Attack Analysis and Resilient Control Design for
Discrete-time Distributed Multi-agent Systems

arXiv:1801.00870v1 [] 3 Jan 2018

Aquib Mustafa, Student Member, IEEE and Hamidreza Modares, Member, IEEE

Abstract—This work presents a rigorous analysis of the adverse
effects of cyber-physical attacks on discrete-time distributed
multi-agent systems, and propose a mitigation approach for
attacks on sensors and actuators. First, we show how an attack
on a compromised agent can propagate and affect intact agents
that are reachable from it. This is, an attack on a single node
snowballs into a network-wide attack and can even destabilize
the entire system. Moreover, we show that the attacker can
bypass the robust H∞ control protocol and make it entirely
ineffective in attenuating the effect of the adversarial input on
the system performance. Finally, to overcome the adversarial
effects of attacks on sensors and actuators, a distributed adaptive
attack compensator is designed based on a virtual estimator. The
adaptive attack compensator is augmented with the controller to
achieve resilient control. The developed controller achieves secure
invulnerable consensus in presence of the attacks. This controller
provides remarkable benefits over a class of the existing resilient
controller, by making no restriction on the number of agents or
agents neighbors under the effect of adversarial input, despite
it redeems compromised agent from the effect of the attack.
Effectiveness of proposed controller and analysis is validated
through simulations.
Index Terms—Resilient control, Attack analysis, Discrete-time,
Distributed multi-agent systems, Distributed adaptive attack
compensator.

I. I NTRODUCTION
Distributed control of multi-agent systems [1]-[4] have
gained remarkable attraction due to their potential applications
in different growing fields such as robotics, power system,
transportation and so on. Despite their numerous advantages,
distributed multi-agent systems (DMAS) are prone to cyberphysical attacks. For instance, in case of multi-vehicle systems,
the GPS sensor can be spoofed and corrupt the sensory data
which the vehicle receives [5]. Corruption of sensory data
or manipulation of actuator input can severely and adversely
affect the performance of the system. Therefore, design of
robust, resilient and secure architectures is required to successfully achieve desired coordinated goal in the presence of
attack.
Considerable results have been presented for the detection
[6]-[12] and mitigation of attacks in DMAS. There are generally two approaches in designing mitigation techniques for
DMAS. In the first approach, a monitor is designed to detect
the attack on neighbors and then remove compromised agents,
once identified [13]-[20]. In these approaches, each normal
agent either uses an observer for each of its neighbors to detect
Aquib Mustafa and Hamidreza Modares are with the Department of
Electrical and Computer Engineering, Missouri University of Science
and Technology, Rolla, MO 65401, USA (e-mails: a.mustafa@mst.edu;
modaresh@mst.edu).

abnormality [15] or discard neighbors information based on
the discrepancy between actual and malicious agents using
iterative strategy [13]-[14]. The former approach requires a
model for each of its neighbors are not scalable. The latter
requires meeting the F-total or the F-local condition. That
is, there should be an upper bound on F either on the total
number of adversarial agents, called as F-total or on the local
number of compromised agents in the neighborhood of each
intact agent, called as F-local. Although these approaches can
counteract variety of attacks, including attacks on sensors and
actuators, as well as attacks on the communication network,
they can harm the network connectivity by blindly rejecting the neighbor’s information. This is because, they cannot
distinguish between a change in neighbors behavior due to
attack and a legitimate change in the system. For example,
in a leader-follower synchronization problem, a legitimate
change in leader’s state can be detected as change due to
adversarial input by neighbors. Moreover, these approaches
treat all types of attacks the same by discarding compromised
agent. However, as shown in this paper, attacks on sensors
and actuators can be recovered and the compromised agent
can be brought back to the network without making any
restrictive assumption on network connectivity. This avoids
any unnecessary harm to the network connectivity.
In the second approach, local resilient control protocols
based attack mitigation are designed for a class of attacks,
without isolation of compromised agent. Reputation-based resilient control protocol is presented in [21] for leader-follower
problem under certain conditions. Game-theory based resilient
control architectures [22]-[25] have presented to minimize the
effects of adversarial input. With an assumption of having
partial knowledge of attacker, the resilient receding horizonbased control protocol is discussed in [26]-[28] for mitigation
of the replay attack. Secure state estimation and control under
sensor attack has been considered in [29]-[30]. A resilient
control protocol is presented in [31] for single and double
integrator system based on local state emulator. Then in [32],
an adaptive resilient control protocol is presented for the attack
on sensor and actuator of the system. Most of these results are
presented for continuous-time systems. However, in real-time
applications, the system communicates and broadcasts there
information at discrete instants.
To design a resilient control protocol, one needs to identify
the adverse effects of the attack on the system performance
from the attacker’s perspective. However, to the best of our
knowledge, there is no rigorous attack analysis for discretetime DMAS. In this paper, first, we illustrate that how an attack
on a compromised agent spread across the network and affects

the intact agents that are reachable from a compromised agent.
Then, we show that the attacker can design a stealthy attack
which have common mode with the system dynamics and
launch on a single root node to destabilize the entire system.
We call this as, internal model principle for the attacker in
discrete-time DMAS. The attacker does not need to know the
graph topology or agents dynamics to design its attack signal
and can eavesdrop on some sensory information to identify
one eigenvalue of the consensus dynamics. We also show that
the attacker can entirely disable robust techniques such as H∞ ,
used for attenuating the effects of adversarial inputs on the
performance of the system.
To mitigate the effect of the adversarial input, this work
presents a distributed adaptive resilient controller. First, a
virtual estimator is designed for each node to predict the actual
behavior of the system. Then, the virtual estimator is used to
design an adaptive attack compensator. The designed adaptive
attack compensator is augmented with the controller for the
mitigation of the attack. Moreover, we have shown the uniform
boundedness for the system using the proposed controller in
the presence of the attack. The proposed adaptive resilient
control protocol makes no restriction on graph topology as
compared to the existing approaches [13]-[20]. The proposed
controller preserves the network connectivity and mitigates the
effect of adversarial input on the actuator and/or sensor of the
agent in discrete-time DMAS.
II. N OTATIONS AND P RELIMINARIES
In this section, the preliminaries of graph theory and
standard distributed consensus of multi-agent systems are
provided.
A. Graph Theory
A directed graph G consists of a pair (V , E ) in which set of
nodes and set of edges is represented by V = v1 , . . . , vN and
E ⊂ V xV , respectively. The adjacency matrix is defined as
A = [ai j ], with ai j > 0 if (v j , vi ) ∈ E . The set of nodes vi with
edges incoming to node v j is called the neighbors of node vi ,
namely Ni = v j : (v j , vi ) ∈ E . The graph Laplacian matrix is
defined as L = H − A, where H = diag(hi ) is known as the
in-degree matrix, with ∑ j∈Ni ai j as the weighted in-degree of
node i. A directed tree is a connected digraph where every
node except one, known as root node, has the in-degree equal
to one. A graph is said to have a spanning tree if a subset of the
edges forms a directed tree. Ker(β ) and eig(α) represents the
null space of β and the eigenvalues of matrix α, respectively.
∆|α| and α ad j means the determinant and the adjoint of matrix
α, respectively. Furthermore, λmax (α) and λmin (α) represents
maximum and minimum eigenvalue of matrix α, respectively.
Assumption 1. The communication digraph G contains a
spanning tree.
B. Standard Distributed Consensus in MAS
This subsection presents the standard distributed control
protocol for the consensus of discrete-time multi-agent systems.
Consider N agents with identical system dynamics represented by

xi (k + 1) = Axi (k) + Bui (k), i = 1, . . . , N
(1)
where xi (k) ∈ Rn and ui (k) ∈ Rm are the state and the control
input of agent i, respectively. A and B are the system and
and input matrices, respectively. (A, B) is assumed to be
stabilizable.
Define the local neighborhood tracking error for the agent
i as
N
εi (k) = (1 + hi )−1 ∑ ai j (x j (k) − xi (k))
(2)
j=1

in which ai j is the (i, j)-th value of the adjacency matrix.
Consider the distributed control law for each node i as in
[33]
ui,n (k) = c(1 + hi )−1 Kεi , i = 1, . . . , N
(3)
where c is a positive coupling constant, and K ∈ Rm×n is a
design feedback control gain matrix. Define the global state
vector as x(k) = [x1T (k), x2T (k), . . . , xNT (k)]T ∈ RnN . Using (1)(3), the global dynamics of DMAS can be expressed as
x(k + 1) = [IN ⊗ A − c(I + H)−1 L ⊗ BK]x(k)

(4)

The normalized graph Laplacian matrix L̂ is defined as [33]
L̂ = (I + H)−1 L

(5)

Let the eigenvalues of the normalized graph Laplacian matrix
L̂ be λi , ∀ i = 1, . . . , N. Then, λi lies inside unit circle centered
at 1 + j0 for i = 2, . . . , N and λ1 = 0 [34].
Using (4), the state of agent’s global dynamics is given by
x(k) = [IN ⊗ A − cL̂ ⊗ BK]k x(0) , Akc x(0)

(6)

where Ac is the closed-loop matrix defined as
Ac = (IN ⊗ A − cL̂ ⊗ BK)

(7)

Lemma 1. [34] Let R ⊂ V be the set of root nodes and r =
[p1 , . . . , pN ]T be the left eigenvector of the normalized graph
Laplacian matrix L̂ for λ1 = 0. Then, pi > 0 if i ∈ R and pi = 0
if i ∈
/ R.
Theorem 1. [33]-[34] Let feedback gain K be designed such
that A − cλi BK is Schur stable. Then, according to Lemma 1,
the final consensus value for DMAS can written as


x1 (0)
 . 

x(k) = (rT ⊗ Ak ) 
(8)
 .  i = 1, . . . , N as k → ∞
xN (0)
Assumption 2. The system matrix A in (1) is marginally
stable, with all eigenvalues on or outside the unit circle
centered at origin.
III. ATTACK A NALYSIS FOR D ISCRETE - TIME
D ISTRIBUTED MAS
This section presents the attack modeling and analyzes its
adverse effects on the standard control protocol. The internal
model principle for the attacker is presented to show that how
a single compromised agent can destabilize the entire system.
Then, the effect of the attack on the local neighborhood
tracking error is analyzed to show the ineffectiveness of the
standard robust H∞ control protocol (which is well-known

disturbance attenuation technique) in the presence of a stealthy
attack.
The attack on actuators of agent i can be modeled as
udi

= ui,n + γi uai

(9)

to the sensors and actuators, respectively. The global dynamics
for DMAS (11) under the effect of attack can be written as
x(k + 1) = Ac x(k) + (IN ⊗ B) f (k), i = 1, . . . , N
where the injected global attack signal f (k) is

uai

where ui is the control law given in (3),
represents the
attacker’s signal injected into the actuator of agent i, udi is the
distorted control law applied to (1) and the scalar γi is 1 when
there is an attack on actuator of agent i and 0, otherwise.
The attack on sensors of agent i can be modeled as
xid = xi + δi xia

xi (k + 1) = Axi (k) + Bui (k) + B fi (k), i = 1, . . . , N

f (k) = −c(L̂ ⊗ K)(δ ⊗ IN )xa + (γ ⊗ IN )ua

(11)

k−1

x(k) = Akc x(0) +

N

j=1

(12)

+γi uai
Remark 1. An attacker can manipulate sensor data or actuator
without physical tampering. Spoofing of global positioning
system (GPS) of an unmanned vehicle or of phasor measurement unit’s (PMU’s) in power system are examples of attack
without physical tampering.

This subsection analyzes the effects of the attack on the
standard discrete-time DMAS (1). Theorem 2 investigates how
an attack can propagate across the network.
Definition 1: In a graph, agent i is reachable from agent j if
there is a directed path of any length from node j to Node i.
Theorem 2. Consider the discrete-time DMAS (11) under the
attack fi (k). Let the control protocol be designed as (3) such
that the closed loop matrix Ac in (7) is Schur. Then,
1) All agents reach consensus if fi (k) = 0, ∀i = 1, . . . , N.
2) The intact agent deviates from the desired consensus
value if it is reachable from a compromised agent.
3) The deviation of the network from the desired behavior
depends on the number of compromised agents, their
attack signal magnitude and the number of agents reachable from them.
Proof. It is shown in [34] that if c and K are designed so
that Ac in (7) is Schur, then all agents reach consensus. This
completes the proof of part 1.
To prove part 2, define xa = [(x1a )T , (x2a )T , . . . , (xNa )T ]T and
a
u = [(ua1 )T , (ua2 )T , . . . , (uaN )T ]T as a vector of signals injected

(15)

with k ≥ p. At the steady state, one has
k−1

∑ (IN ⊗ A)k−p−1 (IN ⊗ IN

x(k) →

p=0

−1

k−p−1

−cL̂ ⊗ A BK)

(16)

(IN ⊗ B) f (p)

For a positive integer n, binomial theorem for matrices can
be expressed as
n

(x + y)n =

∑ Ckn xn−k yk

(17)

k=0
n!
(n−k)!k!

with Ckn =
becomes

if x and y is commutative. Using (17), (16)

k−1

x(k) →

∑ (IN ⊗ A)k−p−1

p=0

(18)

k−p−1

∗

∑

Cmk−p−1 (−cL̂ ⊗ A−1 BK)m (IN ⊗ B) f (p)

m=0

Using (15) and (18), the state of the agent i yields
N k−1 k−p−1

A. Effects of Attack on Standard Distributed MAS

∑ (Ac )k−p−1 (IN ⊗ B) f (p)

p=0

where fi (k) represents the overall attack signal injected into
the agent i, which is given by
fi (k) = c(1 + hi )−1 K( ∑ ai j (δ j xaj (k) − δi xia (k))

(14)

with γ = diag(γ1 , . . . , γN ) and δ = diag(δ1 , . . . , δN ). If f 6= 0 ,
then the solution of (13) is given by

(10)

where xi represents the state of agent i, xia is the attacker’s
signal injected into the sensor of agent i, xid is the distorted
state and the scalar δi is 1 when there is an attack on sensor
of agent i and 0, otherwise.
Using the distributed control law (3) with (9) and (10) in
(1), one can express the DMAS dynamics for an agent i as

(13)

xi (k) → ∑

∑ ∑

−1
m
Ak−p−1Cmk−p−1 (−1)m cm l m
i j (A BK) B f j (p)

j=1 p=0 m=0

(19)
where limj , [(I + H)−1 L]m
and
[
]
denotes
the
element
(i,j)
ij
ij
of a matrix. m represents the length of shortest directed path
from j to i [35]. Assume now that the agent j is under direct
attack, but agent i is intact, i.e. fi (k) = 0 and f j (k) 6= 0. If
the intact agent i is reachable from the compromised agent j,
since limj 6= 0 for some 0 < m < N − 1, one can infer from (19)
that the agent state xi (k) at steady state in (19) is non-zero
which deduces that intact agent i is deviated from the desired
consensus behavior. This completes the proof of part 2.
For the proof of part 3, taking the norm from both sides of
(15), and using
k−1

∑ (Ac )k−p−1 f (p)

p=0

6

k f (k)k
|λmin (Ac )|

(20)

yields
kx(k)k 6 N f

kBk b f
|λmin (Ac )|

(21)

at steady state, where, N f is the number of agents for which fi
is non-zero, b f is bound on adversarial input fi . It was shown
in part 2 that if agent i is reachable from the disrupted agent j,

then its deviation from the desired behavior is non-zero. That
is, for the intact agent i that is reachable from a compromised
agent, kxi (k)k is non zero and as can be seen from (21),
its deviation bound depends on the number of compromised
agents N f and bound on adversarial input b f . This completes
the proof.

B. Internal Model Principle Approach for the Attacker
In order for a control system to reject a disturbance or
follow a reference trajectory, one needs to incorporate their
dynamics in the control system. This is called the internal
model principle (IMP). We showed in following Theorem 3
that the attacker can also leverage the IMP and incorporate
some eigenvalues of the consensus dynamics in its attack
design to destabilize the entire network.
We now take the role of the attacker and show that how it
can maximize the damage and cause a catastrophe. Conditions
under which the attacker achieves this objective are provided.
Let the dynamics of the attacker on a node i be defined as
f (k + 1) = W f (k)

(22)

where W ∈ Rm×m . Consider the set of eigenvalues of W as

L̂. The left and the right eigenvectors of L̂ corresponding to
zero eigenvalue of the normalized graph Laplacian matrix are
r and 1N , respectively [34]. Define
M = [1 M1 ],

M −1 = [rT M2 ]T

where M1 ∈ RN×(N−1) and M2 ∈ R(N−1)×N . Using (27) with
L̂ = MΛM −1 , one has
[INn + cMΛM −1 ⊗ G(z)K]x(z) = (IN ⊗ G(z)) f (z)
As MM −1 = IN , one can write (28) as
(M ⊗ In )[InN + cΛ ⊗ G(z)K](M −1 ⊗ In )x(z) = G(z) f (z) (29)
Define state transformation as
x̂(z) = (M −1 ⊗ In )x(z)

(23)

(30)

and premultiplying (29) with (M −1 ⊗ In ). Then, one has
x̂(z) = [INn + cΛ ⊗ G(z)K]−1 (M −1 ⊗ G(z)) f (z)

(31)

Let assume for simplicity that all the Jordan blocks are simple,
M −1 = [pi j ] and M = [mi j ]. For the agent i, using (30) and (31),
one has
N

ΛW = [λW1 , . . . , λWm ]

(28)

xi (z) =

N

∑ mih [In + cKGi (z)λi ]−1 Gi (z)∑ j=1 pi j fi (z)

(32)

h=1

and the set of eigenvalues of the system matrix A
ΛA = [λA1 , . . . , λAn ],

(24)

respectively.
Theorem 3. Consider the discrete-time DMAS (11) under the
attack fi with the control protocol (3). Let fi (k) be designed
as (22). Then,
1) The attacker destabilizes the complete network, if
∑Nj=1 p1 j fi (k) 6= 0 and the sets defined in (23) and (24)
have at least one common eigenvalue.
2) The attacker does not affect the stability of MAS
(1), but cause deviation from consensus behavior, if
∑Nj=1 p1 j fi (k) = 0 or the sets defined in (23) and (24)
have no common eigenvalues.
Proof. The transfer function for the DMAS (1), from xi (z) to
ui (z) in z-domain can be written as
Gi (z) =

xi (z)
= (zI − A)−1 B
ui (z)

The first eigenvalue of the normalized graph Laplacian matrix
L̂ is zero and its corresponding right eigenvector is 1N i.e.
mi1 = 1. Using this fact with (32), one has
N

xi (z) = Gi (z) ∑ p1 j f j (z)+
j=1

N

−1

∑ mih [In + cλh Gi (z)K]
h=2

N

(33)

Gi (z) ∑ ph j f j (z)
j=1

Now, if we show that [In + cKGi (z)λh ]−1 is Schur, then the
second term of (33) is bounded, even in the presence of attack.
Since (A − cλh BK), ∀h = 2, . . . , N is Schur, therefore if
we show that the roots of the characteristic polynomial
(A − cλh BK) are identical to the poles of [In + cKGi (z)λh ]−1 ,
then one can say [In + cKGi (z)λh ]−1 is also Schur. To this end,
using (25), one has
∆|(zIn − (A − cλh BK))| = ∆|(zIn − A + cλh BK)|

(25)

Using (3), the global control law under the influence of the
attack can be expressed as

= ∆|zIn − A|(In + cλh (zIn − A)−1 BK)
∆|zIn − A|[(∆|zIn − A| + cλh (zIn − A)ad j BK)]
=
∆|zIn − A|

(34)

with u(z) = [uT1 , . . . , uTN ]T , x(z) = [x1T , . . . , xNT ]T and f (z) =
[ f1T , . . . , fNT ]T . Using (25) and (26), the system state in the
global form can be written as

Hence, this proves that the roots of the characteristic polynomial (A − cλh BK) are identical to the poles of [In +
cKGi (z)λh ]−1 using [36]. Therefore, [In + cKGi (z)λh ]−1 is
Schur. Thus, it concludes that the second term of (33) is
bounded and has no contribution in destabilizing the system.

x(z) = (IN ⊗ G(z))u(z) = (IN ⊗ G(z))(−(cL̂ ⊗ K)x(z) + f (z))
(27)
where G(z) = diag(Gi (z)) with dimension RNxN . Let M be a
non-singular matrix such that L̂ = MΛM −1 , with Λ be the Jordan canonical form of the normalized graph Laplacian matrix

According to Lemma 1, P1 j in (33) is zero for non-root
nodes and ∑Nj=1 p1 j fi (k) 6= 0, if the attack is launched on root
nodes. Assume that the attack is on a root node with a signal
having common mode with the system dynamics. This means
that there is at least a common eigenvalue λAl between sets

u(z) = −(cL̂ ⊗ K)x(z) + f (z)

(26)

defined in (23) and (24). Using the transfer function (25) and
the attack signal defined in (22), one can write (33) as
N

xi (z) =

∑ pi j

j=1

(zIn − A)ad j B(zIn −W )ad j fi (0)
2
(z2 + λA2l ) {

n

∏
i=1,i6=l

2
(z2 + λA2i )(z2 + λW2 i ) }

N

N

h=2

j=1

+

Lemma 2. Consider the normalized graph Laplacian matrix L̂
defined in (5). Then, [L̂T L̂ − 2L̂] is negative semidefinite.
Proof. Let λk be the eigenvalue of the normalized graph
Laplacian matrix L̂. So, the eigenvalue of [L̂T L̂ − 2L̂] can be
written as
eig[L̂T L̂ − 2L̂] = λk2 − 2λk

∑ mih [1 + cKGi (z)λh ]−1 Gi (z) ∑ ph j f j (z)

= (λk − 1)2 − 1

(38)

(35)
The first term of (35) shows that the pole λAl lies on the
unit circle centered at the origin and has multiplicity greater
than 1. Thus, the system states tend to infinity in the discretetime domain as k → ∞. Therefore, the attack on the root node
destabilizes the entire network. This completes the proof of
part 1.
If the attack is on a non-root node, then ∑Nj=1 p1 j fi (k) = 0.
So, (33) can be expressed as
xi (z) =

N

N

h=2

j=1

∑ mih [1 + cKGi (z)λh ]−1 Gi (z) ∑ ph j f j (z)

(36)

Then, according to (34), [In + cKGi (z)λh ]−1 is Schur stable.
Therefore, the system states are bounded, even in the presence
of the attack. Moreover, the agents that are reachable from
the attacker shows stable behavior, but deviation from the
desired consensus value. If ΛA ∩ΛW 6= φ which implies that the
multiplicity of poles lie on the unit is one. Therefore according
to (33), the system states remain bounded and shows deviation
from the desired consensus behavior due to the adverse effect
of the attacker. This completes the proof.

Remark 2. Note that the attacker does not need to know
the system matrix A, and it can get access to the eigenvalues
of dynamics through eavesdropping the sensory informations.
Then, the attacker can identify root node and destabilize the
entire system.
Now, we present the analysis of the effects of the attack on
the local neighborhood tracking error (2). This analysis shows
that although attacks on sensors and actuators can be modeled
as disturbances, existing disturbance attenuation techniques do
not work for attack attenuation.
Disturbance attenuation approaches focus on minimizing the
effects of disturbance on the local neighborhood tracking error
[37]-[38]. More specifically, the H∞ approach for DMAS (1)
in presence of disturbance wi (k) designs a distributed control
protocol as in (3), such that the desired consensus is achieved
as in (8), if disturbance wi (k) = 0 and the bounded L2 -gain
condition is fulfilled for any disturbance wi (k) ∈ L2 [0, ∞)
∞

∞

∑ ε T (k)M̄ε(k) 6 γ 2 ∑ wT (k)N̄w(k)
k=0

(37)

k=0

where γ > 0 is attenuation constant, M̄ and N̄ are positive
definite weight matrices.
We present the following rigorous analysis of the effects
of the attack on the local neighborhood tracking error in
following Theorem 4 and show that how an attacker can
bypass existing H∞ disturbance attenuation approaches and
make them entirely ineffective.

Since all the eigenvalues of matrix L̂ lie inside unit circle
centered at 1 + j0, except λ1 = 0 [34], therefore (λk − 1)2 − 1
is less than or equal to zero for k = 1, . . . , N. This shows that
[L̂T L̂ − 2L̂] is negative semidefinite.
For the sake of simplicity, we consider the scalar system in
the following theorem.
Theorem 4. Consider the discrete-time DMAS with single
integrator dynamics (11) and the control protocol (3). Assume
that the system is under a constant attack signal f (k). Then,
the local neighborhood tracking error for intact agents is zero
while agents do not reach the desired consensus.
Proof. Consider the Lyapunov function for the discrete-time
DMAS as
V (x(k), f (k)) = (−L̂x(k) + f (k))T (−L̂x(k) + f (k))

(39)

The difference equation of the Lyapunov function (39) can be
written as
∆V (x(k), f (k)) = V (x(k + 1), f (k + 1)) −V (x(k), f (k))
= (−L̂x(k + 1) + f (k + 1))T (−L̂x(k + 1) + f (k + 1))
−(−L̂x(k) + f (k))T (−L̂x(k) + f (k))

(40)

For the constant attack signal i.e. f (k + 1) = f (k), one can
write (40) as
= (−L̂x(k + 1) + f (k))T (−L̂x(k + 1) + f (k))
−(−L̂x(k) + f (k))T (−L̂x(k) + f (k))
or equivalently,
= (−L̂x(k + 1))T (−L̂x(k + 1)) − (−L̂x(k))T (−L̂x(k))
−2 f (k)T L̂(x(k + 1) − x(k))

(41)

Using the system dynamics (1) in (41), one has
= (−L̂[x(k) + u(k)])T (−L̂[x(k) + u(k)])
−(−L̂x(k))T (−L̂x(k)) − 2 f (k)T L̂u(k)

(42)

Furthermore, One can express (42) as
= (−L̂x(k) + f (k))T [L̂T L̂ − 2L̂](−L̂x(k) + f (k))

(43)

Using Lemma 2, one has
∆V (x(k), f (k)) = (−L̂x(k) + f (k))T [L̂T L̂
−2L̂](−L̂x(k) + f (k)) 6 0

(44)

Then, using Lasalle’s invariance principle [39], the trajectories
(x(k), f (k)) converge to a set that satisfy ∆V (x(k), f (k)) = 0.
Based on (44), this yields
(−L̂x(k) + f (k)) ∈ ker(L̂T L̂ − 2L̂)

(45)

or
(−L̂x(k) + f (k)) = 0

(46)

From (45), one has (−L̂x(k) + f (k)) = c̄1N . According to
this, the single integrator system dynamics becomes xi (k +
1) = xi (k) + c̄, which shows that it destabilizes the system.
Therefore, xi (k) → ∞ as k → ∞ ∀i = 1, . . . , N and thus the local
neighborhood tracking error goes to zero for all agent. Note
that, based on Theorem 3, (54) is the possible case when the
attack is on a root node. On the other hand, for an attack on a
non-root node agent, from (46), one has (−L̂x(k) + f (k)) = 0.
Since for the intact agent i, fi (k) = 0, therefore, the local
neighborhood tracking error for the intact agents converge to
zero, even in the presence of the attack.
We now show that the intact agents do not reach the desired
consensus, despite the fact the local neighborhood tracking
error is zero. From (46), one has
L̂x(k) = f (k)

(47)

which can be written for agent i as
N

(1 + hi )−1 ∑ ai j (x j (k) − xi (k)) = fi (k)

(48)

j=1

For a compromised agent i, since fi (k) 6= 0, then, one has
xi (k) 6= x j (k) for some i, j.
Now let assume that agent i is intact. Then, one has
−1

(1 + hi )

∑ x j (k)

j∈N

i
where xavg = |N
, which is not equal to xi (k) due to
i|
incoming information from a comprised agent xic (k). From
(51), one can infer that the deviation of the intact agent from
the desired consensus value depends on the number of the inneighbors and deviation of the compromised agent ic from the
desired consensus value which depends on the magnitude of
the injected attack signal. Moreover, the closer the agent is to
the source of the attack, the more its value will be deviated
from the desired consensus.

Corollary 1. Let the attacker design its attack signal using
the internal model principle approach described in Theorem
3. Then, it bypasses the H∞ control protocol.
Proof. In the absence of the attack, minimizing the local neighborhood tracking error results in minimizing the consensus
error. Therefore, the H∞ control in (37) is used to attenuate the
effect of adversarial input on the local neighborhood tracking
error. However, according to Theorem 4, in the presence of
IMP attack, by making the local neighborhood tracking error
go to zero, agents do not reach consensus. This completes the
proof.

In existing approaches, the local neighborhood tracking
error is one of the important measures for the performance of
the DMAS. Theorem 4 and following analysis highlight that
while the local neighborhood tracking error is zero, the agents
might not reach consensus. Define a performance function
Γi (k) as
2
Γi (k) = ∑ xi (k) − x j (k)
(52)
j∈Ni

Define the set of intact agents as

N

∑ ai j (x j (k) − xi (k)) = 0

(49)

Nint = Ni − Nc ∀i = 1, . . . , N

(53)

j=1

Consider the intact agent i as an immediate neighbor of the
compromised agent ic . Let assume by contradiction that only
the compromised agent does not reach the desired consensus
but all the intact agents reach the desired consensus. Using
(49), one can write
(1 + hi )−1

∑ ai j (x j − xi )+aiic (xic − xi ) = 0

(50)

j∈Ni

Assuming that the intact agents reach consensus, xi (k) =
x j (k) ∀ j ∈ Ni . However, (50) cannot be satisfied if xi (k) =
x j (k) ∀ j ∈ Ni because xic (k) 6= xi (k) and this contradict the
assumption. Therefore, this shows that the intact agent i is
deviated from the desired consensus value. Similarly, one can
use the same argument to show that all reachable agents from
the compromised agent will deviate from the desired consensus
value. This completes the proof.

Remark 3. If a intact agent i is an immediate neighbor of a
compromised agent ic , then using (2), one can write the local
neighborhood tracking error εi (k) with ai j = 1 as
εi (k) = (1 + hi )−1

∑ (x j (k) − xi (k))

j∈Ni

= |Ni | (1 + hi )−1 (

1
|Ni |

∑ x j (k) − xi )

j∈Ni

= |Ni | (1 + hi )−1 (xavg − xi )

(51)

where Ni represents set of all agents and Nc represents set of
compromised agents of the network.
Corollary 2. Consider the performance function Γi (k) and the
local neighborhood tracking error εi (k) defined in (52) and (3),
respectively. Then,
1) Γi (k) and εi (k) ∀i = 1, . . . , N converges to zero, if
there is no attack. Moreover, agents achieve the desired
consensus.
2) If the attacker designs an IMP-based attack on the nonroot node, then εi (k) ∀i ∈ Nint converges to zero, but
Γi (k) ∀i = 1, . . . , N does not converges to zero. That is,
agents do not reach the desired consensus, while the
local neighborhood tracking error is zero.
3) If the attacker designs an IMP-based attack on the root
node, then εi (k) and Γi (k) ∀i = 1, . . . , N goes to zero,
despite agents do not achieve the desired consensus and
the entire system get destabilized.
Proof. According to Theorem 1, the system achieves the
desired consensus if there is no adversarial input in the system
and this proves part 1 of corollary. If the attacker injects a
signal having common mode with the system dynamics into
the non-root node of the DMAS, then based on Theorem, 3
and 4, one can infer εi (k) → 0. However, as shown in Theorem
4, xi (k) − x j (k) 6→ 0, so Γi (k) 6→ 0 and this proves part 2.

Based on Theorem 3, if the attacker injects a signal having
common mode with the system dynamics into the root node
of the DMAS, then xi (k) − x j (k) → 0. However, the system
gets destabilized as xi (k) → ∞ as k → ∞, while εi (k) and Γi (k)
∀i = 1, . . . , N converges to zero. This completes the proof. 

and λ1 = 0. Therefore, the virtual estimator states achieve the
desired consensus value and written as


x̂1 (0)
 . 

(60)
x̂(k) = (rT ⊗ Ak ) 
 .  i = 1, . . . , N as k → ∞
x̂N (0)

IV. R ESILIENT D ISTRIBUTED C ONTROL P ROTOCOL FOR
ATTACKS ON S ENSOR AND ACTUATOR : AN A DAPTIVE
A PPROACH


Although the attacks on the actuators and/or sensors can
adversely affect the agents dynamics, they cannot affect the
dynamics of the distributed virtual estimator (54), unless they
entirely compromise the agent which is extremely harder to
do for the attacker.
The deviation of the agent’s behavior from the normal
behavior is estimated by distributed virtual estimator. Then,
an adaptive attack compensator is developed using a virtual
estimator. The designed adaptive compensator is augmented
with the controller for the mitigation of the adversarial input.
In contrast to existing isolation approaches [13]-[20], which
require a strong network connectivity, the developed resilient
distributed controller preserves network topology and achieves
the desired consensus without any restrictions on the number
of agents under sensor and actuator attack. Attacks on communication links i.e. denial of service (DoS) attack can be mitigated by incorporating existing attack detection/identification
methodologies [13]-[20] with the proposed approach. Therefore, agents under the influence of the adversarial input on
sensors and actuators can be recovered using the proposed
resilient controller and be brought back to the network in intact
mode without being isolated.

This section presents the design of a resilient distributed
control protocol for the mitigation of the adverse effect of the
attack on sensor and actuator of an agent in the discrete-time
DMAS. Despite the magnitude of attack f (k) on sensor and
actuator of an agent and its reachability from the intact agent,
the developed distributed adaptive compensator is resilient
against the attack and avoids catastrophic effects. To this end,
first a distributed virtual estimator for each agent is designed
to estimate the expected normal behavior of the MAS, then
an distributed adaptive compensator is designed using virtual
estimator.
Consider the estimated state for agent i as x̂i (k). The
distributed virtual estimator is designed as

N

 x̂i (k + 1) = Ax̂i (k) + cBK(1 + hi )−1
∑ ai j (x̂ j − x̂i )
j=1


x̂i (0) = xi (0)

(54)

where the gain k and the coupling coefficient c are to be
designed such that to ensure Ac in (7) is Schur. The global
virtual estimator state vector for (54) can be written as
x̂(k) = [x̂1T (k), x̂2T (k), . . . , x̂NT (k)]T ∈ RnN .
Lemma 3. Consider the N virtual estimators given in (54). Let
the feedback gain K and coupling coefficient c are designed
to ensure Ac in (7) is Schur. Then, the virtual estimator state
x̂(k) converges to the desired consensus value.
Proof. The designed virtual estimator in (54) can be expressed
as
x̂i (k + 1) = Ax̂i (k) + Bûi (k), x̂i (0) = xi (0),
(55)

(56)

with local neighborhood tracking error ε̂ as
(57)

j=1

One can write the global virtual estimator state dynamics as
x̂(k + 1) = Ac x̂(k) ∈ RnN

(58)

where, ui,n (k) represents standard control protocol defined in
(3) and ui,comp (k) represents the distributed adaptive compensator protocol responsible for rejection of the adversarial input.
Consider the feedback gain K in the control protocol (3)
given as
T
K = (R1 + BT P1 B)−1 BT P1 A = R̄−1
1 B P1 A

AT P1 A − P1 − AT P1 B(R1 + BT P1 B)−1 BT P1 A = Q1

ui (k) = cKεi (k) − di (k)

(62)

(63)

(59)

As A − cλi BK is Schur stable, with λi be the eigenvalues
of the normalized graph Laplacian matrix L̂ for i = 2, . . . , N

(64)

where di (k) is the estimated response of the adaptive compensator and K is the gain given by (62) and (63). The update for
the distributed adaptive compensator is designed as
di (k + 1) = θ cK(ε̂i − εi ) + θ di (k)

which yields
x̂(k) = Akc x̂(0) ∈ RnN

(61)

with a positive definite matrix Q1 .
The designed distributed control protocol is given by

N

ε̂i (k) = (1 + hi )−1 ∑ ai j (x̂ j − x̂i ))

ui (k) = ui,n (k) + ui,comp (k)

where R1 is a positive definite design matrix, and P1 is solution
of

where
ûi (k) = c(1 + hi )−1 K ε̂i (k)

We now design a distributed resilient control protocol as

(65)

where θ > 0 is a design parameter, and εi and ε̂i are defined
in (3) and (57). Define Q2 = QT2 > 0 as
Q2 = cR2 (I + H)−1 L = cR2 L̂

(66)

with some positive definite R2 . Let the minimum eigenvalue
of graph matrix L̂ be λm .
The design of adaptive compensator using virtual estimator
is provided in the following theorem.
Theorem 5. Consider the effect of the attack on sensor and
actuator of an agent in DMAS (11). Let the control protocol
developed as (64)-(66). Then, the agents consensus error are
bounded, and the bound can be made arbitrarily small, despite
the attack.
Proof. According to Lemma 4, the virtual estimator state
converges to the desired consensus value. Therefore, the
consensus of discrete-time DMAS can be achieved by showing
the convergence of the agent state xi (k) to the virtual estimator
state x̂i (k). Define
x̃(k) = x(k) − x̂(k)

(67)

Then, with (11) and (55), one can write x̃(k + 1) as
˜
x̃(k + 1) = (IN ⊗ A − cL̂ ⊗ BK)x̃(k) − (IN ⊗ B)d(k)

(68)

where R̄1 = (R1 + BT P1 B) is a positive definite matrix. Using
(69), one can express (75) as
1 T
[d (k + 1)(R2 ⊗ R̄1 )d(k + 1) − 2d T (k + 1)(R2 ⊗ R̄1 ) f (k + 1)
θ2
˜
+ f T (k + 1)(R2 ⊗ R̄1 )( f (k + 1) − d˜T (k)(R2 ⊗ R̄1 )d(k)]
(76)
Using the dynamics of the distributed adaptive compensator
in (70) with (76), one has
= x̃T (k)(cL̂T Q2 ⊗ K T BT P1 A)x̃(k) + 2d˜T (k)(Q2 ⊗ BT P1 A)x̃(k)
+2 f T (k)(Q2 ⊗ BT P1 A)x̃(k) − 2θ −1 f T (k + 1)(Q2 ⊗ BT P1 A)x̃(k)
˜ + 2 f T (k)(R2 ⊗ R̄1 )d(k)
˜
+(1 − θ −2 )d˜T (k)(R2 ⊗ R̄1 )d(k)
˜ + f T (k)(R2 ⊗ R̄1 ) f (k)
−2θ −1 f T (k + 1)(R2 ⊗ R̄1 )d(k)
−2θ −1 f T (k + 1)(R2 ⊗ R̄1 ) f (k)

where
˜ = d(k) − f (k)
d(k)
[d1T (k), d2T (k), . . . , dNT (k)]T

where T = K T BT P1 BK.
We now consider the part 2 of the difference equation of
the Lyapunov candidate function in (72)
˜ + 1) − θ −2 d˜T (k)(R2 ⊗ R̄1 )d(k)
˜
θ −2 d˜T (k + 1)(R2 ⊗ R̄1 )d(k
(75)

(69)

+θ −2 f T (k + 1)(R2 ⊗ R̄1 )( f (k + 1)

RnN

with d(k) =
∈
as the global
adaptive compensator vector and the dynamics of the attack
f (k) is defined in (22).
Using (65), the global dynamics of the adaptive compensator can written as
T
d(k + 1) = θ cL̂ ⊗ R̄−1
1 B P1 Ax̃(k) + θ d(k)

(70)

R̄1 = R1 + BT P1 B.

where
Define the Lyapunov candidate function function as

(77)
With the dynamics of the attack in (22), one can write (77) as
= x̃T (k)[cL̂T Q2 ⊗ K T BT P1 A]x̃(k) + 2d˜T (k)(Q2 ⊗ BT P1 A)x̃(k)
˜
+2 f T (k)(I − θ −1W T )(Q2 ⊗ BT P1 A)x̃(k) + d˜T (k)(R2 ⊗ R̄1 )d(k)
T
−1
T
−2 ˜T
˜ + 2 f (k)(I − θ W )(R2 ⊗ R̄1 )d(k)
˜
−θ d (k)(R2 ⊗ R̄1 )d(k)
+ f T (k)[(R2 ⊗ R̄1 ) − 2θ −1W T (R2 ⊗ R̄1 )
+θ −2W T (R2 ⊗ R̄1 )W ] f (k)

˜
(71)
V (k) = x̃T (k)(Q2 ⊗ P1 )x̃(k) + θ −2 d˜T (k)(R2 ⊗ R̄1 )d(k)
The difference equation of the Lyapunov candidate function
can be written as
∆V (k) = V (k + 1) −V (k)

(78)
Using Young’s inequality, one can simplify (78) as
3
≤ x̃T (k)(cQ2 L̂ ⊗ AT P1 BK)x̃(k) + 2d˜T (k)(Q2 ⊗ BT P1 A)x̃(k)
2
˜
+(2 − θ −2 )d˜T (k)(R2 ⊗ R̄1 )d(k)
+4(I − θ −1 λmin (W ))2 f T (k)(R2 ⊗ R̄1 ) f (k)

T

= x̃ (k + 1)(Q2 ⊗ P1 )x̃(k + 1) − x̃T (k)(Q2 ⊗ P1 )x̃(k)
{z
}
|

(79)

part 1

˜ + 1) − θ −1 d˜T (k)(R2 ⊗ R1 )d(k)
˜
+ θ −1 d˜T (k + 1)(R2 ⊗ R1 )d(k
|
{z
}
part 2

(72)
Using (68), part 1 of the difference equation of the Lyapunov
candidate function (72) can expressed as
= x̃T (k)(Q2 ⊗ AT P1 A − 2cQ2 L̂ ⊗ AT P1 BK
+c2 L̂T Q2 L̂ ⊗ (BK)T P1 BK − (Q2 ⊗ P1 ))x̃(k)
˜
−2x̃ (k)[Q2 ⊗ A P1 B − cL̂ Q2 ⊗ (BK) P1 B]d(k)
˜
+d˜T (k)(Q2 ⊗ BT P1 B)d(k)
T

T

T

T

(73)

Integrating equation (74) and (79), one can express the difference equation of the Lyapunov candidate function as
∆V (k) = V (k + 1) −V (k) 6 −x̃T (k)(Q2 ⊗ Q1 )x̃(k)
1
−x̃T (k)(−Q2 + Q2 L̂) ⊗ AT P1 BK)x̃(k)
2
T
+2c2 λmin (L̂T L̂)λmin (T Q−1
1 ))x̃ (k)(Q2 ⊗ Q1 )x̃(k)
˜ + (2 − θ −2 )d˜T (k)(R2 ⊗ R̄1 )d(k)
˜
+2d˜T (k)(Q2 ⊗ BT P1 B)d(k)
+4(I − θ −1 λmin (W ))2 f T (k)(R2 ⊗ R̄1 ) f (k)
(80)
Further, simplify and write (80) as

Using Young’s inequality, one can further simplify and express
(73) as
6 −x̃T (k)(Q2 ⊗ Q1 )x̃(k) − x̃T (k)(−Q2 + 2cQ2 L̂) ⊗ AT P1 BK)x̃(k)
T
+2c2 λmin (c2 L̂T L̂λmin (T Q−1
1 ))x̃ (k)(Q2 ⊗ Q1 )x̃(k)
˜ + 2d˜T (k)(Q2 ⊗ BT P1 B)d(k)
˜
−2x̃T (k)(Q2 ⊗ AT P1 B)d(k)

∆V 6 −x̃T (k)(Q2 ⊗ Q1 )x̃(k)
1
−x̃T (k)(−Q2 + cQ2 L̂) ⊗ AT P1 BK)x̃(k)
2
T
(81)
+2c2 λmin (L̂T L̂)λmin (T Q−1
1 ))x̃ (k)(Q2 ⊗ Q1 )x̃(k)
˜
− (θ −2 − 2 − 2λmin (cL̂BT P1 BR̄−1 )d˜T (k)(R2 ⊗ R̄1 )d(k)
1

(74)

+4(I − θ −1 λmin (W ))2 f T (k)(R2 ⊗ R̄1 ) f (k)

One can infer that ∆V ≤ 0, if following conditions are satis2
−1
˜
fied: d(k)
> −2 4(I−θ λmin (WT )) −1 k f (k)k and λ2m < c <
(θ

q 1
.
λm 2λmin (T Q−1
1 )

−2−2λmin (cL̂B P1 BR̄1 )

This shows that the agents consensus error is

4

2
Agent 1
Agent 2
Agent 3
Agent 4
Agent 5

2
0
-2

bounded. Therefore, the actual agents x(k) achieve the desired
consensus behavior with a bound. This completes the proof.

Remark 4. As presented in Theorem 4 and Corollary 2, existing H∞ approaches minimizes the local neighborhood tracking
error of the system εi and are not capable of attenuating
the sophisticated attacks. In contrast, the designed distributed
resilient control can successfully attenuate the adverse effects
of the attacks using the distributed adaptive compensator. The
developed compensator di (k) in (70) minimizes the deviation
of the local neighborhood tracking error of the system εi from
the local neighborhood tracking error of the virtual estimator
ε̂i . We can also infer that, although the proposed controller is
designed for leader-less multi-agent systems, it can be used
for the special case of the leader-follower systems and the
containment control systems.
V. S IMULATION R ESULTS
This section presents the simulation results to evaluate the
effectiveness of the presented work. The effect of the attack
on both non-root node and root node is analyzed, and then the
efficiency of the designed resilient controller is shown.

Fig. 1: Graph topology

Consider a graph topology of DMAS shown in Fig. 1 for 5
agents communicating with each other with the dynamics of
discrete-time DMAS as


 
0 −1
0
xi (k + 1) =
xi (k) +
ui (k)
1 0
1
(82)
f or i = 1, . . . , 5

-4

0
-1

10

20

30

40

50

60

70

80

-2

10

20

(a)

30

40

50

60

70

80

(b)

Fig. 2: The DMAS response under the effect of IMP-based attack on agent 3 (non-root
node) without adaptive compensator. (a) The agent’s state (b) The local neighborhood
tracking error
2

Agent 1
Agent 2
Agent 3
Agent 4
Agent 5

1
0
-1
-2

1

Agent 1
Agent 2
Agent 3
Agent 4
Agent 5

0.5
0
-0.5

10

20

30

40

50

60

70

80

-1

10

20

(a)

30

40

50

60

70

80

(b)

Fig. 3: The DMAS response under the effect of IMP-based attack on agent 3 (nonroot node) with adaptive compensator. (a) The agent’s state (b) The local neighborhood
tracking error

adaptive attack compensator in (65) is applied. Fig. 3 shows
the response of the system under actuator attack using the
proposed controller. The system states achieve the desired
consensus behavior and the local neighborhood tracking error
goes to zero, even in the presence of the attack on non-root
node 3. This demonstrates the mitigation of attack using the
developed resilient controller.
B. Attacks on Root Node
In this subsection, the effect of the attack on a root node is
analyzed with the IMP-based attack signal.
Consider the effect of attack on actuator of Agent 2 by IMPbased attack signal i.e. ua2 (k) = sin(k). Fig. 4(a) shows that the
compromised agent destabilizes the entire network. All agents
of the DMAS deviate from the desired consensus behavior.
The simulation results verify Theorem 2 and Theorem 3. Let
Q1 and R1 be identity matrix in (62) and (63), respectively.
Now, the proposed resilient control protocol in (64) with
adaptive attack compensator in (65) is incorporated and Fig.
4(b) shows the response of the system under actuator attack on
root node 2. The system states achieve the desired consensus
behavior, even in the presence of the attack on root node 3.
This illustrates the mitigation of sophisticated attack using the
designed resilient controller.
100

2
Agent 1
Agent 2
Agent 3
Agent 4
Agent 5

50

A. Attacks on Non-root Node
0

This subsection presents the results for the effect of the
attack on a non-root node.
Consider an IMP-based attack signal which has a common
mode with the system dynamics is launched on actuator of
Agent 3 (non-root node) i.e. ua3 (k) = sin(k). Let Q1 and R1 be
identity matrix in (62) and (63), respectively. Fig. 2 shows that
Agents 4 and 5 which are reachable from the compromised
Agent 3 do not converge to the desired consensus value and
the local neighborhood tracking error goes to zero for intact
agents. These results comply with Theorem 3 and Theorem 4.
Then, the proposed resilient control protocol in (64) with

Agent 1
Agent 2
Agent 3
Agent 4
Agent 5

1

-50
-100

Agent 1
Agent 2
Agent 3
Agent 4
Agent 5

1
0
-1

10

20

30

(a)

40

50

60

70

80

-2

10

20

30

40

50

60

70

80

(b)

Fig. 4: The DMAS response under the effect of IMP-based attack on agent 2 (root node)
with adaptive compensator. (a) The agent’s state without adaptive compensator (b) The
agent’s state with adaptive compensator

VI. C ONCLUSION
This paper presents a rigorous analysis of the effects of
attacks for leaderless discrete-time DMAS and designs a

resilient distributed control protocol their mitigation. It is
shown that the attack on a compromised agent can propagate
through the entire network and affects intact agents those are
reachable from it. Then, the IMP for the attacker shows that
an attack on a single root node can destabilize the entire
network. The attacker does not require to know about the
communication graph and the system dynamics. Furthermore,
the ineffectiveness of existing robust approach is discussed
for sophisticated attacks. To overcome the effect of the attacks on sensor and actuators of the agent in discrete-time
DMAS, a resilient controller is developed based on a virtual
estimator. The presented controller shows that the attack on
sensor and actuator can be mitigated without compromising
the connectivity of the network and achieves the desired
consensus. Although we have considered a general leaderless
consensus problem for the developed controller, it can be used
for the other DMAS problems such as leader-follower and
containment control problem. The analysis and effectiveness
of the presented work have shown in simulation results.
R EFERENCES
[1] R. Olfati-Saber, J. A. Fax, and R. M. Murray, “Consensus and cooperation in networked multi-agent systems”, Proceedings of the IEEE, vol.
95, pp. 215-233, Jan 2007.
[2] J. A. Fax, and R. M. Murray, “Information flow and cooperative control
of vehicle formations”, IEEE Transactions on Automatic Control, vol.
49, no. 9, pp. 1465-1476, 2004.
[3] F. Bullo, J. Cortes, and S. Martinez, Distributed control of robotic
networks: a mathematical approach to motion coordination algorithms.
Princeton University Press, 2009.
[4] A. Jadbabaie, J. Lin, and A. Morse, “Coordination of groups of mobile
autonomous agents using nearest neighbor rules”, IEEE Transactions on
Automatic Control, vol. 48, no. 6, pp. 988-1001, 2003.
[5] A.J. Kerns, D. P. Shepard, J. A. Bhatti, and T. E. Humphreys, “Unmanned aircraft capture and control via GPS spoofing”, Journal of Field
Robotics, vol. 31, pp. 617-636, 2014.
[6] F. Pasqualetti, F. Drfler, and F. Bullo, “Attack detection and identification
in cyber-physical systems”, IEEE Transactions on Automatic Control,
vol. 58, pp. 2715-2729, 2013.
[7] K. G. Vamvoudakis, J. P. Hespanha, B. Sinopoli, and Y. Mo, “Detection
in adversarial environments,” IEEE Transactions on Automatic Control,
vol. 59, no. 12, pp. 3209-3223, 2014.
[8] A. Teixeira, H. Sandberg, and K. H. Johansson, “ Strategic stealthy
attacks: the output-to-output l2 -gain,” In Proceedings of IEEE 54th
Annual Conference on Decision and Control, pp. 2582-2587, 2015.
[9] Z. Guo, D. Shi, K. H. Johansson, and L. Shi, “Optimal linear cyberattack on remote state estimation,” IEEE Transactions on Control of
Network Systems, vol. 4, no. 1, pp. 4-13, 2017.
[10] R. Mitchell, and I. Chen, “Adaptive intrusion detection of malicious
unmanned air vehicles using behavior rule specifications”, IEEE Transactions on SMC systems, vol. 44, no. 5, pp. 593-604, May 2014.
[11] N. Bezzo, J. Weimer, M. Pajic, O. Sokolsky, G. J. Pappas, and I. Lee,
“Attack resilient state estimation for autonomous robotic systems,” In
proceedings of IEEE/RSJ Conference on Intelligent Robots and Systems,
pp. 3692-3698, 2014.
[12] C. Persis, and P. Tesi, “Resilient Control under Denial-of-Service”, In
proceedings of the 19th IFAC World Congress, South Africa, 2014.
[13] S. Sundaram, and C.N. Hadjicostis, “Distributed function calculation
via linear iterative strategies in the presence of malicious agents,” IEEE
Transactions on Automatic Control, vol. 56, no. 7, pp. 1495-1508, 2011.
[14] S. Sundaram, and B. Gharesifard, “Consensus-based distributed optimization with malicious nodes,” In Proceedings of Conference on
Communication, Control, and Computing (Allerton), pp. 244-249, 2015.
[15] F. Pasqualetti, A. Bicchi, and F. Bullo, “Consensus computation in
unreliable networks: A system theoretic approach”, IEEE Transactions
on Automatic Control, vol. 57, no. 1, pp. 90-104, 2012.
[16] H.J. LeBlanc, H. Zhang, X. Koutsoukos, and S. Sundaram, “Resilient
asymptotic consensus in robust networks,” IEEE Journal on Selected
Areas in Communications, vol. 31, no. 4, pp. 766-781, 2013.

[17] K. Saulnier, D. Saldana, A. Prorok, G. Pappas, and V. Kumar, “Resilient
Flocking for Mobile Robot Teams,” IEEE Robotics and Automation
Letters, vol. 2, no. 2, pp. 1039-1046, 2017.
[18] A. Teixeira, I. Shames, H. Sandberg, and K. H. Johansson, “A secure
control framework for resource-limited adversaries,” Automatica, vol.
51, pp. 135-148, 2015.
[19] H.J. LeBlanc, H. Zhang, S. Sundaram, and X. Koutsoukos, “Consensus
of multi-agent networks in the presence of adversaries using only local
information,” In Proceedings of the 1st international conference on High
Confidence Networked Systems, pp. 1-10, 2012.
[20] H.J. LeBlanc, and X. Koutsoukos, “Resilient synchronization in robust
networked multi-agent systems,” In Proceedings of the 16th international conference on Hybrid systems: computation and control, pp. 2130, 2013.
[21] W. Zeng, and M. Chow, “Resilient distributed control in the presence of
misbehaving agents in networked control systems,” IEEE transactions
on cybernetics, vol. 44, no. 11, pp. 2038-2049, 2014.
[22] T. Alpcan, and T. Basar, “A game theoretic analysis of intrusion detection
in access control systems,” In Proceedings of IEEE Conference on
Decision and Control, pp. 1568-1573, 2004.
[23] Y. Mo, and B. Sinopoli, “Secure estimation in the presence of integrity
attacks”, IEEE Transactions on Automatic Control, vol. 60, no. 4, pp.
1145-1151, 2015.
[24] Q. Zhu, and T. Basar, “Robust and resilient control design for cyberphysical systems with an application to power systems,” In Proceedings
of IEEE Conference on Decision and Control and European Control
Conference (CDC-ECC), pp. 4066-4071, 2011.
[25] A. Hota, and S. Sundaram, “Interdependent security games on networks
under behavioral probability weighting”, IEEE Transactions on Control
of Network Systems, 2016.
[26] M. Zhu, and S. Martnez, “On distributed constrained formation control
in operatorvehicle adversarial networks,” Automatica, vol. 49, no. 12,
pp. 3571-3582, 2013.
[27] M. Zhu, and S. Martnez, “On the performance analysis of resilient
networked control systems under replay attacks,” IEEE Transactions on
Automatic Control, vol. 59, no. 3, pp.804-808, 2014.
[28] M. Zhu, and S. Martnez, “Consensus-based distributed optimization
with malicious nodes,” In Proceedings of Communication, Control, and
Computing (Allerton), pp. 244-249, 2015.
[29] H. Fawzi, P. Tabuada, and S. Diggavi, “Secure estimation and control for
cyber-physical systems under adversarial attacks,” IEEE Transactions on
Automatic Control, vol. 59, no. 6, pp. 1454-1467, 2014.
[30] Y. Shoukry, P. Nuzzo, A. Puggelli, A.L. Sangiovanni-Vincentelli, S.A.
Seshia, and P. Tabuada, “Secure state estimation for cyber physical
systems under sensor attacks: a satisfiability modulo theory approach,”
IEEE Transactions on Automatic Control, 2017.
[31] G. D. Torre and T. Yucelen, “Adaptive architectures for resilient control
of networked multi-agent systems in the presence of misbehaving
agents,” International Journal of Control, pp. 1-13, 2017.
[32] X. Jin, W.M. Haddad, and T. Yucelen, “An adaptive control architecture
for mitigating sensor and actuator attacks in cyber-physical systems,”
IEEE Transactions on Automatic Control, 2017.
[33] F. Lewis, H. Zhang, K. Hengster-Movric, and A. Das, Cooperative Control of Multi-Agent Systems: Optimal and Adaptive Design Approaches,
Communications and Control Engineering, Springer, London, 2013.
[34] Z. Li, and Z. Duan, Cooperative Control of Multi-Agent Systems:
A Consensus Region Approach. Automation and Control Engineering,
Taylor and Francis, 2014.
[35] K.G. Vamvoudakis, F. L. Lewis, and G. R. Hudas, “Multi-agent differential graphical games: Online adaptive learning solution for synchronization with optimality”, Automatica, vol. 48, no. 8, pp. 1598-1611,
2012.
[36] D. Harville, Matrix algebra from a statistician’s perspective, SpringerVerlag New York, 1997.
[37] Q. Jiao, H. Modares, F. L. Lewis, S. Xu, and L. Xie, “Distributed gain
output-feedback control of homogeneous and heterogeneous systems”,
Automatica, vol. 71, pp. 361-368, 2016.
[38] Q. Liu, Z. Wang, X. He, and D. Zhou, “Event-Based H∞ Consensus
Control of Multi-Agent Systems With Relative Output Feedback: The
Finite-Horizon Case”, IEEE Transactions on Automatic Control, vol. 60,
no. 9, pp. 2553-2558, 2015.
[39] A. Isidori, Nonlinear control systems, Springer Science and Business
Media, 2013.

