# A Survey on Recent Advanced Research of CPS Security
## 3 Reviews
### Intrusion Detection  
Intrusion detection is a device or software application that monitors a network or systems for malicious activity or policy violations. In CPS, researchers explore intrusion with state machines, model checking, or machine learning. They apply the technology to new areas, such as water distribution systems, power grid substations, and drone systems. As the security of a medical cyber physical system (MCPS) is essential to patients' health, [PERSON] and [PERSON] [17] proposed a behavior-rule specification-based technique to detect attackers while reducing the false alarm probability. This methodology transforms behavior rules to a state machine; therefore, a device against normal behavior can easily be checked. After testing on medical monitoring devices, the experimental results demonstrated that the intrusion detection technique can cope with more complicated and underlying attackers compared with the other two existing anomaly-based methods in pervasive healthcare applications. [PERSON] et al. [95] proposed a self-organizing map (SOM)-based approach to detect abnormal program behavior in commercial off-the-shelf embedded devices, especially those that cannot be updated conventionally. The proposed method utilizes cycle per instruction (CPI) to extract corresponding program counter (PC) values and uses these to pinpoint malicious behaviors with an unsupervised SOM. Experiments on a typical low-cost ARM-based embedded development board with 104 programs showed that this method can classify unknown program behaviors with over 98.4% accuracy. [PERSON] et al. [91] proposed a systematic security analysis framework to detect attackers' actions without previous threat models. First, they used rewriting logic to model all the functions and define transitional rules of the states. Then, they defined attacker actions (e.g., dropping packets and replaying messages) that translate the system into an unsafe state. Finally, model checking was used to find an attacker's actions in all the sequences. In this paper, the authors took a real smart meter as an example and found astronomical numbers of attacks with cheap commodity hardware. [PERSON] et al. [75] studied the timing aspects of CPS to detect integrity and DoS attacks on sensors or actuators. To picture these attacks, they defined a hybrid process calculus and defined a threat model for both CPS and cyber-physical attacks. They also assessed the influence of a successful attacks on a CPS and estimated possible quantification of the chances of success of an attack. [PERSON] et al. [22] demonstrated a drone detection system with cheap and easily obtained hardware to prevent drones from invading residents' privacy. The authors derived the statistical metrics of the movements of a drone from the communications between the drone and its controller. They used these data to detect attackers who tried to bypass detection by changing speed or flight patterns. After it was tested on two popular consumer drone models and with four kinds of approaches, this system was proven to detect the presence of a drone at a minimal distance of 48 m.  
DICE [28] is an automatic method for detecting and identifying faulty IoT devices with context extraction. First, it computes sensor correlation and the transition probability between sensor states known as context. Then, the system monitors the sensor's status transition and analyzes sensor data to detect and identify faults. The experimental results on several real-world smart home environments confirmed that DICE can effectively detect and identify device faults of different types with high accuracy. [PERSON] et al. [76] proposed a novel framework that was designed to systematically generate invariant rules from industrial control system (ICS) operational logs to detect malicious behavior. In this paper, the authors used ICS's general control dynamics with several machine learning and data mining techniques to analyze the ICS's physical process variables.