# A Survey on Machine-Learning Based Security Design for Cyber-Physical Systems
## 4 ML-Based Cyber-Physical Attack Detection
### Physical System Layer  
A recursive neural network (RNN)-based sensor attack detection strategy is proposed in [22], where an attacker targets a vehicle with four-wheel speed sensors. The authors in [22] consider multiple wheel speed sensor attack scenarios in which the proposed detection strategy classifies the location and number of attacked sensors. Experiments for the validation of the proposed RNN-based detector are carried out in a real road environment with actual sensors, where the accuracy of sensor attack detection is greater than 99%. An out-of-distribution detector for autonomous driving systems is proposed in [103], where the authors consider a malicious image injection attack against a visual-based autonomous driving system. For the attacks, the proposed detector adopts an auto-encoder and a deep support vector data description to learn convolutional neural network (CNN) models while reducing the computation time and guaranteeing real-time detection. An ML-based sensor attack-detection method targeting autonomous vehicles is proposed in [104] with a long short-term memory (LSTM)-based CNN model. The authors in [104] focus on various sensor attack scenarios with a small-magnitude attack signal, which poses problems for a conventional model-based detector. The LSTM-based CNN model is evaluated in terms of its accuracy, sensitivity, precision, and F1-score, where it enhances detection performance better than a Kalman filter (KF)-based detector and a KF-based CNN detector. A one-class SVM-based anomaly detector for connected vehicles is proposed in [105], where the  
Figure 6: Machine learning in cyber-physical attack detection: (**a**) training the ML model for anomaly detection, and (**b**) anomaly detection with unknown data. one-class SVM is substituted for a conventional \(\chi^{2}\) detector. The proposed detector on the vehicle allows it to utilize the states of surrounding vehicles connected through the network in order to classify anomalies. The evaluation results show that the proposed one-class SVM model enhances detection accuracy better than the \(\chi^{2}\) detector; however, the state transmission delay from the vehicles connected by the network deteriorates accuracy. A Bayesian network-based attack detection strategy is proposed in [106] for water treatment systems, with data from multiple sensors and actuators under normal operation and attack situations. The authors in [106] evaluate the proposed detection strategy with precision, recall, and F1-score, in comparison with an SVM and a deep neural network (DNN) model. The proposed strategy has the advantage of a learning speed that is faster than other learning models. A robust supervised learning method to detect cyber-physical attacks on chemical processes is proposed in [107]. The proposed learning method adopts a non-linear SVM for the classification of normal behavior, disturbances, and anomalous behavior. An evaluation of the proposed method is conducted in a hardware-in-the-loop system (HILS) environment for a chemical process under sensor and controller attacks, where the proposed method provides real-time attack detection. A fusion of a physical model-based detector and a learning-based detector, defending against a sophisticated sensor attack targeting an HVAC system, is proposed in [108], where a one-class SVM model is used on the learning-based detector, which enables the detection of an attack that is not detected by a model-based detector. In [36], an SVM-based anomaly detection method is proposed for HVAC system anomalies, where a Gaussian process regression method [109] and an SVM method are combined to classify various faults in HVAC systems. The Gaussian process algorithm estimates the state of the HVAC system, and the SVM detection method is trained with the estimation from the Gaussian process and from sensor measurements. The demonstration result shows a low-level false detection rate and an execution time in milliseconds.