Research in cyber-physical security

The research investigates how cyber interventions interact with process dynamics, control decisions, operating conditions and interconnected infrastructure. The same manipulated measurement may be inconsequential in one installation and significant in another, and the difference lies in the physical system behind the measurement.

Reusable computational representations of physical processes, and reusable methods for analyzing their security, are central to this program. The four directions below set out questions that have to be answered before an experiment spanning cyber and physical domains can be relied upon, and they are the reason the CoSimu architecture takes the form it does. Power systems provide the initial application context for this work, while the directions themselves concern interconnected cyber-physical processes more generally.

Heterogeneous model coupling

Models drawn from different computational domains represent time, state and uncertainty in incompatible ways, and combining them changes what the resulting evidence can support.

A power-system solver integrates continuous dynamics on a fine step. A communication model advances on discrete packet events. Control logic executes on a scan cycle. A representation of the physical process may be coarser than all of them. Each is valid within its own domain, and none was written with the others in mind.

Combining them raises questions that connecting the software does not answer: which state is meaningful to exchange, and at what resolution; what a coordination scheme does to behavior occurring between exchange points; whether the assumptions each model makes about its environment survive being placed alongside the others; and whether a result obtained under one coupling would also hold under a different one.

These questions determine how far reusable process representations can be taken. Reuse rests on a defensible account of what happens when a kernel is coupled to a model it was not designed for, specific to the pair of models, their interfaces, and the resolution at which they exchange state.

Four models on different native time steps under one negotiated exchange step Four horizontal lanes represent a power-system model on a fine step, a communication network advancing on packet events, control logic on a discrete scan cycle, and process dynamics on a coarse step. Each lane shows its own tick marks. Vertical lines crossing all four lanes mark the negotiated exchange points at which state crosses the declared interfaces; between those points each model advances alone. NEGOTIATED EXCHANGE STEP Power system continuous · fine step Communication network discrete · packet events Control logic discrete · scan cycle Process dynamics continuous · coarse step t t+Δ t+2Δ t+3Δ t+4Δ t+5Δ Between exchange points each model advances on its own step; at the exchange point, state crosses the declared interfaces.
Four native time bases coordinated through a shared exchange schedule.
Power system
Continuous dynamics, fine step.
Communication network
Discrete packet events.
Control logic
Discrete scan cycle.
Process dynamics
Continuous, coarse step.

Four native time bases under one negotiated exchange step. Between exchange points each model advances alone; at the exchange point, state crosses the declared interfaces and ordering across domains is preserved.

Attack propagation and observability

An intervention in the cyber domain becomes physically consequential only when it reaches a component that acts, and what happens afterwards is governed by the process rather than by the intervention.

A forged measurement is inert until a controller consumes it. Once consumed it changes a decision, the decision changes the process, and the disturbance travels wherever the process is coupled: to other control loops, to interconnected infrastructure, and to operators reading instruments that are themselves downstream of the change. A coupled experiment follows that pathway across the interfaces where it develops.

Observability is the second half of the question. Monitors placed at different positions produce different accounts of the same intervention, and which of them registers it, and after how long, is a property of the configuration under study rather than of the intervention.

One intervention as it crosses three domains, and what each monitoring position observes Three stacked domain bands represent the communication path, the control system and the physical process. A manipulated measurement enters the communication band, passes into the control band where the regulator acts on a false state, and then into the physical band where the process leaves its operating band. To the right of a vertical divider, three monitoring positions are aligned with the bands: a network monitor observing well-formed packets with plausible values, a state estimator observing a consistent but incorrect picture, and a monitor holding a model of the process observing a discrepancy between expected and observed behavior. PROPAGATION ACROSS DOMAINS WHAT EACH POSITION OBSERVES Communication path measurements in transit Control system regulator decisions Physical process coupled dynamics manipulated measurement regulator acts on a false state process leaves its operating band Network monitor well-formed packets, values inside range State estimator a consistent but incorrect picture Process-model monitor discrepancy between expected and observed behavior The same intervention is recorded differently at each monitoring position, and the difference is a property of the configuration.
One propagation pathway observed from three monitoring positions.
CYBERCommunication path
A manipulated measurement remains plausible and well formed; a network monitor registers nothing unusual.
CONTROLControl system
The regulator acts on a state that does not exist; a state estimator may report a consistent but incorrect picture.
PHYSICALPhysical process
The process leaves its operating band and the departure reaches the coupled processes; a monitor holding a model of the process observes the discrepancy.

Physics-informed security

Physical systems are governed by dynamics and bounded by constraints, and those properties carry information that network telemetry does not.

A value can be syntactically valid, arrive on schedule, and still be inconsistent with what the process could physically have done. Physics-informed anomaly detection treats that inconsistency as evidence, evaluated against the current operating point rather than a fixed threshold. Its sensitivity therefore depends on the operating conditions, on the fidelity of the process representation, and on the size of the disturbance relative to legitimate variation.

Moving target defense approaches the same problem from the opposite direction, perturbing quantities an adversary must estimate in order to make the system harder to model from outside. The perturbation has an operational cost and a benefit that depends on the sensitivity of the process, which is why both are best assessed against the same process representation. Both methods depend on their setting: a method developed for one process is adapted and revalidated for the next, and an evaluation carried out under operational constraints is what establishes a deployable technique.

A reported value inside configured limits but inconsistent with the process dynamics A schematic plot of a process variable against time. Two dashed horizontal lines mark the configured range limits within which any reported value is accepted. Between them, a narrower band represents the behavior that is physically admissible given the current operating point; the band widens and narrows as the operating point changes. An observed trajectory follows the middle of that band, and then a reported value appears above the band but still inside the configured limits, so a range check accepts it while an analysis evaluated against the process dynamics does not. PROCESS VARIABLE time configured range limits physically admissible given the operating point observed trajectory reported value: inside configured limits, inconsistent with the dynamics The admissible band depends on the operating point; the sensitivity of a physics-informed method therefore varies with operating conditions.
An admissible operating envelope provides a physical reference for evaluating observed behavior.
Configured range limits
A conventional check accepts any value inside a fixed range.
Physically admissible behavior
A narrower region, determined by the dynamics and the current operating point, and therefore variable.
The inconsistent value
A reported value can sit inside the configured range and outside what the process could have done; physics-informed analysis treats that as evidence.

Cyber-physical resilience

Resilience concerns how a system behaves during and after a disturbance: how far operation departs from normal, and how it returns.

The relevant measures are how far the disturbance propagates, how severely operation is affected, how long the system remains degraded, what recovery occurs, and whether it requires intervention by an operator. A defensive measure that was active during the event may have changed any of these, or it may have changed only the evidence available to the defender while leaving the physical trajectory unaltered.

Separating those outcomes requires controlled comparison: the same configuration, the same intervention, one element changed. The comparison holds when everything else remains constant, which is the practical reason for separating reusable process representations and reusable methods from the orchestration that assembles them. Results are read against the system, the operating point and the coupling under which they were obtained.

The measures used in resilience analysis A schematic plot of operational capability against time. A dashed horizontal line marks nominal capability. One trace falls after the onset of a disturbance, remains degraded for a period, then recovers toward nominal. A second trace, representing the same configuration with a defensive measure active, falls less far and recovers earlier. Annotations mark the severity of degradation and the duration of degradation, and the time axis is divided into nominal operation, onset, degradation, recovery and restored operation. OPERATIONAL CAPABILITY nominal capability severity of degradation duration of degradation nominal onset degraded operation recovery restored operation baseline configuration same configuration with a defensive measure active
System response measures used to compare disturbance, degradation and recovery.
Propagation
How far the disturbance reaches through the coupled processes.
Severity
How far operational capability departs from nominal.
Duration
How long the system remains degraded before recovery begins.
Recovery
Whether capability is restored, how quickly, and whether operator intervention is required.

Distinguishing a change in the physical trajectory from a change in the evidence available to the defender requires the same configuration to be repeated with one element changed.

How the research shapes the architecture

Model coupling is the reason kernels declare interfaces. Propagation and observability are the reason the scenario libraries are written against those interfaces. Physics-informed methods require a kernel that computes the dynamics. Resilience requires that the same configuration can be repeated with a single element altered.

Each direction places a requirement on the environment, and together they describe the architecture set out on the Platform page.

The platform Frequently asked questions