Clarification on Sensor Manipulation Impact in Dhalsim on Concealment MitM Attack

[jhin-coder]

Hi @afmurillo

I hope you're doing well. I'm currently using the Dhalsim tool to simulate sensor manipulation attacks, and I have a few questions about the interaction between sensor spoofing and the simulated ground truth values in the system.

What I’m trying to do:
My goal is to simulate an attack where, for example, I manipulate a tank level sensor reading to trick the SCADA system into thinking the tank is full (e.g., spoofing a reading of 500). The idea is that this false reading would cause the SCADA to stop the pump, which should then result in a change to the actual tank level (i.e., a reduction in the ground truth value, as the tank empties naturally once the pump is off).

What I’ve tried so far:

I’ve altered the sensor readings in the simulation using the Dhalsim tool to send false values.

I monitored the SCADA system’s response to the spoofed values

However, I noticed that while the SCADA responds correctly to the spoofed readings, the ground truth values do not seem to change accordingly, and the real process dynamics (like tank level decreasing) are unaffected.

My question:

Does Dhalsim support attacks that not only manipulate the SCADA-visible sensor values but also impact the underlying ground truth values and process behavior?

If not, is there a way to achieve this within the tool, or would it require custom code to reflect the physical consequences of these attacks?

Essentially, can an attack that alters sensor readings result in realistic system behavior changes in the Dhalsim simulation (e.g., stopping a pump due to a false full-tank reading and therefore reducing the real tank level)?

Because in my project this is exactly what i want to do and demonstrate the realistic impact of the cyber attack on the physical system.

I want to ensure that my simulation reflects realistic cyber-physical impacts, and I’d really appreciate your guidance on how best to approach this with Dhalsim.

Thank you in advance for your time!

Best regards,

[afmurillo]

Hello, thank you for using DHALSIM.

Are you also manipulating the values that reach the PLCs? Which attack module are you using to generate these attacks? "Concealment" in DHALSIM terms only modifies the value being reported to the SCADA server, but you also have to check that the values being sent to the PLCs are modified. For example, this attack (https://github.com/Critical-Infrastructure-Systems-Lab/DHALSIM/blob/master/examples/ctown_topology/dataset/dataset_anomaly_config_files/dataset_attacks/attack_03.yaml) does two things:

1. offset by 4.5 the T7 values being sent by PLC9 to PLC5, causing the pumps to be operated wrongly.
   You could take a look at how that attack works, as it seems similar to your scenario.