A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Background <s> In this paper we survey a number of methods for the detection of abrupt changes (such as failures) in stochastic dynamical systems. We concentrate on the class of linear systems, but the basic concepts, if not the detailed analyses, carry over to other classes of systems. The methods surveyed range from the design of specific failure-sensitive filters, to the use of statistical tests on filter innovations, to the development of jump process formulations. Tradeoffs in complexity vs performance are discussed. <s> BIB001 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Background <s> Techniques to detect and isolate failures in complex technological systems, such as sensor biases, actuator malfunctions, leaks, and equipment deterioration are surveyed. The methods are based on analytical redundancy afforded by a mathematical model of the system. The main components of such techniques are residual generation using the model, signature generation by statistical testing, and signature analysis. Model-structural conditions for failure isolation are introduced together with transformation methods to implement them. Sensitivity and robustness considerations are presented, and a design framework based on model redundancy is proposed. > <s> BIB002 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Background <s> Fault detection, isolation, and reconfiguration (FDIR) is an important and challenging problem in many engineering applications and continues to be an active area of research in the control community. This paper presents a survey of the various model-based FDIR methods developed in the last decade. In the paper, the FDIR problem is divided into the fault detection and isolation (FDI) step, and the controller reconfiguration step. For FDI, we discuss various model-based techniques to generate residuals that are robust to noise, unknown disturbance, and model uncertainties, as well as various statistical techniques of testing the residuals for abrupt changes (or faults). We then discuss various techniques of implementing reconfigurable control strategy in response to faults. <s> BIB003 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Background <s> Smart grid deployment initiatives have been witnessed in the past recent years. Smart grids provide bi-directional communication between meters and headend system through Advanced Metering Infrastructure (AMI). Recent studies highlight the threats targeting AMI. Despite the need of tailored Intrusion Detection Systems (IDS) for the smart grid, very limited progress has been made in this area. Unlike traditional networks, smart grid has its own unique challenges, such as limited computational power devices and potentially high deployment cost, that restrict the deployment options of intrusion detectors. We show that smart grid exhibits deterministic and predictable behavior that can be accurately modeled to develop intrusion detection system. In this paper, we show that AMI behavior can be modeled using event logs collected at smart collectors, which in turn can be verified using the specifications invariant generated from the configurations of the AMI devices. Event logs are modeled using fourth order Markov Chain and specifications are written in Linear Temporal Logic (LTL). The approach provides robustness against evasion and mimicry attacks, however, we discuss that it still can be evaded to a certain extent. We validate our approach on a real-world dataset of thousands of meters collected at the AMI of a leading utility provider. <s> BIB004 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Background <s> The new culture of networked systems that offer everywhere accessible services has given rise to various types of security tradeoffs. In fact, with the evolution of physical systems that keep getting integrated with cyber frameworks, cyber threats have far more critical effects as they get reflected on the physical environment. As a result, the issue of security of cyber physical systems requires a special holistic treatment. In this paper, we study the tradeoff between security, safety, and availability in such systems and demonstrate these concepts on implantable medical devices as a case study. We discuss the challenges and constraints associated with securing such systems and focus on the tradeoff between security measures required for blocking unauthorized access to the device and the safety of the patient in emergency situations where such measures must be dropped to allow access. We analyze the up to date proposed solutions and discuss their strengths and limitations. <s> BIB005
A general feedback control system has four components: (1) the physical phenomena of interest (sometimes called the "plant"), BIB005 sensors to observe the physical system and send a time series y k denoting the value of the physical measurement at time k (e.g., the voltage at 3am is 120KV), (3) based on the sensor measurements received y k , the controller sends control commands u k (e.g., open a valve by 10%) to actuators, and (4) actuators that change the control command to an actual physical change (the device that opens the valve). A general security monitoring architecture for control systems that looks into the "physics" of the system needs an anomaly detection system that receives as inputs the sensor measurements y k from the physical system and the control commands u k sent to the physical system and then uses them to identify any suspicious sensor or control commands is shown in Figure 1 . The idea of monitoring sensor measurements y k and control commands u k and to use them to identify problems with sensors, actuators, or controllers is not new. In fact, this is what the literature of fault-detection in dynamical systems has investigated for more than four decades BIB002 BIB003 BIB001 . Fault Detection, Isolation, and Reconfiguration (FDIR) methods are diverse and encompass research on hardware redundancy (e.g., adding more sensors to detect faulty measurements, or adding more controllers and decide on a majority voting control) as well as software (also known as analytical) redundancy BIB003 . While fault-detection theory provides the foundations for our work, the disadvantage of fault-detection systems is that they were designed to detect and respond to equipment failures, random faults, and accidents, not attacks. Fig. 1 . Anomaly detection architecture. The sensor measurements y k and the control commands u k are fed to the anomaly detection block. Under normal operating conditions, the actuation on the plant corresponds to the intended action by the controller: v k = u k , and the observations are correctly reported back to the controller: y k = z k . Fig. 2 . When one or more actuation signals are compromised (e.g., the actuator itself is compromised or it receives and accepts a control command from an untrusted entity), the actuation to the plant will be different to the intended action by the controller: v k u k . This false actuation will in turn affect the measured variables of the plant z k , which in turn affect the sensor measurements reported back to the controller: y k = z k . Figure 2 shows an attack on the actuator, which modifies the control command send to the plant. Note that the controller is not aware of the communication interruption. However, Figure 3 shows an attack in the sensor, which allows the attacker to deceive the controller about the real state of the plant. In the worst case, the control device can be compromised as well, giving the attacker potentially unlimited control on the plant to implement any outcome (see Figure 4 ). This last figure also captures the threat model from a malicious control command sent from the control center as seen in Figure 5 : While the implementation might be different-one monitor is placed in the supervisory network and the other monitor on the field communications interface-the logical architecture-what the monitoring application sees-will be the same. In these attack schemes, we assume that the control has a trusted detection mechanism, which can recognize unexpected behaviors and potentially take counter measures. The detection block in Figures 1-4 is expanded in Figure 6 to illustrate several alternative algorithms we found in the literature. There are two blocks that are straightforward to implement: BIB004 The controller block in Figure 6 is a redundant control algorithm (i.e., in addition to the controller of Figure 1 ) that checks if the controller is sending the appropriate u k to the field, and (2) The safety check block is an algorithm that checks if the predicted future state of the system will violate a safety specification (e.g., the pressure in a tank will exceed its safety limit). The Fig. 3 . When one or more sensor signals are compromised (e.g., the sensor itself is compromised or the controller receives and accepts a sensor measurement from an untrusted entity), the sensor measurement used as an input to the control algorithm will be different from the real state of the measured variables y k z k . Fig. 4 . When the controller is compromised, it will generate a control signal that does not satisfy the logic of the correct control algorithm: u k K (y k ). different alternative detection algorithms are also summarized in Table 1 . In this article, we focus on analyzing the more challenging algorithms: (1) Prediction (Physical Model): given sensor y k and control commands u k , a model of the physical system will predict a future expected measurementŷ k+1 . If we only have output data (sensor measurements y k ), then regression models like AR, ARMA, or ARIMA are a popular way to learn the correlation between observations. Using these models, we can predict the next outcome. For example, for an Auto-Regressive (AR) model, the prediction would be Fig. 6 . The detection block from Figure 1 , with a set of different detection algorithms. In the top, the controller block is a redundant control (i.e., in addition to the controller of Figure 1 ) that checks if the control commands are appropriate. The middle row (prediction, residual generation, and anomaly detection blocks) focuses on looking at the sensor values and raising an alarm if they are different than what we expect/predict. The prediction and safety check blocks focus on predicting the future state of the system, and if it violates a safety limit, then we raise an alert.  where α i are the coefficients learned through system identification and y i the last N sensor measurements-where the amount of parameters to learn N can be also estimated to prevent over-fitting of the model using tools like Akaike's Information Criteria (AIC). It is possible to obtain the coefficients α i , by solving an optimization problem that minimizes the residuals (e.g., least squares)  . If we have inputs (control commands u k ) and outputs (sensor measurements y k ) available, then we can use subspace model identification methods, producing the following model: where A, B, C, and D are matrices modeling the dynamics of the physical system. Most physical systems are strictly causal and then therefore usually D = 0. The control commands u k ∈ R p affect the next time step of the state of the system x k ∈ R n and sensor measurements y k ∈ R q are modeled as a linear combination of these hidden states. e k and ϵ k are sensor and perturbation noise, and are assumed to be a random process with zero mean. (2) Anomaly detection (Statistical Test): Given a time series of residuals r k (the difference between the received sensor measurement y k and the predicted/expected measurementŷ k ), the anomaly detection test needs to determine when to raise an alarm. Anomaly detection strategies that are based on residuals, can be divided into two main categories: Statelss and Stateful. In a Stateless test, we raise an alarm for every single significant deviation at time k, i.e., if In a Stateful test, we compute an additional statistic S k that keeps track of the historical changes of r k (no matter how small) and generate an alert if S k ≥ τ , i.e., if there is a persistent deviation across multiple time steps. There are many tests that can keep track of the historical behavior of the residual r k such as taking an average over a time-window, an exponential weighted moving average (EWMA), or using change detection statistics such as the non-parametric CUmulative SUM (CUSUM) statistic. The theory behind CUSUM assumes we have a probability model for our observations r k (the residuals in our case); this obscures the intuition behind CUSUM, so we focus on the non-parametric CUSUM (CUSUM without probability likelihood models), which is basically a sum of the residuals. In this case, the CUSUM statistic is defined recursively as S 0 = 0 and S k+1 = (S k + |r k | − δ ) + , where (x ) + represents max(0, x ) and δ is selected so that the expected value of |r k | − δ < 0 under hypothesis H 0 (i.e., δ prevents S k from increasing consistently under normal operation). An alert is generated whenever the statistic is greater than a previously defined threshold S k > τ and the test is restarted with S k+1 = 0. By focusing on these algorithms our detection block can be simplified as shown in Figure 7 .