  The problem of state estimation in the setting of partially-observed discrete
event systems subject to cyber attacks is considered. An operator observes a
plant through a natural projection that hides the occurrence of certain events.
The objective of the operator is that of estimating the current state of the
system. The observation is corrupted by an attacker which can tamper with the
readings of a set of sensors thus inserting some fake events or erasing some
observations. The aim of the attacker is that of altering the state estimation
of the operator. An automaton, called joint estimator, is defined to describe
the set of all possible attacks. In more details, an unbounded joint estimator
is obtained by concurrent composition of two state observers, the attacker
observer and the operator observer. The joint estimator shows, for each
possible corrupted observation, the joint state estimation, i.e., the set of
states consistent with the uncorrupted observation and the set of states
consistent with the corrupted observation. Such a structure can be used to
establish if an attack function is harmful w.r.t. a misleading relation. Our
approach is also extended to the case in which the attacker may insert at most
n events between two consecutive observations.
