its current value toward the new target. Consequently, the time τ required to execute a step of magnitude |∆v| is approximately proportional to |∆v|. Because the plant is held at a fixed operating point (1500 RPM), the network carries no excitation, and a passively observed steady-state trace is uninformative: identifiability requires the input to be persistently exciting. The attacker must therefore adopt an active identification strategy, injecting its own perturbations and correlating their magnitude with the resulting execution time observed in the feedback. Unlike passive observation, these perturbations are themselves potentially detectable events; the concrete injection protocol is given in Section 4.1. The model relates the magnitude of a commanded speed change to the time the drive needs to execute it. Let vk be the current speed, vk+1 the next target, ∆vk = vk+1 − vk the signed step, |∆vk | its magnitude, and τk the resulting execution (settling) time. The relationship is modeled as τk = α |∆vk | + β,

(1)

with slope α (s/RPM) and intercept β (s); τk is in seconds and ∆vk in RPM. The timing law is memoryless and cheap to evaluate, hence suitable for real-time covert deployment. Feedback masks. In this paper, a feedback mask is the model-based rewriting rule used by the attacker on the feedback word. Let y(t) be the actual VFD feedback under the covert command, and let ŷM (t) be the response predicted by an attacker model M for the same covert setpoint change. The attacker forwards to the PLC the masked signal
ỹM (t) = ynom (t) + y(t) − ŷM (t) , (2) where ynom (t) is the feedback that the PLC/operator should observe under the unmodified command. Thus, a perfect mask would make ỹM (t) = ynom (t). Any model mismatch remains visible as the residual eM (t) = y(t) − ŷM (t).

(3)

8

V. Mattos et al.

M is called a static mask when ŷM (t) is the constant-ramp-rate prediction (5), and an N4SID mask when ŷM (t) is generated by a state-space model fitted with N4SID, introduced as a comparison point in Section 5.5. 4.1

Identification Protocol

To excite the plant while disturbing the operating point as little as possible, the attacker applies a symmetric bidirectional probing strategy around the nominal setpoint v0 = 1500 RPM. For a prescribed maximum probing amplitude s, each identification round visits a set of targets spread evenly over [v0 − s, v0 + s], so the round contains multiple setpoint changes with magnitudes 0 < |∆vk | ≤ s; every target is approached from v0 and then returned to it, sampling both acceleration and deceleration at each magnitude. The symmetric pattern keeps the time-averaged setpoint at v0 , so the mean process value is undisturbed. The amplitude s is bounded by the stealth constraint: it must stay small enough that the resulting leakage escapes the detectors introduced below. Each perturbation is observed for one settling period, and the attacker fits the affine timing law (1) by ordinary least squares over the resulting distinct (|∆vk |, τk ) pairs. 4.2

Reference Parameters from Controlled Steps

These parameters are a research-side characterisation, not an attacker action: the steps are commanded directly at the drive, over a range far wider than the covert probing of Section 4.1. The attacker acquires its own model by that protocol, knowing only the four Telegram 1 words of Section 3.1 — no drive parameters, motor nameplate data, or ramp settings. Model parameters were estimated from controlled step experiments. Speed steps of |∆v| ∈ {100, 200, 400, 800} RPM were applied, and the settling time τk was measured from each setpoint change to the first instant the measured speed reached 99% of its target. The acceleration set comprises 35 steps (18 at 100 RPM, 11 at 200, 4 at 400, 2 at 800), and deceleration mirrors this with an identical count. Linear regression on the acceleration data yields: τ̂k = 0.00257 |∆vk | − 0.020 s,

R2 = 0.9987.

(4)

The coefficient α = 0.00257 s/RPM corresponds to an effective ramp rate of approximately 389 RPM/s. The small negative intercept (β = −0.020 s) is not interpreted as a physical delay; accordingly, the ramp predictor introduces no separate dead-time term. Figure 3 shows the scatter and fitted lines for both directions, which yield nearly identical parameters. The fitted linear model defines the static feedback mask used in the experiments. For each commanded step ∆vk , beginning from the current speed vk at time tk , the attacker predicts the attack-induced speed trajectory ŷlin (t) = vk + sign(∆vk ) min{|∆vk |, (t − tk )/α},

(5)

Covert System Identification Under Timing Constraints

Deceleration: vs v

= 0.00257 | v| 0.0197 R 2 = 0.9987

2.0 1.5

Settling time (s)

Settling time (s)

Acceleration: vs v

1.0 0.5 0.0 0

200

400

600

Step size | v| (RPM)

9

800

= 0.00262 | v| 0.0219 R 2 = 0.9984

2.0 1.5 1.0 0.5 0.0 0

200

400

600

Step size | v| (RPM)

800

Fig. 3. Timing law fitted to the controlled step experiments: settling time τ vs. step size |∆v| for acceleration (left) and deceleration (right). Dots: individual measurements; triangles: per-step means; dashed line: fitted model (4). The fit tracks the commanded ramp; the terminal overshoot it omits is the residual analyzed in Section 5.

that is, a constant-ramp-rate response clamped at the target, with ŷlin and vk in RPM, t and tk in seconds.6 The intercept β does not enter this trajectory; the ramp predictor introduces no separate dead-time term and starts immediately at tk . The attacker then rewrites the feedback word according to the feedbackmask rule in (2), so that only the mismatch between the true VFD response and the predicted response remains visible. Deviations between y(t) and ŷlin (t), especially the terminal overshoot, constitute the overshoot leakage analyzed in Section 5.

5

Detectability at the Control Layer

Pursuing the two-phase objective of Section 1—identify, then attack—the fitted linear model exposes the attacker at two points: during identification, each probe is a potentially observable event; during the covert attack, the model’s feedback leaves a residual (3) in the feedback channel: the VFD drives the motor to the new target along its configured acceleration ramp, then briefly overshoots before settling, and the static mask reproduces the ramp but not that terminal overshoot. This overshoot leakage is the observable a defender monitoring the measured-speed channel can exploit, and it grows with step size. Two detectors are introduced and calibrated, and both phases are evaluated in turn—the identification phase (cascade strategy, Section 5.3) and the attack phase (staircase strategy and N4SID comparison). 6

The clamp makes (5) linear in t only up to the target; static linear refers to the affine timing law (1) it is built from, not to the trajectory itself.

10

5.1

V. Mattos et al.

Anomaly Detectors

Two anomaly detectors are evaluated on the measured-speed residual seen by the PLC after the covert mask is applied. PASAD [2]: From a sliding window of the last L speed samples, PASAD builds a low-dimensional subspace model of the plant’s normal dynamics, then scores each new window by how far it departs from that subspace; this departure score is denoted Dj . L = 500 samples and subspace dimension r = 2 are used. An alarm fires when Dj exceeds the training maximum. CUSUM [9]: It accumulates positive and negative drifts g + and g − from the training mean, with reference shift κ = 0.5σ, where σ is the training standard deviation. An alarm fires when max(g + , g − ) exceeds h, the maximum accumulated drift observed over the training window. 5.2

Calibration

Both detectors are trained on a calibration dataset, which covers the motor’s start-up and settling to its 1500 RPM operating point. The resulting thresholds are: – PASAD: θP = 339.7, training mean µ0 = 1499.9 RPM. – CUSUM: h = 317.1, κ = 0.28 RPM. Threshold calibration. The thresholds are set as the maximum departure (PASAD) or drift (CUSUM) observed over the training window, the standard self-calibrating rule for PASAD [2], applied identically to CUSUM. Importantly, this window includes the motor’s own settling transient as it reaches the 1500 RPM operating point from start-up (a 0 → 1500 RPM step response): a brief mechanical overshoot to ≈ 1507 RPM above a noise floor of σ = 0.56 RPM. The excursion is too short to move the training standard deviation appreciably— hence κ = 0.5σ = 0.28 RPM—but it dominates the accumulated drift that sets h. A detector that alarmed on the plant’s normal start-up and re-settling transients would be unusable in practice, so a single threshold spanning all operating regimes must sit above the largest benign transient. Because that transient is an upward overshoot, it is g + that reaches the training maximum h = 317.1. The calibration trace holds no benign downward excursion of comparable size—the raw negative-drift maximum is only 5.1—so g − stays far below h, and the shared threshold is in effect set by the upward direction. Covert window. Because that single threshold must sit above the largest benign transient, that same transient defines the attacker’s covert window. Overshoot leakage from a small covert step has a similar qualitative form as a benign settling transient, so a perturbation whose leakage stays below the benign envelope cannot be flagged without also alarming on normal start-up and re-settling; under this calibration regime the covert margin is set by the magnitude of the plant’s intrinsic transients. Calibration trade-off. This conclusion relies on a deployment assumption: the detector is active from cold start and must therefore absorb the start-up

Covert System Identification Under Timing Constraints

11

transient into its baseline. A deployment that separates the two regimes, either by suppressing monitoring during start-up, or by calibrating start-up and steady operation independently, could apply the steady-state noise floor during normal operation. In our data, excluding the start-up excursion from the training window—the noise floor σ itself is unchanged—would yield approximately θP ≈ 2.2 and h ≈ 5, shrinking the covert margin by two orders of magnitude; the negative-direction maximum noted above, h− = 5.1, is already at that scale. The cost is a blind interval after every restart, or a mechanism to detect the regime transition. 5.3

Detectability of the Identification Phase: the Cascade Strategy

Identification is not free: probing the plant requires injecting perturbations, and each perturbation is itself an observable event. A cautious attacker may attempt to bootstrap the model incrementally, using each estimate to mask the next, larger probe. The first unmasked round tests whether zero-knowledge acquisition is feasible; subsequent rounds evaluate masked model refinement. This cascade strategy, given in Procedure 1, is evaluated to determine how far the identification phase can proceed before it becomes detectable. The cascade protocol executes seven successive identification rounds at probing levels pk ∈ {0.5, 1, 2, 4, 6, 8, 10}% of the nominal 1500 RPM, indexed k = 1, . . . , 7. The first round (p = 0.5%, maximum probing amplitude 7.5 RPM) applies no covert mask, as no model has yet been estimated. From p = 1% onward, the attacker applies the linear ramp mask fitted from the preceding level’s VFD response, using the same regression procedure as in Section 4. The detector scores reported below are not computed on the live-masked trace. Instead, the true VFD response is recorded and the same mask is reapplied offline to reconstruct the trace the PLC would have seen—a step that belongs to this evaluation, not to the attacker. Offline reconstruction is faithful here because the covert mask rewrites only the feedback word forwarded to the PLC, leaving the VFD’s internal speedcontrol loop untouched. The masked trace is therefore a deterministic function of the recorded VFD response, and reconstructing it offline reproduces the ideal signal-domain feedback the PLC would have received under immediate, lossless rewriting online. This idealization sets aside implementation-level effects such as bridge latency, jitter, or dropped frames; the distinction between offline and online evaluation concerns deployability and computational timing, not the detector scores under this idealization. This point is revisited in Section 6. Concretely, for each of five runs the ramp rate fitted at level pk is extracted and applied as the mask at the next level pk+1 , and the masked feedback is scored with the PASAD and CUSUM detectors against thresholds θP = 339.7 and h = 317.1. As in Section 4, the mask starts ramping immediately (zero dead-time). Table 2 summarizes results. The unmasked 0.5% round is highly detectable: mean PASAD = 29 857 (88 × θP ). This score dwarfs every later round not because the perturbation is larger—it is the smallest—but because no mask is applied. The detector sees

12

V. Mattos et al.

Procedure 1 Evaluation of cascade identification under threat monitoring. Italic blue lines are the evaluation, not attacker actions. 1: procedure CascadeIdentification(v0 , P, Θ, D) 2: Initialize previous mask model Mprev ← ∅ 3: Initialize detection log L ← ∅ 4: for each probing level p ∈ P in increasing order do 5: Set maximum probing amplitude s ← p v0 6: Construct a symmetric bidirectional probing sequence around v0 using multiple step magnitudes 0 < |∆vk | ≤ s 7: if Mprev = ∅ then 8: Execute the probing sequence without feedback masking 9: else 10: Execute the probing sequence while masking feedback with Mprev 11: Record the feedback trace observed by the PLC 12: Compute detector scores using the detector suite D 13: if any detector score exceeds its threshold in Θ then 14: Mark probing level p as detected 15: else 16: Mark probing level p as stealthy 17: Observe step increment ∆vk and settling times τk 18: Fit a new linear ramp model Mp from pairs (|∆vk |, τk ) 19: Append (p, Mp , detector scores) to L 20: Mprev ← Mp 21: return fitted models and detection log L

the entire symmetric bidirectional probing excursion, a ±7.5 RPM swing about the setpoint. From p = 1% on, the linear mask subtracts the predicted ramp, and only the post-mask residual, the mechanical overshoot the model omits, reaches the detector. Once a mask is applied, that residual is dominated by mechanical overshoot, which scales with perturbation amplitude. At p ∈ {1, 2}% (maximum probing amplitudes ≤30 RPM) the overshoot is small enough that both detectors remain below threshold in every run (PASAD ≤ 134 < θP = 339.7): the identification is covert. From p = 4% onward (maximum probing amplitudes ≥ 60 RPM) the overshoot residual exceeds threshold in all runs, and the peak scores have a tendency to grow with probing level (2485 → 4387). The stealth boundary therefore lies between 2% and 4% probing level. These results have two implications. First, the identification phase is most vulnerable at the unmasked bootstrap step: before any model is available, even the smallest probing signal is exposed as a full commanded excursion rather than as a masked residual. This limits our covertness claim to model refinement, not zero-knowledge acquisition. In a steady-state plant with no ambient excitation, the attacker cannot obtain the initial seed model covertly through the bootstrap probe used here; that seed must come from another source, such as prior knowledge, offline measurements, or passive identification during routine

Covert System Identification Under Timing Constraints

13

setpoint changes. Second, once a mask is available, detectability is governed by the overshoot boundary, so within this ramp-mask family larger perturbations remain detectable even after model refinement. Table 2. Cascade identification detection scores (PASAD L = 500, r = 2; CUSUM κ = 0.5σ; offline mask, zero dead-time). Values are mean ± std over 5 runs; Det = fraction exceeding any threshold. Level

Mask from

PASAD peak

CUSUM peak

Det

0.5% 1.0% 2.0% 4.0% 6.0% 8.0% 10.0%

— 0.5% 1.0% 2.0% 4.0% 6.0% 8.0%

29 857 ± 35 119 ± 44 134 ± 30 2 485 ± 1 361 3 910 ± 479 3 873 ± 256 4 387 ± 964

8 171 ± 76 193 ± 48 205 ± 23 1 111 ± 311 1 485 ± 78 1 530 ± 46 1 603 ± 164

5/5 0/5 0/5 5/5 5/5 5/5 5/5

339.7

317.1

—

Threshold

5.4

Detectability of the Attack Phase: the Staircase Strategy

Once a model has been acquired, the attacker moves to the attack phase. The objective is a covert misappropriation of the operating point: driving the motor from its nominal 1500 RPM to 1800 RPM while the PLC-side feedback continues to report steady operation at 1500 RPM. Applying the full 300 RPM change as a single step fails. In this experiment, as in all experiments below, the feedback mask removes the predicted ramp so that only the modeling residual remains visible; even so, the direct step produces a mean peak PASAD score of 1422 (4.2 × θP ) and a mean peak CUSUM score of 779 (2.5 × h), and is detected in all 10 trials. This motivates the staircase strategy, given in Procedure 2: instead of applying one large setpoint change, the attacker decomposes the same total change into smaller increments of size s, waiting for the motor to re-settle between consecutive increments. Each increment is masked relative to the current accumulated speed offset. For the static linear mask (Static column of Fig. 4), both PASAD and CUSUM remain below threshold in every trial for s ≤ 25 RPM. At s = 50 RPM, the detectors begin to diverge: CUSUM exceeds threshold in 3 of 6 trials, with worst-case score 320 > h, whereas PASAD remains below threshold, with worstcase score 239 < θP . This marks the empirical transition region. At the smallest step size, s = 5 RPM, the worst PASAD score is only 11 (0.03 × θP ), close to the calibration-noise level. The stealth boundary around s ≈ 25–50 RPM occurs when the resulting overshoot leakage approaches the plant’s benign transient envelope, and the

14

V. Mattos et al.

Procedure 2 Staircase attack and its evaluation with feedback masking. Italic blue lines are the evaluation, not attacker actions. 1: procedure StaircaseAttack(v0 , vT , s, M , Θ, D) 2: Initialize commanded speed v ← v0 3: Initialize masked feedback trace Y ← ∅ 4: while v ̸= vT do 5: Set next command v ′ ← v + sign(vT − v) min{s, |vT − v|} 6: Inject covert setpoint change v → v ′ 7: Use mask model M to synthesize the expected ramp response ŷ(t) 8: Rewrite the feedback channel using ŷ(t) so that only the modeling residual remains observable 9: Append the resulting masked feedback samples to Y 10: Wait until the motor re-settles 11: v ← v′ 12: Treat Y as the feedback trace observed by the PLC-side monitor 13: Compute PASAD and CUSUM scores over Y using D 14: if any detector score exceeds its threshold in Θ then 15: Mark the staircase attack as detected 16: else 17: Mark the staircase attack as stealthy 18: return detector scores and detection outcome

CUSUM

102 ×

5 10 25 50 100

101 ×

max score / threshold

Attack step (RPM)

PASAD

threshold

Static 0.5 1

2

4

6

N4SID training level

8

10

Static 0.5 1

2

4

6

N4SID training level

8

10

10 1 ×

Fig. 4. Amplitude-swept N4SID stealth boundary (concealment-selected order 9). Columns: the static mask and N4SID trained at each cascade probing level; rows: covert staircase step size (n = 5 trials per cell at 5–25 RPM, n = 6 at 50–100 RPM). Color encodes the worst-case score divided by that detector’s own threshold, so the labelled colorbar tick is the detection boundary and both panels share one scale; the black contour marks it within each heatmap. No N4SID training level extends the static mask’s boundary, and training at ≥ 4% is detected even at the smallest step.

cascade analysis of Section 5.3 independently locates the same boundary at 2– 4% probing level. A step whose overshoot leakage stays under that envelope is masked by the plant’s own dynamics: it is not separated from a routine re-settling event by the evaluated detectors under the adopted calibration. A defender could only compress this window by replacing self-calibrated thresholding with a model that distinguishes attack-induced from commanded transients. An attacker who

Covert System Identification Under Timing Constraints

15

has characterized the plant’s transient envelope can predict the maximum covert step size before initiating the attack. 5.5

Attack-Phase Model Comparison

To test whether this boundary is an artifact of the static model being too simple, the static mask is replaced with N4SID state-space masks and the staircase evaluation is repeated. N4SID (Numerical algorithms for Subspace State Space System Identification) [13] estimates a discrete-time state-space model, xk+1 = Axk + Buk and yk = Cxk + Duk , directly from input–output data; unlike the ramp predictor it carries state across cycles and can therefore represent transient dynamics the static map omits—but only linear ones. Two choices govern the comparison, the training amplitude and the model order n (the state dimension), and both are swept. A mask is fitted at each cascade probing level p ∈ {0.5, 1, 2, 4, 6, 8, 10}% and applied to every staircase run. The training-amplitude sweep ranges from 7.5 to 150 RPM, spanning amplitudes below and above most of the evaluated attack steps. The order is selected for the attacker’s actual objective, concealment, not identification. The conventional criterion, the Akaike information criterion (AIC) [1], scores a model by its prediction error penalized by the number of free parameters; at the sample counts available here it decreases to the sweep boundary (order 20, Fig. 6b): it rewards a predictive fidelity the attacker does not need. The held-out concealment residual is instead minimized—the RMS departure, on a validation split, of the masked feedback from the calibration baseline—used here as a detector-agnostic proxy for concealment. This criterion has a minimum at order 9, which is used for every training level. Figure 5 shows the mechanism on single traces, for the static mask and the N4SID mask trained at the 1% level. At a 25 RPM covert step both stay below threshold (Dj = 99 static, Dj = 215 N4SID). At 100 RPM both are detected, but the N4SID score (Dj = 71 303) is 189× the static score (Dj = 377): the 1%-trained model extrapolates poorly to a step ≈6.7× larger than its training excitation (±15 RPM probe). Fitting a more complex model at the training amplitude therefore does not imply better concealment under larger covert steps. Even so, none of the evaluated N4SID masks extends the static mask’s stealth region (Fig. 4). The static map, built from the reference timing law of Section 4, is never outperformed: on PASAD it alone keeps the 50 RPM step below threshold, and on CUSUM it crosses only marginally there (320 against h = 317.1, in 3 of 6 trials). Masks trained at small amplitudes (0.5–2%) match the static map up to 25 RPM, where every mask stays stealthy, but lapse at 50 RPM where the static map still holds. Masks trained at 4% probing level and above are detected at every step size, including the smallest 5 RPM covert step: a 10%-trained mask leaks a worst-case CUSUM score of 2.3 × 104 (74 × h) for a 5 RPM step, whereas the largest staircase step in the amplitude sweep, 100 RPM, only just crosses (≈ 1.5×). Among the evaluated state-free ramp and LTI subspace models, higher complexity does not push the boundary outward.

16

V. Mattos et al.

Actual speed

Static ramp

N4SID prediction

Setpoint

(B) 100 RPM step

(A) 25 RPM step 1530 1620 1525 1600

Speed (RPM)

Speed (RPM)

1520 1515 1510

1580 1560 1540

1505 1520 1500 1495 1.8

1500 2

2.2

2.4

2.6

2.8

3

3.2

1.8

3.4

2

2.2

2.4

2.6

Time (s)

Static mask

10

2

3.4

(D) PASAD score

10 0

10

3.2

10 5

PASAD score Dj

PASAD score Dj

4

3

N4SID mask (1% level)

(C) PASAD score 10

2.8

Time (s)

-2

10

0

10 -4 4

5

6

7

8

9

10

4

5

Time (s)

6

7

8

9

10

Time (s)

Fig. 5. Overshoot leakage: static vs. N4SID mask (order 9, 1% cascade training). (A)– (B) Actual VFD speed (blue), static ramp prediction (orange, dashed), N4SID prediction (purple), and setpoint for a 25 RPM and 100 RPM covert step. (C)–(D) PASAD score Dj for the static mask (blue, solid) and N4SID mask (purple, dashed); red dashed line: threshold θP = 339.7. (a) concealment residual

(b) AIC -0.5

Held-out RMS

30

nAIC

selected: 9

minimum: 20

-1

Normalized AIC

Concealment residual (RMS, RPM)

35

25 20 15

-1.5

-2 10 5

-2.5 5

10

N4SID model order

15

20

5

10

15

20

N4SID model order

Fig. 6. N4SID order selection on the largest-amplitude (10%) training data. (a) The held-out RMS concealment residual, used as a detector-agnostic proxy for concealment, has an interior minimum at order 9. (b) AIC, computed on the prediction error, falls to the sweep boundary (order 20): it optimizes predictive fidelity, not concealment. The attacker selects for (a).

Covert System Identification Under Timing Constraints

17

Remark 1 (the control-layer boundary is structural). The cascade analysis (Section 5.3), the staircase attack, and the amplitude-swept N4SID comparison exhibit a consistent transition around the same transient envelope: leakage below it remains undetected, whereas crossing it increasingly drives the detector scores beyond threshold. This boundary is structural under the self-calibrated, cold-start monitoring assumed here, which must absorb the motor’s start-up overshoot into its baseline. A defender that instead gated monitoring around restarts (θP ≈ 2.2, Section 5.2) would compress it sharply, so the margin is a property of the plant and of the detector’s calibration regime. The leak is not second-order ringing but the terminal overshoot of the drive’s configured acceleration ramp (Section 4): in Fig. 5B the static map cancels the near-linear rise and leaks only the overshoot, whereas the N4SID prediction, which cannot represent the rate-limit nonlinearity, departs from the actual response across the whole transient.

6

Discussion

The results expose a narrower but stronger trade-off than the usual intuition that a more accurate model should be stealthier but computationally heavier. At the control layer the attacker is exposed by what the model omits, and Remark 1 shows that added complexity relocates that exposure rather than removing it. Zeroing the residual would require a model that reproduces the rate-limited rise and its overshoot, which the evaluated masks cannot supply. A natural objection is that a richer model might be difficult to evaluate within the 2 ms PROFINET cycle, which would place the binding trade-off in per-cycle compute rather than in detectability. Remark 2 (per-cycle cost is not the discriminator). We time only the arithmetic kernel each mask evaluates once per cycle: the static multiply-andclamp, or one state-space propagation step. The surrounding bridge path (packet interception, parsing, reinjection) is common to both masks and cannot separate them. Figure 7 reports both costs over the full order sweep, measured in MATLAB on the attacker station of Section 3: the static mask applies in 1.4 ns and the heaviest measured N4SID propagation (order 19) in 141 ns, both under 0.01% of the 2 ms PROFINET budget. The asymmetry lies instead in fitting: static OLS on 35 pairs takes ≈ 0.005 ms (< 0.01 cycles), whereas N4SID on 200–500 samples takes 16–118 ms across orders 1–20, equivalent in duration to 8–59 PROFINET cycle periods. What distinguishes the two models is the cost of building them, not of running them. If the cost that matters is fitting, what matters next is how often the attacker must pay it. Our experiments treat the plant as time-invariant, and the fitted timing law reproduces across disjoint sets of runs (Section 6.1), so within our horizon it is paid once. A plant whose parameters drift would be a different regime; the relevant drift there would be parameter drift at a fixed setpoint (thermal effects, mechanical wear, load variation), not setpoint drift, which would supply passive excitation and reduce the need for active re-identification.

18

V. Mattos et al.

105

(b) one-shot fitting 102

N4SID static 2 ms budget

Fit time (ms)

Apply time (ns)

(a) per-cycle apply

103 101

101 100 10 1 10 2

5

10

N4SID order n

15

20

N4SID, N=200 N4SID, N=500 static 2 ms budget 5

10

Model order n

15

20

Fig. 7. Per-cycle apply cost (left) and one-shot model-fitting cost (right) for the static linear mask and N4SID at orders 1–20 (mean ±1σ, 10 repetitions, log scale). Apply cost is negligible for both at every order; the asymmetry lies in fitting, where N4SID is equivalent in duration to 8–59 PROFINET cycle periods across the full order sweep.

Remark 3 (re-identification under drift). Drift was not observed in our experiments, and the fitted timing law reproduces across sessions, so within this horizon a mask can be identified once and reused. Should the plant’s parameters drift, however, even the static model—the stronger covert choice by Remark 1—would cease to be a one-time cost. Tracking drift requires new identification pairs, so the attacker must re-probe, and each re-probe would meet the same control-layer stealth boundary measured in the cascade and staircase experiments: sufficiently small perturbations stay hidden, larger ones leak the overshoot residual. Building the model offline and deploying only when it is ready avoids the exposure of re-probing, but not the drift of the model away from the plant: by (3) the residual is the model error, so a stale mask can increase the leakage. 6.1

Scope and Limitations

The assumptions behind the results above are stated where they are used; they are collected here. Plant and operating point. All experiments use a single VFD–motor pair held at a single 1500 RPM operating point. The timing-law fit, detector calibration, cascade, and staircase each draw on a disjoint set of runs, so the reported numbers do not depend on any single session; that independence, however, does not by itself extend them beyond this testbed. Defender model. The monitored quantity is the PLC-side feedback stream alone. The thresholds follow the self-calibrating, cold-start rule of Section 5.2; as quantified there, a deployment that gated monitoring around restarts would shrink the covert margin by roughly two orders of magnitude. The boundary is therefore a property of the plant and of this calibration regime, not of the plant alone.

Covert System Identification Under Timing Constraints

19

Evaluation procedure. Masks are reconstructed offline under the idealization of immediate rewriting (Section 5.3), which sets aside bridge-level latency, jitter, and frame loss. The covertness claim covers model refinement rather than zero-knowledge acquisition: the unmasked bootstrap probe is detected, so the seed model must come from elsewhere. The attack-phase masks are built from the reference timing law of Section 4, which is fitted from steps well above the stealth boundary and is therefore more accurate than the covert probing of Section 5.3 yields. The attack-phase results accordingly assume an already-acquired model; they are a favourable case for the attacker, not a characterisation of end-to-end covert operation. Model class. We evaluate model-based feedback masking; covert strategies that do not rely on a plant model are out of scope. Two mask families are evaluated: the state-free ramp predictor, whose clamp is a fixed saturation rather than a fitted nonlinearity, and LTI subspace models fitted by N4SID. Fitted nonlinear and learning-based masks are untested: the order sweep indicates that increasing order alone does not remove the boundary within the evaluated LTI class, but a mask matched to the rate-limited transient and its terminal overshoot remains future work.

7

Conclusion

In this paper, we studied covert system identification under timing constraints. A simple static linear model approximates the VFD–motor response accurately through the commanded ramp (R2 ≈ 0.999) at negligible computational cost, making it attractive for real-time MitM deployment. Its limitation is structural: because the model omits the plant’s terminal overshoot, each covert step leaks a residual that becomes detectable once the resulting leakage exceeds the benign settling envelope admitted by the detector calibration. The cascade and staircase experiments locate this boundary consistently, and the amplitude-swept N4SID comparison shows that a more complex linear model does not remove it. The resulting trade-off is not primarily about per-cycle computation, which is negligible for both static and N4SID masks, but about identification cost and robustness across amplitudes: the static model costs orders of magnitude less to fit and was never outperformed by a richer mask in our experiments. These results are bounded by the scope stated in Section 6.1. The natural next step is to look outside the LTI class: a nonlinear mask able to reproduce the rate-limited rise together with its terminal overshoot would remove the residual this paper measures, and the open question is whether such a mask can be acquired within the covert data budget the stealth boundary allows. Future work should test the non-stationary, drifting-plant setting of Remark 3 directly: measuring how parameter drift affects the residual, characterizing the stealth boundary under different detector calibrations, formalizing the staircase as a detection-constrained optimization.

20

V. Mattos et al.

Acknowledgments This research was partially funded by Clavis FINEP/PlatCiber, under FINEP reference 1488/22. Additional support was provided by CAPES (Finance Code 001); FAPERJ under grants E-26/204.268/2024 and E-26/260.168/2026; CNPq under grants 424622/2021-1, 403601/2023-1, 315106/2023-9, 444956/2024-7, and BPP/PQ-Sr 313335/2022-2; and FCT through the LASIGE Research Unit, ref. UID/00408/2025, DOI: https://doi.org/10.54499/UID/00408/2025.

References 1. Akaike, H.: A new look at the statistical model identification. IEEE Transactions on Automatic Control 19(6), 716–723 (1974). https://doi.org/10.1109/TAC.1974.1100705 2. Aoudi, W., Iturbe, M., Almgren, M.: Truth will out: Departure-based process-level detection of stealthy attacks on control systems. In: Proceedings of the 2018 ACM SIGSAC CCS. pp. 817–831 (2018) 3. Cárdenas, A.A., Amin, S., Lin, Z.S., Huang, Y.L., Huang, C.Y., Sastry, S.: Attacks against process control systems: risk assessment, detection, and response. In: Proceedings of the 6th ACM Symposium on Information, Computer and Communications Security. pp. 355–366 (2011) 4. de Sá, A.O., da Costa Carmo, L.F.R., Machado, R.C.S.: A controller design for mitigation of passive system identification attacks in networked control systems. Journal of Internet Services and Applications 9(1), 2 (Feb 2018). https://doi.org/10.1186/s13174-017-0074-z 5. De Sá, A.O., Carmo, L.F.R.D.C., Machado, R.C.S.: Covert Attacks in CyberPhysical Control Systems. IEEE Transactions on Industrial Informatics 13(4), 1641–1651 (Aug 2017). https://doi.org/10.1109/TII.2017.2676005 6. Liu, Y., Ning, P., Reiter, M.K.: False data injection attacks against state estimation in electric power grids. ACM Transactions on Information and System Security (TISSEC) 14(1), 1–33 (2011) 7. Ljung, L.: System Identification: Theory for the User. Prentice Hall, Upper Saddle River, NJ, 2nd edn. (1999) 8. Mattos, V., Schmidt, J., Bhaya, A., de Sá, A.O., Menasche, D., Srivastava, G.: Design and detection of covert man-in-the-middle cyberattacks on water treatment plants. In: Proceedings of the 2025 Workshop on Re-design Industrial Control Systems with Security. pp. 7–15 (2025) 9. Montgomery, D.C.: Introduction to statistical quality control. John Wiley and Sons, Inc (2020) 10. Siemens AG: SINAMICS G120, G120P, G120C, G120D, G110M Fieldbuses Function Manual, 04/2018 edn. (Apr 2018), Firmware V4.7 SP10. Document ID: A5E34229197B AE 11. Smith, R.S.: Covert misappropriation of networked control systems: Presenting a feedback structure. IEEE Control Systems Magazine 35(1), 82–92 (2015) 12. Teixeira, A., Shames, I., Sandberg, H., Johansson, K.H.: A secure control framework for resource-limited adversaries. Automatica 51, 135–148 (2015) 13. Van Overschee, P., De Moor, B.: N4SID: Subspace algorithms for the identification of combined deterministic-stochastic systems. Automatica 30(1), 75–93 (1994)

Related documents

• Plant Equivalent Controller Realizations for Attack-Resilient Cyber-Physical Systems#987525
• RISK: Auditing Industrial Control Systems for Too-Late-to-Recover Vulnerabilities#1143129
• Model-Free Generative Stealthy Attacks on Safety-Critical Vehicle Cyber-Physical Systems#1446909
• 6 U.S.C. § 124h-1 — Threat information sharing#559781
• NIST SP 1800-7: Situational Awareness for Electric Utilities#2853