Cybersecurity in model-based Control: Resilient Design and Software rejuvenation Methods

UNIVERSIDAD DE SEVILLA Escuela Técnica Superior de Ingeniería Dep. Ingeniería de Sistemas y Automática Tesis Doctoral Cybersecurity in model-based control: resilient design and software rejuvenation methods Autor: MªTeresa Araúz Pisón Directores: José María Maestre Torreblanca Eduardo Fernández Camacho Sevilla, 2025 Tesis Doctoral: Cybersecurity in model-based control: resilient design and software rejuvenation methods Autor: MªTeresa Araúz Pisón Directores: José María Maestre Torreblanca Eduardo Fernández Camacho El tribunal nombrado para juzgar la Tesis arriba indicada, compuesto por los siguientes doctores: Presidente: Vocales: Secretario: acuerdan otorgarle la calificación de: El Secretario del Tribunal Fecha: Agradecimientos E n primer lugar, quiero agradecer a mis directores de tesis, José MªMaestre y Eduardo F. Camacho, por su apoyo, orientación e implicación a lo largo de estos años. Sin duda, para mí ha sido un auténtico privilegio y orgullo contar con estos grandes profesionales con tan fecunda experiencia y tan alta calidad humana guiando mi formación como ingeniera. En especial, a Pepe, con quien he compartido tantos proyectos desde aquella clase de primero de Informática en 2012. Estoy profundamente agradecida por la confianza que depositó en mí desde el principio, apostando por mí incluso cuando yo misma no me sentía capaz, respetando siempre mis propuestas y necesidades, pero animándome a dar lo mejor de mí. También quiero agradecer a mis compañeros durante estos años. En especial, a Paula, por su apoyo, implicación y esfuerzo en los artículos que hemos desarrollado juntas. Y a Ramón y José María, por su ayuda desinteresada, siempre dispuestos a echarme una mano, no solo en lo profesional, sino también en lo personal. Gracias, sobretodo, por esos momentos compartidos de alegrías, penas y risas, que sin duda han hecho estos años mucho más llevaderos. Agradecer también a mi familia en el sentido más amplio: mis padres, mis hermanas, cuñados y sobrinas. En especial a mi madre, por estar siempre a mi lado, por animarme a seguir adelante a pesar de las dificultades y por su disposición y ayuda incondicional en todo momento. Y a mis suegros, Alberto y Elena, por su dedicación y por estar siempre dispuestos a cuidar de mis hijos, permitiéndome perseverar en el esfuerzo y sacar adelante esta tesis y lo que verdaderamente importa. Y, por supuesto, quiero agradecer a mi pequeña familia, que ha crecido y se ha formado a lo largo de estos años. A Tillo, mi fiel compañero, por darme fuerzas para seguir siempre y estar a mi lado en cada paso de mi vida, en los buenos y en los malos momentos. Y a mis hijos, Ignacio y Javier, mis pequeños exploradores, por la vida y alegría que me regalan cada día, haciendo que todo el esfuerzo y las dificultades vividas siempre valgan la pena. Comencé la tesis con el nacimiento de mi sobrina mayor, Teresa, y empecé a escribirla con la llegada de mi última sobrina, Angelines, nuestro angelito, la más especial de todos los primos. Por eso, esta tesis no puede ir dedicada a nadie más que a los niños de mi casa, que han ido naciendo mientras todo esto se fraguaba, llenando nuestras vidas de alegría y poniéndolas patas arriba. A Teresa, Ana, Ignacio, Javier y Angelines, con todo mi cariño. Teresa Araúz Pisón Sevilla, 2025 I Abstract T he current interconnection of control architectures demands resilient control strategies capable of ensuring stability and performance under adversarial conditions. This doctoral thesis focuses on the cybersecurity of model-based control systems, particularly in networked environments, where cyber threats can significantly compromise system performance and safety. To this end, this thesis presents the fundamentals of cybersecurity resilient design in model-based control systems and introduces the concept of software rejuvenation in a predictive control setting. In particular, the contributions and results obtained in the published articles correspond to four key research directions: i) Cybersecurity in model predictive control (MPC): A comprehensive survey examines security risks in distributed MPC (DMPC) architectures, categorizing attack models, and proposing mitigation strategies to enhance their resilience. ii) Resilient PI controller design: A model-based approach using state-space techniques and LMIs is developed to enhance the robustness of PI controllers. iii) Stochastic MPC strategies: A tree-based MPC framework is introduced to explicitly integrate packet losses and jamming attacks into the control optimization process, ensuring robust system operation under adversarial conditions. iv) Software rejuvenation: This thesis extends the concept of software rejuvenation to predictive control, introducing openand closed-loop TBMPC strategies. Additionally, this thesis presents the manuscripts of the published and accepted articles that constitute the foundation of this research. Finally, the main findings and conclusions of this thesis are provided, along with possible future research directions. III Contents Abstract III List of Figures VII Glossary IX 1 Introduction and objectives 1 1.1 Cybersecurity in model-based control systems 3 1.1.1 Vulnerability sources 4 1.1.2 Types of cyberattacks 4 1.1.3 Cybersecurity strategies for model-based controllers 5 1.1.4 Cybersecurity and model-based control 6 1.2 Principal concepts of software rejuvenation 6 1.2.1 Origins and literature review 7 1.2.2 Modes of operation 8 1.2.3 Safe sets for software rejuvenation 8 1.3 Objectives 10 1.4 List of publications 11 1.5 Outline of the rest of this thesis 12 2 Summary of results and discussion 15 2.1 Cybersecurity and MPC 16 2.2 Resilient model-based PI controller design 19 2.2.1 Basic PI controllers design using LMIs 19 2.2.2 Design of PI controllers considering packet losses 24 2.3 Stochastic MPC for unreliable networks 25 2.3.1 Tree-Based MPC for jamming attacks 25 2.3.2 Enhanced tree-based MPC for packet losses and disturbances 28 2.4 Software rejuvenation strategies 30 2.4.1 A linear programming approach to computing safe sets for software rejuvenation 30 2.4.2 Open and closed-loop predictive control strategies for software rejuvenation 33 3 Publications 39 V 2Chapter 1. Introduction and objectives play an important role [4]. In particular, PI controllers are vulnerable to cyberattacks in which, for example, sensor are hijacked or communication links are disrupted, leading to poor control performance or system instability [13,23]. To address these vulnerabilities, researchers have explored various cyber-resilient PI control strategies, such as secure state estimation techniques and adaptive control strategies that dynamically adjust gains in response to detected anomalies [19,24]. Additionally, the integration of PI controllers with security mechanisms has demonstrated effectiveness in improving robustness against cyber threats [21,22]. To address these limitations, modern control architectures, such as MPC, provide advanced capabilities for optimization but also introduce new security challenges [14]. MPC is an optimization-based control strategy that determines control inputs by predicting the system evolution over a finite horizon. At each time step, MPC solves a constrained optimization problem to minimize a predefined cost function while ensuring that state and input constraints are satisfied [25,26]. This predictive approach allows the controller to anticipate disturbances and compensate for system uncertainties, making MPC widely used in applications such as industrial processes, energy networks, and autonomous systems [27, 28]. Furthermore, its flexibility in handling multivariable systems and constraints has established MPC as a preferred choice for complex CPS applications [29,30]. However, the reliance of MPC on real-time data exchange and iterative optimization increases its exposure to cyber threats, highlighting the need for secure control techniques [31,32]. Since MPC continuously updates its control actions based on state measurements, it is particularly vulnerable to cyberattacks where information is manipulated or network is disrupted, compromising the integrity and availability of control inputs [23,24]. To mitigate these risks, recent research has focused on attack-resilient MPC formulations that incorporate anomaly detection, robust optimization, and encrypted communication strategies [33,34]. These enhancements aim to preserve system stability and performance even in adversarial environments. Besides these strategies for enhancing cybersecurity in control systems, in this thesis we also focus on software rejuvenation as a particularly effective approach. Unlike traditional security mechanisms that rely on attack identification and classification, software rejuvenation proactively mitigates the effects of cyber threats by periodically resetting or restoring system components before faults accumulate or an attack fully compromises the system. Originally introduced in computing to counteract software aging [35], this concept has been extended to control systems to enhance resilience against cyberattacks [36]. The main idea is to periodically refresh the runtime control software with a secure copy to prevent persistent attacks from altering online execution [36,37]. Different implementations have been developed depending on the criteria used to determine the rejuvenation frequency: while some approaches rely on predefined time intervals based on system safety constraints [38], others adapt the refresh timing according to the duration of an effective cyberattack [39]. More advanced strategies consider robust formulations to account for uncertainties, disturbances, and sensor noise [40], and also optimize the number of reboots by evaluating potential attack consequences in real time [37]. Given its ability to handle various security threats without requiring previous attack detection or identification, software rejuvenation becomes as a promising solution for enhancing the security of networked control systems. 1.1 Cybersecurity in model-based control systems 3 Therefore, this thesis addresses the growing demand to improve the cybersecurity of modern control systems, especially in networked environments, where the presence of communication links exposes the system to external attacks that can significantly degrade performance and compromise system safety. To provide the necessary context, Section 1.1 introduces the main cybersecurity aspects relevant to model-based control systems. Section 1.2 focuses on software rejuvenation, a key concept in this thesis. Section 1.3 defines the objectives of this thesis, presenting the specific goals that guide the development of the proposed methodologies. Section 1.4 lists the publications derived from this research. Finally, Section 1.5 outlines the structure of the remaining chapters. 1.1 Cybersecurity in model-based control systems The increasing integration of control systems with communication networks has significantly enhanced their efficiency, scalability, and adaptability. However, this interconnection has also introduced new cybersecurity challenges that can compromise system performance, stability, and safety. Ensuring the security of model-based controllers, including MPC and other advanced control strategies, has become an essential research topic due to the growing sophistication and frequency of cyberattacks. Cyber threats in control systems can arise from different sources, including malicious external attackers, compromised network infrastructure, or even software vulnerabilities inherent to the control algorithms. These threats can have severe consequences, varying from performance degradation to catastrophic system failures in safety-critical applications. Thus, a comprehensive understanding of cybersecurity in control systems is necessary to develop effective defense mechanisms that ensure reliable operation even under adversarial conditions. In this context, the security of control systems is often defined in terms of [41]: • Confidentiality: it ensures that sensitive control data, such as system states, control commands, or operational parameters, remains protected from unauthorized access. This is particularly relevant in networked control systems, where information is transmitted over potentially insecure communication channels. • Integrity: it guarantees that system data, including sensor measurements and control actions, remains accurate and unaltered by malicious adversaries. Integrity is critical in model-based control systems, where control decisions depend on the accuracy of real-time data. • Availability: it ensures that control functionalities remain accessible and operational, even in the presence of cyberattacks. For example, jamming attacks specifically target availability by disrupting communications and preventing timely execution of control actions. Violation of any of these aspects can compromise system safety and performance. For instance, an attacker who gains access to control commands (confidentiality breach) could manipulate actuator signals (integrity breach); a well-coordinated cyberattack could also prevent a system from executing its tasks (availability breach). Therefore, security 4Chapter 1. Introduction and objectives strategies must address all three principles simultaneously to ensure the robustness of control systems under adversarial conditions. 1.1.1 Vulnerability sources Model-based control systems, particularly those operating in networked environments, are inherently vulnerable to cyber threats due to their reliance on real-time data exchange, communication infrastructure, and computational resources. These vulnerabilities can be categorized as follows: •Communication network vulnerabilities. Modern control systems rely on wired or wireless communication networks for data exchange between controllers, sensors, actuators, and supervisory systems. This interconnectivity makes them susceptible to cyber threats such as data interception, manipulation, and denial-of-service attacks. In distributed control schemes, such as Distributed Model Predictive Control (DMPC), where agents exchange optimization-related data to coordinate their decisions, malicious interference in communication can significantly affect overall system performance [23]. • Sensor and actuator tampering. Attackers can compromise sensors and actuators to inject false measurements or alter control signals, leading to incorrect decisions by the controller. For example, in an MPC framework, an adversary injecting erroneous sensor readings can mislead the optimization process, resulting in unsafe control actions [42]. • Software exploits and malware. Software-based vulnerabilities can be exploited to introduce malicious modifications in control algorithms, disable security mechanisms, or cause unexpected failures. Malicious software, such as ransomware, can make control systems inoperative by encrypting critical configuration files or corrupting system dynamics [13]. • Insider threats. Attackers with authorized access to the control system, such as compromised employees or external contractors, can manipulate operational parameters, disable security features, or extract confidential information. In distributed control architectures, insider threats can manipulate optimization constraints or cost functions to steer the system towards unsafe or inefficient configurations [43]. • Resource constraints in embedded controllers. Many industrial controllers have limited computational resources, which complicates the implementation of advanced encryption, intrusion detection, and real-time anomaly detection without impacting system performance. This limitation also makes them attractive targets for cyber adversaries [44]. These vulnerabilities demonstrate that ensuring control systems security requires a combination of protective strategies that address both physical and cyber-based threats. 1.1.2 Types of cyberattacks Cyberattacks on control systems can be classified based on their objectives and impact on system performance. The most common categories include: 1.1 Cybersecurity in model-based control systems 5 • Deception attacks: they focus on compromising the integrity of data exchanged within the control system. Their goal is to compromise the controller by injecting manipulated information into the system, leading to incorrect control decisions. Examples include: i) False Data Injection (FDI), where attackers modify sensor readings or state estimates to introduce deviations in the control process, e.g., to degrade controller performance or lead to unsafe operations [19]; ii) replay attacks, where an adversary records valid sensor data and replays it at a later time to deceive the controller into believing that the system is in a different state [42]; and iii) covert attacks, which are designed to remain undetected by traditional anomaly detection methods, e.g., without triggering security mechanisms [45]. • Disruption attacks: they focus on reducing system availability by interfering with network communications or computational resources. Some of the most relevant examples are: i) Denial-of-Service (DoS), where an attacker floods the network with excessive traffic, making it difficult for controllers to communicate with other system components [23]; ii) jamming attacks, where interference signals are generated to disrupt normal communication, preventing the transmission of control inputs or sensor measurements in wireless control networks [5]; and iii) exploiting packet losses: which consists of exploiting the compensation mechanisms to handle packet losses to systematically degrade control performance [6] • Insider and software-based attacks: unlike deception or disruption attacks, which primarily target data integrity and system availability, insider and software-based attacks exploit privileged access or software vulnerabilities to compromise control systems. These attacks can be particularly challenging to detect and mitigate, as they often bypass traditional security mechanisms. Sometimes, they come from individuals with legitimate access to the control system, such as employees, contractors, or compromised administrators, and may involve malicious manipulation of control parameters, optimization constraints, and security features to induce unsafe behavior. However, notice that insiders may also create security risks accidentally by improperly setting access controls or exposing sensitive information. Other times, these are software-based attacks that exploit vulnerabilities in control software, including firmware, middleware, and runtime environments, e.g., by i) malware injection into the control system, enabling persistent illicit access, unauthorized command execution, or disruption of control loops [13]; ii) corruption of the control logic, altering setpoints, safety constraints, or computational routines to induce performance degradation or system instability [44]; and iii) exploiting software aging, memory leaks or resource exhaustion, leading to performance degradation over time. Without cyber-defense strategies like software rejuvenation, these issues can remain undetected until they cause system failures [35]. 1.1.3 Cybersecurity strategies for model-based controllers To mitigate cybersecurity threats in model-based control systems, different defense mechanisms have been proposed in the literature. These strategies can be broadly classified into: 6Chapter 1. Introduction and objectives • Prevention mechanisms. They protect the control system before an attack occurs by reinforcing communication protocols, restricting access to system components, and designing robust control architectures. Key strategies include: i) secure communication protocols, such as end-to-end encryption and authentication methods (e.g., TLS and IEC 62443) [46] and must balance security and computational efficiency [13]; ii) zero-trust and access control policies to restrict unauthorized access [23] and block unauthorized attempts in industrial environments [19]; and iii) software hardening to restrict permissions, and strengthen execution environments by making periodic updates, integrity verification, and creating secure execution environments [43]. • Detection mechanisms. These methods identify anomalies and cyber threats in real-time by analyzing system behavior and network activity, and include i) anomaly detection systems such as support vector machines and recurrent neural networks to detect deviations in network traffic and sensor data [47], possibly comparing predicted and observed states [6]; ii) state estimation-based security, where observers such as Kalman filters and unknown input observers identify inconsistencies in system states [19], possibly aided by cross-verification of exchanged data [5]; and iii) intrusion detection systems, which analyze network traffic and can detect anomalies in control commands and process variables [44]. • Mitigation mechanisms. These strategies ensure that the system remains operational after an attack. These can be categorized into i) passive mitigation mechanisms based on fault-tolerant control, stochastic MPC [7], redundant control paths, graceful degradation techniques [47]; and ii) active mitigation mechanisms to adapt the control configuration dynamically in response to detected anomalies [44], and trigger attack-resilient estimation techniques [5], or periodical resets such as in software rejuvenation [7]. This is particularly relevant in networked MPC architectures, where undetected malware can degrade long-term performance. By integrating prevention,detection, and mitigation strategies, model-based control systems can achieve cyber resilience ensuring robust performance even under adversarial conditions. 1.1.4 Cybersecurity and model-based control During this thesis, a survey on cybersecurity in DMPC has been published, providing an indepth analysis of the security challenges, attack models, and defense mechanisms specific to this framework [48]. This work appears in Chapter 3 and complements the discussion presented in this section. Also, a summary of the main findings and contributions of the survey is presented in Section 2.1. 1.2 Principal concepts of software rejuvenation This section provides an overview of software rejuvenation, one of the main strategies analyzed in this thesis and the foundation of its most significant contributions [1,7,49]. As the primary cybersecurity approach explored in this work, software rejuvenation plays 1.2 Principal concepts of software rejuvenation 7 a crucial role in the proposed methodologies and key results, particularly in its integration with model-based control strategies. Given its relevance to the proposed methodologies, the following subsections present the key concepts underlying this technique. Specifically, this section covers its origins and relevant literature, the modes of operation that define its functioning, and the safe sets used to ensure system stability. Additionally, an illustrative example demonstrates its practical application, followed by a discussion on the types of cyberattacks it mitigates. While this section introduces the fundamental aspects of software rejuvenation, the detailed implementation and contributions of this thesis are presented in Section 2.4. 1.2.1 Origins and literature review Software rejuvenation is a proactive fault-tolerance technique originally introduced to mitigate software aging, which refers to the gradual degradation of software performance due to memory leaks, data corruption, and the accumulation of execution errors [35]. Initially developed to periodically restore the runtime code and data, software rejuvenation was designed to prevent failures caused by non-anticipated software states [35]. Over time, its role has expanded beyond reliability concerns, becoming a cybersecurity mechanism for protecting CPSs against stealthy and persistent cyberattacks that can compromise system integrity [37,39]. The fundamental principle of software rejuvenation is to periodically refresh the runtime control software with a trusted, secure copy, ensuring that malicious modifications are removed before they can cause lasting damage [50]. Since its beginnings, the concept has evolved significantly, with modern research focusing on optimizing the refresh timing to minimize system disruption while maximizing security. Recent advances define refresh frequencies based on the time that a system can remain safe during a cyberattack [38] or the duration before an attack becomes effective enough to compromise system stability [39]. Despite its advantages, frequent reboots can degrade control performance, requiring adaptive strategies to dynamically compute optimal rejuvenation intervals [37]. To improve security, [37] incorporates the hardware roots of trust, which are onboard security modules responsible for managing the secure execution interval. This interval is a period during which external communications are disabled to prevent potential cyber interference while the system reloads its secure software version. Additionally, a safety controller is activated after the software refresh to ensure that the system returns to a stable operational state before resuming normal control tasks. Another crucial aspect in this context is the computation of safe sets, which provide formal guarantees that the system remains within a defined operational boundary after a software refresh. Common approaches include defining robust invariant terminal sets and maximum safe initial sets [51]. However, computing these sets can be demanding, especially when using polytope-based formulations [52,53]. To address this, researchers have proposed simplified representations such as zonotopes [51] and ellipsoids [50]. Notably, these challenges align with advances in learning-based control, where efficient computation and robustness are key concerns [54,55]. In the literature, software rejuvenation has been explored as a cybersecurity strategy to enhance system resilience by integrating periodic software refresh mechanisms into 8Chapter 1. Introduction and objectives control architectures, ensuring protection against both known and stealthy cyber threats. For instance, Romagnoli et al. proposed a framework that protects cyber-physical systems against runtime code tampering by periodically updating the software with a clean, uncompromised version, ensuring security by disabling all external communications during the refresh process [56]. Furthermore, in [57], the same authors developed an invariant-setbased approach to determine the optimal rejuvenation intervals, ensuring that the system remains in a safe state even under undetectable attacks. These works demonstrate the potential of software rejuvenation as an effective defense mechanism against persistent cyber threats in control architectures. One of the contributions of this thesis lies in proposing the application of software rejuvenation in combination with MPC for the first time, integrating this cybersecurity strategy into advanced control frameworks to enhance system resilience against cyberattacks. The specific contributions in this direction are detailed in Section 2.4. 1.2.2 Modes of operation Software rejuvenation operates through specific operational modes that periodically reset system components to mitigate faults and performance degradation [50]. In this framework, the operation time is divided into three distinct modes: Mission Control (MC),Software Refresh (SR), and Safety Control (SC), which are active during TMC , TSR , and TSC time steps, respectively. Additionally, the uncertain control period (UC), denoted as TUC , includes both the software refresh and mission control modes. • Mission Control Mode: The system exchanges information through the network during the MC mode, presenting vulnerabilities that attackers could exploit to hijack the control signal, steering the system away from its goal. • Software Refresh Mode: SR takes place when the operating software is restored, eliminating possible modifications from cyber-attacks so that the system recovers its initial safe configuration. During this time, external communications are switched off and the actuators maintain the last control input provided during MC, which may be corrupted in case of attack. Therefore, it must be carefully designed to ensure system safety. • Safety Control Mode: This mode is activated before transferring control back to the mission controller in case the state is outside the safe set after the software refresh. The safety controller steers the state of the system back to the safe set while communications are still turned off. 1.2.3 Safe sets for software rejuvenation Safety conditions are defined by specifying two sets corresponding to different controllers, ensuring that the constraint sets within the system state space remain satisfied under all circumstances [50], such as it is illustrated in Figure 1.1: • Safe Set ( SS ): This set is the maximum set containing all admissible system states that comply with state and input constraints during the SC mode. 1.2 Principal concepts of software rejuvenation 9 Figure 1.1 Illustration of the software rejuvenation strategy in a networked control system under cyberattack, extracted from [1]. The figure depicts the system transition through different operational modes: the MC (blue solid line) executes normal control tasks while an adversary attempts to manipulate system behavior (red dashed line). At a scheduled SR event (gray dashed line), the system reloads a secure software version, eliminating malicious code, but the system is still driven by the attacker. Due to the system state is outside the Inner Safe Set (yellow region), the SC (green dotted line) drives the system back into that set before resuming normal operation. Once the system reaches the Inner Safe Set, it transitions back to MC, and the cycle repeats. • Inner Safe Set ( ISS ): This set is the subset of the Safe set that contains all admissible states during the MC mode. The ISS must satisfy the following safety conditions: 1. Containment: The system must remain within ISS during normal operation (MC mode). 2. Recovery Guarantee: the safety controller must be able to return the system from the Safe Set to this set in a bounded time. 3. Attack Resilience: The attacker should not be able to drive the system out to SS during the period of uncertain control. 4. Admissibility: ISS must be a subset of the set of admissible states for the MC mode (which is composed of all states that comply with both state and input constraints). These safe sets establish formal guarantees that the system remains within controlled limits even in the presence of adversarial perturbations. 10 Chapter 1. Introduction and objectives 1.3 Objectives The primary objective of this thesis is to develop model-based control strategies that improve the resilience of control systems against cyber threats and adversarial attacks. To this end, the research is structured around four key objectives: • Objective 1: Review of the state-of-the-art in cybersecurity for networked and distributed MPC. Cybersecurity has become a critical aspect of modern control applications, especially in networked and distributed MPC architectures. To guarantee the security of these controllers, a deep prior knowledge of both potential threats and possible resilient control strategies capable of mitigating their impact is necessary. Therefore, a detailed review of the state-of-the-art on cybersecurity for networked and distributed MPC has been carried out. This review examines key attack vectors, existing defensive approaches, and emerging strategies to enhance system security. The main findings of this analysis are presented in the survey [48], which provides a structured overview of the intersection between cybersecurity and advanced control techniques. • Objective 2: Design of resilient PI controllers against cyber threats. PI controllers are widely used in industrial applications due to their simplicity and effectiveness. They were developed in a time when cybersecurity concerns were not a primary consideration, and as a result, their classical tuning methods, such as the Ziegler-Nichols rules, do not explicitly incorporate resilience against cyberattacks. Given the increasing complexity of industrial control systems and their exposure to cyber threats, it is necessary to update their design to benefit from modern control methodologies. This thesis aims to enhance the PI controller design by employing state-space techniques that integrate robustness properties into the PI formulation. By incorporating these methods, the proposed approach improves the controller’s ability to withstand cyber-induced perturbations while maintaining stability and performance. The results of this objective are demonstrated in [2,4]. • Objective 3: Development of TBMPC for cyber-secure control. While PI controllers provide a basic level of resilience, more advanced control strategies, such as MPC, offer greater flexibility in handling uncertainties. However, conventional MPC approaches often rely on input buffers to manage communication delays or packet losses, a technique that has been extensively explored in the literature [25,26]. This thesis extends MPC-based security strategies by incorporating a tree-based predictive structure that accounts for multiple potential cyberattacks, including jamming attacks. In this way, instead of storing a single input sequence in the buffer, the proposed TBMPC framework generates and stores multiple possible control sequences in a tree structure. This allows the controller to dynamically adapt to network disruptions, increasing resilience against adversarial threats. The effectiveness of this approach has been validated in [5,6]. • Objective 4: Integration of software rejuvenation into TBMPC. Another key objective of this thesis is to adapt cybersecurity strategies from other domains to the field of control engineering, specifically, the software rejuvenation strategy into 1.4 List of publications 11 MPC controllers. Originally, software rejuvenation was developed in the 1990s to handle the software aging problem [35], and since then, it has been explored in various fields [36,58]. In particular, this thesis extends its application by integrating software rejuvenation within predictive control frameworks, representing the first attempt to combine both methodologies systematically. The proposed approach is detailed in [1,7,49]. • Objective 5: Validation and evaluation in realistic scenarios through simulations. The final objective of this thesis is to validate the proposed methods in realistic control scenarios, ensuring their applicability to practical CPS. This is achieved through simulations in two different environments: –The HyLab laboratory-scale microgrid, which is a domestic hydrogen-based renewable microgrid introduced in [59]. This testbed was originally designed to implement and analyze different operational modes and control strategies aimed at optimizing hydrogen-based smart grid performance. In our case, it provides a controlled environment for assessing cyber-attack resilience strategies in networked control systems. It represents the case study used in [1,7,49]. – Irrigation canal networks, which are large-scale hydraulic systems designed to distribute water efficiently for agricultural use. Given their interconnected nature and reliance on remote control, these systems are increasingly vulnerable to cyber threats that can disrupt water delivery and compromise infrastructure reliability. In particular, the ASCE Test Canal 1 introduced in [60,61] represents the case study in [2,4]. This test canal provides a standardized platform for evaluating control strategies under realistic conditions. In our simulations, we utilize the linear canal model proposed by [62]. The combination of these test scenarios ensures that the proposed security mechanisms are not only theoretically sound but also effective in real-world applications. 1.4 List of publications The works carried out for this thesis have originated the following publications. •Journal articles: 1. T. Arauz, J.M. Maestre, X. Tian, G. Guan, "Design of PI Controllers for Irrigation Canals Based on Linear Matrix Inequalities," Water, vol. 12, no. 3, pp. 855, 2020. [2] 2. T. Arauz, J.M Maestre, R. Romagnoli, B. Sinopoli, E.F. Camacho, "A Linear Programming Approach to Computing Safe Sets for Software Rejuvenation," IEEE Control Systems Letters, vol. 6, pp. 1214–1219, 2021. [1] 3. T. Arauz, P. Chanfreut, J.M. Maestre, "Cyber-security in networked and distributed model predictive control," Annual Reviews in Control, vol. 53, pp. 338–355, 2022. [48] 18 Chapter 2. Summary of results and discussion system objectives. Software-based attacks can introduce persistent threats that are difficult to detect and mitigate. To illustrate these attacks, the survey presents simulation results that demonstrate how different DMPC frameworks behave under adversarial conditions. Specifically, it evaluates the resilience of a dual-decomposition DMPC scheme under jamming attacks (Example 1), as well as the impact of false reference injections on cooperation-based DMPC (Example 2), following models from [65,66]. To mitigate cybersecurity risks in DMPC, various defense strategies have been proposed. The survey categorizes these into prevention, detection, and mitigation techniques: • Prevention mechanisms. These strategies aim to strengthen security before an attack occurs. Common techniques include encrypted communication protocols, secure consensus algorithms, and robust optimization techniques that improve resilience to adversarial disruptions. • Detection mechanisms. These focus on identifying cyberattacks in real time. Advanced anomaly detection systems use statistical models, machine learning, or state estimation techniques to identify deviations from normal system behavior. In particular, the survey discusses in Example 3 the learning-based detection mechanism introduced in [67], which employs historical data to detect network anomalies. • Mitigation mechanisms. When an attack is detected, mitigation strategies ensure system stability by adapting control actions. These strategies can be classified as passive or active. – Passive mitigation techniques focus on designing inherently robust controllers capable of maintaining stability despite attacks, without requiring real-time detection. Examples include fault-tolerant DMPC architectures and secure state estimation methods, which enhance resilience by ensuring that control actions remain stable under adversarial conditions. – Active mitigation strategies, on the other hand, dynamically adjust control actions in response to detected anomalies. These include neural network-based countermeasures, such as those proposed in [68], which use predictive models to compensate for compromised data. In particular, Example 4 in [48] illustrates the application of a neural network-based detection and compensation mechanism within a cooperative-based DMPC framework, highlighting its ability to mitigate the impact of cyberattacks on distributed controllers. Despite significant advancements in cyber-defense mechanisms for DMPC systems, several open challenges remain. One of the most pressing issues is the need for real-time detection and adaptive response strategies, as many existing methods rely on offline analysis and predefined attack models. Future efforts should focus on developing adaptive security frameworks capable of dynamically responding to emerging threats without compromising system performance. Additionally, integrating cyber-resilient control mechanisms directly into DMPC formulations is a crucial research direction. Ensuring that controllers remain robust against adversarial conditions while maintaining optimal decision-making 2.2 Resilient model-based PI controller design 19 under uncertainty would enhance the resilience of distributed control architectures. Another key challenge is scalability and computational efficiency. As DMPC is commonly applied to large-scale networked systems, cyber-resilient implementations must remain computationally feasible to be practical in real-world applications. The survey presented in [48] provides a structured analysis of these challenges, offering a comprehensive overview of vulnerabilities, attack strategies, and defense mechanisms in distributed predictive control. This work serves as a reference for researchers and practitioners working towards the development of more secure and resilient DMPC frameworks. 2.2 Resilient model-based PI controller design This section summarizes the works of [2,4] that propose two distinct algorithms based on LMIs. Both designs aim to make canal irrigation management more efficient and practical. In particular, the first article [2] solves an LMI-based optimal control problem to obtain a sparse feedback that provides the PI tuning. Moreover, the second algorithm, presented in [4], enhances the work in [2] by incorporating stability guarantees for systems with up to a specified maximum probability of packet losses. The next subsections summarize the main features of both LMI-based algorithms. 2.2.1 Basic PI controllers design using LMIs The article [2] presents a novel LMI-based methodology for tuning PI controllers with an application to irrigation canals. In particular, the work focuses on challenges in designing PI controllers for distributed systems and proposes an LMI-based approach that ensures optimal control performance by addressing these challenges. Irrigation canals are essential to efficiently distribute water as they represent approximately 85% of global water usage. Managing water levels and flow rates across interconnected canal pools requires effective control mechanisms. Here, PI controllers are broadly employed for their simplicity and adaptability. However, their tuning presents a significant challenge, often requiring a balance between performance, robustness, and practical implementation. Therefore, [2] proposes an efficient LMI-based method to tune PI controllers for irrigation canal systems. The proposed method incorporates: i) A sparse feedback design to minimize unwanted interactions between canal pools; ii) a centralized control strategy leveraging subsystem synergies; and iii) the ability to integrate constraints and handle uncertainties, improving robustness and reliability. This work also models the irrigation canal system as a series of interconnected subsystems, each representing a canal pool. The dynamics of each subsystem are described using a linearized model. The overall goal is to minimize a cost function that penalizes deviations in water levels and excessive gate movements. The LMI approach formulates the controller design as a convex optimization problem. Key steps include: • State and input mapping: A feedback matrix is designed to map system states to control actions under sparsity constraints, ensuring that not all state variables influence every control action. 20 Chapter 2. Summary of results and discussion • Stability and performance: System stability is ensured through the use of a Lyapunov function. The matrix inequalities derived ensure that the controller minimizes cost while maintaining stability. • Tuning flexibility: By adjusting the weighting matrices of the cost function, the controller allows trade-offs between water level stability and control effort. The proposed method is tested on the ASCE Test Canal 1, a standardized model frequently used to evaluate irrigation control algorithms. The model includes eight interconnected canal pools with gated controls. A simplified linear model of the canal (the Integrator-Delay model) is used for controller design, and simulations are conducted using Sobek software, which solves the full Saint-Venant equations for unsteady flow. In order to analyze its performance, three LMI-based PI tuning strategies are evaluated, each varying the weighting matrix for water level stability: LMI Method 1, where penalties are manually adjusted through trial and error; LMI Method 2, with penalties proportional to the length of each canal section; and LMI Method 3, with penalties proportional to the backwater surface area of each canal section. Furthermore, this work compares these controllers with the four PIF controllers presented by [3]. Figures 2.1 and 2.2 illustrate the results for the LMI and PIF controllers, respectively. As can be shown in all Figures and Tables of [2], the LMI-based controllers consistently outperform PIF controllers: • LMI methods achieve lower maximum error values, demonstrating improved accuracy in maintaining desired water levels. • LMI controllers recover faster from disturbances, highlighting their robustness under variable conditions. • LMI methods reduce the magnitude of deviations during failures, improving overall reliability in failure scenarios. Among the three LMI-based PI tuning strategies considered, the third strategy achieves the best overall performance, balancing error reduction and recovery speed. In contrast, the first controller provides the fastest disturbance recovery, although it leads to slightly higher errors. The second method offers intermediate performance, making it suitable for general applications. To sum up, the key advantages of the LMI approach presented in [2] are: • Centralized design: by considering the entire canal system, the method avoids local optima and exploits inter-pool synergies. • Sparsity constraints: the feedback matrix ensures that each controller focuses on relevant states, minimizing complexity and mitigating conflicts between controllers. • Robustness: the framework naturally handles uncertainties and disturbances, enhancing adaptability to practical operational scenarios. 2.2 Resilient model-based PI controller design 21 (a) LMI Method 1. (b) LMI Method 2. (c) LMI Method 3. Figure 2.1 Simulation results of the test in the non-linear canal model presented in [2] for the three LMI-based PI tuning strategies. 22 Chapter 2. Summary of results and discussion (a) PIF Method 1. (b) PIF Method 2. Figure 2.2 Simulation results of the test in the non-linear canal model presented in [2] for the PIF methods [3]. 2.2 Resilient model-based PI controller design 23 (Figure 2.2 continued) (c) PIF Method 3. (d) PIF Method 4. Figure 2.2 (c) and (d). 24 Chapter 2. Summary of results and discussion 2.2.2 Design of PI controllers considering packet losses The article [4] offers an improved approach for irrigation canal control in unreliable communication networks. The earlier article [2] presented an PI controller design using LMIs, but without considering network imperfections like packet losses. Thus, this new contribution enhances the model by adding resilience to packet losses, improving both reliability and system stability. Irrigation systems are essential for global agriculture, but their efficiency is often challenged by infrastructural and communication flaws, particularly in CPSs. These systems integrate computing resources with physical processes, making them vulnerable to network disruptions. The previous work [2] highlighted the effectiveness of PI controllers designed using LMIs for stable canal management, although it assumed ideal communication conditions. Given the increasing threat of cybersecurity incidents and natural packet losses due to unreliable transmissions, the development of robust controllers has become increasingly important. This work [4] addresses these challenges by proposing a model capable of maintaining system stability even under significant packet loss, thereby enhancing the practical applicability of the PI control methodology. This improvement is achieved by extending the LMI constraints from [2] with additional conditions from [64] to account for packet losses. In particular, the main innovations of [4] over the previous algorithm of [2] are: • Packet loss consideration: While the method of [2] optimizes controllers without accounting for network reliability, the new design of [4] introduces a probabilistic Bernoulli model to represent packet loss scenarios. This probabilistic approach ensures that the controller maintains performance up to a specified maximum packet loss probability. • Stability guarantees with LMIs: The enhanced design integrates additional LMI constraints to ensure stability despite unreliable communication. The method calculates feasible solutions iteratively, adjusting some particular parameters to maintain performance despite high packet loss probabilities (up to 60%). • Centralized vs. decentralized design: Unlike earlier work of [2], that focuses on centralized control assumptions, the current model of [4] adapts to local variations while preserving centralized coordination. This allows for independent handling of packet losses by each canal section, thereby reducing interdependency risks. In [4], three different controllers are compared under various conditions: i) the proposed packet loss tolerant PI controller, designed with robustness against up to 60% packet loss; ii) the standard PI controller of previous work [2]; and iii) the PIF controller of [3] that presents the best performance of all methods presented in that article. The comparison between the three controllers is accomplished in [4] by simulating three different scenarios: with no packet losses, with 30% probability of packet losses and with 60% probability. The test simulated in [4] is the same as in [2]. Here, only the results of the simulations with a 60% packet loss probability are shown in Figure 2.3. However, the complete set of results is illustrated in the figures and tables in [4]. Next, a summary of their discussion is provided: 2.3 Stochastic MPC for unreliable networks 25 • No packet loss: In ideal conditions, where there are no losses, the previous PI controller of [2] presents the best performance, outperforming the new design of [4]. The latter presents the softest response due to it has been designed considering packet losses. •30% Packet loss: The standard PI controller of [2] exhibits significant degradation, with increased errors and instability. However, the proposed design of [4] maintains consistent performance, demonstrating superior resilience. The PIF controller handles moderate packet loss but exhibits reduced stability compared to the proposed method. •60% Packet loss: Under severe conditions, the PI controller of [2] fails, with errors increasing significantly. Although the PIF controller performs better, it still experiences considerable deviations. In contrast, the proposed design of [4] maintains system integrity, effectively controlling water levels with minimal increase in errors. Therefore, this work [4] represents a significant improvement over the previous PI design of [2] by addressing the critical challenge of network reliability. By incorporating packet loss resilience through advanced LMI constraints, the new method ensures robust performance and stability, even under severe communication faults. This advancement makes it a useful tool for modern irrigation canal management, enhancing both efficiency and sustainability in water resource utilization. 2.3 Stochastic MPC for unreliable networks In this section, papers [5] and [6] are presented. The first paper [5] introduces a novel TBMPC approach to address cybersecurity threats, specifically focusing on jamming attacks in networked control systems. The second article, [6], presents an enhanced version of the previous TBMPC approach [5] by incorporating robustness against both packet losses and external disturbances simultaneously, using a multi-scenario stochastic framework. 2.3.1 Tree-Based MPC for jamming attacks The paper [5] presents a TBMPC strategy to face packet losses due to jamming attacks. Unlike traditional MPC methods, this new framework enhances system robustness by anticipating potential packet losses and pre-computing control sequences for various loss scenarios. By organizing these sequences into a tree structure, the controller dynamically adapts to real-time conditions, ensuring stability and performance even under significant communication disruptions. Networked control systems depend on stable communication between components; however, wireless networks face vulnerabilities such as interference and jamming attacks, which risk performance and stability. Although previous research has focused on designing robust controllers to address these challenges, traditional MPC strategies often assume ideal communication conditions, reducing their practicality in real-world applications. MPC is a widely used control strategy that optimizes future control actions based on system models and constraints. It computes a sequence of inputs to minimize a cost function 26 Chapter 2. Summary of results and discussion (a) PI controller of [4]. (b) PI controller of [2]. (c) PIF controller of [3]. Figure 2.3 Simulation results of the test in the non-linear canal model with 60% of packet loss presented in [4] for the designed PI controller of [4], the PI controller of [2] and the PIF controller of [3]. 2.3 Stochastic MPC for unreliable networks 27 over a prediction horizon. However, standard MPC implementations struggle with packet losses because they rely on continuous feedback. When data packets are lost, the system might receive delayed or partial information, resulting in reduced performance or potential instability. Previous efforts to address this issue include deterministic controllers with input buffers and stochastic MPC formulations that incorporate packet loss probabilities into the cost function. Although these approaches improve resilience, they often fail to perform effectively in highly uncertain scenarios, such as coordinated jamming attacks. The proposed TBMPC method overcomes these limitations by considering all possible packet loss scenarios within the prediction horizon, allowing the controller to successfully adapt to disruptions. The main innovation of TBMPC lies in its tree structure, which maps all possible communication scenarios. Each branch of the tree corresponds to a different packet loss pattern, and each node represents a control action. By evaluating the system’s evolution under each scenario, the controller selects the optimal sequence of actions based on a weighted cost function. The key features of the TBMPC framework presented in [5] are: •The system is modeled using a discrete-time state-space representation. • Packet losses are modeled using a Bernoulli process, with each packet having a probability of being lost. This probabilistic framework allows the controller to anticipate disruptions and adjust its strategy accordingly. • The prediction horizon is divided into time steps, and each step is branched into two possible outcomes: successful transmission or packet loss. This branching results in a binary tree with 2N−1possible scenarios for a prediction horizon of length N. • To ensure the controller does not anticipate future packet losses, non-anticipativity constraints are imposed, requiring control actions at each node to be consistent with the information available at that time. • The objective of TBMPC is to minimize the expected value of a cost function that includes state deviations and control efforts. • The optimization problem ensures that control inputs respect system constraints while minimizing the expected cost. To demonstrate the effectiveness of TBMPC in [5], the method was applied to a cartpendulum system, a common benchmark in control theory. In addition, two different strategies are tested for the input signal in case of packet loss: a zero input is applied to the system, or the corresponding element of the last input sequence successfully received is applied instead. The simulation compares TBMPC with standard MPC under different packet loss scenarios: •Results without packet loss: In the absence of packet losses, the TBMPC and standard MPC perform identically, both achieving quick stabilization of the pendulum. This result confirms that TBMPC does not introduce unnecessary complexity or performance degradation when communication is reliable. 34 Chapter 2. Summary of results and discussion and SR periods. This ensures that control actions are optimized for both immediate and long-term objectives. The prediction horizon incorporates the probability of cyberattacks during MC and integrates the fixed duration of SR actions to ensure continuity and system stability. • Tree-based structure: A key feature of the framework is its tree-based structure, which models all possible attack scenarios over the prediction horizon. Each scenario is associated with a probability, which is used to calculate the expected cost and guide optimal decision-making. Each branch corresponds to a distinct sequence of attack and recovery events, enabling the controller to evaluate various pathways simultaneously. This structure allows the system to anticipate disruptions and adjust control actions accordingly, enhancing its resilience to cyberattacks. • Non-anticipatory constraints: To maintain causality, the control actions across different scenarios must align until the corresponding divergence point of the tree. These constraints reduce the number of decision variables, simplifying the optimization problem while maintaining precision. • Cost function: The cost function balances multiple objectives, including minimizing state deviations, control effort, and recovery time. By assigning weights to these objectives, the controller can prioritize the goals based on operational needs. In addition, the probabilistic nature of attacks is introduced into the cost function, ensuring that the optimization process accounts for the likelihood and impact of each scenario. •Open-loop predictive control strategy: This approach builds on the findings of our previous articles [5,6,49], and computes control actions over a fixed prediction horizon, considering predefined probabilities of potential cyberattacks. Based on how uncertain variables are managed, three different configurations are established: – Open-Loop Worst-Case Min-Max TBMPC (OL-WmmTBMPC): Focused on robustness, this configuration computes control actions under the assumption of the worst-case attack scenario, i.e., both attacks and disturbances are considered as uncertain. Therefore, this is the most conservative approach. – Open-Loop Min-Max TBMPC (OL-mmTBMPC): This configuration considers attacks as an uncertain variable and forecast of disturbances (external disturbances set as their mean observed values). – Open-Loop TBMPC (OL-TBMPC): A baseline configuration that precomputes control actions based on nominal conditions, without explicitly accounting for worst-case scenarios, i.e., considering disturbance and attack forecast (external disturbances set as their mean observed values and no attacks). • Closed-loop predictive control strategy: The Closed-Loop TBMPC (CL-TBMPC) is based on the methodology presented in [71]. This approach employs disturbance feedback parameterization, which means that the control policy is defined as an affine function of the sequence of past disturbances within the prediction horizon. However, this strategy is adapted in [7] to the tree-based framework that includes 2.4 Software rejuvenation strategies 35 both sources of uncertainty: external disturbances and attacks. Further details are provided in Section III-B and the Appendix of [7]. The article [7] evaluates these strategies through simulations conducted on the labscale HyLab microgrid [70], which was previously used in other software rejuvenation works [1,49]. The configuration of the software rejuvenation set-up is computed using the basic algorithm outlined in [1], and the corresponding LQR controller for MC is also included for comparative analysis. Four scenarios are analyzed based on the probability of attack: 0% , 25% , 50% , and 75% . And three distinct types of attack are defined regarding the attacker’s performance: •Attack Case 1: The attacker sets the input signals to their maximum values. • Attack Case 2: The attacker disables the actuators by setting the input signals to zero. • Attack Case 3: The attacker replays the last input signal applied by the MC controller. To evaluate the performance of the different mission controllers, some performance indicators are calculated: the accumulated cost, the number of instants where the SC is activated, and the total number of attacks experienced. For the three scenarios that involve attacks, the results are presented as the mean value with the standard deviation shown in brackets. Each case is based on a set of 1,000 simulations. The complete results are summarized in Table 2.1. Finally, Figure 2.7 shows an interval of 30 time instants ( 15 min) of the simulations performed with 25% of probability of attacks and attack case 1 ( uAtt =umax ) using the LQR, the OL-mmTBMPC, and the CL-TBMPC as mission controllers. The simulation results highlight the strengths and weaknesses of each strategy: • The CL-TBMPC consistently outperforms all open-loop configurations and the LQR-based controller in terms of recovery time and cost efficiency, especially under high-intensity attacks (Attack Case 3). • Among the open-loop configurations, OL-mmTBMPC achieves the best balance between performance and operational cost, whereas OL-WmmTBMPC prioritizes robustness, resulting in increased costs. • The LQR controller performs effectively in low-intensity attack scenarios. However, it struggles to maintain stability and incurs higher operational costs under more severe conditions. In conclusion, this article [7] highlights the benefits of closed-loop TBMPC in addressing the challenges of cyberattacks in software rejuvenation strategies. The three open-loop configurations offer alternative approaches, with OL-mmTBMPC being particularly effective for applications that prioritize reduced computational complexity. As demonstrated, CL-TBMPC achieves moderate improvements compared to the baseline LQR mission controller, providing a simpler setup for software rejuvenation parameters but requiring more intensive online computations. In addition, recursive feasibility is readily ensured within this framework, as state constraints are managed by the safety controller and the periodic software refresh mechanism. 36 Chapter 2. Summary of results and discussion (a) LQR mission controller. (b) OL-mmTBMPC mission controller. Figure 2.7 Simulation results of the test in the lab-scale microgrid HyLab system presented in [7], with a probability of attacks of 25% during 15 minutes, using four different mission controllers. 2.4 Software rejuvenation strategies 37 (Figure 2.7 continued) (c) CL-TBMPC mission controller. Figure 2.7 (c). 38 Chapter 2. Summary of results and discussion Table 2.1 Values of 1000 simulations with varying attack probabilities presenting the mean values and, in brackets, the corresponding standard deviation. MC Controller Cost (104) Instants of SC # Attacks Cost (104) Instants of SC # Attacks Cost (104) Instants of SC # Attacks Attack Probability 0% LQR 0.26 0.00 0 – – – – – – OL-TBMPC 0.26 0.00 0 – – – – – – OL-mmTBMPC 0.26 0.00 0 – – – – – – OL-WmmTBMPC 0.71 0.00 0 – – – – – – CL-TBMPC 0.25 0.00 0 – – – – – – Attack Case 1 Attack Case 2 Attack Case 3 Attack Probability 25% LQR 5.84 (1.43) 38.42 (12.67) 21.45 (3.62) 0.37 (0.04) 0.00 (0.00) 23.93 (4.37) 0.26 (0.00) 0.00 (0.00) 23.93 (4.37) OL-TBMPC 5.84 (1.45) 40.92 (12.67) 21.28 (3.56) 0.36 (0.04) 0.01 (0.13) 23.93 (4.37) 0.26 (0.01) 0.00 (0.09) 23.93 (4.37) OL-mmTBMPC 6.12 (1.49) 41.88 (12.80) 21.23 (3.55) 0.42 (0.05) 0.01 (0.13) 23.93 (4.37) 0.32 (0.02) 0.01 (0.13) 23.93 (4.37) OL-WmmTBMPC 7.25 (1.53) 55.50 (11.58) 20.30 (3.47) 0.93 (0.09) 3.53 (2.64) 23.83 (4.32) 0.81 (0.07) 3.12 (2.75) 23.83 (4.35) CL-TBMPC 5.70 (1.39) 40.57 (12.46) 21.32 (3.58) 0.35 (0.04) 0.00 (0.00) 23.93 (4.37) 0.25 (0.00) 0.00 (0.00) 23.93 (4.37) Attack Probability 50% LQR 13.65 (2.26) 79.15 (12.70) 37.52 (3.63) 0.58 (0.10) 0.13 (0.66) 48.03 (5.19) 0.26 (0.00) 0.00 (0.00) 48.03 (5.19) OL-TBMPC 13.26 (2.22) 83.24 (11.93) 37.00 (3.50) 0.54 (0.10) 0.11 (0.59) 48.03 (5.19) 0.25 (0.02) 0.10 (0.78) 48.02 (5.18) OL-mmTBMPC 13.85 (2.18) 85.92 (11.94) 36.66 (3.48) 0.72 (0.12) 0.56 (1.29) 48.02 (5.18) 0.40 (0.04) 0.10 (0.72) 48.02 (5.19) OL-WmmTBMPC 14.80 (2.20) 93.41 (9.89) 35.67 (3.60) 1.20 (0.12) 7.17 (2.80) 47.32 (5.01) 0.92 (0.12) 2.93 (2.88) 47.85 (5.16) CL-TBMPC 13.10 (2.20) 83.12 (11.84) 37.03 (3.50) 0.56 (0.10) 0.11 (0.61) 48.03 (5.19) 0.25 (0.00) 0.00 (0.00) 48.03 (5.19) Attack Probability 75% LQR 23.05 (2.43) 111.19 (8.41) 50.00 (2.79) 1.05 (0.19) 3.35 (2.83) 71.76 (3.98) 0.28 (0.03) 0.38 (2.03) 72.01 (4.12) OL-TBMPC 22.22 (2.50) 114.62 (7.16) 49.32 (2.67) 0.96 (0.19) 2.37 (2.50) 71.90 (4.05) 0.32 (0.10) 5.25 (7.08) 71.24 (3.73) OL-mmTBMPC 22.81 (2.41) 116.33 (6.83) 48.97 (2.75) 1.22 (0.18) 5.38 (3.19) 71.36 (3.88) 0.52 (0.10) 0.49 (1.78) 72.02 (4.17) OL-WmmTBMPC 23.54 (2.32) 118.24 (5.90) 48.58 (2.88) 1.50 (0.14) 11.77 (2.41) 69.85 (3.92) 1.01 (0.21) 2.46 (4.16) 71.76 (4.10) CL-TBMPC 22.15 (2.49) 114.81 (7.03) 49.28 (2.68) 1.03 (0.19) 2.87 (2.66) 71.83 (4.01) 0.29 (0.06) 1.34 (3.75) 71.88 (4.00) 3 Publications The content of this chapter has been omitted for copyright reasons. Instead, we provide a list of the publications included in this thesis, along with their DOI and a summary of their content, which is presented in the different sections of Chapter 2. •Block 1: Cybersecurity and MPC (Section 2.1). 1. T. Arauz, P. Chanfreut, J.M. Maestre, "Cyber-security in networked and distributed model predictive control," Annual Reviews in Control, vol. 53, pp. 338–355, 2022. [48] DOI: 10.1016/j.arcontrol.2021.10.005 Summary: Section 2.1 •Block 2: Resilient model-based PI controller design (Section 2.2). 2. T. Arauz, J.M. Maestre, X. Tian, G. Guan, "Design of PI Controllers for Irrigation Canals Based on Linear Matrix Inequalities," Water, vol. 12, no. 3, pp. 855, 2020. [2] DOI: 10.3390/w12030855 Summary: Section 2.2.1 3. T. Arauz, J.M. Maestre, A. Cetinkaya, E.F. Camacho, "Model-based PI design for irrigation canals with faulty communication networks," 2021 European Control Conference (ECC), pp. 1236–1242, 2021. [4] DOI: 10.23919/ECC54610.2021.9655060 Summary: Section 2.2.2 •Block 3: Stochastic MPC for unreliable networks (Section 2.3). 4. T. Pierron, T. Arauz, J.M. Maestre, A. Cetinkaya, C. Stoica Maniu, "TreeBased Model Predictive Control for Jamming Attacks," 2020 European Control Conference (ECC), pp. 948–953, 2020. [5] DOI: 10.23919/ECC51009.2020.9143814 Summary: Section 2.3.1 39 40 Chapter 3. Publications 5. T. Arauz, J.M. Maestre, A. Cetinkaya, C. Stoica Maniu, "A Tree-Based Multi-Scenario Approach to Networked MPC under Packet Losses and Disturbances," IFAC-PapersOnLine, vol. 55, no. 16, pp. 296–301, 2022. [6] DOI: 10.1016/j.ifacol.2022.09.040 Summary: Section 2.3.2 •Block 4: Software rejuvenation strategies (Section 2.4). 6. T. Arauz, J.M Maestre, R. Romagnoli, B. Sinopoli, E.F. Camacho, "A Linear Programming Approach to Computing Safe Sets for Software Rejuvenation," IEEE Control Systems Letters, vol. 6, pp. 1214–1219, 2021. [1] DOI: 10.1109/LCSYS.2021.3090448 Summary: Section 2.4.1 7. T. Arauz, J.M. Maestre, D. Quevedo, E.F. Camacho, "Tree-based Model Predictive Control Strategy for Software Rejuvenation," 2022 IEEE 61st Conference on Decision and Control (CDC), pp. 1124–1129, 2022. [49] DOI: 10.1109/CDC51059.2022.9993366 Summary: Section 2.4.2 8. T. Arauz, J.M. Maestre, P. Chanfreut, D.E. Quevedo, E.F. Camacho, "Open and closed-loop predictive control strategies for software rejuvenation," IEEE Transactions on Emerging Topics in Computing, 2024. [7] DOI: 10.1109/TETC.2024.3481997 Summary: Section 2.4.2 4 Conclusions and future research directions H istorically, most industrial control systems were designed as isolated, independent units operating in physically secure environments with limited external interaction. However, the extended adoption of networked control architectures, together with the progressive integration of advanced computing and communication technologies, has dramatically increased the potential attack surface of these systems. Modern CPS rely on real-time data exchange between distributed components, remote access capabilities for monitoring and maintenance, and cloud-based infrastructures for data storage and processing. While these features offer undeniable benefits in terms of operational efficiency and flexibility, they also introduce numerous possibilities for malicious actors. The growing number of documented cyberattacks targeting critical infrastructures in sectors such as energy, water management, transportation, and manufacturing highlights the real and immediate threat posed by these vulnerabilities. Attacks on control systems have become real dangers with documented impacts on the economy, the environment, and operational safety. Moreover, the evolution of attack strategies, including the use of stealthy, persistent techniques specifically designed to bypass traditional detection mechanisms, further complicates the task of securing these systems. This situation is aggravated by the fact that many of the control architectures currently in operation were developed decades ago, before cybersecurity was considered a design requirement. As a result, much of the industrial control infrastructure in operation today lacks basic security measures, leaving it highly exposed to cyberattacks. The challenges posed by this context are further amplified when considering the high specificity of cyberattacks targeting control systems. Unlike conventional attacks on information systems, which typically focus on disrupting services or stealing data, attacks on control systems aim to manipulate the physical process, gradually altering its behavior to degrade performance, create unsafe conditions, or even cause complete failures. This dual nature, which combines cyber manipulation with physical consequences, makes the development of universal defense mechanisms extremely difficult. Effective cybersecurity for control systems therefore requires a multidisciplinary approach, capable of addressing both the inherent vulnerabilities of control algorithms and the communication and software infrastructures on which they rely. This thesis addresses precisely this need, focusing on improving the resilience of modelbased control systems against cyber threats through the integration of security-aware 41 42 Chapter 4. Conclusions and future research directions design methodologies. The work has tackled this challenge from a broad perspective, covering both conventional control strategies, such as PI controllers widely used in industry, and more advanced approaches like predictive control, particularly in networked and distributed settings. In both cases, the proposed methodologies aim to explicitly account for the presence of cyber threats, ensuring that the designed controllers not only meet performance requirements under nominal conditions, but also maintain their ability to operate safely and reliably in adversarial environments. In the case of PI controllers, which remain the most common control solution in industrial applications, this thesis has demonstrated how a model-based design approach using state-space techniques and LMIs can be applied to enhance their robustness against cyberinduced disturbances. Despite their extensive use in industrial processes, PI controllers are still predominantly designed using classical tuning methods, such as the Ziegler-Nichols rules, which do not explicitly account for cyber threats. This thesis addresses this limitation by incorporating robustness properties directly into the controller design, ensuring that the resulting PI controllers are not only capable of maintaining performance under nominal conditions, but also withstand communication faults, packet losses, and cyber-induced perturbations that typically arise in networked environments. These contributions combine the simplicity and familiarity of PI controllers with the robustness benefits derived from modern control design techniques. Therefore, they provide a practical and effective way to upgrade existing industrial control systems to address the cybersecurity challenges associated with interconnected infrastructures. Furthermore, this result highlights that even well-established control techniques, developed decades ago, can be adapted and enhanced to incorporate resilience properties, demonstrating that traditional control solutions can evolve to meet modern security requirements, as shown in [2,4]. For more advanced control architectures, this thesis has focused on MPC, a strategy that inherently offers considerable flexibility to handle uncertainties and operational constraints, but also introduces specific vulnerabilities due to its reliance on real-time data exchange and iterative optimization processes. While PI controllers provide a basic level of resilience, MPC controllers enable a more explicit consideration of adversarial scenarios by embedding potential disturbances and network-induced issues directly into the optimization formulation. To enhance the robustness of predictive control in networked environments, this thesis proposes a new class of cyber-resilient predictive controllers, built on tree-based MPC formulations. They explicitly account for potential network disruptions, including packet losses and jamming attacks, by generating a tree of possible control sequences that reflects the range of feasible scenarios the system could deal with. This enables the controller to dynamically adapt its actions as the actual communication conditions unfold. Unlike conventional MPC strategies, which primarily rely on input buffers or conservative constraints to mitigate the impact of delays and packet losses, the proposed approach offers a more flexible and adaptive response, anticipating adversarial scenarios and embedding this awareness directly into the optimization process. The results presented in [5,6] demonstrate the effectiveness of this strategy, which builds upon and extends previous approaches that focused on compensating for communication delays, now incorporating a broader view that considers both stochastic disturbances and adversarial interference. 4.1 Future research 43 The most innovative contribution of this thesis lies in the integration of software rejuvenation techniques into predictive control frameworks, representing a novel approach to improving the cybersecurity of networked control systems. Originally developed in the computing field to address software aging, software rejuvenation was designed to periodically reset the runtime software, eliminating accumulated errors, resource leaks, or unintended modifications. This thesis extends that concept and adapts it to the specific requirements of control systems operating in adversarial environments, using software rejuvenation as a proactive cybersecurity mechanism. By periodically restoring the control software to a secure state, the system can effectively remove any stealthy modifications introduced by undetected cyberattacks that target the runtime code. A key contribution of this work is the direct incorporation of scheduled software refreshes into the predictive control formulation, ensuring that both the timing of these events and their potential impact on the system dynamics are explicitly considered during the optimization process. This combination between software rejuvenation and TBMPC allows the controller to anticipate and plan around software resets, ensuring smooth transitions between operational modes and maintaining system stability and performance even when operating under adversarial conditions. The effectiveness of this strategy has been demonstrated in [1,7,49], where its ability to mitigate hijacking-based attacks and persistent stealthy threats in networked control systems has been validated. Together, these contributions represent a comprehensive and coherent set of methodologies that advance the state-of-the-art in cybersecurity for model-based control systems. By combining improved design methods for conventional PI controllers, cyber-resilient predictive control strategies, and the integration of software rejuvenation into predictive control frameworks, this thesis provides practical tools and theoretical foundations to enhance the cybersecurity of modern control systems. These results not only address current challenges, but also lay the groundwork for future research efforts aimed at developing increasingly adaptive, intelligent, and resilient control architectures capable of operating safely in the face of evolving cyber threats. 4.1 Future research Although this thesis provides advances in the field of cyber-secure control, several open research questions remain. Future work should aim to further explore and enhance the methodologies proposed here, addressing several key aspects that could expand both the applicability and effectiveness of the proposed approaches in the following areas: • Invariant set computation for software rejuvenation. One relevant research direction concerns the computation of invariant sets for software rejuvenation strategies. In Chapter 3 [1], a LP approach was used to compute the minimal invariant set, ensuring that system constraints were satisfied after each software refresh. This set plays a crucial role in guaranteeing that the system always returns to a safe state following a software rejuvenation event. However, the computation of the maximal invariant set, which would enlarge the set of states from which safe recovery is guaranteed, remains an open challenge. This extension could exploit the periodic nature of software rejuvenation to reformulate the control problem as a periodic 50 Bibliography [38] L. Aung, Y. Xin, D. Han, K. Vaidyanathan, and K. S. Trivedi, “Software rejuvenation: Towards proactive fault management,” Journal of Systems and Software, vol. 76, no. 1, pp. 3–22, 2004. [39] P. Arroyo, J. Cuellar, and A. F. Skarmeta, “Fired: A framework for attack detection in industrial control systems,” Computers & Security, vol. 73, pp. 274–295, 2017. [40] R. Romagnoli, J. M. Maestre, and E. F. Camacho, “Robust control strategies for resilient cyber-physical systems under cyber-attacks,” Control Engineering Practice, vol. 102, p. 104556, 2020. [41] N. Zeldovich, Computer Systems Security. MIT OpenCourseWare, 2014. [42] Y. Mo and B. Sinopoli, “Secure control against replay attacks,” Proceedings of the 47th Annual Allerton Conference on Communication, Control, and Computing, 2009. [43] A. Humayed, J. Lin, F. Li, and B. Luo, “Cyber-physical systems security—a survey,” IEEE Internet of Things Journal, vol. 4, no. 6, pp. 1802–1831, 2017. [44] R. F. Ali, A. Muneer, P. D. Dominic, E. A. Ghaleb, and A. Al-Ashmori, “Survey on cyber security for industrial control systems,” in 2021 International Conference on Data Analytics for Business and Industry (ICDABI). IEEE, 2021, pp. 630–634. [45] R. Smith, “Decoupled networks: A covert channel architecture,” Proceedings of the 2011 ACM Workshop on Privacy in the Electronic Society, 2011. [46] H. Sandberg, A. Teixeira, and K. H. Johansson, “Cyberphysical security in control systems,” IEEE Control Systems Magazine, 2015. [47] F. Boem, D. M. Raimondo, and T. Parisini, “Secure state estimation and control of cyber-physical systems,” IEEE Transactions on Automatic Control, 2019. [48] T. Arauz, P. Chanfreut, and J. Maestre, “Cyber-security in networked and distributed model predictive control,” Annual Reviews in Control, vol. 53, pp. 338–355, 2022. [49] T. Arauz, J. M. Maestre, D. Quevedo, and E. F. Camacho, “Tree-based model predictive control strategy for software rejuvenation,” in 2022 IEEE 61st Conference on Decision and Control (CDC). IEEE, 2022, pp. 1124–1129. [50] R. Romagnoli, B. H. Krogh, and B. Sinopoli, “Design of software rejuvenation for cps security using invariant sets,” in 2019 American Control Conference (ACC). IEEE, 2019, pp. 3740–3745. [51] F. Gruber and M. Althoff, “Computing safe sets of linear sampled-data systems,” IEEE Control Systems Letters, vol. 5, no. 2, pp. 385–390, 2020. [52] S. V. Rakovic, E. C. Kerrigan, K. I. Kouramas, and D. Q. Mayne, “Invariant approximations of the minimal robust positively invariant set,” IEEE Transactions on automatic control, vol. 50, no. 3, pp. 406–410, 2005. Bibliography 51 [53] S. V. Raković, B. Kouvaritakis, and M. Cannon, “Equi-normalization and exact scaling dynamics in homothetic tube model predictive control,” Systems & Control Letters, vol. 62, no. 2, pp. 209–217, 2013. [54] I. M. Mitchell, J. Yeh, F. J. Laine, and C. J. Tomlin, “Ensuring safety for sampled data systems: An efficient algorithm for filtering potentially unsafe input signals,” in 2016 IEEE 55th Conference on Decision and Control (CDC). IEEE, 2016, pp. 7431–7438. [55] K. P. Wabersich and M. N. Zeilinger, “Linear model predictive safety certification for learning-based control,” in 2018 IEEE Conference on Decision and Control (CDC). IEEE, 2018, pp. 7130–7135. [56] R. Romagnoli, T. Alamo, B. Sinopoli, and E. F. Camacho, “Secure control against stealthy attacks via software rejuvenation,” arXiv preprint arXiv:1810.10468, 2018. [57] ——, “Optimal invariant set computation for software rejuvenation strategies in cyber-physical systems,” IEEE Transactions on Automatic Control, 2019. [58] D. Cotroneo and R. Natella, “A survey of software aging and rejuvenation studies,” ACM Computing Surveys (CSUR), vol. 47, no. 2, pp. 1–36, 2014. [59] L. Valverde, F. Rosa, A. Del Real, A. Arce, and C. Bordons, “Modeling, simulation and experimental set-up of a renewable hydrogen-based domestic microgrid,” International journal of hydrogen energy, vol. 38, no. 27, pp. 11 672–11 684, 2013. [60] A. Clemmens, T. Kacerek, B. Grawitz, and W. Schuurmans, “Test cases for canal control algorithms,” Journal of irrigation and drainage engineering, vol. 124, no. 1, pp. 23–30, 1998. [61] A. Clemmens, G. Sloan, and J. Schuurmans, “Canal-control needs: example,” Journal of irrigation and drainage engineering, vol. 120, no. 6, pp. 1067–1085, 1994. [62] J. Schuurmans, A. Hof, S. Dijkstra, O. Bosgra, and R. Brouwer, “Simple water level controller for irrigation and drainage canals,” Journal of irrigation and drainage engineering, vol. 125, no. 4, pp. 189–195, 1999. [63] M. Sivianes, T. Arauz, E. Marín, and J. M. Maestre, “Reputation-based consensus on a secure blockchain network,” in Blockchain for Cybersecurity in Cyber-Physical Systems. Springer, 2022, pp. 167–184. [64] A. Cetinkaya, H. Ishii, and T. Hayakawa, “Networked control under random and malicious packet losses,” IEEE Transactions on Automatic Control, vol. 62, no. 5, pp. 2434–2449, 2016. [65] P. Chanfreut, J. M. Maestre, and H. Ishii, “Vulnerabilities in distributed model predictive control based on jacobi-gauss decomposition,” in 2018 European Control Conference (ECC). IEEE, 2018, pp. 2587–2592. 52 Bibliography [66] P. Velarde, J. M. Maestre, H. Ishii, and R. R. Negenborn, “Scenario-based defense mechanism for distributed model predictive control,” in 2017 IEEE 56th Annual Conference on Decision and Control (CDC). IEEE, 2017, pp. 6171–6176. [67] W. Ananduta, J. M. Maestre, C. Ocampo-Martinez, and H. Ishii, “Resilient distributed model predictive control for energy management of interconnected microgrids,” Optimal Control Applications and Methods, vol. 41, no. 1, pp. 146–169, 2020. [68] P. Chanfreut, A. Sánchez-Amores, J. M. Maestre, and E. F. Camacho, “Distributed model predictive control based on dual decomposition with neural-network-based warm start,” in 2021 European Control Conference (ECC). IEEE, 2021, pp. 1969– 1974. [69] P. Trodden, “A one-step approach to computing a polytopic robust positively invariant set,” IEEE Transactions on Automatic Control, vol. 61, no. 12, pp. 4100–4105, 2016. [70] M. Pereira, D. Limon, D. M. de la Peña, L. Valverde, and T. Alamo, “Periodic economic control of a nonisolated microgrid,” IEEE Transactions on industrial electronics, vol. 62, no. 8, pp. 5247–5255, 2015. [71] P. J. Goulart, E. C. Kerrigan, and J. M. Maciejowski, “Optimization over state feedback policies for robust control with constraints,” Automatica, vol. 42, no. 4, pp. 523–533, 2006.