Cyc-Attack: Iterative Cyber-Physical & Security Strategies

• Cyc-Attack is a framework of iterative, cyclic attack strategies that exploit feedback loops in cyber-physical and cyber-security systems to maximize impact while evading detection.
• It employs methods such as Markov Decision Processes, convex optimization, and recursive Bayesian evaluations to balance immediate attack efficacy with long-term stealth.
• Applications span smart grids, connected vehicles, deep learning weather pipelines, and hardware security, highlighting the need for robust, adaptive defense mechanisms.

Cyc-Attack refers to a set of attack strategies and algorithmic frameworks exploiting cyclic or iterative mechanisms in cyber‐physical and cyber‐security systems. These strategies are characterized by their sequential adaptation, optimization, and deception patterns across multiple domains, including smart grids, cyber‐physical control systems, weather forecasting, Bayesian network security, and connected vehicle platoons.

1. Sequential Optimization of Attack Impact in Cyber-Physical Control

In cyber-physical control systems (CPCS) subject to reactive attack detection and mitigation, Cyc-Attack represents the attacker’s attempt to maximize cumulative state estimation error via a sequence of false data injection actions modeled as a Markov Decision Process (MDP) (Lakshminarayana et al., 2017). The attacker’s decision at each time instant considers the trade-off between immediate impact and risk of detection, factoring in both the system's Kalman filter estimation error state and the probabilistic activation of the $\chi^2$ detector.

The system dynamics follow:

$$x[t+1] = A_K x[t] + B_K a[t] - [y[t+1] - i[t+1] m[t+1]]$$

where $a[t]$ denotes the attack injection, $i[t+1]$ and $m[t+1]$ are the detection indicator and mitigation signal respectively.

The attacker solves for the optimal policy $\pi^*$ via discretized value iteration:

$$V_{t+1}(\xi_i) \leftarrow \max_{a} \sum_{\xi_j \in \Xi} \bar{\mathcal{T}}(\xi_i, a, \xi_j) [\bar{R}(\xi_i, a, \xi_j) + V_t(\xi_j)]$$

balancing estimation error growth against stealthiness (i.e., detection probability).

Intermediate magnitude injections achieve maximal cumulative error while keeping detection rates moderate, yielding substantial voltage deviation in realistic simulations (e.g., pilot bus voltage departing by over 0.18 p.u. from nominal over a 30-step horizon). The overarching implication is that effective attack mitigation requires robust joint threshold tuning and responsive detection during iterative adversarial campaigns.

2. Combinational Attacks in Smart Grid Topology Manipulation

In power system contexts, Cyc-Attack is realized as a combinational strategy—synchronously executing both physical line-outage (removal) and cyber measurement alteration to mask the true location and mislead detection (Chung et al., 2017). This leverages the interplay between physical and cyber manipulation:

• The attacker selects vulnerable lines using Line Outage Distribution Factors (LODFs):

$$f_l = (L_{:,l})^T \cdot \operatorname{sign}(P) \cdot P_l$$

Target lines are chosen by

$l_o = \arg\max_l\{f_l\}$

• Cyber modifications maximize the decoy line signature (power flow):

$J_2 = \frac{\bar{\theta}_i - \bar{\theta}_j}{x_l}$

A convex optimization ensures constraints on topology and minimal detectable change.

Monte Carlo simulation on IEEE 14-bus systems shows a ~79.9% deception rate of control centers, supporting continuous, stealthy masquerading of outage locations, and emphasizes the need for adaptive monitoring and cross-validation in grid security.

3. Cyclicity in Bayesian Attack Graphs for Network Risk Evaluation

Cyc-Attack also denotes algorithmic approaches for precisely computing the marginal probabilities of network compromise in Bayesian Attack Graphs (BAGs) containing cycles (Matthews et al., 2020). Cycles arise in realistic attack graphs due to overlapping or feedback-laden attack paths.

The proposed interpretation models these graphs as combinational logic circuits, applying monotonic recursive evaluations with cycle detection. The state probability of each node is given by:

$$P(v) = p(v) \cdot \left[1 - \prod_{v' \in pa(v)} (1 - P(v'))\right]$$

The recursive algorithm prevents double-counting in cycles by zeroing repeated contributions along each branch.

Empirical scaling shows tractable runtimes (several seconds for realistic 1000+ node graphs), and the preservation of graph structure leads to more accurate security risk assessment and prioritization compared to prior approaches that artificially break cycles or unwind graphs.

4. Adversarial Perturbations in Deep Learning Weather Pipelines

Cyc-Attack designates a gradient-based adversarial methodology for manipulating upstream forecasts in DLWF to achieve targeted downstream outcomes, notably in tropical cyclone trajectory prediction (Deng et al., 11 Oct 2025). The pipeline confronts two central obstacles:

• Non-differentiable detection systems: Addressed via pre-training a surrogate segmentation model (e.g., DeepLabV3+) to approximate the detector's output.
• Extreme class imbalance: Handled using kernel dilation in mask labels and a skewness-aware focal loss:

$$\mathcal{L}_{\mathrm{surrogate}} = - \frac{1}{\beta} \sum_{t,p,q} \left[(1 - P_{tpq})^2 Z^D_{tpq} \log(P_{tpq}) + (P_{tpq})^2 (1 - Z^D_{tpq}) \log(1 - P_{tpq})\right]$$

Regularization and geodesic-based gradient weighting constrain perturbations to physically plausible domains:

$$w_{\mathrm{grad},tpq} = \begin{cases} 1 & \text{if }(p, q) \text{ in target}\ \exp\left(-d_t(p, q)^2/(2\sigma_{\mathrm{grad}}^2)\right) & \text{otherwise} \end{cases}$$

Empirical evaluation yields a detection rate nearly double that of baseline attacks, low false alarm rates, and physically consistent trajectories. This exposes the vulnerability of DLWF to surreptitious, staged adversarial manipulations.

5. Observer-Based Detection–Isolation in Connected Autonomous Vehicles

Cyc-Attack encompasses unified detection–isolation algorithms for defending against both V2V and V2I cyberattacks in CAV platoons (Ghosh et al., 2023, Ghosh et al., 18 Mar 2025). Each vehicle maintains observer-based residual generators with analytical guarantees on disturbance-to-state stability, robustness, and sensitivity. The observer dynamics for detection follow:

$$\frac{d\hat{x}_i}{dt} = A_\alpha \hat{x}_i + D_{\phi\alpha} \hat{x}_{i-1} - S_\alpha s_i + L_\alpha (y_i - C\hat{x}_i)$$

The residual thresholding detects deviations:

$$r_{c,i} = \max(0, \|y_i - \hat{h}_i\|^2 - \|y_{i-1} - \hat{h}_{i-1}\|^2)$$

Post-detection, isolation exploits V2V-only information to discriminate V2I-origin attacks. Monte Carlo and SUMO-based simulations show rapid and accurate attack localization in both highway and urban scenarios, with performance metrics tuned via Lyapunov-based LMI design.

6. Cyclic Physical Unclonable Functions in Hardware Security

In circuit security, Cyc-Attack can indicate the use of cyclic combinational architectures in PUF design to resist ML modeling. CycPUF introduces feedback paths (e.g., XORing responses into challenge bits), producing dynamic multiple response modes (binary, steady-state, oscillating, pseudo-random) for fixed challenges (Dominguez et al., 12 Feb 2024). Formally, response metrics such as Average Bit Value (ABV) are used over multiple cycles:

$$\operatorname{ABV}(j) = \frac{1}{c} \sum_{i=1}^c r_{ij}$$

Hardware implementation on FPGA reveals moderate area and power overheads, but modeling accuracy for ML attacks drops from 99.38% in APUF to 59.49% in CycAPUF, substantiating the efficacy of cyclic feedback in enhancing PUF resilience.

7. Strategic Implications and Frameworks for Cyclical Security Assessment

Cyc-Attack strategies, across domains, underline the necessity of understanding cyclical trade-offs between immediate impact and long-term stealth, leveraging sequential adaptation in both attacker and defender frameworks. Whether optimizing attack policies in control systems, orchestrating combinational deception in smart grids, or defending CAV platoons, these iterative and cyclic mechanisms demand integrated design of robust detection, mitigation, and resilience strategies. Theoretical models such as MDPs, combinational logic circuit mapping, and observer-based robust control play central roles in quantifying and mitigating the impact of cyclical adversarial actions.

Overall, the Cyc-Attack paradigm reflects a multiplicity of technical approaches unified by the exploitation of iterative, feedback-driven behaviors—either for attack surfaces in critical infrastructure and intelligent systems, or as defensive and analytical frameworks to bound, detect, and respond to such threats.