# A Survey on Machine-Learning Based Security Design for Cyber-Physical Systems
## 5 Potential Research Directions
### Resilient Cyber-Physical System Design  
The purpose of a cyber-physical attack is to disrupt the physical system. In particular, the CPSs for societal infrastructure must have guaranteed safety and must provide normal services in spite of an attack. Therefore, a resilient CPS design that provides seamless performance recovery from an attack is required, with appropriate ML-based attack handling strategies after real-time attack detection. Figure 7 shows an example of the recovery of a ball-beam control system under a DoS attack. When the DoS attack launches at 15 s, the position of the ball drastically leaves the range of the beam, resulting in the irreparable state of the physical system at 25.75 s (the red line). However, if a real-time detection and performance recovery strategy is adopted and operates starting at 22 s, then the position of the ball is regulated in a timely fashion to the reference position of 0.5 m with a temporary, small fluctuation (the magenta line). Through the resilience strategy, the stability of the ball-beam control system is guaranteed against the DoS attack in this control scenario. In conventional physical system security, a hardware redundancy strategy is adopted to handle cyber-physical attacks and unexpected system faults. When one computing system of a CPS shows abnormal behavior, the previously configured auxiliary system  
Figure 7: Real-time attack detection and recovery. then substitutes for the abnormal computing system. A redundant controller architecture is adopted in [107] to mitigate the physical impact of a cyber-physical attack targeting chemical processes, switching controllers when the attack is detected by the SVM-model detector. The authors in [110] also consider a redundant system configuration to guarantee the stability of a power plant against cyber-physical attacks. In [135], a system-level simplex architecture that consists of a high-performance complex control module and a high-assurance safety controller with limited performance is proposed to guarantee the safety of the control system against unexpected faults in the complex control module. If the high-performance control module suffers an unexpected error, such as rebooting, the high-assurance control module takes over the control functions of the physical system, which provides robustness against system faults. The simplex architecture is also adopted for safety-critical CBTC systems in [32] to provide CPS resiliency against software faults and sensor attacks. At the network layer, software-defined networking (SDN) can be adopted as one of the network recovery methods against the network layer attacks. SDN is a network paradigm that separates network functions for the control plane and data plane as software [136; 137]. In the control plane, the centralized SDN controller periodically monitors the distributed network devices in general and installs network policies. On the data plane, distributed network devices are responsible for delivering the data and reporting the statistics of the network, such as link information, packet transmission successes, and changes in network topology. Interaction between the control plane and data plane enables the handling of network-layer cyber-physical attacks. When abnormal behavior, including attacks, is detected on the data plane, such as a link failure, the network devices send an alarm to the SDN controller, which then handles the abnormal behavior; e.g., with communications link reconfiguration for an alternative path routing method [138; 139]. An SDN-based network recovery strategy is proposed in [140] for the performance recovery of a micro-grid against a link cut-off attack, where the proposed strategy detects malicious network topology changes from the attack and provides a seamless recovery of voltage with a small recovery overhead. Furthermore, the SDN provides a mitigation strategy against network delay generated by the flooding attack on the data plane [141; 142].