{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,6]],"date-time":"2026-06-06T14:34:05Z","timestamp":1780756445586,"version":"3.54.1"},"publisher-location":"New York, New York, USA","reference-count":55,"publisher":"ACM Press","license":[{"start":{"date-parts":[[2019,1,1]],"date-time":"2019-01-01T00:00:00Z","timestamp":1546300800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2019]]},"DOI":"10.1145\/3338499.3357358","type":"proceedings-article","created":{"date-parts":[[2019,11,8]],"date-time":"2019-11-08T13:40:33Z","timestamp":1573220433000},"page":"87-98","source":"Crossref","is-referenced-by-count":9,"title":["The Leaky Actuator"],"prefix":"10.1145","author":[{"given":"Amir","family":"Herzberg","sequence":"first","affiliation":[{"name":"University of Connecticut, Storrs, CT, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yehonatan","family":"Kfir","sequence":"additional","affiliation":[{"name":"Bar-Ilan University, Ramat-Gan, Israel"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","reference":[{"key":"key-10.1145\/3338499.3357358-1","unstructured":"IAEA's nuclear security series. online,,https:\/\/www.iaea.org\/resources\/nuclear-security-series. Accessed: 2019-04-03."},{"key":"key-10.1145\/3338499.3357358-2","unstructured":"Industrial communication networks - Network and system security - Part 3--3: System security requirements and security levels, howpublished = https:\/\/webstore.iec.ch\/publication\/7033, note = Accessed: 2019-04-03."},{"key":"key-10.1145\/3338499.3357358-3","unstructured":"Managing Cyber Security for ICS. online, https:\/\/www.ssi.gouv.fr\/uploads\/2014\/01\/Managing_Cybe_for_ICS_EN.pdf. Accessed: 2019-04-03."},{"key":"key-10.1145\/3338499.3357358-4","unstructured":"Boussad Addad and Saïd Amari. Delay evaluation and compensation in ethernet-networked control systems. In 16th International Conference on Real-Time and Network Systems (RTNS 2008), 2008."},{"key":"key-10.1145\/3338499.3357358-5","doi-asserted-by":"crossref","unstructured":"Boussad Addad, Saïd Amari, and Jean-Jacques Lesage. Analytic calculus of response time in networked automation systems. IEEE Transactions on Automation Science and Engineering, 7(4):858--869, 2010.","DOI":"10.1109\/TASE.2010.2047499"},{"key":"key-10.1145\/3338499.3357358-6","unstructured":"Chuadhry Mujeeb Ahmed, Jianying Zhou, and Aditya P Mathur. Noise matters: Using sensor and process noise fingerprint to detect stealthy cyber attacks and authenticate sensors in cps. In Proceedings of the 34th Annual Computer Security Applications Conference, pages 566--581. ACM, 2018."},{"key":"key-10.1145\/3338499.3357358-7","doi-asserted-by":"crossref","unstructured":"Emad Ali. pH control using PI control algorithms with automatic tuning method. Chemical Engineering Research and Design, 79(5):611--620, 2001.","DOI":"10.1205\/02638760152424398"},{"key":"key-10.1145\/3338499.3357358-8","doi-asserted-by":"crossref","unstructured":"Luis B Almeida. Product and convolution theorems for the fractional fourier transform. IEEE Signal Processing Letters, 4(1):15--17, 1997.","DOI":"10.1109\/97.551689"},{"key":"key-10.1145\/3338499.3357358-9","unstructured":"Saurabh Amin, Xavier Litrico, S Shankar Sastry, and Alexandre M Bayen. Cyber security of water scada systems\"part ii: Attack detection using enhanced hydrodynamic models. IEEE Transactions on Control Systems Technology, 21(5):1679--1693, 2013."},{"key":"key-10.1145\/3338499.3357358-10","doi-asserted-by":"crossref","unstructured":"Wissam Aoudi, Mikel Iturbe, and Magnus Almgren. Truth will out: Departure-based process-level detection of stealthy attacks on control systems. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, CCS '18, pages 817--831, New York, NY, USA, 2018. ACM.","DOI":"10.1145\/3243734.3243781"},{"key":"key-10.1145\/3338499.3357358-11","doi-asserted-by":"crossref","unstructured":"Davide B Bartolini, Philipp Miedl, and Lothar Thiele. On the capacity of thermal covert channels in multicores. In Proceedings of the Eleventh European Conference on Computer Systems, page 24. ACM, 2016.","DOI":"10.1145\/2901318.2901322"},{"key":"key-10.1145\/3338499.3357358-12","unstructured":"Rakesh B Bobba, Katherine M Rogers, Qiyan Wang, Himanshu Khurana, Klara Nahrstedt, and Thomas J Overbye. Detecting false data injection attacks on dc state estimation. In Preprints of the First Workshop on Secure Control Systems, CPSWEEK, volume 2010, 2010."},{"key":"key-10.1145\/3338499.3357358-13","doi-asserted-by":"crossref","unstructured":"Andrea Carcano, Alessio Coletta, Michele Guglielmi, Marcelo Masera, I Nai Fovino, and Alberto Trombetta. A multidimensional critical state analysis for detecting intrusions in SCADA systems. IEEE Transactions on Industrial Informatics, 7(2):179--186, 2011.","DOI":"10.1109\/TII.2010.2099234"},{"key":"key-10.1145\/3338499.3357358-14","unstructured":"US Nuclear Regulatory Commission et al. Cyber security programs for nuclear facilities, regulatory guide 5.71, pg. 18. US Nuclear Regulatory Commission, Office of Nuclear Regulatory Research, 2010."},{"key":"key-10.1145\/3338499.3357358-15","unstructured":"Thomas M Cover and Joy A Thomas. Elements of information theory. John Wiley & Sons, 2012."},{"key":"key-10.1145\/3338499.3357358-16","unstructured":"Jonathan de Brun Mangs and Mikael Tillquist. Evaluation of a programmable hydraulic valve for drill rig applications, 2018."},{"key":"key-10.1145\/3338499.3357358-17","doi-asserted-by":"crossref","unstructured":"Bruno Denis, Silvain Ruel, Jean-Marc Faure, Georg Frey, and Gaelle Marsal. Measuring the impact of vertical integration on response times in ethernet fieldbuses. In 2007 IEEE Conference on Emerging Technologies and Factory Automation (EFTA 2007), pages 532--539. IEEE, 2007.","DOI":"10.1109\/EFTA.2007.4416815"},{"key":"key-10.1145\/3338499.3357358-18","unstructured":"Luke Deshotels. Inaudible sound as a covert channel in mobile devices. In WOOT, 2014."},{"key":"key-10.1145\/3338499.3357358-19","unstructured":"David Dittrich. So you want to take over a botnet... In LEET, 2012."},{"key":"key-10.1145\/3338499.3357358-20","unstructured":"A Divya, NM Ramya, and V Gomath. Online monitoring of temperature control in nuclear power plants with alarm indication using soft computing technique."},{"key":"key-10.1145\/3338499.3357358-21","doi-asserted-by":"crossref","unstructured":"Noam Erez and Avishai Wool. Control variable classification, modeling and anomaly detection in modbus\/tcp scada systems. International Journal of Critical Infrastructure Protection, 2015.","DOI":"10.1016\/j.ijcip.2015.05.001"},{"key":"key-10.1145\/3338499.3357358-22","doi-asserted-by":"crossref","unstructured":"Mostefa Ghassoul. pH control using MATLAB. In MATLAB-A Fundamental Tool for Scientific Computing and Engineering Applications-Volume 1. In Tech, 2012.","DOI":"10.5772\/46454"},{"key":"key-10.1145\/3338499.3357358-23","unstructured":"Oded Goldreich, Shafi Goldwasser, and Silvio Micali. How to construct random functions. In Foundations of Computer Science, 1984. 25th Annual Symposium on, pages 464--479. IEEE, 1984."},{"key":"key-10.1145\/3338499.3357358-24","doi-asserted-by":"crossref","unstructured":"Charles Miller Grinstead and James Laurie Snell. Introduction to probability. American Mathematical Soc., 2012.","DOI":"10.1090\/stml\/057"},{"key":"key-10.1145\/3338499.3357358-25","unstructured":"Mordechai Guri, Matan Monitz, Yisroel Mirski, and Yuval Elovici. Bitwhisper: Covert signaling channel between air-gapped computers using thermal manipulations. In Computer Security Foundations Symposium (CSF), 2015 IEEE 28th, pages 276--289. IEEE, 2015."},{"key":"key-10.1145\/3338499.3357358-26","unstructured":"Mordechai Guri, Yosef Solewicz, Andrey Daidakulov, and Yuval Elovici. Fansmitter: Acoustic data exfiltration from (speakerless) air-gapped computers. arXiv preprint arXiv:1606.05915, 2016."},{"key":"key-10.1145\/3338499.3357358-27","doi-asserted-by":"crossref","unstructured":"Dina Hadz iosmanović, Robin Sommer, Emmanuele Zambon, and Pieter H Hartel. Through the eye of the plc: semantic security monitoring for industrial processes. In Proceedings of the 30th Annual Computer Security Applications Conference, pages 126--135. ACM, 2014.","DOI":"10.1145\/2664243.2664277"},{"key":"key-10.1145\/3338499.3357358-28","doi-asserted-by":"crossref","unstructured":"Khodor Hamandi, Imad H Elhajj, Ali Chehab, and Ayman Kayssi. Android SMS botnet: a new perspective. In Proceedings of the 10th ACM international symposium on Mobility management and wireless access, pages 125--130. ACM, 2012.","DOI":"10.1145\/2386995.2387016"},{"key":"key-10.1145\/3338499.3357358-29","doi-asserted-by":"crossref","unstructured":"Michael Hanspach and Michael Goetz. On covert acoustical mesh networks in air. arXiv preprint arXiv:1406.1213, 2014.","DOI":"10.12720\/jcm.8.11.758-767"},{"key":"key-10.1145\/3338499.3357358-30","doi-asserted-by":"crossref","unstructured":"Michael A Henson and Dale E Seborg. Adaptive nonlinear control of a pHneutralization process. IEEE transactions on control systems technology, 2(3):169--182, 1994.","DOI":"10.1109\/87.317975"},{"key":"key-10.1145\/3338499.3357358-31","doi-asserted-by":"crossref","unstructured":"Amir Herzberg and Yehonatan Kfir. The chatty-sensor: A provable-covert channel in cyber physical systems. In Proceedings of the 35th Annual Computer Security Applications Conference. ACM, 2019.","DOI":"10.1145\/3359789.3359794"},{"key":"key-10.1145\/3338499.3357358-32","unstructured":"Richard A Kemmerer. Shared resource matrix methodology: An approach to identifying storage and timing channels. ACM Transactions on Computer Systems (TOCS), 1(3):256--277, 1983."},{"key":"key-10.1145\/3338499.3357358-33","doi-asserted-by":"crossref","unstructured":"Max Kerkers, José Jair Santanna, and Anna Sperotto. Characterisation of the kelihos. b botnet. In IFIP International Conference on Autonomous Infrastructure, Management and Security, pages 79--91. Springer, 2014.","DOI":"10.1007\/978-3-662-43862-6_11"},{"key":"key-10.1145\/3338499.3357358-34","doi-asserted-by":"crossref","unstructured":"Xiaowu Kong and Shizhen Li. Dynamic performance of high speed solenoid valve with parallel coils. Chinese Journal of Mechanical Engineering, 27(4):816--821, 2014.","DOI":"10.3901\/CJME.2014.0513.091"},{"key":"key-10.1145\/3338499.3357358-35","doi-asserted-by":"crossref","unstructured":"Moshe Kravchik and Asaf Shabtai. Detecting cyber attacks in industrial control systems using convolutional neural networks. In Proceedings of the 2018 Workshop on Cyber-Physical Systems Security and PrivaCy, pages 72--83. ACM, 2018.","DOI":"10.1145\/3264888.3264896"},{"key":"key-10.1145\/3338499.3357358-36","doi-asserted-by":"crossref","unstructured":"Prashanth Krishnamurthy, Farshad Khorrami, Ramesh Karri, David Paul-Pena, and Hossein Salehghaffari. Process-aware covert channels using physical instrumentation in cyber-physical systems. IEEE Transactions on Information Forensics and Security, 13(11):2761--2771, 2018.","DOI":"10.1109\/TIFS.2018.2833063"},{"key":"key-10.1145\/3338499.3357358-37","doi-asserted-by":"crossref","unstructured":"Hayoung Lee, Taeho Kang, Sangho Lee, Jong Kim, and Yoonho Kim. Punobot: Mobile botnet using push notification service in android. In International Workshop on Information Security Applications, pages 124--137. Springer, 2013.","DOI":"10.1007\/978-3-319-05149-9_8"},{"key":"key-10.1145\/3338499.3357358-38","doi-asserted-by":"crossref","unstructured":"PX Li, M Su, and DB Zhang. Response characteristic of high-speed on\/off valve with double voltage driving circuit. In IOP Conference Series: Materials Science and Engineering, volume 220, page 012028. IOP Publishing, 2017.","DOI":"10.1088\/1757-899X\/220\/1\/012028"},{"key":"key-10.1145\/3338499.3357358-39","doi-asserted-by":"crossref","unstructured":"Chan-Chiao Lin, Jun-Mo Kang, JW Grizzle, and Huei Peng. Energy management strategy for a parallel hybrid electric truck. In American Control Conference, 2001. Proceedings of the 2001, volume 4, pages 2878--2883. IEEE, 2001.","DOI":"10.1109\/ACC.2001.946337"},{"key":"key-10.1145\/3338499.3357358-40","doi-asserted-by":"crossref","unstructured":"Yali Liu, Dipak Ghosal, Frederik Armknecht, Ahmad-Reza Sadeghi, Steffen Schulz, and Stefan Katzenbeisser. Robust and undetectable steganographic timing channels for iid traffic. In International Workshop on Information Hiding, pages 193--207. Springer, 2010.","DOI":"10.1007\/978-3-642-16435-4_15"},{"key":"key-10.1145\/3338499.3357358-41","doi-asserted-by":"crossref","unstructured":"Joe Loughry and David A Umphress. Information leakage from optical emanations. ACM Transactions on Information and System Security (TISSEC), 5(3):262--289, 2002.","DOI":"10.1145\/545186.545189"},{"key":"key-10.1145\/3338499.3357358-42","doi-asserted-by":"crossref","unstructured":"Xiapu Luo, Edmond WW Chan, and Rocky KC Chang. TCP covert timing channels: Design and detection. In Dependable Systems and Networks With FTCS and DCC, 2008. DSN 2008. IEEE International Conference on, pages 420--429. IEEE, 2008.","DOI":"10.1109\/DSN.2008.4630112"},{"key":"key-10.1145\/3338499.3357358-43","unstructured":"Richard E Overill. Foundations of cryptography: Basic tools. Journal of Logic and Computation, 12(3):543--544, 2002."},{"key":"key-10.1145\/3338499.3357358-44","doi-asserted-by":"crossref","unstructured":"Heloise Pieterse and Martin S Olivier. Android botnets on the rise: Trends and characteristics. In Information Security for South Africa (ISSA), 2012, pages 1--5. IEEE, 2012.","DOI":"10.1109\/ISSA.2012.6320432"},{"key":"key-10.1145\/3338499.3357358-45","doi-asserted-by":"crossref","unstructured":"Eyal Ronen and Adi Shamir. Extended functionality attacks on IoT devices: The case of smart lights. In 2016 IEEE European Symposium on Security and Privacy (EuroS&P), pages 3--12. IEEE, 2016.","DOI":"10.1109\/EuroSP.2016.13"},{"key":"key-10.1145\/3338499.3357358-46","doi-asserted-by":"crossref","unstructured":"Silvain Ruel, Olivier De Smet, and Jean-Marc Faure. Finding the bounds of response time of networked automation systems by iterative proofs. In 13th IFAC Symposium on Information Control Problems in Manufacturing (INCOM 2009), pages paper--63, 2009.","DOI":"10.3182\/20090603-3-RU-2001.00230"},{"key":"key-10.1145\/3338499.3357358-47","doi-asserted-by":"crossref","unstructured":"Sarah H Sellke, C-C Wang, Saurabh Bagchi, and Ness Shroff. TCP\/IP timing channels: Theory to implementation. In INFOCOM 2009, IEEE, pages 2204--2212. IEEE, 2009.","DOI":"10.1109\/INFCOM.2009.5062145"},{"key":"key-10.1145\/3338499.3357358-48","doi-asserted-by":"crossref","unstructured":"Claude Elwood Shannon. A mathematical theory of communication. Bell system technical journal, 27(3):379--423, 1948.","DOI":"10.1002\/j.1538-7305.1948.tb01338.x"},{"key":"key-10.1145\/3338499.3357358-49","unstructured":"Pedro Silva and Michael Schukat. On the use of k-nn in intrusion detection for industrial control systems. In Proceedings of The IT&T 13th International Conference on Information Technology and Telecommunication, Dublin, Ireland, pages 103--106, 2014."},{"key":"key-10.1145\/3338499.3357358-50","unstructured":"Saleh Soltan, Prateek Mittal, and H Vincent Poor. BlackIoT: IoT botnet of high wattage devices can disrupt the power grid. In 27th USENIX Security Symposium, pages 15--32, 2018."},{"key":"key-10.1145\/3338499.3357358-51","unstructured":"Alastair Stevenson. Botnets infecting 18 systems per second, warns fbi. V3. cok. uk, 16, 2014."},{"key":"key-10.1145\/3338499.3357358-52","doi-asserted-by":"crossref","unstructured":"David I Urbina, Jairo A Giraldo, Alvaro A Cardenas, Nils Ole Tippenhauer, Junia Valente, Mustafa Faisal, Justin Ruths, Richard Candell, and Henrik Sandberg. Limiting the impact of stealthy attacks on industrial control systems. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 1092--1105. ACM, 2016.","DOI":"10.1145\/2976749.2978388"},{"key":"key-10.1145\/3338499.3357358-53","doi-asserted-by":"crossref","unstructured":"KA Venkataraman, K Kanthavel, and B Nirmal Kumar. Investigations of response time parameters of a pneumatic 3\/2 direct acting solenoid valve under various working pressure conditions. Engineering, Technology & Applied Science Research, 3(4):502--505, 2013.","DOI":"10.48084\/etasr.360"},{"key":"key-10.1145\/3338499.3357358-54","unstructured":"Matthew Warren and William Hutchinson. Cyber attacks against supply chain management systems: a short note. International Journal of Physical Distribution & Logistics Management, 30(7\/8):710--716, 2000."},{"key":"key-10.1145\/3338499.3357358-55","unstructured":"Zhenyu Wu, Zhang Xu, and Haining Wang. Whispers in the hyper-space: High-speed covert channel attacks in the cloud. In USENIX Security symposium, pages 159--173, 2012."}],"event":{"name":"the ACM Workshop","location":"London, United Kingdom","acronym":"CPS-SPC'19","number":"2019","sponsor":["SIGSAC, ACM Special Interest Group on Security, Audit, and Control"],"start":{"date-parts":[[2019,11,11]]},"end":{"date-parts":[[2019,11,11]]}},"container-title":["Proceedings of the ACM Workshop on Cyber-Physical Systems Security & Privacy - CPS-SPC'19"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3338499.3357358","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/dl.acm.org\/ft_gateway.cfm?id=3357358&ftid=2095969&dwn=1","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T23:12:48Z","timestamp":1750201968000},"score":1,"resource":{"primary":{"URL":"http:\/\/dl.acm.org\/citation.cfm?doid=3338499.3357358"}},"subtitle":["A Provably-covert Channel in Cyber Physical Systems"],"proceedings-subject":"Cyber-Physical Systems Security & Privacy","short-title":[],"issued":{"date-parts":[[2019]]},"references-count":55,"URL":"https:\/\/doi.org\/10.1145\/3338499.3357358","relation":{},"subject":[],"published":{"date-parts":[[2019]]}}}