Francesca Guerriero
email: francesca.guerriero@unical.it

Valeria Loscrí
email: valeria.loscri@inria.fr

Pasquale Pace
email: ppace@dimes.unical.it

Rosario Surace
email: rsurace@dimes.unical.it

Neural Networks and SDR Modulation schemes for wireless mobile nodes: a synergic approach

Keywords: Self-Organizing Networks, SDR, Controlled Mobility, Neural Network, Genetic Algorithm

In this paper, we envisage the possibility to exploit, in a synergic way, the Software Defined Radio (SDR) capability and the mobility support for wireless devices to dynamically compute the most suitable modulation scheme and the best position in order to improve both the coverage and connectivity in a specific area. The combined approach is based on a Neural/Genetic technique and wireless nodes are able to self-organize in a totally distributed way by using only local information. The extreme adaptability to the network conditions and application level constraints makes the proposed approach well suited for different communication scenarios such as standard monitoring or disaster recovery. The system performance has been evaluated by dealing a suite of simulation tests to show as the controlled mobility paradigm, coupled with the intrinsic reconfiguring SDR capabilities of such wireless devices, allows to increase the network performances both in terms of coverage and connectivity by dynamically adapting the modulation schemes to the specific communication scenario.

INTRODUCTION

Very recently, the idea of designing new communication devices, capable to adapt their operation roles in a self-organized fashion to rapidly face the changes within the working environment, has gained a very high attention from the wireless network research community [START_REF] Aloi | STEM-NET: An Evolutionary Network Architecture for Smart and Sustainable Cities[END_REF], [START_REF] Di Felice | Smartphones Like Stem Cells: Cooperation and Evolution for Emergency Communication in Post-Disaster Scenarios[END_REF]; similarly, the availability of novel general purpose and powerful hardware platforms able to be dynamically reconfigured via software, has paved the way for new research directions in which it is possible to deploy extremely challenging communication scenarios. [START_REF] Bl Ümm | SDR OFDM Waveform Design for a UGV/UAV Communication Scenario[END_REF], [START_REF] Pejovic | WhiteRate: A Context-Aware Approach to Wireless Rate Adaptation[END_REF].

Being inspired by this novel communication trend and, taking into account the unique features offered by the recent Software Defined Radio (SDR) paradigm, we considered the design of a self-adapting deployment strategy for a communication network in which several wireless devices, scattered all around in a specific area, can carry out a common task according to specific network requirements in terms of coverage or connectivity. In this context, aiming at handling very unlike communication scenarios, we firmly believe that, the SDR capabilities of future wireless devices can be effectively improved by coupling them with the potential offered by a wise controlled mobility strategy to exploit different reconfiguration and selfadaptation levels.

By following this first intuition, the paper proposes a distributed Neural/Genetic algorithm to compute the final nodes positions and the more performing modulation schemes for each transmitter/receiver pair in order to guarantee an agreed QoS level. In particular, by considering a generic SDR architecture [START_REF] Godbole | Performance Improvement by Changing Modulation Methods for Software Defined Radios[END_REF], the major advantages consisting into the ability of automatically selecting the more suitable modulation scheme to be used for an unknown received signal, can be effectively achieved. Thus, as a channel capacity varies, modulation scheme switching enables the baud rate to be increased or decreased in order to maximize the channel capacity usage. In addition, as demonstrated in our preliminary studies [START_REF] Loscrì | Multi-objective evolving neural network supporting SDR modulations management[END_REF], SDR capabilities supported by a wireless node, coupled with the controlled mobility functionality, can improve the overall system performances in terms of connectivity. Therefore, such mobile SDR nodes turn out to be very useful for communication scenarios in which, the requirements on constrained QoS connectivity, are more stringent respect to the ones on the maximum coverage.

An example of such communication scenario could be the case of a disaster area where the communication between the survivors and the rescue teams has to guarantee a good quality level [START_REF] Pace | Disaster monitoring and mitigation using aerospace technologies and integrated telecommunication networks[END_REF]; on the other side, a communication scenario mostly related to applications such as pollution monitoring or fire detection only need a high coverage degree that can be achieved by taking advantages just from the mobility of the nodes without using the SDR capabilities.

In summary, we made the following contributions in this paper:

• we discussed the potential of mobile SDR communication devices in terms of both dynamical re-configuration and operation flexibility; • we shown how the SDR capabilities supported by the wireless node, coupled with the controlled mobility functionality driven by a distributed Neural/Genetic, can improve the system performances in terms of connectivity by also guaranteeing an agreed QoS level; • we designed and validated an optimization model in order to prove, in a mathematical way and on a very simple communication scenario, the goodness of the proposed Neural/Genetic algorithm before to conduct a more complex and intensive simulation analysis; • we validated, throughout a self developed simulator based on a widely used open source framework for evolutionary design, the proposed strategy in different communication scenarios by varying both the amount of mobile and SDR nodes to measure the impact of a larger number of Mobile/SDR nodes on the overall system performances. The rest of the paper is organized as follows: Section 2 presents few recent research works on deployment techniques for wireless nodes and adaptive modulation schemes implemented via SDR. Section 3 describes which technologies and specific features the devices involved in the proposed communication scenario should support, by highlighting hardware and software capabilities. Section 4 presents the Neural/Genetic algorithm able to compute the best positioning for the wireless nodes to satisfy the constraints imposed by the specific communication scenario. Section 5 presents the proposed optimization model to describe and validate the system behaviour from a mathematical point of view. Section 6 discusses the obtained results and the goodness of the proposed approach in terms of extreme adaptability in different communication scenarios, whilst the conclusions and future research directions have been drawn in Section 7.

RELATED WORKS

In this work we envision two main topics: 1) deployment techniques for different communication scenarios and 2) adaptive modulation schemes for nodes equipped with SDR capabilities. From the synergical combination and integration of Neural and Genetic approaches, we designed an algorithm able to compute the best position and the most suitable modulation scheme for each node involved into the communication path. According to these remarks, we first recall few contributions on positioning techniques for wireless nodes that have attracted much research attention becoming increasingly important in recent years. In [START_REF]A survey of Multi-Objective deployment in Wireless Sensor Networks[END_REF] the authors try to outline the main criteria that should be considered while deploying wireless nodes in a sensor field. Fundamentally, they give an overview of multi-objective approaches by outlining the main assumptions and the formulation of this challenging problem. In [START_REF] Goyal | A Survey on deployment Methods in Wireless Sensor Networks[END_REF], the author argues that the communication holes in wireless networks is the main problem causing inefficiency; thus it needs to be effectively addressed. More precisely, sensor nodes can be moved from an initial "unbalanced" state to a "balanced" state, where the number of communications holes is minimized. In [START_REF] Damuut | Survey of Deterministic Vs Non-Deterministic Node Placement Schemes in WSNs[END_REF] the authors distinguish placement approaches by considering deterministic and non-deterministic techniques. Often, non-deterministic placements are also named as random placements, while deterministic placements are referred as controlled placements and the authors refer to the two approaches by keeping this kind of assumption. The choice of how to deploy the sensors in a field, is often affected by the specific application, the type of sensors, the environment in which the sensors operate, etc. The possibility to control a node deployment can be extremely advantageous in terms of operational costs. Based on this last consideration, we figure out to equip wireless nodes with motion capabilities in order to make them able to move towards specific and more convenient locations by obtaining a dynamic changing of the topology/deployment. In this way, it could be add more control to the network and consequently outperform the operational costs. Generally, the survey we cited above, group the deployment techniques based on some specific network parameters such as coverage, lifetime, connectivity, or two or more of them together, but do neither consider at all the possibility for the nodes to autonomously move towards a specific position nor to adapt the modulation scheme to some specific requirements. In this work we consider the possibility to "change" the modulation scheme in order to guarantee a certain Bit Error Rate (BER) level, and in case this constraint can be satisfied by selecting more than one scheme, we select the most efficient in terms of energy consumption. For this reason, the contributions that compare modulation schemes selection to increase coverage and/or connectivity are considered also as related work. In [START_REF] Loscrì | Multi-objective evolving neural network supporting SDR modulations management[END_REF] we present the preliminary idea to opportunistically select the more appropriate modulation scheme in order to achieve a certain degree of coverage and connectivity. The added value in respect of [START_REF] Loscrì | Multi-objective evolving neural network supporting SDR modulations management[END_REF] is first of all in terms of a general benchmark definition, computed through the formulation of the combined coverage and connectivity problems as a multi-objective optimization problem. Moreover, we provide more details in terms of results by validating the algorithm we propose in several communication scenarios. Starting from 2007, Stuckmann and Zim-Fig. 1. Mobile relay devices supporting SDR capabilities mermann [START_REF] Stuckmann | Toward ubiquitous and unlimited-capacity communication networks: European research in Framework Programme 7[END_REF] envisaged SDR technology as one of the four main objectives, to develop European technologies for systems beyond 3G. Specifically, the spectrum and resource management to make efficient the use of existing spectrum resources can be realized in an feasible and effective way through the application of the SDR concept. The importance of this kind of technology is shown in [START_REF] Godbole | Performance Improvement by Changing Modulation Methods for Software Defined Radios[END_REF], where the authors propose to optimize the throughput of the network, working in different channel conditions, by considering an automatic modulation switching method to reconfigure the transceivers of SDR systems. We propose a similar approach but with a different purpose, namely a multi-objective algorithm where the goals are both the coverage and the connectivity, in addition the technique is also energy-aware because, where more solutions are feasible, the best one in terms of energy-consumption is selected. Finally, in [START_REF] Bhambare | A Survey on Digital Modulation Techniques for Software Defined Radio Applications[END_REF], the authors analyse different modulation techniques in combination with SDR. In practice, they outline again the importance of this kind of technology for the future mobile communication systems.

SMART MOBILE DEVICES SUPPORTING SDR

New powerful devices supporting SDR capabilities will be used in the next future to form a self-evolving wireless network in which several goals such as coverage increase, high data rate and connectivity will be achieved in diverse communication scenarios. For this reason, with the aim of considering a quite modern communication context, we studied the case in which both simple mobile or fixed sensor nodes equipped with a wireless IEEE 802.15.4/ZigBee compliant RF transceiver, are considered. Furthermore, we also took into account the presence of more complex mobile devices, with a high processing capability, able to dynamically change the modulation scheme between different transmitter/receiver pairs by using the SDR support as shown in Figure 1. In addition, we assume that these wireless devices are equipped with a GPS module coupled with a software application for position coordinates exchange to perform a specific positioning strategy as detailed in the next section.

By exploiting the new features of programmable SDR architectures, a flexible implementation of several modulation schemes (i.e. MFSK, MPSK, MQAM) can be realized in a simple and effective way. This flexibility turns into a great adaptivity to optimize different network performance indexes such as throughput, coverage and degree of connectivity of a wireless networks operating under varying channel conditions. In this context, the devices equipped with SDR functionalities can easily work as relay nodes in a multi-hop communication scenario by dynamically adapting different modulation schemes between the receiving and transmitting phases with the aim of optimizing network performances such as BER (Bit Error Rate), energy consumption and overall coverage.

It is well known that channel modulation has a relevant impact on the quality of the wireless link measured in terms of BER and on software/hardware complexity; furthermore, digital modulation/demodulation techniques need specific channel waveform coherence, coding/decoding and spreading/despreading of the radio spectrum [START_REF] Oka | A General Orthogonal Modulation Model for Software Radio[END_REF]. Since the bit error probability is a function of the channel modulation, a radio channel with better quality has to be assigned to a larger number of bits and a higher order modulation, whereas a channel with poorer quality has to be assigned fewer bits or even no bit when the channel quality is too bad. For example, by working with three main digital modulation schemes (i.e. MFSK, MPSK, MQAM) having different modulation orders (M=2,4,8,16), it is possible to select and to use the most suitable combination by implementing it on-the-fly throughout SDR techniques. Moreover, to guarantee a certain BER value, the modulation schemes could be dynamically changed according to the channel quality experienced by the nodes and the distance variation between nodes due to the mobility.

In the last few years, the SDR paradigm is becoming more attractive and feasible thanks to the development of open-source software tool-kit such as GNU radio [START_REF]GNU Radio[END_REF] and hardware devices such as Universal Software Radio Peripheral (USRP) [11]; therefore, several modulation/demodulation software blocks can be developed within the generic SDR architecture [START_REF] Marpanaji | Experimental Study of DQPSK Modulation on SDR Platform[END_REF] for both transmitter and receiver (see Figure 2) allowing the design of new and more powerful devices well suited to support the dynamic modulation changing and adaptation strategies proposed in this work [START_REF] Pejovic | WhiteRate: A Context-Aware Approach to Wireless Rate Adaptation[END_REF], [START_REF] Fr Öhlich | HYRA: A Software-defined Radio Architecture for Wireless Embedded Systems[END_REF].

In particular, it is worth to note that, with reference to the complexity of such software/hardware architecture, the Hybrid Radio Architecture (HYRA) proposed in [START_REF] Fr Öhlich | HYRA: A Software-defined Radio Architecture for Wireless Embedded Systems[END_REF] addresses the implementation of SDRs in the context of embedded systems by using reconfigurable hardware platforms with minimal additional resources.

Regarding the mobility features implementation, Fig. 2. SDR architecture for Relay Node [START_REF] Marpanaji | Experimental Study of DQPSK Modulation on SDR Platform[END_REF]. we would like to remark that this feature can be implemented by equipping a network device with two or four wheels and a servo motor controlled by Arduino-based modules. The estimated cost of implementing controlled mobility and reconfiguration capability in such platforms is reported in the Table 1.

Even if this kind of software/hardware architectures seem quite expensive, the fast technological advancements will favour the reduction of estimated costs; thus, it is plausible that the mentioned embedded architectures will shortly be available at a much lower cost.

NEURAL NETWORK AND GENETIC ALGO-RITHM

The proposed work aims at computing, in a fully distributed fashion, the best positions for wireless devices belonging to a network placed in a given area, in order to satisfy some specific network requirements.

In particular the algorithmic scheme, to be performed by each node, consists of a neural network used to control and compute the next movement within the network area, and a genetic algorithm to perform a new solution that better fits with the desired objective function. Since the computation of the new nodes' position can be only based on local information, both the components of the proposed scheme are performed in a distributed way: a node executes the neural algorithm by knowing the positions of its neighborhood and the genetic algorithm manages its own genes without using global information. Specifically, the two objectives considered in this work, namely, the coverage area and the number of sensor devices having a path toward a sink with a certain quality of service, are in contrast one to each other. Therefore we designed a wise strategy, based on the approach presented in [START_REF] Costanzo | Nodes self-deployment for coverage maximization in mobile robot networks using an evolving neural network[END_REF], able to take into account both the requirements in a dynamic and reconfigurable fashion.

The Neural Network

The neural network determines the movements of each wireless node; it is fully connected, recurrent and time-discrete. The neural network consists in input, output and hidden neurons. Inputs are subdivided as follows:

• 4 inputs to detect overlapping of sensing zone with neighborhood' sensing zone (1 for each direction); • 4 inputs to detect missing of sink connection (1 for each direction); • 1 to detect nodes in the same position. The output is the new position. Each neuron "actives" a real-valued function and a time-varying realvalued connection with every other neuron of the network to map input (n-dim) in output (m-dim). We indicate with out j the output of neuron j towards all other neurons of the network. The output of neuron j is computed as shown in Equation [START_REF] Aloi | STEM-NET: An Evolutionary Network Architecture for Smart and Sustainable Cities[END_REF].

out j (k) = F i∈N w ij • out i (k -1) + b j ( 1
)
where N is the set of neurons, w ij is the weight of the connection between neuron i and neuron j and b j is the bias of neuron j. Weights can produce both excitatory or inhibitory effect. The activation function F is the following linear threshold function:

F (x) =        -1.0 if x ≤ -1.0 x if -1.0 < x < 1.0 1.0 if x ≥ 1.0 (2)
For each node the output of the neural network is given from the two output neurons and it is consists of two real numbers that vary in the range [1, -1], as it is clear from (2) and Fig. 3. Based on these two values, the node chooses the action to do. Assuming a square field of n × n cells, the node can move in one of the four allowed directions or remain in the current cell.

The Genetic Algorithm

A conventional and real-value Genetic Algorithm (GA) is used in the training phase of the Neural Algorithm. The genes are associated with the connections weights between each couples of neurons and the bias of each neuron. Through the typical operators of genetic approaches (i.e. crossover, mutation and selection), different weights to the neurons in the next generations will be assigned. Of course, the chromosome selected for the next generations is the one which has the best value of the fitness function. In our work, we consider a bi-objective functions in order to: 1) maximize the coverage; 2) maximize the number of nodes connected to the sink either in a direct fashion or through a multi-hop path. The fitness function can be written as follows:

f itness = α * Coverage + β * QoS connectivity (3)
where Coverage = covered area whole area

and QoS connectivity = #nodes connected to the sink #total nodes (5) where α and β are weights that take into account the priority of the objective to be reached.

The term #nodes connected to the sink represents the number of nodes "connected" to the sink, namely nodes that are able to reach the sink directly or for which exists a multi-hop path [START_REF] Molina | Optimal Sensor Network Layout Using Multi-Objective Metaheuristics[END_REF] throughout links that are able to deliver data by guaranteeing a certain value of BER given as an input constraint. To the follow we show the pseudo-code of the Neural/Genetic Algorithm.

Algorithm 1 Neural/Genetic Algorithm

Supported Connectivities and Communication Complexity

As already explained, each node has a set of possible modulations that can be "used" for data transmission by guaranteeing different connectivity levels. In this work, we figure out two different types of connectivities:

• Basic Connectivity : according to a specific propagation model, it is possible to compute the maximum distance at which a node n 1 is able to transmit, that is the transmitting radius. If a node n 2 is inside the area delimited by the circle with radius equal to the transmitting radius of the node n 1 , then n 1 and n 2 are connected. In this work we consider the propagation model as defined in [START_REF] Surace | On the impact of the propagation environment on controlled mobility algorithms[END_REF]:

P L generic = 4πd 0 λ 2 • d d 0 γ + χ ( 6
)
where d is the distance between the T x and the Rx, γ is the path loss exponent, λ is the wavelength, χ is the shadowing effect value (neglectable) and d 0 is the critical distance. • QoS Connectivity : each node n has a neighborhood.

For every neighbor, the node n computes the BER value on the specific link by considering the different available modulations. The node n excludes all the modulations that do not respect the BER required as constraint in input. In practice, in this way the node n has a set of neighbors and every link from n to the neighbor meets the QoS constraint in terms of BER computed according to the formulas shown in the next subsection.

For each iteration of the algorithm and for every node, both the Basic Connectivity and the QoS Connectivity are computed.

Since the proposed algorithm is based on local communication, a node only needs to know the position of its neighboring nodes to make a movement. According to [START_REF] Costanzo | Nodes self-deployment for coverage maximization in mobile robot networks using an evolving neural network[END_REF], after each nodes movement, an update on the nodes position is broadcasted through a constant size message containing the node identifier (Id) and the node position (x,y), therefore the message size is in O(1). As a consequence, considering a constant value for the number of time steps given as an input parameter, nodes will update their positions and broadcast their new information at each time step; this leads to a linear message sending complexity of O(n) where n is the number of nodes within the network.

BER Computation

In order to compute the BER value related to each specific modulation scheme, we used the following relations coming from an asymptotic approximation [START_REF] Goldsmith | Wireless Communications[END_REF]:

BER M -F SK ≈ 2 k-2 • erfc k 2 E b N 0 (7) BER M -P SK ≈ 1 k • erfc k E b N 0 sin 2 π M (8) BER M -QAM ≈ 2 √ M -1 √ M k • erfc 3k 2(M -1) E b N 0 (9) BER 8-QAM ≈ 5 12 • erfc 1 2 E b N 0 (10)
In particular, the BER computation for the QAM modulation needs the use of two different formula according to the particular shape: formula [START_REF] Marpanaji | Experimental Study of DQPSK Modulation on SDR Platform[END_REF] for squared modulations and formula [START_REF]GNU Radio[END_REF] for non squared such as 8-QAM.

Transmitted Energy Computation

In order to save energy for the transmission always guaranteeing the required QoS level, it is necessary to choose the less power hungry modulation scheme within the set of the the most common modulation schemes available in real devices. To this aim, the energy spent per information bit [J] can be computed as follows [START_REF] Costa | A comparison of modulations for energy optimization in wireless sensor network links[END_REF]:

• For both MQAM and MPSK, by considering a signal bandwidth equal to B[Hz] and, by assuming a sample time T s ≈ 1/B [START_REF] Cui | Energy-constrained modulation optimization[END_REF], we can write:

E inf Bit ≈ (1 + δ) • SN R • N 0 • N f • G d R + P c R • B + P tr • T tr L (11)
where δ = ξ/η -1, ξ is the peak-to-average power ratio (PAPR) of the signal depending on the specific modulation, constellation size and shape 1 whereas η is the efficiency of PA drain chosen equal to 0.35 as typical value of class A power amplifiers [START_REF] Cui | Energy-constrained modulation optimization[END_REF]. P tr and T tr are the consumed power and the time spent in transient mode respectively whilst L is the total number of information bits. The SN R = Prx•Ts N0•N f , where P rx is the received signal power, N 0 /2 is the power spectral density of the noise and N f is the receiver noise figure. Moreover, by assuming a general path-loss model, the value of G d can be computed according to the Equation ( 6) and it is equal to

G d = ( 4πd0 λ ) 2 • ( d d0 ) γ .
Finally, the term P c represents the circuit power (i.e. 211 [mW ] for both MQAM and MPSK) and the term R is the

1. ξ = 3 • ( √ M -1) √ M +1
for square constellations whereas M is the constellation size, while it assumes a value among those shown in Tab. 1 of the work [START_REF] Costa | A comparison of modulations for energy optimization in wireless sensor network links[END_REF] for cross-shaped constellations.

transmitting rate computed for each constellation by using the cutoff curves.

• For the MFSK modulation, by considering a noncoherent detection, the well known relation M = 2T S B [START_REF] Butman | Design Criteria for Noncoherent Gaussian Channels with MFSK Signaling and Coding[END_REF] allows to derive T S = M/2B, therefore the energy for the transmission will be equal to:

E inf Bit = (1 + δ) • SN R • N 0 • N f • G d R + P c • M 2 • R • B + P tr • T tr L (12)
where η = 0.75 is the typical value for class B or even greater (C, D, or E) power amplifiers [START_REF] Cui | Energy-constrained modulation optimization[END_REF], ξ = 1 according to [START_REF] Costa | A comparison of modulations for energy optimization in wireless sensor network links[END_REF] and P c = 165. 3 [mW ] for general MFSK modulation schemes.

Cut-off rate curves

In this work, we decided to use the relation between cut-off rate and pre-detection SNR to model the required power of the received signal; this choice is mainly motivated by the fact that the cut-off rate is considered as a meaningful measure of the effective maximum rate for convolutional coding with sequential decoding [START_REF] Butman | Design Criteria for Noncoherent Gaussian Channels with MFSK Signaling and Coding[END_REF]. These relations can be calculated for MQAM and MPSK by the following formulas [START_REF] Hanzo | Quadrature Amplitude Modulation: From Basics to Adaptive Trellis-Coded, Turbo-Equalised and Space-Time Coded OFDM, CDMA and MC-CDMA Systems[END_REF]:

R 0 = 2 log 2 (M ) -log 2 M m=1 M i=1 C(x m , x i )
where C(x m , x i ) is the Chernoff bound on the pairwise error probability that for an AWGN channel having a Rician factor of K = ∞ we have:

C(x m , x i ) = exp - 1 4 |d mi | 2 with |d mi | 2 = |x m -x i | 2
/N 0 and x j is the j th signal.

For noncoherent MFSK we have [START_REF] Butman | Design Criteria for Noncoherent Gaussian Channels with MFSK Signaling and Coding[END_REF]:

R 0 = - 1 T s • log 2 1 M + 1 - 1 M • exp - α 2 2 ∞ 0 x • exp - x 2 2 • I 0 (αx) dx 2 (13)
where α 2 /2 = SN R and I 0 (αr) is the modified bessel function of the first kind. They are shown in Fig. 4.

THE OPTIMIZATION MODEL

In this section, we give the mathematical formulation of the problem under study, as an integer nonlinear programming model. It is assumed that the field is represented by a two-dimensional grid. The parameters used for the formulation are the following: h: the grid height; w: the grid width; d s : the discretization step; sink: a particular node that is located in a defined a-priori position; n: the total number of available nodes, including the sink; r: the sensing radius; tx radius : the transmission radius; M : a large positive number.

The variables of the proposed model are:

• (x k , y k ), k = 1, . . . ,
max α × ( h/ds i=1 w/ds j=1 δ ij ) h/d s × w/d s ) -β × n k=1 ψ + k + ψ - k 2 * (n -1) (14)
r -|i -x k |≥ M (φ + ijk -1), ∀i, j and k = 1, . . . , n -1 (15) r -|j -y k |≥ M (φ - ijk -1), ∀i, j and k = 1, . . . , n -1 (16)
2 * φ ijk ≤ φ + ijk + φ - ijk , ∀i, j and k = 1, . . . , n -1 (17)

δ ij ≤ n-1 k=1 φ ijk , ∀i, j (18)
M δ ij ≥ n-1 k=1 φ ijk , ∀i, j (19)
|x i -x j |-tx radius ≤ M (1 -γ + ij ), ∀i, j = 1, . . . , n (20)
|y i -y j |-tx radius ≤ M (1 -γ - ij ), ∀i, j = 1, . . . , n (21)
2 * γ ij ≤ γ + ij + γ - ij , ∀i, j = 1, . . . , n (22)
x ij + x ji ≤ (n -1) * γ ij , ∀i, j = 1, . . . , n (23)
n j=1,j =i x ij - n j=1,j =i x ji +ψ + i -ψ - i = 1, ∀i = 1, . . . , n-1 (24)
n j=1,j =i

x sink j -n j=1,j =i

x j sink + ψ + sink -ψ - sink = n -1 (25) 0 ≤ x k ≤ h/d s , 0 ≤ y k ≤ w/d s , ∀k (26)
x k , y k integer, ∀k

φ ijk , φ + ijk , φ - ijk binary, ∀i, j, k (27)
δ ij binary, ∀i, j (28)
γ ij , γ + ij , γ - ij binary, ∀i, j = 1, . . . , n (29)
x ij ≥ 0, integer ∀i, j = 1, . . . , n

ψ + i , ψ - i ≥ 0, integer ∀i = 1, . . . , n (31)
The objective function in ( 14) maximizes the number of locations covered by at least one node and the number of nodes that reach the sink. Conditions ( 15) -( 17) state that if the distance between the node k and the location (i, j) is lower than or equal to the sensing radius r than the variable φ ijk takes the value one, otherwise it is set to zero. Constraints ( 18) and ( 19) are logical constraints and ensure that the indicator variable δ ij takes on a value of one if the location (i, j) is covered by at least one node and zero otherwise. Conditions ( 20) - [START_REF]A survey of Multi-Objective deployment in Wireless Sensor Networks[END_REF] state that if the distance between the node j and the node j is lower than or equal to the tx radius than the variable γ ij takes the value one, otherwise it is set to zero. Constraints [START_REF] Goyal | A Survey on deployment Methods in Wireless Sensor Networks[END_REF] ensure that a flow can be sent from node i to node j only if a link between the two nodes exists.

Constraints ( 24) and ( 25) represent a relaxed version of the flow conservation constraints, where the variables ψ + i and ψ - i give a measure of the violation of these constraints.

Finally, conditions ( 26)-( 32) represent the variable domain constraints.

The mathematical formulation reported above is an integer nonlinear programming model, where the nonlinearity is confined to the constraints ( 15) -( 16) and ( 20) - [START_REF] Goldsmith | Wireless Communications[END_REF].

To eliminate the terms with the absolute value, we introduce the additional constraints reported below:

d x ik ≥ i -x k ∀i, k (33)
d x ik ≥ -i + x k ∀i, k (34)
d y jk ≥ j -y k ∀j, k (35)
d y jk ≥ -j + y k ∀j, k (36)
d xixj ≥ x i -x j ∀i, j = 1, . . . , n (37)
d xixj ≥ -x i + x k ∀i, j = 1, . . . , n (38)
d yiyj ≥ y i -y j ∀i, j = 1, . . . , n (39)
d yiyj ≥ -y i + y j ∀i, j = 1, . . . , n (40)
Thus, constraints ( 15) -( 16) and ( 20) -( 21) are replaced by the following conditions:

r -d x ik ≥ M (φ + ijk -1), ∀i, j, k (41) r -d y jk ≥ M (φ - ijk -1), ∀i, j, k (42)
d xixj -tx radius ≤ M (1 -γ + ij ), ∀i, j = 1, . . . , n (43)
d yiyj -tx radius ≤ M (1 -γ - ij ), ∀i, j = 1, . . . , n (44)

VALIDATIONS, SIMULATIONS AND RE-SULTS

The proposed Neural/Genetic algorithm is evaluated by simulations using FREVO 2 , an open source framework for evolutionary design. We took into account a 40 × 40 cells field, where 64 nodes are placed in a random way according to an uniform distribution. We considered one cell and one time step as discrete units of space and time, respectively. Also the sensing 2. http://www.frevotool.tk radius of the nodes is r = 2 [cells] and it expresses the number of cells that nodes are able to cover in each of the four main direction (north, south, east and west). For the neural network, we use 9 input neurons, 2 hidden neurons and 2 output neurons. For the genetic algorithm, we use 300 chromosomes and 100 generations. All the results have been averaged over 10 different runs to respect a confidence interval of 95%.

In order to conduct a quite realistic analysis on the energy consumption, we chose to set transmitting power (12 dBm) and receiver sensitivity (-80 dBm) of our devices by referring to an off-the-shelf Bluetooth module made by Roving Networks [START_REF]Roving Networks wireless for less WiFly GX 802[END_REF]. Table 2 summarizes all the other simulation parameters used. 5% % of selecting an offspring (off s) 5%

Validation of the Optimizazion Model

This first simulation campaign aims at validating the optimization model formulated in section 5. The presented results have been achieved by using LINGO 9.0 3 for the mathematical model and they have been averaged over 100 runs with a confidence interval of 95%. For this simulation campaign we use a simple scenario with a 6 × 6 cells field, where {3; 4; 5} nodes are placed in a random way according to an uniform distribution. Also the sensing radius of the nodes is r = 1 [cell] and the transmission radius is tx radius = 1 [cell]. The discretization step is d s = 1 and the large positive number M is equal to 1000. Fig. 5 shows that the behaviour of the algorithm proposed is very close to the centralized optimum obtained through the mathematical model for each value of alpha/beta within the Fitness function. In order to assess the 3. http://www.lindo.com behaviour of the proposed optimization model, test problems, characterized by a small field size and a limited number of nodes, have been considered. This choice is motivated by the fact that the intrinsic complexity of the model allows to solve, in a reasonable amount of time, only small size instances. For this reason, once we validated the satisfying accuracy of the optimization model respect to the proposed heuristic scheme, we conducted a more intensive simulation campaign to explore several configuration parameters with an higher number of nodes within a wider area.

Fixed nodes analysis supporting SDR

In this section we show the results obtained throughout the support of SDR capabilities; in this context the communication devices are all fixed but they can autonomously decide to use one of three different modulation schemes (MFSK, MPSK, MQAM) with three different symbol levels M (4, 8, 16) thus the set of possible choices is extended to nine. However, since the mobility support is out of the scope of this first reference simulation scenario, the Neural/Genetic algorithm described in section 4 cannot be executed every new generation and the result, in terms of more suitable modulation schemes, in agreement with the desired QoS, is always the same representing the reference benchmark point for the next analysis in which the mobility of the nodes allows to achieve better performances. Figure 6, obtained throughout the implemented simulation framework, shows a clear example of a communication scenario in which the nodes are fixed but the use of SDR capabilities allows them to achieve different results in terms of QoS connectivity . In particular, in figure 6.(a) the circles representing the nodes, are coloured in different ways according to the different supported modulation schemes (i.e., yellow for FSK, cyan for QAM and magenta for PSK). The square around the circle represents the communication ability of each node (i.e., blue if they can reach the sink node, red if they can communicate between each others without reaching the sink node). On the other site, the nodes displayed in figure 6.(b) are all coloured in blue because they can choose to use all the different modulation schemes according to the new features provided by the SDR technology. Thus, they can communicate with more neighbours respect to the previous scenario in order to reach the sink node by increasing the performance in terms of QoS connectivity . On the contrary, the Coverage cannot take advantage from the SDR technology due to the lack of mobility support.

Table 3 summarizes the obtained results over 1000 simulation runs, also specifying the percentage of nodes that have chosen any specific modulation scheme and the average energy consumption for the transmission. It is worth to note that in the simulated scenario few modulation schemes such as 4-8-PSK have never been chosen due to the worst performance in terms of BER and to the higher energy consumption.

Mobile nodes analysis supporting SDR

In this section we show how controlled mobility can be efficiently exploited to reach better configurations both in terms of Coverage and QoS connectivity . In Figures 7 we show results obtained when all nodes are equipped with motion capabilities but they are not able to select, in a dynamic fashion, the most suitable modulation. Specifically, all nodes will support only a specific modulation scheme in a random way, by keeping the percentage of nodes that choose a certain modulation equal for all the modulation schemes. In this specific case, the 33.33% of nodes will support FSK or QAM or PSK modulation. Of course, in order to obtain reliable results we averaged them complying a confidential interval of 95%. In this scenario, all nodes will move in a distributed fashion towards novel positions computed through the neural network by considering a genetic approach during the training phase as explained in Section 4. It is worth to notice that in the configuration where nodes are not able to move, Coverage cannot be improved and nodes are only allowed to choose a better modulation in order to improve QoS connectivity . When nodes are able to move, better configurations in terms of both Coverage and QoS connectivity are obtained. For α values ranging from 0.5 to 1, after 20 Generations the nodes are able to reach a percentage of coverage higher than 90%.

Concerning the QoS connectivity index, it is increased from 12.2% to 35% after ≈ 35 Generations by tuning the connectivity parameter (β) with higher values, 0.75 and 1. Unfortunately, if we observe the curves related to Coverage and QoS connectivity in a crossway, we notice as controlled mobility is a valid tool to improve performance of the system, but coverage and connectivity are opposite goals, and then controlled mobility is able to generate configuration that "answer" in an effective way to the setting of α and β, but it is not able to handle the opposition of those two QoS requirements. In fact, in Figure 7 (a), when the value of α is chosen equal to 0.25, the network is not able to reach a degree of coverage higher than ≈ 24%, and this is the case (see Figure 7 (b)) where the connectivity value reaches ≈ 42%. By considering an additional freedom degree consisting into the possibility to set the most suitable modulation, the overall performance of the system are improved as shown in Figure 8 (a) and (b). A strange effect of the dynamic modulation setting occurs when α and β are both set equal to 0.5. In this case (see Figure 8 (a)), coverage reached is smaller than in the previous case, but it is worth to analyze this behavior in combination with the connectivity value. In fact, in Figure 8 (b), in correspondence of the same α and β values, we are able to obtain a connectivity degree higher than 93% after very few Generations. On the other hand, the system gives an answer matching the interest we express with the α value, since we set α equal to 0.5. When the α value is higher than 0.5, the system takes properly into account this setting and the coverage increases. From this analysis, we can argue that, by considering in a similar way the importance of both α and β parameters, the system will behave in a very effective fashion guaranteeing a very high level of QoS connectivity and a good degree of Coverage.

These results are also confirmed by the Fitness curves shown in Figures 7 (c) and 8 (c) respectively. In fact, we can observe as Fitness improves by reaching very high values after a few number of generations when the weight associated with connectivity is the highest possible (α = 0 and β = 1). In respect of the case in which nodes are only equipped with motion capabilities, SDR mobile nodes are able to react to the connectivity requests of the networks. Moreover, in all the studied cases we can notice an improvement of the Fitness except when coverage is considered as a kind of high priority (i.e. α = 0.75 or α = 1) making the Fitness trend similar to the case with no-SDR mobile nodes. As main conclusion of this simulation campaign, we can argue that, by correctly tuning the α and β weights of the Fitness function, the wireless network consisting of self-configuring SDR devices can dynamically react in order to face different communication scenarios by favoring, from time to time, the Coverage, the QoS connectivity or both.

Mobile nodes analysis with variable amount of SDR nodes

In this section we investigate the impact of the amount of SDR nodes on the overall network performances because, as detailed in section 3 and in table 1, the SDR nodes are still quite expensive devices; thus it is convenient to reduce their number as much as possible. We tested the system with mobile nodes by choosing the same value for the parameters of the Fitness function (i.e. α = β = 0.5) and varying the percentage of SDR nodes (i.e. 0%; 20%; 30%; 50%; 100%). The obtained results, shown in figure 9, demonstrate that even using a small amount of SDR nodes, it is possible to achieves good performances in terms of QoS connectivity (figure 9.b) but the Coverage turns out to be considerably reduced due to the fact that the nodes equipped with SDR capabilities work as attractors for the nodes without those features by greatly reducing the possibility to expand to cover larger areas.

Varying the percentange of mobile nodes

In this scenario we investigate the impact of high number of mobile SDR nodes on the overall network performances. This analysis is mainly motivated by the fact that the mobility capability has a quite expensive cost and the SDR equipment is still a bit expensive at the present day. According to these remarks, it makes sense to test how these capabilities impact on the performance of the network, both in terms of coverage and connectivity toward the sink; thus we consider only a portion of nodes equipped with SDR capabilities by varying the number of nodes able to move toward "better" positions. In this way, we aim at dimensioning the right number of mobile nodes in order to save money without excessively reduce the network performances. With this goal in mind, we decided to test a network scenario in which only half of the nodes are provided with SDR functionalities and, among the standard nodes, a variable percentage are equipped with mobile capabilities (i.e. 40%; 60%; 80%; 100%). Just to give a numerical example, let us consider 64 nodes in the network field, 32 among them are equipped with SDR capabilities and are static whilst the number of mobile nodes, without SDR capabilities, varies as follows: 12, 19, 25 and 32.

The obtained results are shown in figure 10. As already explained, by using a certain percentage of SDR nodes it is possible to improve the network performances in terms of connectivity but at the expense of coverage; on the other side, by considering a more realistic network scenario in which not all the nodes can move, the effect of attraction mechanism, due to the SDR nodes, decreases thereby improving the performance in terms of coverage. However, if the percentage of standard mobile nodes is lower than 80%, we experienced a bad connection management toward the sink node; i.e. to reach the more isolated fixed nodes, the SDR nodes prefer to ensure optimal coverage rather than communicate with the sink.

As main conclusion of this simulation campaign, we can argue that it is possible to decouple the effects due to both SDR and mobility features; in fact, in a mixed scenario in which only a portion of fixed nodes are equipped with SDR capabilities, a good QoS connectivity level can be guaranteed by increasing the number of mobile standard nodes.

CONCLUSIONS

In this paper we considered SDR mobile nodes able to move towards most suitable positions and to select the best modulation scheme in order to both improve the coverage within a specific area and the connectivity to a sink node. All nodes run an algorithm based on a totally distributed Neural/Genetic approach by using only local information. As main conclusion of the different simulation campaigns we can argue that the proposed strategy can handle the two opposite requirements, represented by the coverage and the connectivity, in a dynamic fashion by wisely tuning the fitness function parameters; moreover, we demonstrated that, quite similar performances, can be achieved also using a reduced amount of devices equipped with expensive SDR and mobility features by making the proposed solution more attractive from an economic point of view. As future work we would like to test our strategy by implementing a proof of concept on real devices.

Fig. 3 .

 3 Fig. 3. Neural network architecture of one node

Fig. 4 .

 4 Fig. 4. Capacities and cutoff rates of MQAM, MPSK, and MFSK in AWGN channel as a function of predetection SNR. Each curve represents a different constellation size. The curves 1 ≤ log 2 M ≤ 6 for M-FSK, and 2 ≤ log 2 M ≤ 6 for M-QAM and M-PSK are shown, where M is the constellation size.

Fig. 5 .

 5 Fig. 5. Validation of the Neural/Genetic Algorithm: Heuristic vs. Optimization model.

Fig. 6 .

 6 Fig. 6. Fixed nodes communication scenario: (a) No mobility without SDR, (b) No mobility with SDR.

Fig. 7 .

 7 Fig. 7. Neural/Genetic algorithm supporting mobility without SDR capabilities: (a) Coverage, (b) QoS connectivity , (c) Fitness

Fig. 8 .

 8 Fig. 8. Neural/Genetic algorithm supporting mobility and SDR capabilities: (a) Coverage, (b) QoS connectivity , (c) Fitness

Fig. 9 .

 9 Fig. 9. Neural/Genetic algorithm supporting mobility and percentage of nodes with SDR capabilities: (a) Coverage ratio , (b) QOS connectivity ratio , (c) Fitness

Fig. 10 .

 10 Fig. 10. Neural/Genetic algorithm supporting SDR capabilities and percentage of mobile nodes: (a) Coverage ratio , (b) QOS connectivity ratio , (c) Fitness

TABLE 1

 1 Costs to implement SDR devices.

	Mobility Support	SDR Support
	Wheels + servo motors	USRP B200
	+ Arduino
	250$	800$

  γ ij , i = 1, . . . , n, j = 1, . . . , n, a binary variable that takes the value one if the node i is linked to node j, and zero otherwise;• x ij , i = 1, . . . , h/d s , j = 1, . . . , w/d s , aninteger flow variable that is used to represent the paths from each node to the sink;

	• ψ + k , and ψ -k k = 1, . . . , n variables used to rep-
	resent a relaxed version of the flow conservation
	constraints.
	The considered problem can be mathematically
	stated as follows:

n the Cartesian coordinates that indicate the location of the node k in the field; • φ ijk , i = 1, . . . , h/d s , j = 1, . . . , w/d s , k = 1, . . . , n a binary variable that takes the value one if the location (i, j) is covered by node k, and zero otherwise; • φ + ijk , φ - ijk , i = 1, . . . , h/d s , j = 1, . . . , w/d s , k = 1, . . . , n are support variables; • δ ij , i = 1, . . . , h/d s , j = 1, . . . , w/d s , a binary variable that takes the value one if the location (i, j) is covered by at least one node, and zero otherwise; •

TABLE 2

 2 Values of the relevant parameters used for the simulations

	Device Parameters
	Power spent in transient mode (Ptr)	100 [mW ]
	Time spent in transient mode (Ttr)	5 [µs]
	Wavelength (λ)	0.125 [m]
	Information bits (L)	1000 [bits]
	Receiver noise figure (N f )	10
	Bandwidth (B)	10 [kHz]
	Scenario Parameters
	Path Loss Exponent (γ)	3.8
	Critical distance (d0)	1 [m]
	PSD of the noise (N0/2)	10 -15 /2 [W/Hz]
	Bit Error Rate (BER threshold )	10 -3
	Maximum number of time steps	100
	Genetic Algorithm Parameters
	% of elite selection (e)	15%
	% of mutation (mu)	45%
	% of crossover (c)	30%
	% of created offsprings (off c)

TABLE 3

 3

	Fixed nodes analysis supporting or not supporting
	SDR capabilities
	Output Parameters	Without SDR	With SDR
	Coverage	61.57%	61.47%
	QoSconnectivity	2.03%	12.20%
	Energy per	2.4 • 10 -5 [J]	2.75 • 10 -5 [J]
	Information Bit
	Nodes choosing 4-FSK	12.59%	0%
	Nodes choosing 8-FSK	28.34%	38.57%
	Nodes choosing 16-FSK	34.82%	43.92%
	Nodes choosing 4-PSK	0%	0%
	Nodes choosing 8-PSK	0%	0%
	Nodes choosing 16-PSK	10.80%	10.94%
	Nodes choosing 4-QAM	0%	6.57%
	Nodes choosing 8-QAM	0%	0%
	Nodes choosing 16-QAM	13.45%	0%

ACKNOWLEDGMENT

This work has been carried out under the framework of STEM-Net, PRIN-National Italian Project #H21J11000050001, financed by the Italian Ministry of University and Research.


Marina Krotofil

Alvaro Cardenas

Kishore Angrishi

Timing of Cyber-Physical Attacks on Process Control Systems

Keywords: Cyber-physical attacks, optimal stopping, secretary problem

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

One of the growing research areas related to cyber-physical system security is developing threat models that consider an adversary who can manipulate sensor or actuator signals in order to drive a physical process to an undesired state. While many researchers have focused on the implications of manipulating signals, little work has attempted to understand the complexity and uncertainties associated with launching successful attacks and, in particular, finding the "best time" to launch an attack.

Attempting to disrupt a physical process without clearly understanding the consequences of the attack actions on the process is likely to result in a minor nuisance instead of an actual disruption -after all, breaking into a system is not the same a breaking a system. This paper considers an attacker who can read a sensor signal for a given process variable and has to decide on a time to launch a denial-of-service (DoS) attack in order to "freeze" a certain process value above or below the setpoint stored in controller memory [START_REF] Krotofil | Resilience of process control systems to cyber-physical attacks[END_REF]. In doing so, the attacker deceives the controller about the current state of the process and evokes compensating reactions that could bring the process into the state desired by the attacker (e.g., unsafe state). In order to achieve the attack goal faster, the attacker may opt to freeze one of the peak values of a process variable (low or high) to expedite process dynamics. Typical sensor signals in a process control environment fluctuate around the setpoint or track dynamic changes in the process. In both cases, the process variable exhibits a time series of low and high peaks. The attacker neither knows how high nor how low the process variable can span, nor which of the peak values should be chosen from among all the possible boundary states.

This paper formulates the challenge as an optimal stopping time problem for the attacker. In particular, it is formulated as a best choice problem (also known as the secretary problem), in which the adversary is presented with a time series of system states provided by sensor measurements and has to decide on the optimal time to attack. Because the best choice problem assumes noncorrelated time measurements, it is necessary to discern upward or downward trends in process measurements (time correlations) and then identify when a local optimum has been reached. This is a non-trivial task in many real-world environments because sensor measurements can be noisy and can have sudden fluctuations.

Timing and Cyber-Physical Security

The miniaturization of processors has enabled them to replace analog components in many electronic products. The further integration of microprocessors with input and output system components has led to the evolution of microcontrollers. Microcontrollers are ubiquitous in applications ranging from consumer electronics to complex industrial systems. Microcontrollers are embedded in purpose-built computing systems used for myriad applications in the physical world. Collaborative environments comprising computational and communications elements that control physical entities with the help of sensors and actuators are called cyber-physical systems. Cyber abuses in the information technology domain do not generally depend on timing aspects. In certain instances, such as during race conditions, time-of-check to time-of-use vulnerabilities and cross-site scripting attacks that rely on gaining access to session cookies before they expire, the attacker has to ensure that the attack occurs within a tight window of time. In cyber-physical systems, however, timing is more critical because the physical state of a system changes continuously, and during the system evolution over time, some states might be more vulnerable to attacks than others. Timing plays an important role in cyber-physical systems because it characterizes the vulnerability of a system. For example, it may take minutes to observe a process change realized by an actuator action, hours to heat a tank of water or burn out a motor, and days to destroy centrifuges [START_REF] Langner | To Kill a Centrifuge: A Technical Analysis of What Stuxnet's Creators Tried to Achieve[END_REF]. Understanding the timing parameters of a physical process enables an attacker to construct a successful attack as well as to maximize its impact (damage).

This paper focuses on industrial control systems, an aggregated term covering architectures, mechanisms and algorithms, that enable the processing of physical substances and the manufacturing of end products. Over the past few decades, industrial plants have undergone tremendous modernization. Technology has become an enabler of efficiency as well as a source of problems. Panels of relays are now embedded computers and simple analog sensors are now IP-enabled smart transmitters [START_REF] Mcintyre | Using smart instrumentation[END_REF] with multiple wired and wireless communications modes, numerous configuration modes and even web-servers, so that maintenance staff can calibrate and manage the devices from remote locations. Thus, the possibility of remote exploitation of industrial control systems and the physical processes they manage has become a reality.

Optimal Stopping Problem

The adversary's goal is to cause a tangible impact on the targeted process. In the physical domain, the attacker can either tamper with the sensor signals or modify the manipulated variables issued by the controller. This paper focuses exclusively on sensor signals. In particular, it is assumed that an attacker intends to drive the process to an unsafe state by deceiving a controller about the current state of the process and thus forcing it to take harmful compensating actions. To accomplish this, the attacker can force the controller to believe that a process variable is below or above its setpoint. One way to achieve this is to forge the process variable by means of an integrity attack that subverts a sensor-controller communications channel and manipulates messages.

If the sensor-controller communications channel is secured (e.g., using message authentication codes), then the attacker might opt to jam the channel to prevent the controller from receiving process measurement updates. This type of attack is referred to as a DoS attack on the sensor signal. As a rule, controllers store sensor signals in dedicated memory registers that are updated when a new value is received. During the DoS attack, the input register designed to store measurements from a particular sensor are overwritten by fresh values. Therefore, the last process value that reached the controller before the attack is used for system control over the duration of the attack. As a result, the controller would generate control commands based on the last measurement received. In a general sense, a DoS attack is similar to an integrity attack, the only difference being that the adversary does not wield direct influence on the "attack value." Instead, the adversary may take advantage of the timing parameters of an attack, such as the starting time t a and the duration T a .

In previous work [START_REF] Huang | Understanding the physical and economic consequences of attacks on control systems[END_REF][START_REF] Krotofil | Resilience of process control systems to cyber-physical attacks[END_REF], we have shown that the impact of an industrial control system attack is sensitive to the specific state of the targeted system. In particular, an attack may only be effective if the process variable is above (or below) a certain threshold. The higher (or lower) the attack process variable is beyond the threshold, the greater the impact. Moreover, since a DoS attack is easy to detect, the attacker must achieve the disruption objective as soon as possible after the attack is launched. Therefore, the attacker should aim at launching a DoS attack at the time the process variable of interest reaches a more vulnerable state, i.e., a local maximum (or minimum).

The attacker faces the following problem: given a time series that exhibits a sequence of peaks and valleys of different amplitudes, select one of the peaks to launch a DoS attack in real time. If the attacker strikes too soon, the opportunity to have a greater impact on the system is lost (compared with if the attacker waits until the process variable reaches a higher (or lower) value). However, if the attacker waits too long, the process variable may not reach a more vulnerable state than previously observed and the attacker could miss the opportunity to cause maximal damage and even have the implanted attack tools (e.g., communications jammers and sensor malware) detected before the attack is launched.

The problem of selecting an opportune time to attack can be framed as an optimal stopping problem. This problem focuses on choosing the time to take a particular action based on sequentially-observed random variables in order to maximize an expected payoff. The optimal stopping decision task, in which the binary decision to stop or continue the search depends only on the relative ranks, is modeled as the best choice problem, which is also known as the secretary problem [START_REF] Freeman | The secretary problem and its extensions: A review[END_REF].

Secretary Problem

In the standard version of the secretary problem, a finite and known number of items (or alternatives) n are presented to a decision maker sequentially and one-at-a-time in random order. Time is assumed to be discrete. At any period, the decision maker can rank all the items that have been observed in terms of their desirability or quality. For each item inspected, the decision maker must either accept the item, in which case the search process is terminated (reject), the next item in the random order is presented and the decision maker faces the same problem as before. The decision maker's objective is to maximize the probability of selecting the best item from among the n items available.

The classical secretary problem, which seeks to choose the best secretary from among all the applicants, has six assumptions:

There is only one position available.

The number of applicants n is finite and known to the decision maker.

The n applicants are interviewed sequentially, one-at-a-time and in random order. Consequently, each of the n! orders is equally likely.

The decision maker can rank all n applicants from best to worst without ties. The decision to accept or reject an applicant in a given period is based only on the relative ranks of the applicants interviewed to that point.

An applicant who is rejected cannot be recalled later.

The decision maker is satisfied with nothing but the best. The payoff is one if the best applicant of the n applicants is selected; otherwise, the payoff is zero.

Note that an applicant is accepted only if the applicant is relatively the best among the applicants who have already been observed. A relatively best applicant is called a candidate.

The optimal stopping rule suggests that the best candidate can be selected with maximum probability 1/e using the rule: do not make an offer to the first n/e candidates and after that make an offer to the first candidate whose value exceeds the values of all the candidates seen thus far (or proceed to the last applicant if this never occurs). In other words, the algorithm starts with a learning phase in which the decision maker sees n/e candidates and sets an aspiration level equal to the highest value seen during the learning phase. After that, the decision maker hires the first candidate who exceeds the aspiration level.

The secretary problem assumptions impose more constraints on observation and selection than generally apply in practice [START_REF] Gilbert | Recognizing the maximum of a sequence[END_REF]. Relaxing one or more assumptions to produce a more realistic formulation of the standard secretary problem has attracted the attention of the research community. This paper considers the classical solution along with a recent result that assumes the order in which the candidates arrive is not completely random, but has a probability distribution satisfying a hazard rate condition [START_REF] Mahdian | The secretary problem with a hazard rate condition[END_REF]. This assumption is commonly used in engineering applications -specifically, given that the value of a candidate is not less than y, the likelihood that it is equal to y increases as y increases. Gaussian, uniform and exponential distributions satisfy this property. Under these assumptions, it has been shown that the learning period falls from n/e to n/log(n), meaning that it is enough to observe a much smaller number of candidates to set the optimal aspiration level. In a process control environment, the probability of detecting an intrusion increases with time, therefore, having a shorter learning phase is beneficial to the attacker.

Dealing with Correlated Time Series

While the secretary problem matches the problem that an attacker faces in our scenario, an additional condition that an attacker of a physical process encounters is that sensor signal samples do not arrive in random order. Instead, their time series represent continuous real-time measurements of physical phenomena and each sample X i is heavily correlated with the next sample X i+1 . Thus, if a process variable (e.g., temperature) is increasing, it cannot drop radically in the next time instance.

Recall that the attacker sets the aspiration level to a value equal to the highest sample seen during the learning phase. According to the optimal solution algorithm for the secretary problem, upon completing the learning phase the attacker should select the first sample whose value exceeds the aspiration level. By doing so, the attacker would miss the opportunity to select an even higher value as in the case of an upward trend, where the process measurements keep increasing until a local peak is reached. Hence, unlike the static choice rule discussed above, the attacker may incorporate expectations about the future in the decision process. In this case, the choice between stopping and continuing to search at sample X i is determined not only by the aspiration value but also by the difference between the stopping value and the continuation value X i+1 . The problem of identifying a signal peak is exacerbated by the fact that process variables are noisy and, therefore, an upward trend might be followed by a quick drop, followed again by an even higher gain.

To solve this problem, a low-pass filter is incorporated to smooth out shortterm signal fluctuations and highlight the longer-term trends. This enables a peak to be identified as soon as a downward trend in a smoothed signal is detected (e.g., three consecutive measurement drops).

Simulation Setup

The empirical analysis employed a Matlab model of the Tennessee Eastman challenge process [START_REF] Downs | A plant-wide industrial process control problem[END_REF] developed by Ricker [START_REF] Ricker | Tennessee Eastman Challenge Archive[END_REF]. It is implemented as a C-based MEX S-function with a Simulink model.

Tennessee Eastman Challenge Process

The Tennessee Eastman challenge process [START_REF] Downs | A plant-wide industrial process control problem[END_REF] is a modified model of a real plant-wide industrial process. The process produces two liquid (l) products from four gaseous (g) reactants involving two irreversible exothermic reactions:

A(g) + C(g) + D(g) → G(l) Prod u c t1 A(g) + C(g) + E(g) → H(l)
Prod u c t2.

Figure 1 shows the Tennessee Eastman challenge process. It incorporates five major units: reactor, condenser, vapor-liquid separator, recycle compressor and stripper. The gaseous reactant and products are not specifically identified. Feed C is not pure and consists of 48.5% A and 51% C. The gas phase reactions are catalyzed by a substance dissolved in the liquid phase in the reactor. The products and unreacted ingredients leave the reactor in the vapor phase, pass through the condenser and then proceed to the vapor-liquid separator. Noncondensed components cycle back to the reactor via the recycle compressor. Condensed components are sent to the stripper that removes the remaining reactants. The byproducts and inerts are purged from the system in the vapor phase using the vapor-liquid separator whereas products G and H exit the stripper base and are separated in the downstream refining section.

The plant has eleven valves for manipulation and 41 measurements for process monitoring. In the simulation model, the control configuration involves eighteen proportional-integral (PI) controllers, sixteen process measurements XMEAS{1; 2; 3; 4; 5; 7; 8; 9; 10; 11; 12; 14; 15; 17; 31; 40} and nine setpoints that form eight multivariable control loops and one single feedback control loop [START_REF] Krotofil | Resilience of process control systems to cyber-physical attacks[END_REF]. All the process measurements include Gaussian noise with standard deviations typical of the types of measurements. The default simulation time for a single experiment is 72 hours with a sampling frequency of 100 measurement samples per hour. Timestamps of the simulated data sets are stored in the designated variable tout. In order to obtain statistically significant results, the original code was modified by generating a new seed for the random number generator for each run. In addition, higher sampling rates for the process variables -2,000 sensor samples per hour (per sensor) -were incorporated in the Matlab workspace.

DoS Attack Modeling

Let X i (t) be the measurement by sensor i at time t where 0 ≤ t ≤ T and T be the duration of the simulation. The attack interval T a is arbitrary and is limited to the simulation run time. The manipulated sensor readings X ′ i are simulated as follows:

X ′ i (t) = X i (t), for t / ∈ T a X a i (t), for t ∈ T a where X a i (t)
is the modified reading (attack value). During a DoS attack, sensor signals do not reach the controller. If the attack starts at time t a , we have:

X a i (t) = X i (t a -1
). This is translated to the attacker's goal as follows: as soon as the peak is identified and the process value starts decreasing again, the attacker should immediately launch a DoS attack to freeze the peak value from the previous control loop cycle in the controller memory.

Low-Pass Filter for Sensor Signals

The simplest form of signal smoothing is the moving average, which corresponds to the mean of the previous N data points. If µ is the smoothing interval, then the moving mean is given by:

xn = xn-1 - xµ-n n + xµ n for n > µ n-1 n • xn-1 + xn n for n < µ.
One of the side-effects of signal smoothing is the delay of the smoothed signal with respect to the original signal by (µ -1)/2 samples. To avoid shifting data in financial applications, it is recommended to average the same number of values before and after the average is calculated. However, this is not possible during real-time analysis. As a result, when the smoothed signal reaches its peak, the real measurement is already decaying. Another factor to consider is signal amplitude reduction. Increasing the smoothed signal width improves the signal-to-noise ratio but reduces the peak height. Because the aspiration value is determined based on the smoothed signal, it is not optimal.

Figure 2 shows the smoothing results for a sensor signal smoothed over different smoothing intervals. As can be seen, when µ is too small, smoothing does not sufficiently remove the noise (Figure 2(a)). As a result, stopping decisions are taken before the state reaches its local peak (Figure 2

(b)).

To mitigate this problem, we introduce a retry parameter r. If r = 0, the search stops if the current sample is smaller than the previous sample because this could indicate that the peak has been determined and the process value is falling. Correspondingly, if r = 3, the search is stopped if three consecutive samples are smaller than the last "peak" sample. As discussed in the next section, the retry parameter plays an important role in the success of an attack.

In the Tennessee Eastman process, sensor signals can be roughly divided into four groups (Figure 3). A Type 1 sensor signal has large variations with low noise levels (XMEAS{1; 10; 11}). A Type 2 signal measures a variable that is at steady-state but has high frequency noise (XMEAS{2; 3; 9; 17}). A Type 3 signal is a noisy variation of a Type 1 signal (XMEAS{4; 5; 8; 12; 14; 15}). A Type 4 signal has multiple noisy signal peaks (XMEAS7). The next section shows that, in order for an attacker to successfully conduct an attack, it is necessary to consider the type of signal that will be exploited.

Experimental Results

The experiments assume the presence of an attacker whose goal is to force the physical process to shut down. The result of such an attack is evaluated using the shutdown time (SDT), the time that the process is able to run before being shut down because it has exceeded the safety constraints. First, the shortest SDT that can be achieved using a DoS attack on each sensor signal is determined. Following this, to justify the importance of the strategic selection of the attack time, evidence of the ineffectiveness of DoS attacks conducted at random times is provided. In particular, it is shown that random selection not only significantly increases the time required to bring the process to the critical state, but in some cases, it could be completely ineffective. Also, the experiments evaluate the effects of the length of the learning phase and parameter smoothing on the attacker's prospects of selecting the highest (or lowest) possible process value in real time.

Shortest Shutdown Time

To find a reference value for the worst-case attacks, the lowest and highest possible process values based on the results of 20 simulations were determined. These can be considered to be the optimal attacks (but practically infeasible because the attacker has to analyze the signals and launch the attacks in real time). As X a i (t), we use:

X min i (t) = min t∈T X i (t) and X max i (t) = max t∈T X i (t).
The mean times to shutdown for the attacks on different sensors were determined based on the results of 50 simulations. Table 1 summarizes the results. The 95% confidence intervals are calculated using the Student's t-distribution. The table does not include results for XMEAS{10; 11} because no attack on these sensors drives the system to an unsafe state.

Due to the variability of process measurement noise, the process is never in the same state. However, as the results indicate, the Tennessee Eastman process is, in general, resilient to noise variations and the SDT does not exhibit significant variations, with the exception of the attacks F max recycle and F min A . Attack F min A on the A-feed is of special interest. Not all attack instances trigger process shutdowns. Thus, the result for the F min A attack is based on 43 out of 50 cases where the process reaches an unsafe state. At the same time, attacks P max pressure and F max A do not drive the process to an unsafe state. This means that an attacker who intends to launch an attack on reactor pressure should only strike at the minimum peaks.

Random Attack Strategy

The outcome of a DoS attack at a random time results in an arbitrary value being stored in controller memory. The closer the attack value to the setpoint, the more time it takes for the process to reach an unsafe state. To evaluate the effectiveness of launching a DoS attack at a random time, we compute the probability of the process reaching the safety limits based on 100 simulations for different DoS attack durations T a .

The previous section noted that both the process-aware attacks L max reactor and L max reactor on XMEAS8 take about two hours to bring the process to an unsafe state. For purposes of comparison, Figure 4(a) shows the time taken to move the process to an unsafe state by striking randomly. Note that the attack would have to continue for at least seven hours to achieve reliable results (e.g., 75% probability). Furthermore, Figure 4(b) shows that, without process knowledge, the attacker cannot reliably succeed in launching an attack on XMEAS7.

Notably, it is almost impossible to execute a successful attack on XMEAS1 by conducting a random DoS attack. This is because the susceptibility of the process to an attack on the A-feed depends greatly on the attack value as well as the overall system state. Because a fresh stream of C contains 48.5% of A, the control scheme carefully maintains a stoichiometric balance of A and C in the system. As a result, certain attacks on XMEAS1 would be compensated for by the system.

Optimal Stopping Attack Strategy

The results in the preceding section demonstrate that the adversary cannot achieve the attack goal fast and/or reliably enough without strategic decision making with respect to the attack time. This section analyzes the attacker's prospects of selecting the highest possible process value in real time by applying the strategies described in the previous sections (Figure 5). Figure 6 shows the implementation of our approach. To begin, the attacker has to decide on the two parameters of the secretary problem, namely the number of samples or alternatives to consider (n) and the duration of the learning phase. For simplicity, n is measured in hours. For a time frame of 24 hours, the number of alternatives is equal to 24 × f s where f s is the sampling rate of the sensor signal (f s = 2, 000). Next, the attacker must choose the smoothing parameter µ and retry parameter r. Experiments were conducted to decide on the appropriate smoothing interval; they yielded three values for the analysis: µ = {50; 150; 250}. Similarly, reasonable values for the retry parameter were found to be in range r = {0; 1; 2; 3}.

The attacker begins the smoothing of the signal and conducts the selection process in real time. The aspiration level (reference value) is set based on the greatest value of the smoothed signal observed during the learning period. Upon completing the learning phase, the attacker sequentially inspects every sample of the smoothed signal until a sample is found whose value exceeds the reference value. Following this, the attacker applies the forward-looking strategy described in Section 3.2. Next, the value of the sample xi is checked to see if it exceeds the previous one xi-1 . If not, the search continues until the condition xi > xi-1 is met, because this may indicate that the process measurement has reached its peak and has started to decay. The value of the retry parameter determines how many times the latter condition should be met before making the final stopping decision. In this case, the real attack value is equal to the value of the raw signal sample X a i at time (t a -1). Next, we evaluate the performance of the approach based on three metrics: (i) fractional error in identifying the peak (as a percentage) to measure the effectiveness of the low-pass filter and retry parameter r; (ii) fractional error in selecting the highest possible value in the time series (as a percentage) to measure the effectiveness of the stopping problem solution; and (iii) number of non-selections (last sample in the series is taken) evaluated as the average fractional error in selecting the largest possible sample.

Table 2 summarizes the results of applying the strategies to XMEAS1 (Type 1 signal) based on 50 simulations. The simulation results confirm that the learning period can be indeed cut down to n/log(n) while producing results comparable with the n/e strategy. Due to the short learning period, the number of non-selections is reduced substantially (almost to zero). For the same reason, the fractional error in selecting the highest possible process value increases because the attacker has less time to achieve a sufficient aspiration level. Since the classic secretary problem solution results in an average of 25% non-selections, it can be a decisive factor to favor the n/log(n) strategy.

The results also indicate that the appropriate selection of the smoothing factor significantly reduces the fractional error in selecting the highest possible alternative. Meanwhile, the retry parameter has a similar influence on the reduction of the fractional error in identifying the peak. The conclusion from the simulation results is that when planning an attack on a sensor signal of Type 1, the attacker should opt for the attack parameters µ = 250 and r = {1; 2} with learning window n/log(n).

Finally, we demonstrate the performance for different types of sensor signals using histograms of the fractional errors in selecting the highest possible values in the corresponding time series (Figure 7). Note that the best results are obtained for sensor signals of Types 1 and 4. In contrast, the methodology proposed in this paper is not well suited to conducting attacks on sensor signals of Types 2 and 3 because of their noise levels. While applying a low-pass filter yields good results for attacks on low-noise signals, an alternative approach is required for dealing with noisy process variables. One possible approach, which we will examine in our future research, involves the use of non-parametric change detection statistics.

Conclusions

This paper demonstrates that sensor signal characteristics must be considered carefully when developing attacks that target process measurements. Moreover, finding the appropriate values of parameters such as optimal signal smoothing (µ) and stopping decision (r) are not straightforward and the parameters are best determined experimentally.

An attacker may do extensive homework and proactively design portions of attacks, but the attacks would have to be tuned through reconnaissance activities such as changing configuration parameters, manipulating process variables and turning components on and off while observing the effects on the process system. From the defensive perspective, short-term process deviations arising from such "testing" can be detected by process-aware anomaly detection methods. Furthermore, in order to hinder the attacker's ability to disrupt a process system, plant administrators should strategically place misleading or false technical documentation to influence the attacker's strategy selection.

Overall, a better understanding of the complexities and uncertainties faced by an attacker when designing targeted cyber-physical attacks in the physical domain allows for better judgment regarding the efforts required to design

Figure 1 .

 1 Figure 1. Tennessee Eastman challenge process [9].

Figure 2 .

 2 Figure 2. Signal smoothing.

Figure 3 .

 3 Figure 3. Different sensor signals and their smoothed versions (µ=250).

Figure 4 .

 4 Figure 4. Probability of success.

Figure 5 .

 5 Figure 5. Generalized approach.

Figure 6 .

 6 Figure 6. Educated guess approach.

Table 1 .

 1 Simulation results for the process-aware attack strategy.

	XMEAS Variable	Units	Min/	SDT (h)	Confidence
				Max		Interval (95%)
	(1)	A-Feed	kscmh	0.0487/	12.116	(4.919; 19.310)
		Rate		0.7466	-	-
	(2)	D-Feed	kg h -1	3,556/	3.840	(3.641; 4.040)
		Rate		3,750	3.489	(3.387; 3.590)
	(3)	E-Feed	kg h -1	4,322/	4.120	(3.916; 4.427)
		Rate		4,553	2.672	(2.517; 2.879)
	(4)	C-Feed	kscmh	8.524/	0.284	(0.263; 0.305)
		Rate		9.825	0.920	(0.826; 1.026)
	(5)	Recycle	kscmh	29.32/	3.824	(3.384; 4.153)
		Flow		35.17	7.324	(6.358; 8.773)
	(7)	Reactor	kPa	2,771/	8.300	(7.811; 8.638)
		Pressure		2,829	-	-
	(8)	Reactor	%	60.73/	1.877	(1.778; 1.976)
		Level		68.27	2.363	(2.100; 2.482)
	(9)	Reactor	• C	1 2 2 . 8 6 /	1 . 3 1 0	( 1 . 2 6 5 ;1 . 3 4 6 )
		Temperature		123	0.374	(0.370; 0.381)
	(12)	Separator	%	38.49/	4.913	(4.726; 5.184)
		Level		61.2	3.277	(3.168; 3.397)
	(14)	Separator	m 3 h -1	24.12/	7.241	(6.847; 7.672)
		Underflow		26.87	5.584	(5.168; 5.930)
	(15)	Stripper	%	29.17/	5.189	(4.900; 5.375)
		Level		72.96	4.990	(4.880; 5.120)
	(17)	Stripper	m 3 h -1	22.37/	1.287	(1.020; 1.634)
		Underflow		23.5	0.932	(0.910; 0.960)

Table 2. Simulation results for the educated guess approach for XMEAS1. and conduct cyber-physical attacks with surgical precision (as in the case of Stuxnet). Clearly, developing sophisticated and effective cyber-physical attacks requires extensive experimentation with the same specialized industrial equipment as that installed at the targeted site.