A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Prediction Model: LDS or AR. <s> The field of identification and process-parameter estimation has developed rapidly during the past decade. In this survey paper the state-of-the-art/science is presented in a systematic way. Attention is paid to general properties and to classification of identification problems. Model structures are discussed; their choice hinges on the purpose of the identification and on the available a priori knowledge. For the identification of models that are linear in the parameters, the survey explains the least squares method and several of its variants which may solve the problem of correlated residuals, viz. repeated and generalized least squares, maximum likelihood method, instrumental variable method, tally principle. Recently the non-linear situation, the on-line and the real-time identification have witnessed extensive developments. These are also reported. There are 230 references listed, mostly to recent contributions. In appendices a resume is given of parameter estimation principles and a more detailed exposition of an example of least squares estimation. <s> BIB001 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Prediction Model: LDS or AR. <s> Off-the-shelf intrusion detection systems prove an ill fit for protecting industrial control systems, as they do not take their process semantics into account. Specifically, current systems fail to detect recent process control attacks that manifest as unauthorized changes to the configuration of a plant's programmable logic controllers (PLCs). In this work we present a detector that continuously tracks updates to corresponding process variables to then derive variable-specific prediction models as the basis for assessing future activity. Taking a specification-agnostic approach, we passively monitor plant activity by extracting variable updates from the devices' network communication. We evaluate the capabilities of our detection approach with traffic recorded at two operational water treatment plants serving a total of about one million people in two urban areas. We show that the proposed approach can detect direct attacks on process control, and we further explore its potential to identify more sophisticated indirect attacks on field device measurements as well. <s> BIB002 </s> A Survey of Physics-Based Attack Detection in Cyber-Physical Systems <s> Prediction Model: LDS or AR. <s> Embedded sensing systems are pervasively used in life- and security-critical systems such as those found in airplanes, automobiles, and healthcare. Traditional security mechanisms for these sensors focus on data encryption and other post-processing techniques, but the sensors themselves often remain vulnerable to attacks in the physical/analog domain. If an adversary manipulates a physical/analog signal prior to digitization, no amount of digital security mechanisms after the fact can help. Fortunately, nature imposes fundamental constraints on how these analog signals can behave. This work presents PyCRA, a physical challenge-response authentication scheme designed to protect active sensing systems against physical attacks occurring in the analog domain. PyCRA provides secure active sensing by continually challenging the surrounding environment via random but deliberate physical probes. By analyzing the responses to these probes, the system is able to ensure that the underlying physics involved are not violated, providing an authentication mechanism that not only detects malicious attacks but provides resilience against them. We demonstrate the effectiveness of PyCRA in detecting and mitigating attacks through several case studies using two sensing systems: (1) magnetic sensors like those found on gear and wheel speed sensors in robotics and automotive, and (2) commercial Radio Frequency Identification (RFID) tags used in many security-critical applications. In doing so, we evaluate both the robustness and the limitations of the PyCRA security scheme, concluding by outlining practical considerations as well as further applications for the proposed authentication mechanism. <s> BIB003
The model of how a physical system behaves can be developed from physical equations (Newton's laws, fluid dynamics, or electromagnetic laws) or it can be learned from observations through a technique called system identification BIB001  . In system identification one often has to use either Auto-Regressive Moving Average with eXogenous inputs (ARMAX) or linear state-space models. Two popular models used by the papers we survey are Auto-Regressive (AR) models (e.g., used by Hadziosmanovic et al. BIB002 ) and Linear Dynamical State-Space (LDS) models (e.g., used by PyCRA BIB003 ). AR models are a subset of ARMAX models but without modeling external inputs or the average error and LDS are a subset of state space models. To make a prediction, we need y k (and u k for LDS) to obtain aŷ k+1 . For the particular case of LDS, a state estimator uses y k , u k to obtainx k+1 , and then computeŷ k+1 = Cx k+1 (if D is not zero, then we also need u k+1 ). Some communities adopt models that employ the observation equation from Equation (2) without the dynamic state equation. In this particular case, it is possible to assume that the at each sampling instant, the system has already reached some (quasi)stable state. We refer to this special case of LDS as Static Linear State-space (SLS) model.