# A Survey on Recent Advanced Research of CPS Security
## 3 Reviews
### Anomaly Detection  
Anomaly detection is the identification of rare events, behaviors, or observations that deviate from a system's normal behavior. Unlike conventional systems, there are more operating characteristics in CPSs. In addition to conventional traffic and memory analysis, researchers also tend to use various physical features to find anomalies. As public IoT devices still use low-level security protection strategies, [PERSON] and [PERSON] [85] provided a collaborative security detection approach based on game theory for distributed IoT systems. They used a consensus protocol to gather neighbors' local profiles and reached an agreement in the security scheme. The method adopts game theory to consider the confrontation between the defender and the attacker and attempts to achieve maximum security protection for the entire system. Simulations on a test network topology with 50 nodes and 297 edges proved that the approach is valuable for defending against DDoS attacks. MDSClone [86] is a new clone detection method based on multidimensional scaling (MDS). It detects clones without relying on the geographical positions of nodes and is suitable for hybrid networks comprising both static and mobile nodes, which avoidsconsidering any specific mobility pattern. Moreover, three other techniques (i.e., CIPMLO, TI, and SMEBM) were proposed to speed up the core part of MDSClone, and the detection algorithm can be parallelized to improve the performance. Their comprehensive analytical and experimental evaluations showed that the clone detection probability of MDSClone is almost 100% with a shorter detection delay. In clustering Internet of Things (IoT) networks, an adversary could attack the relay associated with all nodes to compromise the whole system. To detect this kind of attack, [PERSON] et al. [87] presented hybrid intrusion detection systems by comparing the observed packet drop probabilities with their long-term expected values. The generalized likelihood ratio test proved that the unicast and broadcast models can achieve a negligible false alarm and ignorable detection probability. [PERSON] et al. [88] proposed a new method, which is based on analysis of runtime data logs and automatic model construction of CPS, to detect attacks before any damage is done. The authors systematically mutated software components and obtained traces of sensor data. Then, they learned an SVM-based model from the data and used the classifier to monitor the runtime status. They evaluated the proposed approach on the secure water treatment (SWaT) testbed, and the results showed that it can detect 85% of 55 network and code modification attacks from data logs generated at runtime. [PERSON] [89] developed a network inspector for IoT devices to detect potential attacks. The author used IoT packet sequences as input nodes to the artificial neural network (ANN) and calculated the probability of attacks. Testing on real IoT samples with backdoor scripts showed that input nodes comprising more dimensions produce lower error rates. Pattern matching plays an integral role in network intrusion detection systems (NIDS). However, with the increasing complexity and functionality of NIDS, pattern matching requires more time and energy consumption. [PERSON] et al. [90] proposed a new pattern matching architecture, which brings new and exciting opportunities for algorithm design, based on embedded GPUs. They evaluated the algorithms on a heterogeneous device and found that GPU-based pattern matching algorithms have competitive performance compared to a CPU and consume half as much energy as the CPU-based variants. [PERSON] et al. proposed two novel hazard analysis techniques, which are helpful in abnormal detection. In [162], the authors leveraged the Failure Modes, Effects, and Criticality Analysis to detect and prevent sensor failure with KB. In addition, in [163], the authors specially addressed the challenges that collaboration between multiple CPSs brings complexity, uncertainty, and variability.