## 2 Related Works  
The detection and mitigation of physical security events in industrial environments, as well as the detection, analysis and control of cybersecurity incidents in information systems have been widely studied as two separate and unrelated issues. However, a small amount of research has been conducted to the detection of attacks against critical infrastructures based on the correlation of cyber and physical indicators. In addition, as Cyber-Physical Systems (CPS) involve a variety of interconnected elements (closely related to the Internet of Things), the integration of these elements within CPS leads to a new dimension namely the Internet of Cyber-Physical Things (IoTCPT) for which new vulnerabilities, threats and attacks have arisen [3, 16]. Table 1 presents a summary of the most recent scientific research in the area and briefly describes their main advantages and shortcomings. Analysis is performed in an offline basis (i.e., obtaining evidence after the incidents have occurred), which is quite useful to protect critical infrastructures from cyber-physical attacks at an strategic and tactical level, but not to at an operational level that requires an immediate reaction mechanism. The proposed technique although provide promising results on anomaly detection it needs to test it using high-dimensional datasets. In addition, this approach focuses only on machine learning techniques, leaving aside complimentary options such as rule-based techniques, which are very useful in the detection of some cyber-physical attacks. Some attack types (e.g., intellectual property theft) are not compatible with the proposed cyber-physical attack detection and correlation method. In addition, ML algorithms have been selected based on previous work and need to be compared with other approaches. \begin{table}
\begin{tabular}{p{142.3 pt} p{142.3 pt} p{142.3 pt}} \hline \hline
**Approach** & **Advantages** & **Shortcomings** \\ \hline Security detect cyber-attacks in systems [17, 18] & platforms to cyber-physical systems [17, 18] & High accuracy on the attack detection and a great effectiveness of the proposed simulation scheme. & Platforms are constrained to the detection of a limited number of known attacks and no information is provided for the case of zero-days or unknown attacks. \\ \hline Non-stationary watermark scheme to detect cyber and physical attacks against critical systems [19, 20, 21] & Detects adversaries using non-parametric methods. & It is not equally effective against adversaries using parametric identification methods. \\ \hline Stress-testing platform for cyber–physical water infrastructure [22, 23] & Modeling a variety of cyber–physical attacks affecting the normal operation of SCADA elements (e.g., sensors, actuators, PLCs), assessing their impact in what-if exploration scenarios while retaining enough fidelity in the representation of interacting processes and information flow in the cyber layer. \\ \hline Traditional anomaly detection techniques[24, 25, 26, 27, 28] & The use of multi-stage techniques that isolates both local and global anomalies will generally yield better anomaly detection results. The proposed approach outperforms the density-based techniques and has comparable results to the parametric algorithms. \\ \hline Cyber–physical attack detection and correlation system [30] & The approach detects various cyber–physical attacks (e.g., unknown, simultaneous attacks) affecting current and future manufacturing systems; reduces the number of alarms, and reduces the false rates. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Cyber–Physical approaches in Critical Infrastructure Systems. Although related works search for solutions to appropriate detect cyber-physical attacks in critical infrastructures, most of them perform their analysis in an offline basis (i.e., obtaining evidence long after the incidents have occurred) and rely on either signature-based or anomaly-based detection.