## 1 Introduction  
Nowadays, cyber-physical systems (CPSs) are becoming increasingly pervasive across the critical infrastructures [1]. A cyber-physical system is an integration of computing and communication with physical systems [2]. Embedded computers monitor and control physical processes, usually with feedback loops, where physical processes affect computations and vice versa [3,4]. It dramatically enhances the controllability, adaptability, autonomy, efficiency, functionality, reliability, safety, and usability of the original system. Examples of CPSs include transportation systems [5], defensive weapon systems [6] industrial systems [7], and energy systems [8] (such as oil systems, water systems, and power systems). However, cyber-physical attacks are posing great threats to the safety and security of cyber-physical systems. Cyber-physical interactions in the cyber-physical systems make cross-domain attacks, specifically, and cyber-physical attacks, possible. Attackers may use cyber attack techniques(involving viruses, worms, and denial of service) in communication networks to cause damage to the physical system or use means of physical attacks in the physical system to cause disruptions in the communication network. In addition, these attacks can be applied comprehensively to achieve collaborative cyber-physical attacks. The objectives of cyber-physical attacks are usually achieved via threat propagation within the cyber and physical systems. According to the Industrial Control System Cyber Emergency Team reports [9], major cyber threats (such as cyber attacks and computer worms) against critical cyber-physical infrastructures have increased from 9 incidents in 2009 to 257 incidents in 2013. The blackout of the Ukrainian power systems that happened in 2016 shows the fragility of the electrical cyber-physical systems (ECPSs) under cyber attacks [10]. The integration of traditional power grids and modern communication networks into ECPSs has improved the efficiency of the stand-alone power systems [11; 12; 13]. However, the introduction of communication makes power systems become vulnerable to cyber attacks, which has already been a serious problem and needs to be solved [14]. Thus, studying the vulnerability of ECPSs has become an important topic recently. On this issue, research efforts have been undertaken along three different approaches. The first approach focuses on analyzing the vulnerability of ECPSs caused by safety loopholes based on a specific cyber attack, such as denial of service attacks [15], false data injection attacks [16], and undetectable cyber attacks [17]. [PERSON] et al. [18] summarized that sensor measurements and control commands were avenues of cyber-physical attacks. [PERSON] et al. [19] thought that existing security approaches were either inapplicable, not viable, insufficiently scalable, incompatible, or simply inadequate to address the challenges posed by highly complex environments such as the smart grid. [PERSON] et al. [20] pointed out that the vulnerability of ECPSs was caused by deceived bad data detection tests with attackers compromising some of the power grid measurements. [PERSON] et al. [21] showed that the key real-time operational tools (for example, State Estimator) of the electric power grids were vulnerable to false data injection attacks. Based on these points, studies [22; 23] improved the detection strategies in estimators. [PERSON] et al. [24] studied attack detection for descriptor systems by geometric control theory. [PERSON] et al. [25] proposed a random response approach to achieve strong privacy and minimize the privacy leakage based on data-deduplication. However, these strategies are only effective for a special attack or situation. If there are multiple attacks, these methods may not be helpful. Therefore, it is necessary to find a way which can deal with a more complex situation. The second approach assesses the vulnerability of ECPSs based on models in order to enhance the system security. [PERSON] et al.