Event-based state estimation for linear Gaussian systems has garnered significant attention in recent years, with deterministic and stochastic event-based protocols being the most representative. Previous studies have demonstrated that deterministic event-based protocols outperform stochastic ones in the trade-off between communication rate and estimation performance. However, our research reveals that the performance loss in deterministic event-based protocols can surpass that of stochastic event-based protocols for remote state estimation under specific attack scenarios. We explore the impact of insider attacks and derive a closed-form expression for the estimation error covariance under both protocols. Then, we propose a method for designing the attack threshold to meet stealthiness constraints. For scalar cases, we prove that under the same communication rates, the estimation performance of the stochastic event-based estimator outperforms that of its deterministic counterpart under insider attacks. Numerical simulations corroborate that the empirical results align with the theoretical findings.

This article considers malicious attacks on a stochastic event-based state estimation where a smart sensor equipped with the standard Kalman filter is utilized to transmit the local estimate. A novel attack strategy called stealthy insider attack is proposed, which can compromise remote state estimation by hacking the scheduler, reversing the triggering condition, and tampering with the schedule parameter. The discovery of the complete Gaussian crater (CGC) distribution is significant for analyzing various properties of the innovation under the stochastic event-triggered scheme (ETS). An extended CGC distribution is developed to explore the probability distribution of innovation sequences with successive packet losses, and a closed-form expression is derived for the estimation error covariance under attack. Furthermore, to bypass the communication rate detector, a method is presented for tampering with the schedule parameter based on the ergodicity of the underlying Markov chain. Finally, two numerical simulations demonstrate the efficacy of the proposed attack strategy in diminishing the estimation performance of the remote estimator.