Cited by 535Smart Grid Security and ResilienceNetwork Security and Intrusion DetectionFault Detection and Control Systems

A survey of physics-based attack detection in cyber-physical systems

Open access
Giraldo, Jairo, Urbina, David, Cardenas, Alvaro, Valente, Junia, Faisal, Mustafa, Ruths, Justin, Tippenhauer, Nils Ole, Sandberg, Henrik +1 more·2019·ACM Computing Surveys

Abstract

Monitoring the "physics" of cyber-physical systems to detect attacks is a growing area of research. In its basic form a security monitor creates time-series models of sensor readings for an industrial control system and identifies anomalies in these measurements in order to identify potentially false control commands or false sensor readings. In this paper, we review previous work on physics-based anomaly detection based on a unified taxonomy that allows us to identify limitations and unexplored challenges, and propose new solutions.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1145/3203245

Cites

108 of 108 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • The focus of most of the surveys for CPS is on security and privacy.

    “The focus of most of the surveys for CPS is on security and privacy (e.g., [84,85,93,96,102,112,113,119,124]).”

    From A Systematic Review of Data Quality in CPS and IoT for Industry 4.0 (2023) · cites this paper as [85]

    The Related Work section describes numerous CPS surveys addressing security and privacy, including surveys of smart grids and general CPS. It does not establish that these make up most CPS surveys, so the claim's majority assertion is unsupported. (LLM, conf=0.83)

    Experimental — accuracy not yet measured
  • IoT devices and networks are highly vulnerable to security attacks that target data integrity and service availability.

    “Unfortunately, IoT devices and networks are known to be highly vulnerable to security attacks that target data integrity and service availability.”

    From Deep learning-enabled anomaly detection for IoT systems (2023) · cites this paper as [6]

    The Introduction (§1.1; page unavailable) says an attacker controlling a sensor, actuator, or controller can send manipulated values, supporting the data-integrity concern for cyber-physical systems. The copy does not establish that IoT devices and networks generally are highly vulnerable, or that the attacks target service availability. (LLM, conf=0.85)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

4 of the 112 references couldn’t be matched to a known paper.

Research works printed but not linked: 12

  1. [16]Checkoway Stephen McCoy Damon Kantor Brian Anderson Danny Shacham Hovav Savage Stefan Koscher Karl Czeskis Alexei Roesner Franziska Kohno Tadayoshi 2011 Comprehensive Experimental Analyses of Automotive Attack Surfaces USENIX Security Symposium
  2. [28]Gerdes Ryan M Winstead Chris Heaslip Kevin 2013 CPS: an efficiency-motivated attack against autonomous vehicular transportation Proceedings of the Annual Computer Security Applications Conference (ACSAC) ACM 99 108
  3. [37]Henry Nathan Paul Nathanael McFarlane Nicole 2013 Using Bowel Sounds to Create a Forensically-aware Insulin Pump System Proceedings of Workshop on Health Information Technologies
  4. [43]Ishtiaq Roufa Rob Millerb Mustafaa Hossen Travis Taylora Sangho Ohb Xua Wenyuan Gruteserb Marco Trappeb Wade Seskarb Ivan 2010 Security and privacy vulnerabilities of in-car wireless networks: A tire pressure monitoring system case study Proceedings of USENIX Security Symposium 11 13
  5. [45]Jawurek Marek Kerschbaum Florian Danezis George 2012 SoK: Privacy technologies for smart gridsâĂŤA survey of options Microsoft Res Cambridge, UK (2012)
  6. [65]Ljung Lennart 1999 System Identification (2Nd Ed): Theory for the User Prentice Hall PTR Upper Saddle River, NJ, USA
  7. [66]Lun Yuriy Zacchia D’Innocenzo Alessandro Malavolta Ivano Di Benedetto Maria Domenica 2016 Cyber-Physical Systems Security: a Systematic Mapping Study arXiv preprint arXiv:1605.09641 (2016) · arXiv
  8. [69]McLaughlin Stephen 2013 CPS: Stateful Policy Enforcement for Control System Device Usage Proceedings of the Annual Computer Security Applications Conference (ACSAC) ACM New York, NY, USA 109 118
  9. [70]McLaughlin Stephen McDaniel Patrick 2012 SABOT: specification-based payload generation for programmable logic controllers Proceedings of conference on Computer and communications security (CCS) ACM 439 449
  10. [89]Rushanan Michael Rubin Aviel D Kune Denis Foo Swanson Colleen M 2014 SoK: Security and privacy in implantable medical devices and body area networks Security and Privacy (SP), 2014 IEEE Symposium on IEEE 524 539
  11. [90]Sajjad Imran Dunn Daniel D Sharma Rajnikant Gerdes Ryan 2015 Attack Mitigation in Adversarial Platooning Using Detection-Based Sliding Mode Control Proceedings of the ACM Workshop on Cyber-Physical Systems-Security and/or PrivaCy (CPS-SPC) (CPS-SPC ’15) ACM New York, NY, USA 43 53
  12. [95]Shoukry Yasser Martin Paul Yona Yair Diggavi Suhas Srivastava Mani 2015 PyCRA: Physical Challenge-Response Authentication For Active Sensors Under Spoofing Attacks Proceedings of the Conference on Computer and Communications Security (CCS) (CCS’15) ACM New York, NY, USA 1004 1015

Cited by

Sorted by citations

Authors
Giraldo, J., Urbina, D., Cardenas, A., Valente, J., Faisal, M., Ruths, J., Tippenhauer, N. O., Sandberg, H., & Candell, R.
Affiliations
  • The University of Texas at Dallas (US)
  • University of Texas at Dallas, Richardson, USA
  • Singapore University of Technology and Design (SG)
  • KTH Royal Institute of Technology (SE)
  • National Institute of Standards and Technology (US)
Venue
ACM Computing Surveys
Published
2018-07-25
Volume
51
Issue
4
Pages
1-36
ISSN
  • 0360-0300 (ISSN-L)
  • 1557-7341
OpenAlex
W2803355698
Cited by
535
References
112
Citations by year
2026: 33 · 2025: 54 · 2024: 52 · 2023: 65 · 2022: 80 · 2021: 125 · 2020: 82 · 2019: 43 · 2018: 1
FWCI
38.84
Type
journal article
Language
en
Open access
Locations
  • ACM Computing Surveys (publishedVersion)
  • PubMed (publishedVersion)
  • PubMed Central (acceptedVersion)
Funders
  • NRF Singapore (NRF2014NCRNCR001-40)
  • Swedish Research Council (2013-5523)
  • NIST (70NANB16H019 and 70NANB17H282)
  • NSF (CNS-1553683 and CNS-1718848)
  • Swedish Civil Contingencies Agency
Topics
  • Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
  • Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
  • Physical Sciences › Engineering › Control and Systems Engineering › Fault Detection and Control Systems
Keywords
cyber-physical systems, attack detection, industrial control systems, sensor readings, time series models, security monitoring

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review