The same technique can be used to attack devices with touch-sensitive screen, identifying the region touched.
Portable panic attack devices may also be linked to an internal system providing similar locational alerts on a monitoring console.
The area is calculated in the model as the total area covered by two overlapping radii, the attacking device and the victim.
Recall that, as discussed in Section 3.1.1, without sample loss, the minimum value of (3) is minf j =0 when the attacked device is perfectly identified.
In the present attack, the estimated model of the attacked device is iteratively adjusted by the BSA, that minimizes the fitness function herein presented, until the estimated model converges to the actual model of the real device.
To do so, the attack is modeled as an optimization problem, where the transfer function of the attacked device – be it a controller or plant – is estimated by minimizing a specific fitness function.
From the attacker point of view, these higher global minimum values may indicate that the Passive System Identification attack was not effective in obtaining the model of the attacked device.
With these parameters adjusted, the BSA is used to search for the global minimum of the fitness function described in Section 3.1.1 and, therefore, discover the model of the attacked device.
There are some startups attacking device management tools, like Fleetsmith does for Apple devices (which raised $7.7 million), and to be sure provisioning and management is one part of the equation.
If the input i(k) and output o(k) signals of an attacked device are known, the model of such device can be assessed by applying the known i(k) in an estimated model, which must be adjusted until its estimated output (hat {o} k)) converges to o(k).
