Cyber-Physical Systems Security and Attack Detection

Cyber-physical systems (CPS) integrate computation, networking and physical processes to monitor and control critical infrastructures such as power grids, industrial plants, transportation networks and healthcare devices. Their tight coupling of digital and physical components delivers enhanced functionality but also introduces novel vulnerabilities. Cyber attackers can manipulate sensor readings, injector control signals or disrupt communication channels to degrade performance, cause unsafe states or exfiltrate sensitive data. To address these threats, research has developed model-based observers, anomaly detection schemes and resilient controllers that maintain stability under compromised measurements. Techniques range from residual analysis and state estimation under sparse attacks to physical watermarking and sequential change detection. Recent advances explore adaptive and distributed monitoring, exploiting real-time system identification, software-defined networking and machine-learning methods to detect stealthy attacks such as replay or false-data injection. Practical applications demonstrate how integrated detection and mitigation frameworks can isolate compromised components, recover real-time performance and ensure robust operation despite evolving adversarial strategies.

Research from Nature Portfolio

No recent Nature Portfolio content available.

Research from all publishers

One recent study introduces a parsimonious physical watermarking policy for deception-attack detection in networked control systems. By casting watermark insertion as a stochastic optimal control problem, the authors derive a two-threshold rule on posterior attack probability that minimises average detection delay subject to false alarm and control-cost constraints, with analytical performance characterised via Kullback–Leibler divergence. Another contribution applies reinforcement learning and game theory to security-state estimation under denial-of-service attacks. Framing defender and attacker as players in a two-player zero-sum game, an ε-greedy learning algorithm converges rapidly to Nash equilibrium policies while accounting for channel unreliability and energy constraints. A comparative work investigates Q-learning versus SARSA for secure state estimation under DoS attacks, modelling estimation error covariance dynamics as a Markov decision process. Both algorithms identify optimal countermeasures and equilibrium strategies, with analysis highlighting differences in convergence behaviour and resilience in resource-limited scenarios.

Cyber-Physical Systems Security and Attack Detection publication trend

The graph below shows the total number of articles in cyber-physical systems security and attack detection across all publications each year (not limited to Nature Index journals).

Technical terms

Cyber-physical system: Integrated system combining computation, communication and physical processes.

Replay attack: Adversary records and replays valid sensor or actuator data to conceal malicious interventions.

Physical watermarking: Injection of random control signals to enable detection of data manipulation or replay.

Reinforcement learning: Machine-learning paradigm in which agents learn optimal policies via reward-driven interaction.

Zero-sum game: Competitive model where one participant’s gain exactly equals another’s loss.

Nash equilibrium: Strategy profile from which no player can unilaterally improve their outcome.

Kullback–Leibler divergence: Statistical measure quantifying the difference between two probability distributions.

References

1. Quickest detection of deception attacks on cyber–physical systems with a parsimonious watermarking policy. Automatica (2023).
2. Security State Estimation for Cyber-Physical Systems against DoS Attacks via Reinforcement Learning and Game Theory. Actuators (2022).
3. Secure State Estimation of Cyber-Physical System under Cyber Attacks: Q-Learning vs. SARSA. Electronics (2022).