Domain-based Attack Models in Building Automation Systems

Ensuring data integrity is one of the critical needs in cyber-physical systems (CPS). An integrity breach in a CPS can drive the underlying controlled physical process into undesired operating conditions. To evaluate CPS security against malicious entities, attacker models are often employed. In this work, our objective is to incorporate domain-knowledge in modeling attacks in building automation systems (BAS). Specifically, we modify the general sensor integrity attack model based on targeted attacks. We use the model to formulate different attacker types, including a powerful attacker who becomes stealthier as the number of captured node increases. We simulate the attacks by injecting corruption on real-world data obtained from a retrofitted BAS testbed for air conditioning (AC) control. Results show that the vulnerabilities of an underlying system can be explored by leveraging on domain-based attack testing.