Cybersecurity in model-based Control: Resilient Design and Software rejuvenation Methods

UNIVERSIDAD DE SEVILLA Escuela Técnica Supe io de Ingenie ía Dep. Ingenie ía de Sis emas y Au omá ica Tesis Doc o al Cybe secu i y in model-based con ol: esilien design and so wa e eju ena ion me hods Au o : MªTe esa A aúz Pisón Di ec o es: José Ma ía Maes e To eblanca Edua do Fe nández Camacho Se illa, 2025 Tesis Doc o al: Cybe secu i y in model-based con ol: esilien design and so wa e eju ena ion me hods Au o : MªTe esa A aúz Pisón Di ec o es: José Ma ía Maes e To eblanca Edua do Fe nández Camacho El ibunal nomb ado pa a juzga la Tesis a iba indicada, compues o po los siguien es doc o es: P esiden e: Vocales: Sec e a io: acue dan o o ga le la cali icación de: El Sec e a io del T ibunal Fecha: Ag adecimien os E n p ime luga , quie o ag adece a mis di ec o es de esis, José MªMaes e y Edua do F. Camacho, po su apoyo, o ien ación e implicación a lo la go de es os años. Sin duda, pa a mí ha sido un au én ico p i ilegio y o gullo con a con es os g andes p o esionales con an ecunda expe iencia y an al a calidad humana guiando mi o mación como ingenie a. En especial, a Pepe, con quien he compa ido an os p oyec os desde aquella clase de p ime o de In o má ica en 2012. Es oy p o undamen e ag adecida po la con ianza que deposi ó en mí desde el p incipio, apos ando po mí incluso cuando yo misma no me sen ía capaz, espe ando siemp e mis p opues as y necesidades, pe o animándome a da lo mejo de mí. También quie o ag adece a mis compañe os du an e es os años. En especial, a Paula, po su apoyo, implicación y es ue zo en los a ículos que hemos desa ollado jun as. Y a Ramón y José Ma ía, po su ayuda desin e esada, siemp e dispues os a echa me una mano, no solo en lo p o esional, sino ambién en lo pe sonal. G acias, sob e odo, po esos momen os compa idos de aleg ías, penas y isas, que sin duda han hecho es os años mucho más lle ade os. Ag adece ambién a mi amilia en el sen ido más amplio: mis pad es, mis he manas, cuñados y sob inas. En especial a mi mad e, po es a siemp e a mi lado, po anima me a segui adelan e a pesa de las di icul ades y po su disposición y ayuda incondicional en odo momen o. Y a mis sueg os, Albe o y Elena, po su dedicación y po es a siemp e dispues os a cuida de mis hijos, pe mi iéndome pe se e a en el es ue zo y saca adelan e es a esis y lo que e dade amen e impo a. Y, po supues o, quie o ag adece a mi pequeña amilia, que ha c ecido y se ha o mado a lo la go de es os años. A Tillo, mi iel compañe o, po da me ue zas pa a segui siemp e y es a a mi lado en cada paso de mi ida, en los buenos y en los malos momen os. Y a mis hijos, Ignacio y Ja ie , mis pequeños explo ado es, po la ida y aleg ía que me egalan cada día, haciendo que odo el es ue zo y las di icul ades i idas siemp e algan la pena. Comencé la esis con el nacimien o de mi sob ina mayo , Te esa, y empecé a esc ibi la con la llegada de mi úl ima sob ina, Angelines, nues o angeli o, la más especial de odos los p imos. Po eso, es a esis no puede i dedicada a nadie más que a los niños de mi casa, que han ido naciendo mien as odo es o se aguaba, llenando nues as idas de aleg ía y poniéndolas pa as a iba. A Te esa, Ana, Ignacio, Ja ie y Angelines, con odo mi ca iño. Te esa A aúz Pisón Se illa, 2025 I Abs ac T he cu en in e connec ion o con ol a chi ec u es demands esilien con ol s a egies capable o ensu ing s abili y and pe o mance unde ad e sa ial condi ions. This doc o al hesis ocuses on he cybe secu i y o model-based con ol sys ems, pa icula ly in ne wo ked en i onmen s, whe e cybe h ea s can signi ican ly comp omise sys em pe o mance and sa e y. To his end, his hesis p esen s he undamen als o cybe secu i y esilien design in model-based con ol sys ems and in oduces he concep o so wa e eju ena ion in a p edic i e con ol se ing. In pa icula , he con ibu ions and esul s ob ained in he published a icles co espond o ou key esea ch di ec ions: i) Cybe secu- i y in model p edic i e con ol (MPC): A comp ehensi e su ey examines secu i y isks in dis ibu ed MPC (DMPC) a chi ec u es, ca ego izing a ack models, and p oposing mi iga ion s a egies o enhance hei esilience. ii) Resilien PI con olle design: A model-based app oach using s a e-space echniques and LMIs is de eloped o enhance he obus ness o PI con olle s. iii) S ochas ic MPC s a egies: A ee-based MPC amewo k is in oduced o explici ly in eg a e packe losses and jamming a acks in o he con ol op imiza ion p ocess, ensu ing obus sys em ope a ion unde ad e sa ial condi ions. i ) So wa e eju ena ion: This hesis ex ends he concep o so wa e eju ena ion o p e- dic i e con ol, in oducing open- and closed-loop TBMPC s a egies. Addi ionally, his hesis p esen s he manusc ip s o he published and accep ed a icles ha cons i u e he ounda ion o his esea ch. Finally, he main indings and conclusions o his hesis a e p o ided, along wi h possible u u e esea ch di ec ions. III Con en s Abs ac III Lis o Figu es VII Glossa y IX 1 In oduc ion and objec i es 1 1.1 Cybe secu i y in model-based con ol sys ems 3 1.1.1 Vulne abili y sou ces 4 1.1.2 Types o cybe a acks 4 1.1.3 Cybe secu i y s a egies o model-based con olle s 5 1.1.4 Cybe secu i y and model-based con ol 6 1.2 P incipal concep s o so wa e eju ena ion 6 1.2.1 O igins and li e a u e e iew 7 1.2.2 Modes o ope a ion 8 1.2.3 Sa e se s o so wa e eju ena ion 8 1.3 Objec i es 10 1.4 Lis o publica ions 11 1.5 Ou line o he es o his hesis 12 2 Summa y o esul s and discussion 15 2.1 Cybe secu i y and MPC 16 2.2 Resilien model-based PI con olle design 19 2.2.1 Basic PI con olle s design using LMIs 19 2.2.2 Design o PI con olle s conside ing packe losses 24 2.3 S ochas ic MPC o un eliable ne wo ks 25 2.3.1 T ee-Based MPC o jamming a acks 25 2.3.2 Enhanced ee-based MPC o packe losses and dis u bances 28 2.4 So wa e eju ena ion s a egies 30 2.4.1 A linea p og amming app oach o compu ing sa e se s o so wa e eju ena ion 30 2.4.2 Open and closed-loop p edic i e con ol s a egies o so wa e eju ena ion 33 3 Publica ions 39 V 2Chap e 1. In oduc ion and objec i es play an impo an ole [4]. In pa icula , PI con olle s a e ulne able o cybe a acks in which, o example, senso a e hijacked o communica ion links a e dis up ed, leading o poo con ol pe o mance o sys em ins abili y [13,23]. To add ess hese ulne abili ies, esea che s ha e explo ed a ious cybe - esilien PI con ol s a egies, such as secu e s a e es ima ion echniques and adap i e con ol s a egies ha dynamically adjus gains in esponse o de ec ed anomalies [19,24]. Addi ionally, he in eg a ion o PI con olle s wi h secu i y mechanisms has demons a ed e ec i eness in imp o ing obus ness agains cybe h ea s [21,22]. To add ess hese limi a ions, mode n con ol a chi ec u es, such as MPC, p o ide ad anced capabili ies o op imiza ion bu also in oduce new secu i y challenges [14]. MPC is an op imiza ion-based con ol s a egy ha de e mines con ol inpu s by p edic ing he sys em e olu ion o e a ini e ho izon. A each ime s ep, MPC sol es a cons ained op imiza ion p oblem o minimize a p ede ined cos unc ion while ensu ing ha s a e and inpu cons ain s a e sa is ied [25,26]. This p edic i e app oach allows he con olle o an icipa e dis u bances and compensa e o sys em unce ain ies, making MPC widely used in applica ions such as indus ial p ocesses, ene gy ne wo ks, and au onomous sys ems [27, 28]. Fu he mo e, i s lexibili y in handling mul i a iable sys ems and cons ain s has es ablished MPC as a p e e ed choice o complex CPS applica ions [29,30]. Howe e , he eliance o MPC on eal- ime da a exchange and i e a i e op imiza ion inc eases i s exposu e o cybe h ea s, highligh ing he need o secu e con ol echniques [31,32]. Since MPC con inuously upda es i s con ol ac ions based on s a e measu emen s, i is pa icula ly ulne able o cybe a acks whe e in o ma ion is manipula ed o ne wo k is dis up ed, comp omising he in eg i y and a ailabili y o con ol inpu s [23,24]. To mi iga e hese isks, ecen esea ch has ocused on a ack- esilien MPC o mula ions ha inco po a e anomaly de ec ion, obus op imiza ion, and enc yp ed communica ion s a egies [33,34]. These enhancemen s aim o p ese e sys em s abili y and pe o mance e en in ad e sa ial en i onmen s. Besides hese s a egies o enhancing cybe secu i y in con ol sys ems, in his hesis we also ocus on so wa e eju ena ion as a pa icula ly e ec i e app oach. Unlike adi ional secu i y mechanisms ha ely on a ack iden i ica ion and classi ica ion, so wa e eju ena- ion p oac i ely mi iga es he e ec s o cybe h ea s by pe iodically ese ing o es o ing sys em componen s be o e aul s accumula e o an a ack ully comp omises he sys em. O iginally in oduced in compu ing o coun e ac so wa e aging [35], his concep has been ex ended o con ol sys ems o enhance esilience agains cybe a acks [36]. The main idea is o pe iodically e esh he un ime con ol so wa e wi h a secu e copy o p e en pe sis en a acks om al e ing online execu ion [36,37]. Di e en implemen a- ions ha e been de eloped depending on he c i e ia used o de e mine he eju ena ion equency: while some app oaches ely on p ede ined ime in e als based on sys em sa e y cons ain s [38], o he s adap he e esh iming acco ding o he du a ion o an e ec i e cybe a ack [39]. Mo e ad anced s a egies conside obus o mula ions o accoun o unce ain ies, dis u bances, and senso noise [40], and also op imize he numbe o eboo s by e alua ing po en ial a ack consequences in eal ime [37]. Gi en i s abili y o handle a ious secu i y h ea s wi hou equi ing p e ious a ack de ec ion o iden i ica ion, so - wa e eju ena ion becomes as a p omising solu ion o enhancing he secu i y o ne wo ked con ol sys ems. 1.1 Cybe secu i y in model-based con ol sys ems 3 The e o e, his hesis add esses he g owing demand o imp o e he cybe secu i y o mode n con ol sys ems, especially in ne wo ked en i onmen s, whe e he p esence o communica ion links exposes he sys em o ex e nal a acks ha can signi ican ly deg ade pe o mance and comp omise sys em sa e y. To p o ide he necessa y con ex , Sec ion 1.1 in oduces he main cybe secu i y aspec s ele an o model-based con ol sys ems. Sec ion 1.2 ocuses on so wa e eju ena ion, a key concep in his hesis. Sec ion 1.3 de ines he objec i es o his hesis, p esen ing he speci ic goals ha guide he de elopmen o he p oposed me hodologies. Sec ion 1.4 lis s he publica ions de i ed om his esea ch. Finally, Sec ion 1.5 ou lines he s uc u e o he emaining chap e s. 1.1 Cybe secu i y in model-based con ol sys ems The inc easing in eg a ion o con ol sys ems wi h communica ion ne wo ks has signi i- can ly enhanced hei e iciency, scalabili y, and adap abili y. Howe e , his in e connec ion has also in oduced new cybe secu i y challenges ha can comp omise sys em pe o - mance, s abili y, and sa e y. Ensu ing he secu i y o model-based con olle s, including MPC and o he ad anced con ol s a egies, has become an essen ial esea ch opic due o he g owing sophis ica ion and equency o cybe a acks. Cybe h ea s in con ol sys ems can a ise om di e en sou ces, including malicious ex e nal a acke s, comp omised ne wo k in as uc u e, o e en so wa e ulne abili ies inhe en o he con ol algo i hms. These h ea s can ha e se e e consequences, a ying om pe o mance deg ada ion o ca as ophic sys em ailu es in sa e y-c i ical applica ions. Thus, a comp ehensi e unde s anding o cybe secu i y in con ol sys ems is necessa y o de elop e ec i e de ense mechanisms ha ensu e eliable ope a ion e en unde ad e sa ial condi ions. In his con ex , he secu i y o con ol sys ems is o en de ined in e ms o [41]: • Con iden iali y: i ensu es ha sensi i e con ol da a, such as sys em s a es, con ol commands, o ope a ional pa ame e s, emains p o ec ed om unau ho ized access. This is pa icula ly ele an in ne wo ked con ol sys ems, whe e in o ma ion is ansmi ed o e po en ially insecu e communica ion channels. • In eg i y: i gua an ees ha sys em da a, including senso measu emen s and con ol ac ions, emains accu a e and unal e ed by malicious ad e sa ies. In eg i y is c i ical in model-based con ol sys ems, whe e con ol decisions depend on he accu acy o eal- ime da a. • A ailabili y: i ensu es ha con ol unc ionali ies emain accessible and ope a ional, e en in he p esence o cybe a acks. Fo example, jamming a acks speci ically a ge a ailabili y by dis up ing communica ions and p e en ing imely execu ion o con ol ac ions. Viola ion o any o hese aspec s can comp omise sys em sa e y and pe o mance. Fo ins ance, an a acke who gains access o con ol commands (con iden iali y b each) could manipula e ac ua o signals (in eg i y b each); a well-coo dina ed cybe a ack could also p e en a sys em om execu ing i s asks (a ailabili y b each). The e o e, secu i y 4Chap e 1. In oduc ion and objec i es s a egies mus add ess all h ee p inciples simul aneously o ensu e he obus ness o con ol sys ems unde ad e sa ial condi ions. 1.1.1 Vulne abili y sou ces Model-based con ol sys ems, pa icula ly hose ope a ing in ne wo ked en i onmen s, a e inhe en ly ulne able o cybe h ea s due o hei eliance on eal- ime da a exchange, communica ion in as uc u e, and compu a ional esou ces. These ulne abili ies can be ca ego ized as ollows: •Communica ion ne wo k ulne abili ies. Mode n con ol sys ems ely on wi ed o wi eless communica ion ne wo ks o da a exchange be ween con olle s, senso s, ac ua o s, and supe iso y sys ems. This in e connec i i y makes hem suscep i- ble o cybe h ea s such as da a in e cep ion, manipula ion, and denial-o -se ice a acks. In dis ibu ed con ol schemes, such as Dis ibu ed Model P edic i e Con- ol (DMPC), whe e agen s exchange op imiza ion- ela ed da a o coo dina e hei decisions, malicious in e e ence in communica ion can signi ican ly a ec o e all sys em pe o mance [23]. • Senso and ac ua o ampe ing. A acke s can comp omise senso s and ac ua o s o injec alse measu emen s o al e con ol signals, leading o inco ec decisions by he con olle . Fo example, in an MPC amewo k, an ad e sa y injec ing e oneous senso eadings can mislead he op imiza ion p ocess, esul ing in unsa e con ol ac ions [42]. • So wa e exploi s and malwa e. So wa e-based ulne abili ies can be exploi ed o in oduce malicious modi ica ions in con ol algo i hms, disable secu i y mech- anisms, o cause unexpec ed ailu es. Malicious so wa e, such as ansomwa e, can make con ol sys ems inope a i e by enc yp ing c i ical con igu a ion iles o co up ing sys em dynamics [13]. • Inside h ea s. A acke s wi h au ho ized access o he con ol sys em, such as comp omised employees o ex e nal con ac o s, can manipula e ope a ional pa am- e e s, disable secu i y ea u es, o ex ac con iden ial in o ma ion. In dis ibu ed con ol a chi ec u es, inside h ea s can manipula e op imiza ion cons ain s o cos unc ions o s ee he sys em owa ds unsa e o ine icien con igu a ions [43]. • Resou ce cons ain s in embedded con olle s. Many indus ial con olle s ha e limi ed compu a ional esou ces, which complica es he implemen a ion o ad anced enc yp ion, in usion de ec ion, and eal- ime anomaly de ec ion wi hou impac ing sys em pe o mance. This limi a ion also makes hem a ac i e a ge s o cybe ad e sa ies [44]. These ulne abili ies demons a e ha ensu ing con ol sys ems secu i y equi es a combina ion o p o ec i e s a egies ha add ess bo h physical and cybe -based h ea s. 1.1.2 Types o cybe a acks Cybe a acks on con ol sys ems can be classi ied based on hei objec i es and impac on sys em pe o mance. The mos common ca ego ies include: 1.1 Cybe secu i y in model-based con ol sys ems 5 • Decep ion a acks: hey ocus on comp omising he in eg i y o da a exchanged wi hin he con ol sys em. Thei goal is o comp omise he con olle by injec ing manipula ed in o ma ion in o he sys em, leading o inco ec con ol decisions. Examples include: i) False Da a Injec ion (FDI), whe e a acke s modi y senso eadings o s a e es ima es o in oduce de ia ions in he con ol p ocess, e.g., o deg ade con olle pe o mance o lead o unsa e ope a ions [19]; ii) eplay a acks, whe e an ad e sa y eco ds alid senso da a and eplays i a a la e ime o decei e he con olle in o belie ing ha he sys em is in a di e en s a e [42]; and iii) co e a acks, which a e designed o emain unde ec ed by adi ional anomaly de ec ion me hods, e.g., wi hou igge ing secu i y mechanisms [45]. • Dis up ion a acks: hey ocus on educing sys em a ailabili y by in e e ing wi h ne wo k communica ions o compu a ional esou ces. Some o he mos ele an examples a e: i) Denial-o -Se ice (DoS), whe e an a acke loods he ne wo k wi h excessi e a ic, making i di icul o con olle s o communica e wi h o he sys em componen s [23]; ii) jamming a acks, whe e in e e ence signals a e gene a ed o dis up no mal communica ion, p e en ing he ansmission o con ol inpu s o senso measu emen s in wi eless con ol ne wo ks [5]; and iii) exploi ing packe losses: which consis s o exploi ing he compensa ion mechanisms o handle packe losses o sys ema ically deg ade con ol pe o mance [6] • Inside and so wa e-based a acks: unlike decep ion o dis up ion a acks, which p ima ily a ge da a in eg i y and sys em a ailabili y, inside and so wa e-based a acks exploi p i ileged access o so wa e ulne abili ies o comp omise con ol sys ems. These a acks can be pa icula ly challenging o de ec and mi iga e, as hey o en bypass adi ional secu i y mechanisms. Some imes, hey come om indi iduals wi h legi ima e access o he con ol sys em, such as employees, con ac- o s, o comp omised adminis a o s, and may in ol e malicious manipula ion o con ol pa ame e s, op imiza ion cons ain s, and secu i y ea u es o induce unsa e beha io . Howe e , no ice ha inside s may also c ea e secu i y isks acciden ally by imp ope ly se ing access con ols o exposing sensi i e in o ma ion. O he imes, hese a e so wa e-based a acks ha exploi ulne abili ies in con ol so wa e, including i mwa e, middlewa e, and un ime en i onmen s, e.g., by i) malwa e injec ion in o he con ol sys em, enabling pe sis en illici access, unau ho ized command execu ion, o dis up ion o con ol loops [13]; ii) co up ion o he con ol logic, al e ing se poin s, sa e y cons ain s, o compu a ional ou ines o induce pe o mance deg ada ion o sys em ins abili y [44]; and iii) exploi ing so wa e aging, memo y leaks o esou ce exhaus ion, leading o pe o mance deg ada ion o e ime. Wi hou cybe -de ense s a egies like so wa e eju ena ion, hese issues can emain unde ec ed un il hey cause sys em ailu es [35]. 1.1.3 Cybe secu i y s a egies o model-based con olle s To mi iga e cybe secu i y h ea s in model-based con ol sys ems, di e en de ense mech- anisms ha e been p oposed in he li e a u e. These s a egies can be b oadly classi ied in o: 6Chap e 1. In oduc ion and objec i es • P e en ion mechanisms. They p o ec he con ol sys em be o e an a ack occu s by ein o cing communica ion p o ocols, es ic ing access o sys em componen s, and designing obus con ol a chi ec u es. Key s a egies include: i) secu e communica- ion p o ocols, such as end- o-end enc yp ion and au hen ica ion me hods (e.g., TLS and IEC 62443) [46] and mus balance secu i y and compu a ional e iciency [13]; ii) ze o- us and access con ol policies o es ic unau ho ized access [23] and block unau ho ized a emp s in indus ial en i onmen s [19]; and iii) so wa e ha dening o es ic pe missions, and s eng hen execu ion en i onmen s by making pe iodic upda es, in eg i y e i ica ion, and c ea ing secu e execu ion en i onmen s [43]. • De ec ion mechanisms. These me hods iden i y anomalies and cybe h ea s in eal- ime by analyzing sys em beha io and ne wo k ac i i y, and include i) anomaly de ec ion sys ems such as suppo ec o machines and ecu en neu al ne wo ks o de ec de ia ions in ne wo k a ic and senso da a [47], possibly compa ing p edic ed and obse ed s a es [6]; ii) s a e es ima ion-based secu i y, whe e obse e s such as Kalman il e s and unknown inpu obse e s iden i y inconsis encies in sys em s a es [19], possibly aided by c oss- e i ica ion o exchanged da a [5]; and iii) in usion de ec ion sys ems, which analyze ne wo k a ic and can de ec anomalies in con ol commands and p ocess a iables [44]. • Mi iga ion mechanisms. These s a egies ensu e ha he sys em emains ope a- ional a e an a ack. These can be ca ego ized in o i) passi e mi iga ion mechanisms based on aul - ole an con ol, s ochas ic MPC [7], edundan con ol pa hs, g ace ul deg ada ion echniques [47]; and ii) ac i e mi iga ion mechanisms o adap he con- ol con igu a ion dynamically in esponse o de ec ed anomalies [44], and igge a ack- esilien es ima ion echniques [5], o pe iodical ese s such as in so wa e eju ena ion [7]. This is pa icula ly ele an in ne wo ked MPC a chi ec u es, whe e unde ec ed malwa e can deg ade long- e m pe o mance. By in eg a ing p e en ion,de ec ion, and mi iga ion s a egies, model-based con ol sys ems can achie e cybe esilience ensu ing obus pe o mance e en unde ad e sa ial condi ions. 1.1.4 Cybe secu i y and model-based con ol Du ing his hesis, a su ey on cybe secu i y in DMPC has been published, p o iding an in- dep h analysis o he secu i y challenges, a ack models, and de ense mechanisms speci ic o his amewo k [48]. This wo k appea s in Chap e 3 and complemen s he discussion p esen ed in his sec ion. Also, a summa y o he main indings and con ibu ions o he su ey is p esen ed in Sec ion 2.1. 1.2 P incipal concep s o so wa e eju ena ion This sec ion p o ides an o e iew o so wa e eju ena ion, one o he main s a egies analyzed in his hesis and he ounda ion o i s mos signi ican con ibu ions [1,7,49]. As he p ima y cybe secu i y app oach explo ed in his wo k, so wa e eju ena ion plays 1.2 P incipal concep s o so wa e eju ena ion 7 a c ucial ole in he p oposed me hodologies and key esul s, pa icula ly in i s in eg a ion wi h model-based con ol s a egies. Gi en i s ele ance o he p oposed me hodologies, he ollowing subsec ions p esen he key concep s unde lying his echnique. Speci ically, his sec ion co e s i s o igins and ele an li e a u e, he modes o ope a ion ha de ine i s unc ioning, and he sa e se s used o ensu e sys em s abili y. Addi ionally, an illus a i e example demons a es i s p ac ical applica ion, ollowed by a discussion on he ypes o cybe a acks i mi iga es. While his sec ion in oduces he undamen al aspec s o so wa e eju ena ion, he de ailed implemen a ion and con ibu ions o his hesis a e p esen ed in Sec ion 2.4. 1.2.1 O igins and li e a u e e iew So wa e eju ena ion is a p oac i e aul - ole ance echnique o iginally in oduced o mi iga e so wa e aging, which e e s o he g adual deg ada ion o so wa e pe o mance due o memo y leaks, da a co up ion, and he accumula ion o execu ion e o s [35]. Ini ially de eloped o pe iodically es o e he un ime code and da a, so wa e eju ena ion was designed o p e en ailu es caused by non-an icipa ed so wa e s a es [35]. O e ime, i s ole has expanded beyond eliabili y conce ns, becoming a cybe secu i y mechanism o p o ec ing CPSs agains s eal hy and pe sis en cybe a acks ha can comp omise sys em in eg i y [37,39]. The undamen al p inciple o so wa e eju ena ion is o pe iodically e esh he un ime con ol so wa e wi h a us ed, secu e copy, ensu ing ha malicious modi ica ions a e emo ed be o e hey can cause las ing damage [50]. Since i s beginnings, he concep has e ol ed signi ican ly, wi h mode n esea ch ocusing on op imizing he e esh iming o minimize sys em dis up ion while maximizing secu i y. Recen ad ances de ine e esh equencies based on he ime ha a sys em can emain sa e du ing a cybe a ack [38] o he du a ion be o e an a ack becomes e ec i e enough o comp omise sys em s abili y [39]. Despi e i s ad an ages, equen eboo s can deg ade con ol pe o mance, equi ing adap i e s a egies o dynamically compu e op imal eju ena ion in e als [37]. To imp o e secu i y, [37] inco po a es he ha dwa e oo s o us , which a e onboa d secu i y modules esponsible o managing he secu e execu ion in e al. This in e al is a pe iod du ing which ex e nal communica ions a e disabled o p e en po en ial cybe in e e ence while he sys em eloads i s secu e so wa e e sion. Addi ionally, a sa e y con olle is ac i a ed a e he so wa e e esh o ensu e ha he sys em e u ns o a s able ope a ional s a e be o e esuming no mal con ol asks. Ano he c ucial aspec in his con ex is he compu a ion o sa e se s, which p o ide o mal gua an ees ha he sys em emains wi hin a de ined ope a ional bounda y a e a so wa e e esh. Common app oaches include de ining obus in a ian e minal se s and maximum sa e ini ial se s [51]. Howe e , compu ing hese se s can be demanding, especially when using poly ope-based o mula ions [52,53]. To add ess his, esea che s ha e p oposed simpli ied ep esen a ions such as zono opes [51] and ellipsoids [50]. No ably, hese challenges align wi h ad ances in lea ning-based con ol, whe e e icien compu a ion and obus ness a e key conce ns [54,55]. In he li e a u e, so wa e eju ena ion has been explo ed as a cybe secu i y s a egy o enhance sys em esilience by in eg a ing pe iodic so wa e e esh mechanisms in o 8Chap e 1. In oduc ion and objec i es con ol a chi ec u es, ensu ing p o ec ion agains bo h known and s eal hy cybe h ea s. Fo ins ance, Romagnoli e al. p oposed a amewo k ha p o ec s cybe -physical sys ems agains un ime code ampe ing by pe iodically upda ing he so wa e wi h a clean, uncom- p omised e sion, ensu ing secu i y by disabling all ex e nal communica ions du ing he e esh p ocess [56]. Fu he mo e, in [57], he same au ho s de eloped an in a ian -se - based app oach o de e mine he op imal eju ena ion in e als, ensu ing ha he sys em emains in a sa e s a e e en unde unde ec able a acks. These wo ks demons a e he po en ial o so wa e eju ena ion as an e ec i e de ense mechanism agains pe sis en cybe h ea s in con ol a chi ec u es. One o he con ibu ions o his hesis lies in p oposing he applica ion o so wa e eju- ena ion in combina ion wi h MPC o he i s ime, in eg a ing his cybe secu i y s a egy in o ad anced con ol amewo ks o enhance sys em esilience agains cybe a acks. The speci ic con ibu ions in his di ec ion a e de ailed in Sec ion 2.4. 1.2.2 Modes o ope a ion So wa e eju ena ion ope a es h ough speci ic ope a ional modes ha pe iodically ese sys em componen s o mi iga e aul s and pe o mance deg ada ion [50]. In his amewo k, he ope a ion ime is di ided in o h ee dis inc modes: Mission Con ol (MC),So wa e Re esh (SR), and Sa e y Con ol (SC), which a e ac i e du ing TMC , TSR , and TSC ime s eps, espec i ely. Addi ionally, he unce ain con ol pe iod (UC), deno ed as TUC , includes bo h he so wa e e esh and mission con ol modes. • Mission Con ol Mode: The sys em exchanges in o ma ion h ough he ne wo k du ing he MC mode, p esen ing ulne abili ies ha a acke s could exploi o hijack he con ol signal, s ee ing he sys em away om i s goal. • So wa e Re esh Mode: SR akes place when he ope a ing so wa e is es o ed, elimina ing possible modi ica ions om cybe -a acks so ha he sys em eco e s i s ini ial sa e con igu a ion. Du ing his ime, ex e nal communica ions a e swi ched o and he ac ua o s main ain he las con ol inpu p o ided du ing MC, which may be co up ed in case o a ack. The e o e, i mus be ca e ully designed o ensu e sys em sa e y. • Sa e y Con ol Mode: This mode is ac i a ed be o e ans e ing con ol back o he mission con olle in case he s a e is ou side he sa e se a e he so wa e e esh. The sa e y con olle s ee s he s a e o he sys em back o he sa e se while communica ions a e s ill u ned o . 1.2.3 Sa e se s o so wa e eju ena ion Sa e y condi ions a e de ined by speci ying wo se s co esponding o di e en con olle s, ensu ing ha he cons ain se s wi hin he sys em s a e space emain sa is ied unde all ci cums ances [50], such as i is illus a ed in Figu e 1.1: • Sa e Se ( SS ): This se is he maximum se con aining all admissible sys em s a es ha comply wi h s a e and inpu cons ain s du ing he SC mode. 1.2 P incipal concep s o so wa e eju ena ion 9 Figu e 1.1 Illus a ion o he so wa e eju ena ion s a egy in a ne wo ked con ol sys em unde cybe a ack, ex ac ed om [1]. The igu e depic s he sys em ansi ion h ough di e en ope a ional modes: he MC (blue solid line) execu es no mal con ol asks while an ad e sa y a emp s o manipula e sys em beha io ( ed dashed line). A a scheduled SR e en (g ay dashed line), he sys em eloads a secu e so wa e e sion, elimina ing malicious code, bu he sys em is s ill d i en by he a acke . Due o he sys em s a e is ou side he Inne Sa e Se (yellow egion), he SC (g een do ed line) d i es he sys em back in o ha se be o e esuming no mal ope a ion. Once he sys em eaches he Inne Sa e Se , i ansi ions back o MC, and he cycle epea s. • Inne Sa e Se ( ISS ): This se is he subse o he Sa e se ha con ains all admissible s a es du ing he MC mode. The ISS mus sa is y he ollowing sa e y condi ions: 1. Con ainmen : The sys em mus emain wi hin ISS du ing no mal ope a ion (MC mode). 2. Reco e y Gua an ee: he sa e y con olle mus be able o e u n he sys em om he Sa e Se o his se in a bounded ime. 3. A ack Resilience: The a acke should no be able o d i e he sys em ou o SS du ing he pe iod o unce ain con ol. 4. Admissibili y: ISS mus be a subse o he se o admissible s a es o he MC mode (which is composed o all s a es ha comply wi h bo h s a e and inpu cons ain s). These sa e se s es ablish o mal gua an ees ha he sys em emains wi hin con olled limi s e en in he p esence o ad e sa ial pe u ba ions. 10 Chap e 1. In oduc ion and objec i es 1.3 Objec i es The p ima y objec i e o his hesis is o de elop model-based con ol s a egies ha imp o e he esilience o con ol sys ems agains cybe h ea s and ad e sa ial a acks. To his end, he esea ch is s uc u ed a ound ou key objec i es: • Objec i e 1: Re iew o he s a e-o - he-a in cybe secu i y o ne wo ked and dis ibu ed MPC. Cybe secu i y has become a c i ical aspec o mode n con ol applica ions, especially in ne wo ked and dis ibu ed MPC a chi ec u es. To gua an ee he secu i y o hese con olle s, a deep p io knowledge o bo h po en ial h ea s and possible esilien con ol s a egies capable o mi iga ing hei impac is necessa y. The e o e, a de ailed e iew o he s a e-o - he-a on cybe secu i y o ne wo ked and dis ibu ed MPC has been ca ied ou . This e iew examines key a ack ec o s, exis ing de ensi e app oaches, and eme ging s a egies o enhance sys em secu i y. The main indings o his analysis a e p esen ed in he su ey [48], which p o ides a s uc u ed o e iew o he in e sec ion be ween cybe secu i y and ad anced con ol echniques. • Objec i e 2: Design o esilien PI con olle s agains cybe h ea s. PI con- olle s a e widely used in indus ial applica ions due o hei simplici y and e ec- i eness. They we e de eloped in a ime when cybe secu i y conce ns we e no a p ima y conside a ion, and as a esul , hei classical uning me hods, such as he Ziegle -Nichols ules, do no explici ly inco po a e esilience agains cybe a acks. Gi en he inc easing complexi y o indus ial con ol sys ems and hei exposu e o cybe h ea s, i is necessa y o upda e hei design o bene i om mode n con ol me hodologies. This hesis aims o enhance he PI con olle design by employing s a e-space echniques ha in eg a e obus ness p ope ies in o he PI o mula ion. By inco po a ing hese me hods, he p oposed app oach imp o es he con olle ’s abili y o wi hs and cybe -induced pe u ba ions while main aining s abili y and pe o mance. The esul s o his objec i e a e demons a ed in [2,4]. • Objec i e 3: De elopmen o TBMPC o cybe -secu e con ol. While PI con- olle s p o ide a basic le el o esilience, mo e ad anced con ol s a egies, such as MPC, o e g ea e lexibili y in handling unce ain ies. Howe e , con en ional MPC app oaches o en ely on inpu bu e s o manage communica ion delays o packe losses, a echnique ha has been ex ensi ely explo ed in he li e a u e [25,26]. This hesis ex ends MPC-based secu i y s a egies by inco po a ing a ee-based p edic i e s uc u e ha accoun s o mul iple po en ial cybe a acks, including jamming a acks. In his way, ins ead o s o ing a single inpu sequence in he bu e , he p oposed TBMPC amewo k gene a es and s o es mul iple possible con ol sequences in a ee s uc u e. This allows he con olle o dynamically adap o ne - wo k dis up ions, inc easing esilience agains ad e sa ial h ea s. The e ec i eness o his app oach has been alida ed in [5,6]. • Objec i e 4: In eg a ion o so wa e eju ena ion in o TBMPC. Ano he key objec i e o his hesis is o adap cybe secu i y s a egies om o he domains o he ield o con ol enginee ing, speci ically, he so wa e eju ena ion s a egy in o 1.4 Lis o publica ions 11 MPC con olle s. O iginally, so wa e eju ena ion was de eloped in he 1990s o handle he so wa e aging p oblem [35], and since hen, i has been explo ed in a ious ields [36,58]. In pa icula , his hesis ex ends i s applica ion by in eg a ing so wa e eju ena ion wi hin p edic i e con ol amewo ks, ep esen ing he i s a emp o combine bo h me hodologies sys ema ically. The p oposed app oach is de ailed in [1,7,49]. • Objec i e 5: Valida ion and e alua ion in ealis ic scena ios h ough simu- la ions. The inal objec i e o his hesis is o alida e he p oposed me hods in ealis ic con ol scena ios, ensu ing hei applicabili y o p ac ical CPS. This is achie ed h ough simula ions in wo di e en en i onmen s: –The HyLab labo a o y-scale mic og id, which is a domes ic hyd ogen-based enewable mic og id in oduced in [59]. This es bed was o iginally designed o implemen and analyze di e en ope a ional modes and con ol s a egies aimed a op imizing hyd ogen-based sma g id pe o mance. In ou case, i p o ides a con olled en i onmen o assessing cybe -a ack esilience s a egies in ne wo ked con ol sys ems. I ep esen s he case s udy used in [1,7,49]. – I iga ion canal ne wo ks, which a e la ge-scale hyd aulic sys ems designed o dis ibu e wa e e icien ly o ag icul u al use. Gi en hei in e connec ed na- u e and eliance on emo e con ol, hese sys ems a e inc easingly ulne able o cybe h ea s ha can dis up wa e deli e y and comp omise in as uc u e eliabili y. In pa icula , he ASCE Tes Canal 1 in oduced in [60,61] ep e- sen s he case s udy in [2,4]. This es canal p o ides a s anda dized pla o m o e alua ing con ol s a egies unde ealis ic condi ions. In ou simula ions, we u ilize he linea canal model p oposed by [62]. The combina ion o hese es scena ios ensu es ha he p oposed secu i y mecha- nisms a e no only heo e ically sound bu also e ec i e in eal-wo ld applica ions. 1.4 Lis o publica ions The wo ks ca ied ou o his hesis ha e o igina ed he ollowing publica ions. •Jou nal a icles: 1. T. A auz, J.M. Maes e, X. Tian, G. Guan, "Design o PI Con olle s o I iga ion Canals Based on Linea Ma ix Inequali ies," Wa e , ol. 12, no. 3, pp. 855, 2020. [2] 2. T. A auz, J.M Maes e, R. Romagnoli, B. Sinopoli, E.F. Camacho, "A Linea P og amming App oach o Compu ing Sa e Se s o So wa e Reju ena ion," IEEE Con ol Sys ems Le e s, ol. 6, pp. 1214–1219, 2021. [1] 3. T. A auz, P. Chan eu , J.M. Maes e, "Cybe -secu i y in ne wo ked and dis- ibu ed model p edic i e con ol," Annual Re iews in Con ol, ol. 53, pp. 338–355, 2022. [48] 18 Chap e 2. Summa y o esul s and discussion sys em objec i es. So wa e-based a acks can in oduce pe sis en h ea s ha a e di icul o de ec and mi iga e. To illus a e hese a acks, he su ey p esen s simula ion esul s ha demons a e how di e en DMPC amewo ks beha e unde ad e sa ial condi ions. Speci ically, i e alua es he esilience o a dual-decomposi ion DMPC scheme unde jamming a acks (Example 1), as well as he impac o alse e e ence injec ions on coope a ion-based DMPC (Example 2), ollowing models om [65,66]. To mi iga e cybe secu i y isks in DMPC, a ious de ense s a egies ha e been p oposed. The su ey ca ego izes hese in o p e en ion, de ec ion, and mi iga ion echniques: • P e en ion mechanisms. These s a egies aim o s eng hen secu i y be o e an a ack occu s. Common echniques include enc yp ed communica ion p o ocols, secu e consensus algo i hms, and obus op imiza ion echniques ha imp o e esilience o ad e sa ial dis up ions. • De ec ion mechanisms. These ocus on iden i ying cybe a acks in eal ime. Ad- anced anomaly de ec ion sys ems use s a is ical models, machine lea ning, o s a e es ima ion echniques o iden i y de ia ions om no mal sys em beha io . In pa ic- ula , he su ey discusses in Example 3 he lea ning-based de ec ion mechanism in oduced in [67], which employs his o ical da a o de ec ne wo k anomalies. • Mi iga ion mechanisms. When an a ack is de ec ed, mi iga ion s a egies ensu e sys em s abili y by adap ing con ol ac ions. These s a egies can be classi ied as passi e o ac i e. – Passi e mi iga ion echniques ocus on designing inhe en ly obus con olle s capable o main aining s abili y despi e a acks, wi hou equi ing eal- ime de ec ion. Examples include aul - ole an DMPC a chi ec u es and secu e s a e es ima ion me hods, which enhance esilience by ensu ing ha con ol ac ions emain s able unde ad e sa ial condi ions. – Ac i e mi iga ion s a egies, on he o he hand, dynamically adjus con ol ac ions in esponse o de ec ed anomalies. These include neu al ne wo k-based coun e measu es, such as hose p oposed in [68], which use p edic i e models o compensa e o comp omised da a. In pa icula , Example 4 in [48] illus- a es he applica ion o a neu al ne wo k-based de ec ion and compensa ion mechanism wi hin a coope a i e-based DMPC amewo k, highligh ing i s abili y o mi iga e he impac o cybe a acks on dis ibu ed con olle s. Despi e signi ican ad ancemen s in cybe -de ense mechanisms o DMPC sys ems, se e al open challenges emain. One o he mos p essing issues is he need o eal- ime de ec ion and adap i e esponse s a egies, as many exis ing me hods ely on o line analysis and p ede ined a ack models. Fu u e e o s should ocus on de eloping adap i e secu i y amewo ks capable o dynamically esponding o eme ging h ea s wi hou comp omis- ing sys em pe o mance. Addi ionally, in eg a ing cybe - esilien con ol mechanisms di ec ly in o DMPC o mula ions is a c ucial esea ch di ec ion. Ensu ing ha con olle s emain obus agains ad e sa ial condi ions while main aining op imal decision-making 2.2 Resilien model-based PI con olle design 19 unde unce ain y would enhance he esilience o dis ibu ed con ol a chi ec u es. An- o he key challenge is scalabili y and compu a ional e iciency. As DMPC is commonly applied o la ge-scale ne wo ked sys ems, cybe - esilien implemen a ions mus emain compu a ionally easible o be p ac ical in eal-wo ld applica ions. The su ey p esen ed in [48] p o ides a s uc u ed analysis o hese challenges, o e ing a comp ehensi e o e iew o ulne abili ies, a ack s a egies, and de ense mechanisms in dis ibu ed p edic i e con ol. This wo k se es as a e e ence o esea che s and p ac i- ione s wo king owa ds he de elopmen o mo e secu e and esilien DMPC amewo ks. 2.2 Resilien model-based PI con olle design This sec ion summa izes he wo ks o [2,4] ha p opose wo dis inc algo i hms based on LMIs. Bo h designs aim o make canal i iga ion managemen mo e e icien and p ac ical. In pa icula , he i s a icle [2] sol es an LMI-based op imal con ol p oblem o ob ain a spa se eedback ha p o ides he PI uning. Mo eo e , he second algo i hm, p esen ed in [4], enhances he wo k in [2] by inco po a ing s abili y gua an ees o sys ems wi h up o a speci ied maximum p obabili y o packe losses. The nex subsec ions summa ize he main ea u es o bo h LMI-based algo i hms. 2.2.1 Basic PI con olle s design using LMIs The a icle [2] p esen s a no el LMI-based me hodology o uning PI con olle s wi h an applica ion o i iga ion canals. In pa icula , he wo k ocuses on challenges in designing PI con olle s o dis ibu ed sys ems and p oposes an LMI-based app oach ha ensu es op imal con ol pe o mance by add essing hese challenges. I iga ion canals a e essen ial o e icien ly dis ibu e wa e as hey ep esen app ox- ima ely 85% o global wa e usage. Managing wa e le els and low a es ac oss in e - connec ed canal pools equi es e ec i e con ol mechanisms. He e, PI con olle s a e b oadly employed o hei simplici y and adap abili y. Howe e , hei uning p esen s a signi ican challenge, o en equi ing a balance be ween pe o mance, obus ness, and p ac ical implemen a ion. The e o e, [2] p oposes an e icien LMI-based me hod o une PI con olle s o i iga ion canal sys ems. The p oposed me hod inco po a es: i) A spa se eedback design o minimize unwan ed in e ac ions be ween canal pools; ii) a cen alized con ol s a egy le e aging subsys em syne gies; and iii) he abili y o in eg a e cons ain s and handle unce ain ies, imp o ing obus ness and eliabili y. This wo k also models he i iga ion canal sys em as a se ies o in e connec ed sub- sys ems, each ep esen ing a canal pool. The dynamics o each subsys em a e desc ibed using a linea ized model. The o e all goal is o minimize a cos unc ion ha penalizes de ia ions in wa e le els and excessi e ga e mo emen s. The LMI app oach o mula es he con olle design as a con ex op imiza ion p oblem. Key s eps include: • S a e and inpu mapping: A eedback ma ix is designed o map sys em s a es o con ol ac ions unde spa si y cons ain s, ensu ing ha no all s a e a iables in luence e e y con ol ac ion. 20 Chap e 2. Summa y o esul s and discussion • S abili y and pe o mance: Sys em s abili y is ensu ed h ough he use o a Lyapuno unc ion. The ma ix inequali ies de i ed ensu e ha he con olle minimizes cos while main aining s abili y. • Tuning lexibili y: By adjus ing he weigh ing ma ices o he cos unc ion, he con olle allows ade-o s be ween wa e le el s abili y and con ol e o . The p oposed me hod is es ed on he ASCE Tes Canal 1, a s anda dized model e- quen ly used o e alua e i iga ion con ol algo i hms. The model includes eigh in e - connec ed canal pools wi h ga ed con ols. A simpli ied linea model o he canal ( he In eg a o -Delay model) is used o con olle design, and simula ions a e conduc ed using Sobek so wa e, which sol es he ull Sain -Venan equa ions o uns eady low. In o de o analyze i s pe o mance, h ee LMI-based PI uning s a egies a e e alua ed, each a ying he weigh ing ma ix o wa e le el s abili y: LMI Me hod 1, whe e penal ies a e manually adjus ed h ough ial and e o ; LMI Me hod 2, wi h penal ies p opo ional o he leng h o each canal sec ion; and LMI Me hod 3, wi h penal ies p opo ional o he backwa e su ace a ea o each canal sec ion. Fu he mo e, his wo k compa es hese con olle s wi h he ou PIF con olle s p esen ed by [3]. Figu es 2.1 and 2.2 illus a e he esul s o he LMI and PIF con olle s, espec i ely. As can be shown in all Figu es and Tables o [2], he LMI-based con olle s consis en ly ou pe o m PIF con olle s: • LMI me hods achie e lowe maximum e o alues, demons a ing imp o ed accu- acy in main aining desi ed wa e le els. • LMI con olle s eco e as e om dis u bances, highligh ing hei obus ness unde a iable condi ions. • LMI me hods educe he magni ude o de ia ions du ing ailu es, imp o ing o e all eliabili y in ailu e scena ios. Among he h ee LMI-based PI uning s a egies conside ed, he hi d s a egy achie es he bes o e all pe o mance, balancing e o educ ion and eco e y speed. In con as , he i s con olle p o ides he as es dis u bance eco e y, al hough i leads o sligh ly highe e o s. The second me hod o e s in e media e pe o mance, making i sui able o gene al applica ions. To sum up, he key ad an ages o he LMI app oach p esen ed in [2] a e: • Cen alized design: by conside ing he en i e canal sys em, he me hod a oids local op ima and exploi s in e -pool syne gies. • Spa si y cons ain s: he eedback ma ix ensu es ha each con olle ocuses on ele an s a es, minimizing complexi y and mi iga ing con lic s be ween con olle s. • Robus ness: he amewo k na u ally handles unce ain ies and dis u bances, en- hancing adap abili y o p ac ical ope a ional scena ios. 2.2 Resilien model-based PI con olle design 21 (a) LMI Me hod 1. (b) LMI Me hod 2. (c) LMI Me hod 3. Figu e 2.1 Simula ion esul s o he es in he non-linea canal model p esen ed in [2] o he h ee LMI-based PI uning s a egies. 22 Chap e 2. Summa y o esul s and discussion (a) PIF Me hod 1. (b) PIF Me hod 2. Figu e 2.2 Simula ion esul s o he es in he non-linea canal model p esen ed in [2] o he PIF me hods [3]. 2.2 Resilien model-based PI con olle design 23 (Figu e 2.2 con inued) (c) PIF Me hod 3. (d) PIF Me hod 4. Figu e 2.2 (c) and (d). 24 Chap e 2. Summa y o esul s and discussion 2.2.2 Design o PI con olle s conside ing packe losses The a icle [4] o e s an imp o ed app oach o i iga ion canal con ol in un eliable communica ion ne wo ks. The ea lie a icle [2] p esen ed an PI con olle design using LMIs, bu wi hou conside ing ne wo k impe ec ions like packe losses. Thus, his new con ibu ion enhances he model by adding esilience o packe losses, imp o ing bo h eliabili y and sys em s abili y. I iga ion sys ems a e essen ial o global ag icul u e, bu hei e iciency is o en chal- lenged by in as uc u al and communica ion laws, pa icula ly in CPSs. These sys ems in eg a e compu ing esou ces wi h physical p ocesses, making hem ulne able o ne wo k dis up ions. The p e ious wo k [2] highligh ed he e ec i eness o PI con olle s designed using LMIs o s able canal managemen , al hough i assumed ideal communica ion condi- ions. Gi en he inc easing h ea o cybe secu i y inciden s and na u al packe losses due o un eliable ansmissions, he de elopmen o obus con olle s has become inc easingly impo an . This wo k [4] add esses hese challenges by p oposing a model capable o main aining sys em s abili y e en unde signi ican packe loss, he eby enhancing he p ac ical applicabili y o he PI con ol me hodology. This imp o emen is achie ed by ex ending he LMI cons ain s om [2] wi h addi ional condi ions om [64] o accoun o packe losses. In pa icula , he main inno a ions o [4] o e he p e ious algo i hm o [2] a e: • Packe loss conside a ion: While he me hod o [2] op imizes con olle s wi hou accoun ing o ne wo k eliabili y, he new design o [4] in oduces a p obabilis ic Be noulli model o ep esen packe loss scena ios. This p obabilis ic app oach ensu es ha he con olle main ains pe o mance up o a speci ied maximum packe loss p obabili y. • S abili y gua an ees wi h LMIs: The enhanced design in eg a es addi ional LMI cons ain s o ensu e s abili y despi e un eliable communica ion. The me hod calcu- la es easible solu ions i e a i ely, adjus ing some pa icula pa ame e s o main ain pe o mance despi e high packe loss p obabili ies (up o 60%). • Cen alized s. decen alized design: Unlike ea lie wo k o [2], ha ocuses on cen alized con ol assump ions, he cu en model o [4] adap s o local a ia ions while p ese ing cen alized coo dina ion. This allows o independen handling o packe losses by each canal sec ion, he eby educing in e dependency isks. In [4], h ee di e en con olle s a e compa ed unde a ious condi ions: i) he p oposed packe loss ole an PI con olle , designed wi h obus ness agains up o 60% packe loss; ii) he s anda d PI con olle o p e ious wo k [2]; and iii) he PIF con olle o [3] ha p esen s he bes pe o mance o all me hods p esen ed in ha a icle. The compa ison be ween he h ee con olle s is accomplished in [4] by simula ing h ee di e en scena ios: wi h no packe losses, wi h 30% p obabili y o packe losses and wi h 60% p obabili y. The es simula ed in [4] is he same as in [2]. He e, only he esul s o he simula ions wi h a 60% packe loss p obabili y a e shown in Figu e 2.3. Howe e , he comple e se o esul s is illus a ed in he igu es and ables in [4]. Nex , a summa y o hei discussion is p o ided: 2.3 S ochas ic MPC o un eliable ne wo ks 25 • No packe loss: In ideal condi ions, whe e he e a e no losses, he p e ious PI con olle o [2] p esen s he bes pe o mance, ou pe o ming he new design o [4]. The la e p esen s he so es esponse due o i has been designed conside ing packe losses. •30% Packe loss: The s anda d PI con olle o [2] exhibi s signi ican deg ada ion, wi h inc eased e o s and ins abili y. Howe e , he p oposed design o [4] main ains consis en pe o mance, demons a ing supe io esilience. The PIF con olle handles mode a e packe loss bu exhibi s educed s abili y compa ed o he p oposed me hod. •60% Packe loss: Unde se e e condi ions, he PI con olle o [2] ails, wi h e o s inc easing signi ican ly. Al hough he PIF con olle pe o ms be e , i s ill expe- iences conside able de ia ions. In con as , he p oposed design o [4] main ains sys em in eg i y, e ec i ely con olling wa e le els wi h minimal inc ease in e o s. The e o e, his wo k [4] ep esen s a signi ican imp o emen o e he p e ious PI design o [2] by add essing he c i ical challenge o ne wo k eliabili y. By inco po a ing packe loss esilience h ough ad anced LMI cons ain s, he new me hod ensu es obus pe o mance and s abili y, e en unde se e e communica ion aul s. This ad ancemen makes i a use ul ool o mode n i iga ion canal managemen , enhancing bo h e iciency and sus ainabili y in wa e esou ce u iliza ion. 2.3 S ochas ic MPC o un eliable ne wo ks In his sec ion, pape s [5] and [6] a e p esen ed. The i s pape [5] in oduces a no el TBMPC app oach o add ess cybe secu i y h ea s, speci ically ocusing on jamming a acks in ne wo ked con ol sys ems. The second a icle, [6], p esen s an enhanced e sion o he p e ious TBMPC app oach [5] by inco po a ing obus ness agains bo h packe losses and ex e nal dis u bances simul aneously, using a mul i-scena io s ochas ic amewo k. 2.3.1 T ee-Based MPC o jamming a acks The pape [5] p esen s a TBMPC s a egy o ace packe losses due o jamming a acks. Unlike adi ional MPC me hods, his new amewo k enhances sys em obus ness by an icipa ing po en ial packe losses and p e-compu ing con ol sequences o a ious loss scena ios. By o ganizing hese sequences in o a ee s uc u e, he con olle dynamically adap s o eal- ime condi ions, ensu ing s abili y and pe o mance e en unde signi ican communica ion dis up ions. Ne wo ked con ol sys ems depend on s able communica ion be ween componen s; howe e , wi eless ne wo ks ace ulne abili ies such as in e e ence and jamming a acks, which isk pe o mance and s abili y. Al hough p e ious esea ch has ocused on designing obus con olle s o add ess hese challenges, adi ional MPC s a egies o en assume ideal communica ion condi ions, educing hei p ac icali y in eal-wo ld applica ions. MPC is a widely used con ol s a egy ha op imizes u u e con ol ac ions based on sys em models and cons ain s. I compu es a sequence o inpu s o minimize a cos unc ion 26 Chap e 2. Summa y o esul s and discussion (a) PI con olle o [4]. (b) PI con olle o [2]. (c) PIF con olle o [3]. Figu e 2.3 Simula ion esul s o he es in he non-linea canal model wi h 60% o packe loss p esen ed in [4] o he designed PI con olle o [4], he PI con olle o [2] and he PIF con olle o [3]. 2.3 S ochas ic MPC o un eliable ne wo ks 27 o e a p edic ion ho izon. Howe e , s anda d MPC implemen a ions s uggle wi h packe losses because hey ely on con inuous eedback. When da a packe s a e los , he sys em migh ecei e delayed o pa ial in o ma ion, esul ing in educed pe o mance o po en ial ins abili y. P e ious e o s o add ess his issue include de e minis ic con olle s wi h inpu bu e s and s ochas ic MPC o mula ions ha inco po a e packe loss p obabili ies in o he cos unc ion. Al hough hese app oaches imp o e esilience, hey o en ail o pe o m e ec i ely in highly unce ain scena ios, such as coo dina ed jamming a acks. The p oposed TBMPC me hod o e comes hese limi a ions by conside ing all possible packe loss scena ios wi hin he p edic ion ho izon, allowing he con olle o success ully adap o dis up ions. The main inno a ion o TBMPC lies in i s ee s uc u e, which maps all possible communica ion scena ios. Each b anch o he ee co esponds o a di e en packe loss pa e n, and each node ep esen s a con ol ac ion. By e alua ing he sys em’s e olu ion unde each scena io, he con olle selec s he op imal sequence o ac ions based on a weigh ed cos unc ion. The key ea u es o he TBMPC amewo k p esen ed in [5] a e: •The sys em is modeled using a disc e e- ime s a e-space ep esen a ion. • Packe losses a e modeled using a Be noulli p ocess, wi h each packe ha ing a p obabili y o being los . This p obabilis ic amewo k allows he con olle o an icipa e dis up ions and adjus i s s a egy acco dingly. • The p edic ion ho izon is di ided in o ime s eps, and each s ep is b anched in o wo possible ou comes: success ul ansmission o packe loss. This b anching esul s in a bina y ee wi h 2N−1possible scena ios o a p edic ion ho izon o leng h N. • To ensu e he con olle does no an icipa e u u e packe losses, non-an icipa i i y cons ain s a e imposed, equi ing con ol ac ions a each node o be consis en wi h he in o ma ion a ailable a ha ime. • The objec i e o TBMPC is o minimize he expec ed alue o a cos unc ion ha includes s a e de ia ions and con ol e o s. • The op imiza ion p oblem ensu es ha con ol inpu s espec sys em cons ain s while minimizing he expec ed cos . To demons a e he e ec i eness o TBMPC in [5], he me hod was applied o a ca - pendulum sys em, a common benchma k in con ol heo y. In addi ion, wo di e en s a egies a e es ed o he inpu signal in case o packe loss: a ze o inpu is applied o he sys em, o he co esponding elemen o he las inpu sequence success ully ecei ed is applied ins ead. The simula ion compa es TBMPC wi h s anda d MPC unde di e en packe loss scena ios: •Resul s wi hou packe loss: In he absence o packe losses, he TBMPC and s an- da d MPC pe o m iden ically, bo h achie ing quick s abiliza ion o he pendulum. This esul con i ms ha TBMPC does no in oduce unnecessa y complexi y o pe o mance deg ada ion when communica ion is eliable. 34 Chap e 2. Summa y o esul s and discussion and SR pe iods. This ensu es ha con ol ac ions a e op imized o bo h immedia e and long- e m objec i es. The p edic ion ho izon inco po a es he p obabili y o cybe a acks du ing MC and in eg a es he ixed du a ion o SR ac ions o ensu e con inui y and sys em s abili y. • T ee-based s uc u e: A key ea u e o he amewo k is i s ee-based s uc u e, which models all possible a ack scena ios o e he p edic ion ho izon. Each scena io is associa ed wi h a p obabili y, which is used o calcula e he expec ed cos and guide op imal decision-making. Each b anch co esponds o a dis inc sequence o a ack and eco e y e en s, enabling he con olle o e alua e a ious pa hways simul aneously. This s uc u e allows he sys em o an icipa e dis up ions and adjus con ol ac ions acco dingly, enhancing i s esilience o cybe a acks. • Non-an icipa o y cons ain s: To main ain causali y, he con ol ac ions ac oss di e - en scena ios mus align un il he co esponding di e gence poin o he ee. These cons ain s educe he numbe o decision a iables, simpli ying he op imiza ion p oblem while main aining p ecision. • Cos unc ion: The cos unc ion balances mul iple objec i es, including minimizing s a e de ia ions, con ol e o , and eco e y ime. By assigning weigh s o hese objec i es, he con olle can p io i ize he goals based on ope a ional needs. In addi ion, he p obabilis ic na u e o a acks is in oduced in o he cos unc ion, ensu ing ha he op imiza ion p ocess accoun s o he likelihood and impac o each scena io. •Open-loop p edic i e con ol s a egy: This app oach builds on he indings o ou p e ious a icles [5,6,49], and compu es con ol ac ions o e a ixed p edic ion ho izon, conside ing p ede ined p obabili ies o po en ial cybe a acks. Based on how unce ain a iables a e managed, h ee di e en con igu a ions a e es ablished: – Open-Loop Wo s -Case Min-Max TBMPC (OL-WmmTBMPC): Focused on obus ness, his con igu a ion compu es con ol ac ions unde he assump ion o he wo s -case a ack scena io, i.e., bo h a acks and dis u bances a e conside ed as unce ain. The e o e, his is he mos conse a i e app oach. – Open-Loop Min-Max TBMPC (OL-mmTBMPC): This con igu a ion consid- e s a acks as an unce ain a iable and o ecas o dis u bances (ex e nal dis u bances se as hei mean obse ed alues). – Open-Loop TBMPC (OL-TBMPC): A baseline con igu a ion ha p ecompu es con ol ac ions based on nominal condi ions, wi hou explici ly accoun ing o wo s -case scena ios, i.e., conside ing dis u bance and a ack o ecas (ex e nal dis u bances se as hei mean obse ed alues and no a acks). • Closed-loop p edic i e con ol s a egy: The Closed-Loop TBMPC (CL-TBMPC) is based on he me hodology p esen ed in [71]. This app oach employs dis u bance eedback pa ame e iza ion, which means ha he con ol policy is de ined as an a ine unc ion o he sequence o pas dis u bances wi hin he p edic ion ho izon. Howe e , his s a egy is adap ed in [7] o he ee-based amewo k ha includes 2.4 So wa e eju ena ion s a egies 35 bo h sou ces o unce ain y: ex e nal dis u bances and a acks. Fu he de ails a e p o ided in Sec ion III-B and he Appendix o [7]. The a icle [7] e alua es hese s a egies h ough simula ions conduc ed on he lab- scale HyLab mic og id [70], which was p e iously used in o he so wa e eju ena ion wo ks [1,49]. The con igu a ion o he so wa e eju ena ion se -up is compu ed using he basic algo i hm ou lined in [1], and he co esponding LQR con olle o MC is also included o compa a i e analysis. Fou scena ios a e analyzed based on he p obabili y o a ack: 0% , 25% , 50% , and 75% . And h ee dis inc ypes o a ack a e de ined ega ding he a acke ’s pe o mance: •A ack Case 1: The a acke se s he inpu signals o hei maximum alues. • A ack Case 2: The a acke disables he ac ua o s by se ing he inpu signals o ze o. • A ack Case 3: The a acke eplays he las inpu signal applied by he MC con olle . To e alua e he pe o mance o he di e en mission con olle s, some pe o mance indica- o s a e calcula ed: he accumula ed cos , he numbe o ins an s whe e he SC is ac i a ed, and he o al numbe o a acks expe ienced. Fo he h ee scena ios ha in ol e a acks, he esul s a e p esen ed as he mean alue wi h he s anda d de ia ion shown in b acke s. Each case is based on a se o 1,000 simula ions. The comple e esul s a e summa ized in Table 2.1. Finally, Figu e 2.7 shows an in e al o 30 ime ins an s ( 15 min) o he simula ions pe o med wi h 25% o p obabili y o a acks and a ack case 1 ( uA =umax ) using he LQR, he OL-mmTBMPC, and he CL-TBMPC as mission con olle s. The simula ion esul s highligh he s eng hs and weaknesses o each s a egy: • The CL-TBMPC consis en ly ou pe o ms all open-loop con igu a ions and he LQR-based con olle in e ms o eco e y ime and cos e iciency, especially unde high-in ensi y a acks (A ack Case 3). • Among he open-loop con igu a ions, OL-mmTBMPC achie es he bes balance be ween pe o mance and ope a ional cos , whe eas OL-WmmTBMPC p io i izes obus ness, esul ing in inc eased cos s. • The LQR con olle pe o ms e ec i ely in low-in ensi y a ack scena ios. Howe e , i s uggles o main ain s abili y and incu s highe ope a ional cos s unde mo e se e e condi ions. In conclusion, his a icle [7] highligh s he bene i s o closed-loop TBMPC in add ess- ing he challenges o cybe a acks in so wa e eju ena ion s a egies. The h ee open-loop con igu a ions o e al e na i e app oaches, wi h OL-mmTBMPC being pa icula ly e ec- i e o applica ions ha p io i ize educed compu a ional complexi y. As demons a ed, CL-TBMPC achie es mode a e imp o emen s compa ed o he baseline LQR mission con olle , p o iding a simple se up o so wa e eju ena ion pa ame e s bu equi ing mo e in ensi e online compu a ions. In addi ion, ecu si e easibili y is eadily ensu ed wi hin his amewo k, as s a e cons ain s a e managed by he sa e y con olle and he pe iodic so wa e e esh mechanism. 36 Chap e 2. Summa y o esul s and discussion (a) LQR mission con olle . (b) OL-mmTBMPC mission con olle . Figu e 2.7 Simula ion esul s o he es in he lab-scale mic og id HyLab sys em p esen ed in [7], wi h a p obabili y o a acks o 25% du ing 15 minu es, using ou di e en mission con olle s. 2.4 So wa e eju ena ion s a egies 37 (Figu e 2.7 con inued) (c) CL-TBMPC mission con olle . Figu e 2.7 (c). 38 Chap e 2. Summa y o esul s and discussion Table 2.1 Values o 1000 simula ions wi h a ying a ack p obabili ies p esen ing he mean alues and, in b acke s, he co esponding s anda d de ia ion. MC Con olle Cos (104) Ins an s o SC # A acks Cos (104) Ins an s o SC # A acks Cos (104) Ins an s o SC # A acks A ack P obabili y 0% LQR 0.26 0.00 0 – – – – – – OL-TBMPC 0.26 0.00 0 – – – – – – OL-mmTBMPC 0.26 0.00 0 – – – – – – OL-WmmTBMPC 0.71 0.00 0 – – – – – – CL-TBMPC 0.25 0.00 0 – – – – – – A ack Case 1 A ack Case 2 A ack Case 3 A ack P obabili y 25% LQR 5.84 (1.43) 38.42 (12.67) 21.45 (3.62) 0.37 (0.04) 0.00 (0.00) 23.93 (4.37) 0.26 (0.00) 0.00 (0.00) 23.93 (4.37) OL-TBMPC 5.84 (1.45) 40.92 (12.67) 21.28 (3.56) 0.36 (0.04) 0.01 (0.13) 23.93 (4.37) 0.26 (0.01) 0.00 (0.09) 23.93 (4.37) OL-mmTBMPC 6.12 (1.49) 41.88 (12.80) 21.23 (3.55) 0.42 (0.05) 0.01 (0.13) 23.93 (4.37) 0.32 (0.02) 0.01 (0.13) 23.93 (4.37) OL-WmmTBMPC 7.25 (1.53) 55.50 (11.58) 20.30 (3.47) 0.93 (0.09) 3.53 (2.64) 23.83 (4.32) 0.81 (0.07) 3.12 (2.75) 23.83 (4.35) CL-TBMPC 5.70 (1.39) 40.57 (12.46) 21.32 (3.58) 0.35 (0.04) 0.00 (0.00) 23.93 (4.37) 0.25 (0.00) 0.00 (0.00) 23.93 (4.37) A ack P obabili y 50% LQR 13.65 (2.26) 79.15 (12.70) 37.52 (3.63) 0.58 (0.10) 0.13 (0.66) 48.03 (5.19) 0.26 (0.00) 0.00 (0.00) 48.03 (5.19) OL-TBMPC 13.26 (2.22) 83.24 (11.93) 37.00 (3.50) 0.54 (0.10) 0.11 (0.59) 48.03 (5.19) 0.25 (0.02) 0.10 (0.78) 48.02 (5.18) OL-mmTBMPC 13.85 (2.18) 85.92 (11.94) 36.66 (3.48) 0.72 (0.12) 0.56 (1.29) 48.02 (5.18) 0.40 (0.04) 0.10 (0.72) 48.02 (5.19) OL-WmmTBMPC 14.80 (2.20) 93.41 (9.89) 35.67 (3.60) 1.20 (0.12) 7.17 (2.80) 47.32 (5.01) 0.92 (0.12) 2.93 (2.88) 47.85 (5.16) CL-TBMPC 13.10 (2.20) 83.12 (11.84) 37.03 (3.50) 0.56 (0.10) 0.11 (0.61) 48.03 (5.19) 0.25 (0.00) 0.00 (0.00) 48.03 (5.19) A ack P obabili y 75% LQR 23.05 (2.43) 111.19 (8.41) 50.00 (2.79) 1.05 (0.19) 3.35 (2.83) 71.76 (3.98) 0.28 (0.03) 0.38 (2.03) 72.01 (4.12) OL-TBMPC 22.22 (2.50) 114.62 (7.16) 49.32 (2.67) 0.96 (0.19) 2.37 (2.50) 71.90 (4.05) 0.32 (0.10) 5.25 (7.08) 71.24 (3.73) OL-mmTBMPC 22.81 (2.41) 116.33 (6.83) 48.97 (2.75) 1.22 (0.18) 5.38 (3.19) 71.36 (3.88) 0.52 (0.10) 0.49 (1.78) 72.02 (4.17) OL-WmmTBMPC 23.54 (2.32) 118.24 (5.90) 48.58 (2.88) 1.50 (0.14) 11.77 (2.41) 69.85 (3.92) 1.01 (0.21) 2.46 (4.16) 71.76 (4.10) CL-TBMPC 22.15 (2.49) 114.81 (7.03) 49.28 (2.68) 1.03 (0.19) 2.87 (2.66) 71.83 (4.01) 0.29 (0.06) 1.34 (3.75) 71.88 (4.00) 3 Publica ions The con en o his chap e has been omi ed o copy igh easons. Ins ead, we p o ide a lis o he publica ions included in his hesis, along wi h hei DOI and a summa y o hei con en , which is p esen ed in he di e en sec ions o Chap e 2. •Block 1: Cybe secu i y and MPC (Sec ion 2.1). 1. T. A auz, P. Chan eu , J.M. Maes e, "Cybe -secu i y in ne wo ked and dis- ibu ed model p edic i e con ol," Annual Re iews in Con ol, ol. 53, pp. 338–355, 2022. [48] DOI: 10.1016/j.a con ol.2021.10.005 Summa y: Sec ion 2.1 •Block 2: Resilien model-based PI con olle design (Sec ion 2.2). 2. T. A auz, J.M. Maes e, X. Tian, G. Guan, "Design o PI Con olle s o I iga ion Canals Based on Linea Ma ix Inequali ies," Wa e , ol. 12, no. 3, pp. 855, 2020. [2] DOI: 10.3390/w12030855 Summa y: Sec ion 2.2.1 3. T. A auz, J.M. Maes e, A. Ce inkaya, E.F. Camacho, "Model-based PI design o i iga ion canals wi h aul y communica ion ne wo ks," 2021 Eu opean Con ol Con e ence (ECC), pp. 1236–1242, 2021. [4] DOI: 10.23919/ECC54610.2021.9655060 Summa y: Sec ion 2.2.2 •Block 3: S ochas ic MPC o un eliable ne wo ks (Sec ion 2.3). 4. T. Pie on, T. A auz, J.M. Maes e, A. Ce inkaya, C. S oica Maniu, "T ee- Based Model P edic i e Con ol o Jamming A acks," 2020 Eu opean Con ol Con e ence (ECC), pp. 948–953, 2020. [5] DOI: 10.23919/ECC51009.2020.9143814 Summa y: Sec ion 2.3.1 39 40 Chap e 3. Publica ions 5. T. A auz, J.M. Maes e, A. Ce inkaya, C. S oica Maniu, "A T ee-Based Mul i-Scena io App oach o Ne wo ked MPC unde Packe Losses and Dis u - bances," IFAC-Pape sOnLine, ol. 55, no. 16, pp. 296–301, 2022. [6] DOI: 10.1016/j.i acol.2022.09.040 Summa y: Sec ion 2.3.2 •Block 4: So wa e eju ena ion s a egies (Sec ion 2.4). 6. T. A auz, J.M Maes e, R. Romagnoli, B. Sinopoli, E.F. Camacho, "A Linea P og amming App oach o Compu ing Sa e Se s o So wa e Reju ena ion," IEEE Con ol Sys ems Le e s, ol. 6, pp. 1214–1219, 2021. [1] DOI: 10.1109/LCSYS.2021.3090448 Summa y: Sec ion 2.4.1 7. T. A auz, J.M. Maes e, D. Que edo, E.F. Camacho, "T ee-based Model P edic- i e Con ol S a egy o So wa e Reju ena ion," 2022 IEEE 61s Con e ence on Decision and Con ol (CDC), pp. 1124–1129, 2022. [49] DOI: 10.1109/CDC51059.2022.9993366 Summa y: Sec ion 2.4.2 8. T. A auz, J.M. Maes e, P. Chan eu , D.E. Que edo, E.F. Camacho, "Open and closed-loop p edic i e con ol s a egies o so wa e eju ena ion," IEEE T ansac ions on Eme ging Topics in Compu ing, 2024. [7] DOI: 10.1109/TETC.2024.3481997 Summa y: Sec ion 2.4.2 4 Conclusions and u u e esea ch di ec ions H is o ically, mos indus ial con ol sys ems we e designed as isola ed, independen uni s ope a ing in physically secu e en i onmen s wi h limi ed ex e nal in e ac ion. Howe e , he ex ended adop ion o ne wo ked con ol a chi ec u es, oge he wi h he p og essi e in eg a ion o ad anced compu ing and communica ion echnologies, has d ama ically inc eased he po en ial a ack su ace o hese sys ems. Mode n CPS ely on eal- ime da a exchange be ween dis ibu ed componen s, emo e access capabili ies o moni o ing and main enance, and cloud-based in as uc u es o da a s o age and p ocessing. While hese ea u es o e undeniable bene i s in e ms o ope a ional e iciency and lexibili y, hey also in oduce nume ous possibili ies o malicious ac o s. The g owing numbe o documen ed cybe a acks a ge ing c i ical in as uc u es in sec o s such as ene gy, wa e managemen , anspo a ion, and manu ac u ing highligh s he eal and immedia e h ea posed by hese ulne abili ies. A acks on con ol sys ems ha e become eal dange s wi h documen ed impac s on he economy, he en i onmen , and ope a ional sa e y. Mo eo e , he e olu ion o a ack s a egies, including he use o s eal hy, pe sis en echniques speci ically designed o bypass adi ional de ec ion mechanisms, u he complica es he ask o secu ing hese sys ems. This si ua ion is agg a a ed by he ac ha many o he con ol a chi ec u es cu en ly in ope a ion we e de eloped decades ago, be o e cybe secu i y was conside ed a design equi emen . As a esul , much o he indus ial con ol in as uc u e in ope a ion oday lacks basic secu i y measu es, lea ing i highly exposed o cybe a acks. The challenges posed by his con ex a e u he ampli ied when conside ing he high speci ici y o cybe a acks a ge ing con ol sys ems. Unlike con en ional a acks on in o ma ion sys ems, which ypically ocus on dis up ing se ices o s ealing da a, a acks on con ol sys ems aim o manipula e he physical p ocess, g adually al e ing i s beha io o deg ade pe o mance, c ea e unsa e condi ions, o e en cause comple e ailu es. This dual na u e, which combines cybe manipula ion wi h physical consequences, makes he de elopmen o uni e sal de ense mechanisms ex emely di icul . E ec i e cybe secu i y o con ol sys ems he e o e equi es a mul idisciplina y app oach, capable o add essing bo h he inhe en ulne abili ies o con ol algo i hms and he communica ion and so wa e in as uc u es on which hey ely. This hesis add esses p ecisely his need, ocusing on imp o ing he esilience o model- based con ol sys ems agains cybe h ea s h ough he in eg a ion o secu i y-awa e 41 42 Chap e 4. Conclusions and u u e esea ch di ec ions design me hodologies. The wo k has ackled his challenge om a b oad pe spec i e, co e ing bo h con en ional con ol s a egies, such as PI con olle s widely used in indus y, and mo e ad anced app oaches like p edic i e con ol, pa icula ly in ne wo ked and dis ibu ed se ings. In bo h cases, he p oposed me hodologies aim o explici ly accoun o he p esence o cybe h ea s, ensu ing ha he designed con olle s no only mee pe o mance equi emen s unde nominal condi ions, bu also main ain hei abili y o ope a e sa ely and eliably in ad e sa ial en i onmen s. In he case o PI con olle s, which emain he mos common con ol solu ion in indus ial applica ions, his hesis has demons a ed how a model-based design app oach using s a e-space echniques and LMIs can be applied o enhance hei obus ness agains cybe - induced dis u bances. Despi e hei ex ensi e use in indus ial p ocesses, PI con olle s a e s ill p edominan ly designed using classical uning me hods, such as he Ziegle -Nichols ules, which do no explici ly accoun o cybe h ea s. This hesis add esses his limi a ion by inco po a ing obus ness p ope ies di ec ly in o he con olle design, ensu ing ha he esul ing PI con olle s a e no only capable o main aining pe o mance unde nominal condi ions, bu also wi hs and communica ion aul s, packe losses, and cybe -induced pe u ba ions ha ypically a ise in ne wo ked en i onmen s. These con ibu ions combine he simplici y and amilia i y o PI con olle s wi h he obus ness bene i s de i ed om mode n con ol design echniques. The e o e, hey p o ide a p ac ical and e ec i e way o upg ade exis ing indus ial con ol sys ems o add ess he cybe secu i y challenges associa ed wi h in e connec ed in as uc u es. Fu he mo e, his esul highligh s ha e en well-es ablished con ol echniques, de eloped decades ago, can be adap ed and enhanced o inco po a e esilience p ope ies, demons a ing ha adi ional con ol solu ions can e ol e o mee mode n secu i y equi emen s, as shown in [2,4]. Fo mo e ad anced con ol a chi ec u es, his hesis has ocused on MPC, a s a egy ha inhe en ly o e s conside able lexibili y o handle unce ain ies and ope a ional con- s ain s, bu also in oduces speci ic ulne abili ies due o i s eliance on eal- ime da a exchange and i e a i e op imiza ion p ocesses. While PI con olle s p o ide a basic le el o esilience, MPC con olle s enable a mo e explici conside a ion o ad e sa ial sce- na ios by embedding po en ial dis u bances and ne wo k-induced issues di ec ly in o he op imiza ion o mula ion. To enhance he obus ness o p edic i e con ol in ne wo ked en i onmen s, his hesis p oposes a new class o cybe - esilien p edic i e con olle s, buil on ee-based MPC o mula ions. They explici ly accoun o po en ial ne wo k dis up ions, including packe losses and jamming a acks, by gene a ing a ee o possible con ol sequences ha e lec s he ange o easible scena ios he sys em could deal wi h. This enables he con olle o dynamically adap i s ac ions as he ac ual communica ion condi ions un old. Unlike con en ional MPC s a egies, which p ima ily ely on inpu bu e s o conse a i e cons ain s o mi iga e he impac o delays and packe losses, he p oposed app oach o e s a mo e lexible and adap i e esponse, an icipa ing ad e sa ial scena ios and embedding his awa eness di ec ly in o he op imiza ion p ocess. The esul s p esen ed in [5,6] demons a e he e ec i eness o his s a egy, which builds upon and ex ends p e ious app oaches ha ocused on compensa ing o communica ion delays, now inco po a ing a b oade iew ha conside s bo h s ochas ic dis u bances and ad e sa ial in e e ence. 4.1 Fu u e esea ch 43 The mos inno a i e con ibu ion o his hesis lies in he in eg a ion o so wa e eju- ena ion echniques in o p edic i e con ol amewo ks, ep esen ing a no el app oach o imp o ing he cybe secu i y o ne wo ked con ol sys ems. O iginally de eloped in he compu ing ield o add ess so wa e aging, so wa e eju ena ion was designed o pe iodically ese he un ime so wa e, elimina ing accumula ed e o s, esou ce leaks, o unin ended modi ica ions. This hesis ex ends ha concep and adap s i o he speci ic equi emen s o con ol sys ems ope a ing in ad e sa ial en i onmen s, using so wa e eju ena ion as a p oac i e cybe secu i y mechanism. By pe iodically es o ing he con ol so wa e o a secu e s a e, he sys em can e ec i ely emo e any s eal hy modi ica ions in oduced by unde ec ed cybe a acks ha a ge he un ime code. A key con ibu ion o his wo k is he di ec inco po a ion o scheduled so wa e e eshes in o he p edic i e con ol o mula ion, ensu ing ha bo h he iming o hese e en s and hei po en ial impac on he sys em dynamics a e explici ly conside ed du ing he op imiza ion p ocess. This combina ion be ween so wa e eju ena ion and TBMPC allows he con olle o an icipa e and plan a ound so wa e ese s, ensu ing smoo h ansi ions be ween ope a ional modes and main aining sys em s abili y and pe o mance e en when ope a ing unde ad e sa ial condi ions. The e ec i eness o his s a egy has been demons a ed in [1,7,49], whe e i s abili y o mi iga e hijacking-based a acks and pe sis en s eal hy h ea s in ne wo ked con ol sys ems has been alida ed. Toge he , hese con ibu ions ep esen a comp ehensi e and cohe en se o me hodolo- gies ha ad ance he s a e-o - he-a in cybe secu i y o model-based con ol sys ems. By combining imp o ed design me hods o con en ional PI con olle s, cybe - esilien p edic i e con ol s a egies, and he in eg a ion o so wa e eju ena ion in o p edic i e con ol amewo ks, his hesis p o ides p ac ical ools and heo e ical ounda ions o en- hance he cybe secu i y o mode n con ol sys ems. These esul s no only add ess cu en challenges, bu also lay he g oundwo k o u u e esea ch e o s aimed a de eloping inc easingly adap i e, in elligen , and esilien con ol a chi ec u es capable o ope a ing sa ely in he ace o e ol ing cybe h ea s. 4.1 Fu u e esea ch Al hough his hesis p o ides ad ances in he ield o cybe -secu e con ol, se e al open esea ch ques ions emain. Fu u e wo k should aim o u he explo e and enhance he me hodologies p oposed he e, add essing se e al key aspec s ha could expand bo h he applicabili y and e ec i eness o he p oposed app oaches in he ollowing a eas: • In a ian se compu a ion o so wa e eju ena ion. One ele an esea ch di ec- ion conce ns he compu a ion o in a ian se s o so wa e eju ena ion s a egies. In Chap e 3 [1], a LP app oach was used o compu e he minimal in a ian se , ensu ing ha sys em cons ain s we e sa is ied a e each so wa e e esh. This se plays a c ucial ole in gua an eeing ha he sys em always e u ns o a sa e s a e ollowing a so wa e eju ena ion e en . Howe e , he compu a ion o he maximal in a ian se , which would enla ge he se o s a es om which sa e eco e y is gua an eed, emains an open challenge. This ex ension could exploi he pe iodic na u e o so wa e eju ena ion o e o mula e he con ol p oblem as a pe iodic 50 Bibliog aphy [38] L. Aung, Y. Xin, D. Han, K. Vaidyana han, and K. S. T i edi, “So wa e eju ena ion: Towa ds p oac i e aul managemen ,” Jou nal o Sys ems and So wa e, ol. 76, no. 1, pp. 3–22, 2004. [39] P. A oyo, J. Cuella , and A. F. Ska me a, “Fi ed: A amewo k o a ack de ec ion in indus ial con ol sys ems,” Compu e s & Secu i y, ol. 73, pp. 274–295, 2017. [40] R. Romagnoli, J. M. Maes e, and E. F. Camacho, “Robus con ol s a egies o esilien cybe -physical sys ems unde cybe -a acks,” Con ol Enginee ing P ac ice, ol. 102, p. 104556, 2020. [41] N. Zeldo ich, Compu e Sys ems Secu i y. MIT OpenCou seWa e, 2014. [42] Y. Mo and B. Sinopoli, “Secu e con ol agains eplay a acks,” P oceedings o he 47 h Annual Alle on Con e ence on Communica ion, Con ol, and Compu ing, 2009. [43] A. Humayed, J. Lin, F. Li, and B. Luo, “Cybe -physical sys ems secu i y—a su ey,” IEEE In e ne o Things Jou nal, ol. 4, no. 6, pp. 1802–1831, 2017. [44] R. F. Ali, A. Munee , P. D. Dominic, E. A. Ghaleb, and A. Al-Ashmo i, “Su ey on cybe secu i y o indus ial con ol sys ems,” in 2021 In e na ional Con e ence on Da a Analy ics o Business and Indus y (ICDABI). IEEE, 2021, pp. 630–634. [45] R. Smi h, “Decoupled ne wo ks: A co e channel a chi ec u e,” P oceedings o he 2011 ACM Wo kshop on P i acy in he Elec onic Socie y, 2011. [46] H. Sandbe g, A. Teixei a, and K. H. Johansson, “Cybe physical secu i y in con ol sys ems,” IEEE Con ol Sys ems Magazine, 2015. [47] F. Boem, D. M. Raimondo, and T. Pa isini, “Secu e s a e es ima ion and con ol o cybe -physical sys ems,” IEEE T ansac ions on Au oma ic Con ol, 2019. [48] T. A auz, P. Chan eu , and J. Maes e, “Cybe -secu i y in ne wo ked and dis ibu ed model p edic i e con ol,” Annual Re iews in Con ol, ol. 53, pp. 338–355, 2022. [49] T. A auz, J. M. Maes e, D. Que edo, and E. F. Camacho, “T ee-based model p edic- i e con ol s a egy o so wa e eju ena ion,” in 2022 IEEE 61s Con e ence on Decision and Con ol (CDC). IEEE, 2022, pp. 1124–1129. [50] R. Romagnoli, B. H. K ogh, and B. Sinopoli, “Design o so wa e eju ena ion o cps secu i y using in a ian se s,” in 2019 Ame ican Con ol Con e ence (ACC). IEEE, 2019, pp. 3740–3745. [51] F. G ube and M. Al ho , “Compu ing sa e se s o linea sampled-da a sys ems,” IEEE Con ol Sys ems Le e s, ol. 5, no. 2, pp. 385–390, 2020. [52] S. V. Rako ic, E. C. Ke igan, K. I. Kou amas, and D. Q. Mayne, “In a ian ap- p oxima ions o he minimal obus posi i ely in a ian se ,” IEEE T ansac ions on au oma ic con ol, ol. 50, no. 3, pp. 406–410, 2005. Bibliog aphy 51 [53] S. V. Rako ić, B. Kou a i akis, and M. Cannon, “Equi-no maliza ion and exac scaling dynamics in homo he ic ube model p edic i e con ol,” Sys ems & Con ol Le e s, ol. 62, no. 2, pp. 209–217, 2013. [54] I. M. Mi chell, J. Yeh, F. J. Laine, and C. J. Tomlin, “Ensu ing sa e y o sampled da a sys ems: An e icien algo i hm o il e ing po en ially unsa e inpu signals,” in 2016 IEEE 55 h Con e ence on Decision and Con ol (CDC). IEEE, 2016, pp. 7431–7438. [55] K. P. Wabe sich and M. N. Zeilinge , “Linea model p edic i e sa e y ce i ica ion o lea ning-based con ol,” in 2018 IEEE Con e ence on Decision and Con ol (CDC). IEEE, 2018, pp. 7130–7135. [56] R. Romagnoli, T. Alamo, B. Sinopoli, and E. F. Camacho, “Secu e con ol agains s eal hy a acks ia so wa e eju ena ion,” a Xi p ep in a Xi :1810.10468, 2018. [57] ——, “Op imal in a ian se compu a ion o so wa e eju ena ion s a egies in cybe -physical sys ems,” IEEE T ansac ions on Au oma ic Con ol, 2019. [58] D. Co oneo and R. Na ella, “A su ey o so wa e aging and eju ena ion s udies,” ACM Compu ing Su eys (CSUR), ol. 47, no. 2, pp. 1–36, 2014. [59] L. Val e de, F. Rosa, A. Del Real, A. A ce, and C. Bo dons, “Modeling, simula- ion and expe imen al se -up o a enewable hyd ogen-based domes ic mic og id,” In e na ional jou nal o hyd ogen ene gy, ol. 38, no. 27, pp. 11 672–11 684, 2013. [60] A. Clemmens, T. Kace ek, B. G awi z, and W. Schuu mans, “Tes cases o canal con ol algo i hms,” Jou nal o i iga ion and d ainage enginee ing, ol. 124, no. 1, pp. 23–30, 1998. [61] A. Clemmens, G. Sloan, and J. Schuu mans, “Canal-con ol needs: example,” Jou - nal o i iga ion and d ainage enginee ing, ol. 120, no. 6, pp. 1067–1085, 1994. [62] J. Schuu mans, A. Ho , S. Dijks a, O. Bosg a, and R. B ouwe , “Simple wa e le el con olle o i iga ion and d ainage canals,” Jou nal o i iga ion and d ainage enginee ing, ol. 125, no. 4, pp. 189–195, 1999. [63] M. Si ianes, T. A auz, E. Ma ín, and J. M. Maes e, “Repu a ion-based consensus on a secu e blockchain ne wo k,” in Blockchain o Cybe secu i y in Cybe -Physical Sys ems. Sp inge , 2022, pp. 167–184. [64] A. Ce inkaya, H. Ishii, and T. Hayakawa, “Ne wo ked con ol unde andom and malicious packe losses,” IEEE T ansac ions on Au oma ic Con ol, ol. 62, no. 5, pp. 2434–2449, 2016. [65] P. Chan eu , J. M. Maes e, and H. Ishii, “Vulne abili ies in dis ibu ed model p edic i e con ol based on jacobi-gauss decomposi ion,” in 2018 Eu opean Con ol Con e ence (ECC). IEEE, 2018, pp. 2587–2592. 52 Bibliog aphy [66] P. Vela de, J. M. Maes e, H. Ishii, and R. R. Negenbo n, “Scena io-based de ense mechanism o dis ibu ed model p edic i e con ol,” in 2017 IEEE 56 h Annual Con e ence on Decision and Con ol (CDC). IEEE, 2017, pp. 6171–6176. [67] W. Anandu a, J. M. Maes e, C. Ocampo-Ma inez, and H. Ishii, “Resilien dis ibu ed model p edic i e con ol o ene gy managemen o in e connec ed mic og ids,” Op imal Con ol Applica ions and Me hods, ol. 41, no. 1, pp. 146–169, 2020. [68] P. Chan eu , A. Sánchez-Amo es, J. M. Maes e, and E. F. Camacho, “Dis ibu ed model p edic i e con ol based on dual decomposi ion wi h neu al-ne wo k-based wa m s a ,” in 2021 Eu opean Con ol Con e ence (ECC). IEEE, 2021, pp. 1969– 1974. [69] P. T odden, “A one-s ep app oach o compu ing a poly opic obus posi i ely in a ian se ,” IEEE T ansac ions on Au oma ic Con ol, ol. 61, no. 12, pp. 4100–4105, 2016. [70] M. Pe ei a, D. Limon, D. M. de la Peña, L. Val e de, and T. Alamo, “Pe iodic economic con ol o a nonisola ed mic og id,” IEEE T ansac ions on indus ial elec onics, ol. 62, no. 8, pp. 5247–5255, 2015. [71] P. J. Goula , E. C. Ke igan, and J. M. Maciejowski, “Op imiza ion o e s a e eedback policies o obus con ol wi h cons ain s,” Au oma ica, ol. 42, no. 4, pp. 523–533, 2006.