# A Survey on Machine-Learning Based Security Design for Cyber-Physical Systems
###### Abstract  
A cyber-physical system (CPS) is the integration of a physical system into the real world and control applications in a computing system, interacting through a communications network. Network technology connecting physical systems and computing systems enables the simultaneous control of many physical systems and provides intelligent applications for them. However, enhancing connectivity leads to extended attack vectors in which attackers can trespass on the network and launch cyber-physical attacks, remotely disrupting the CPS. Therefore, extensive studies into cyber-physical security are being conducted in various domains, such as physical, network, and computing systems. Moreover, large-scale and complex CPSs make it difficult to analyze and detect cyber-physical attacks, and thus, machine learning (ML) techniques have recently been adopted for cyber-physical security. In this survey, we provide an extensive review of the threats and ML-based security designs for CPSs. First, we present a CPS structure that classifies the functions of the CPS into three layers: the physical system, the network, and software applications. Then, we discuss the taxonomy of cyber-physical attacks on each layer, and in particular, we analyze attacks based on the dynamics of the physical system. We review existing studies on detecting cyber-physical attacks with various ML techniques from the perspectives of the physical system, the network, and the computing system. Furthermore, we discuss future research directions for ML-based cyber-physical security research in the context of real-time constraints, resiliency, and dataset generation to learn about the possible attacks. cyber-physical systems; hierarchical CPS structure; CPS security; cyber-physical attacks; machine learning-based detection; learning-enabled CPS +
Footnote †: journal: Applied Sciences  
As the connectivity of the CPS increases and becomes more complex, the paths through which an attacker can infiltrate the CPS are increasing [17; 18; 19]. The networks that connect the physical systems and the control software are especially vulnerable to external attackers that aim to invade the CPS and cause malfunctions in the physical systems [20; 21]. When an attacker accesses the network, the execution of control-critical software can be disturbed in the cyber-world, the control authority of physical system operations on the network can be seized, and the attacker can power-off the physical systems [16; 18] or precisely manipulate the physical state with a deceitful attack detection system [14; 15]. These cyber-physical attacks induce damage to industrial equipment and processes, causing economic losses and human casualties. In 2015, the BlackEnergy malware caused the malfunction of a power plant in Ukraine, resulting in a massive power outage [20]. In 2014, control of plant equipment was seized by a cyber attack on a German steel mill, and some blast furnaces were damaged [20]. To ensure the reliability of a CPS against adversaries, the need for cyber-physical security research is emerging [17; 21]. Cyber-physical security is an extension of conventional cyber-security, where the operation of the physical system is additionally considered. For example, password cracking, which is password recovery process for a system, is one of the important security issues in the conventional cyber-security field due to the risk of personal information leaks. In cyber-physical security, a simple information leakage by password cracking cannot damage the CPS; however, the manipulation of the physical process by unauthorized access with a password can impact the dynamics of the physical systems. Therefore, a variety of cyber-physical security research is conducted by modeling physical dynamics with control theory. However, since CPSs are affected by various factors, such as rapid environmental changes and unexpected events, physical model-based cyber-physical security methods suffer from false alarms that degrade detection performance against cyber-physical attacks.