{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T23:43:57Z","timestamp":1792799037837,"version":"4.5.0"},"reference-count":119,"publisher":"Association for Computing Machinery (ACM)","issue":"4","license":[{"start":{"date-parts":[[2018,7,25]],"date-time":"2018-07-25T00:00:00Z","timestamp":1532476800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"name":"NRF Singapore","award":["NRF2014NCRNCR001-40"],"award-info":[{"award-number":["NRF2014NCRNCR001-40"]}]},{"DOI":"10.13039\/501100004359","name":"Swedish Research Council","doi-asserted-by":"crossref","award":["2013-5523"],"award-info":[{"award-number":["2013-5523"]}],"id":[{"id":"10.13039\/501100004359","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/100000161","name":"NIST","doi-asserted-by":"crossref","award":["70NANB16H019 and 70NANB17H282"],"award-info":[{"award-number":["70NANB16H019 and 70NANB17H282"]}],"id":[{"id":"10.13039\/100000161","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/100000001","name":"NSF","doi-asserted-by":"publisher","award":["CNS-1553683 and CNS-1718848"],"award-info":[{"award-number":["CNS-1553683 and CNS-1718848"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Swedish Civil Contingencies Agency","id":[{"id":"https:\/\/ror.org\/04cz2yk65","id-type":"ROR","asserted-by":"crossref"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Comput. Surv."],"published-print":{"date-parts":[[2019,7,31]]},"abstract":"<jats:p>Monitoring the \u201cphysics\u201d of cyber-physical systems to detect attacks is a growing area of research. In its basic form, a security monitor creates time-series models of sensor readings for an industrial control system and identifies anomalies in these measurements to identify potentially false control commands or false sensor readings. In this article, we review previous work on physics-based anomaly detection based on a unified taxonomy that allows us to identify limitations and unexplored challenges and to propose new solutions.<\/jats:p>","DOI":"10.1145\/3203245","type":"journal-article","created":{"date-parts":[[2018,7,26]],"date-time":"2018-07-26T07:58:04Z","timestamp":1532591884000},"page":"1-36","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":381,"title":["A Survey of Physics-Based Attack Detection in Cyber-Physical Systems"],"prefix":"10.1145","volume":"51","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3933-8271","authenticated-orcid":false,"given":"Jairo","family":"Giraldo","sequence":"first","affiliation":[{"name":"University of Texas at Dallas, Richardson, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"David","family":"Urbina","sequence":"additional","affiliation":[{"name":"University of Texas at Dallas, Richardson, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Alvaro","family":"Cardenas","sequence":"additional","affiliation":[{"name":"University of Texas at Dallas, Richardson, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Junia","family":"Valente","sequence":"additional","affiliation":[{"name":"University of Texas at Dallas, Richardson, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Mustafa","family":"Faisal","sequence":"additional","affiliation":[{"name":"University of Texas at Dallas, Richardson, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Justin","family":"Ruths","sequence":"additional","affiliation":[{"name":"University of Texas at Dallas, Richardson, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Nils Ole","family":"Tippenhauer","sequence":"additional","affiliation":[{"name":"Singapore University of Technology and Design, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Henrik","family":"Sandberg","sequence":"additional","affiliation":[{"name":"KTH Royal Institute of Technology, Stockholm, Sweden"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Richard","family":"Candell","sequence":"additional","affiliation":[{"name":"National Institute of Standards and Technology, Gaithersburg, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2018,7,25]]},"reference":[{"key":"e_1_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516745"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2016.2521727"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1109\/TCST.2012.2211873"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/TCST.2012.2211874"},{"key":"e_1_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1016\/0005-1098(71)90059-8"},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/357830.357849"},{"key":"e_1_2_1_7_1","volume-title":"Proceedings of American Control Conference. 3029--3034","author":"Vijay Gupta Bai","year":"2014"},{"key":"e_1_2_1_8_1","volume-title":"Proceedings of American Control Conference.","author":"Pasqualetti Fabio","year":"2015"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/PRDC.2011.30"},{"key":"e_1_2_1_10_1","volume-title":"Proceedings of Workshop on Secure Control Systems","volume":"2010","author":"Bobba Rakesh B."},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2010.2099234"},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/1966913.1966959"},{"key":"e_1_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2006.2"},{"key":"e_1_2_1_15_1","volume-title":"Proceedings of the USENIX Security Symposium.","author":"Checkoway Stephen"},{"key":"e_1_2_1_16_1","volume-title":"Proceedings of the SCADA Security Scientific Symposium","volume":"46","author":"Cheung Steven","year":"2007"},{"key":"e_1_2_1_17_1","volume-title":"Proceedings of the American Control Conference (ACC\u201915)","author":"Chong Michelle S."},{"key":"e_1_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1109\/CCAC.2015.7345181"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2011.2165843"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2012.2185911"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/SMARTGRID.2010.5622046"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/SmartGridComm.2012.6486007"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/CCA.2014.6981373"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/2566468.2566472"},{"key":"e_1_2_1_25_1","volume-title":"stuxnet dossier. White paper","author":"Falliere Nicolas"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2012.2209668"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/2523649.2523658"},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/37.9163"},{"key":"e_1_2_1_29_1","volume-title":"Proceedings of Conference on Smart Grid Communications (SmartGridComm\u201911)","author":"Giani Annarita","year":"2011"},{"key":"e_1_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-33338-5_18"},{"key":"e_1_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/2664243.2664277"},{"key":"e_1_2_1_32_1","first-page":"4","article-title":"Intrusion Detection in Cyber-Physical Systems","volume":"8","author":"Han S.","year":"2014","journal-title":"Techniques and Challenges. IEEE Syst. J."},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/CEC.2016.7743900"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1049\/iet-cps.2016.0019"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2013.6567115"},{"key":"e_1_2_1_36_1","volume-title":"Proceedings of Workshop on Health Information Technologies.","author":"Henry Nathan","year":"2013"},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/1378600.1378604"},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/CCDC.2015.7162493"},{"key":"e_1_2_1_39_1","first-page":"1","article-title":"Cyberphysical security in networked control systems {about this issue}","volume":"35","author":"How J.","year":"2015","journal-title":"IEEE Control Syst."},{"key":"e_1_2_1_40_1","volume-title":"Cyber-physical systems security\u2014A survey. arXiv preprint arXiv:1701.04525","author":"Humayed Abdulmalik","year":"2017"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/TCST.2009.2026285"},{"key":"e_1_2_1_42_1","volume-title":"Proceedings of USENIX Security Symposium. 11--13","author":"Ishtiaq Roufa Rob Millerb","year":"2010"},{"key":"e_1_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/87.845876"},{"key":"e_1_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1002\/rob.21513"},{"key":"e_1_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSG.2011.2119336"},{"key":"e_1_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1109\/INDIN.2015.7281725"},{"key":"e_1_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2014.2320093"},{"key":"e_1_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2010.34"},{"key":"e_1_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/SMARTGRID.2010.5622045"},{"key":"e_1_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1109\/SmartGridComm.2014.7007764"},{"key":"e_1_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1145\/2714576.2714599"},{"key":"e_1_2_1_53_1","volume-title":"Proceedings of American Control Conference. 3344--3349","author":"Kwon Cheolhyeon","year":"2013"},{"key":"e_1_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2011.67"},{"key":"e_1_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSG.2011.2174811"},{"key":"e_1_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1109\/PESGM.2014.6939486"},{"key":"e_1_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1145\/2459976.2459982"},{"key":"e_1_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1145\/2516930.2516947"},{"key":"e_1_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2011.122111.00145"},{"key":"e_1_2_1_60_1","doi-asserted-by":"publisher","DOI":"10.1145\/1653662.1653666"},{"key":"e_1_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1145\/1952982.1952995"},{"key":"e_1_2_1_62_1","volume-title":"The Control Handbook","author":"Ljung L."},{"key":"e_1_2_1_63_1","unstructured":"Lennart Ljung (Ed.). 1999. System Identification (2nd Ed.): Theory for the User. Prentice Hall PTR Upper Saddle River NJ.   Lennart Ljung (Ed.). 1999. System Identification (2nd Ed.): Theory for the User. Prentice Hall PTR Upper Saddle River NJ."},{"key":"e_1_2_1_64_1","volume-title":"Cyber-physical systems security: A systematic mapping study. arXiv preprint arXiv:1605.09641","author":"Lun Yuriy Zacchia","year":"2016"},{"key":"e_1_2_1_65_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2016.2627399"},{"key":"e_1_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-33338-5_11"},{"key":"e_1_2_1_67_1","doi-asserted-by":"publisher","DOI":"10.1145\/2523649.2523673"},{"key":"e_1_2_1_68_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382244"},{"key":"e_1_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23043"},{"key":"e_1_2_1_70_1","volume-title":"Proceedings of Conference on Decision and Control. 5776--5781","author":"Miao Fei"},{"key":"e_1_2_1_71_1","doi-asserted-by":"publisher","DOI":"10.1109\/TCNS.2016.2606880"},{"key":"e_1_2_1_72_1","doi-asserted-by":"publisher","DOI":"10.1145\/2542049"},{"key":"e_1_2_1_73_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2013.77"},{"key":"e_1_2_1_74_1","doi-asserted-by":"publisher","DOI":"10.5555\/1793974.1794131"},{"key":"e_1_2_1_75_1","doi-asserted-by":"publisher","DOI":"10.1109\/MCS.2014.2364724"},{"key":"e_1_2_1_76_1","doi-asserted-by":"publisher","DOI":"10.1109\/TCST.2013.2280899"},{"key":"e_1_2_1_77_1","doi-asserted-by":"publisher","DOI":"10.1109\/HICSS.2012.594"},{"key":"e_1_2_1_78_1","volume-title":"Proceedings of the IEEE 55th Conference on Decision and Control (CDC\u201916)","author":"Murguia C."},{"key":"e_1_2_1_79_1","doi-asserted-by":"publisher","DOI":"10.5555\/2992856.2992858"},{"key":"e_1_2_1_80_1","volume-title":"The CIP Networks Library","author":"ODVA","year":"2011"},{"key":"e_1_2_1_81_1","doi-asserted-by":"publisher","DOI":"10.9781\/ijimai.2017.437"},{"key":"e_1_2_1_82_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2014.81"},{"key":"e_1_2_1_83_1","doi-asserted-by":"publisher","DOI":"10.1109\/TAC.2013.2266831"},{"key":"e_1_2_1_84_1","volume-title":"Proceedings of Conference on Smart Grid Communications (SmartGridComm\u201913)","author":"Rahman Mohammad Ashiqur"},{"key":"e_1_2_1_85_1","doi-asserted-by":"publisher","DOI":"10.1145\/2382196.2382246"},{"key":"e_1_2_1_86_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.40"},{"key":"e_1_2_1_87_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.40"},{"key":"e_1_2_1_88_1","doi-asserted-by":"publisher","DOI":"10.1145\/2808705.2808713"},{"key":"e_1_2_1_89_1","doi-asserted-by":"publisher","DOI":"10.1145\/2808705.2808713"},{"key":"e_1_2_1_90_1","volume-title":"Proceedings of the Workshop on Secure Control Systems.","author":"Sandberg Henrik"},{"key":"e_1_2_1_91_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2011.18"},{"key":"e_1_2_1_92_1","doi-asserted-by":"publisher","DOI":"10.5555\/2984464.2984493"},{"key":"e_1_2_1_93_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813679"},{"key":"e_1_2_1_94_1","doi-asserted-by":"publisher","DOI":"10.3182\/20110828-6-IT-1002.01721"},{"key":"e_1_2_1_95_1","first-page":"1","article-title":"Covert misappropriation of networked control systems: Presenting a feedback structure","volume":"35","author":"Smith R. S.","year":"2015","journal-title":"IEEE Control Syst."},{"key":"e_1_2_1_96_1","volume-title":"Mathematical Control Theory: Deterministic Finite Dimensional Systems","author":"Sontag Eduardo D."},{"key":"e_1_2_1_97_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSG.2014.2298195"},{"key":"e_1_2_1_98_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516705"},{"key":"e_1_2_1_99_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2016.2616442"},{"key":"e_1_2_1_100_1","volume-title":"Proceedings of Conference on Decision and Control (CDC\u201910)","author":"Teixeira Andr\u00e9"},{"key":"e_1_2_1_101_1","doi-asserted-by":"publisher","DOI":"10.3182\/20110828-6-IT-1002.02210"},{"key":"e_1_2_1_102_1","doi-asserted-by":"publisher","DOI":"10.1145\/2185505.2185515"},{"key":"e_1_2_1_103_1","doi-asserted-by":"publisher","DOI":"10.1109\/Allerton.2012.6483441"},{"key":"e_1_2_1_104_1","volume-title":"Proceedings of Singapore Cyber Security R8D Conference (SG-CRC\u201916)","volume":"14","author":"Urbina David","year":"2016"},{"key":"e_1_2_1_105_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978388"},{"key":"e_1_2_1_106_1","doi-asserted-by":"publisher","DOI":"10.1145\/2818000.2818045"},{"key":"e_1_2_1_107_1","doi-asserted-by":"publisher","DOI":"10.1145\/3140241.3140242"},{"key":"e_1_2_1_108_1","doi-asserted-by":"publisher","DOI":"10.1145\/2480362.2480490"},{"key":"e_1_2_1_109_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jfranklin.2016.04.011"},{"key":"e_1_2_1_110_1","doi-asserted-by":"publisher","DOI":"10.1145\/2906388.2906420"},{"key":"e_1_2_1_111_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-11212-1_23"},{"key":"e_1_2_1_112_1","unstructured":"Greg Welch and Gary Bishop. 1995. An introduction to the Kalman filter.  Greg Welch and Gary Bishop. 1995. An introduction to the Kalman filter."},{"key":"e_1_2_1_113_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.mfglet.2014.01.005"},{"key":"e_1_2_1_114_1","doi-asserted-by":"publisher","DOI":"10.1016\/0166-3615(94)90017-5"},{"key":"e_1_2_1_115_1","doi-asserted-by":"publisher","DOI":"10.1016\/0005-1098(76)90041-8"},{"key":"e_1_2_1_116_1","unstructured":"Wireshark Network Protocol Analyzer. 2016. Retrieved from https:\/\/www.wireshark.org\/.  Wireshark Network Protocol Analyzer. 2016. Retrieved from https:\/\/www.wireshark.org\/."},{"key":"e_1_2_1_117_1","unstructured":"xnetfilterq. 2015. Python bindings for libnetfilter_queue. Retrieved from https:\/\/github.com\/fqrouter\/python-netfilterqueue.  xnetfilterq. 2015. Python bindings for libnetfilter_queue. Retrieved from https:\/\/github.com\/fqrouter\/python-netfilterqueue."},{"key":"e_1_2_1_118_1","unstructured":"xpython. 2015. Python language. Version 2.7.10. Retrieved from https:\/\/docs.python.org\/2\/.  xpython. 2015. Python language. Version 2.7.10. Retrieved from https:\/\/docs.python.org\/2\/."},{"key":"e_1_2_1_119_1","unstructured":"xscapy. 2015. Scapy packet manipulation program. Version 2.3.1. Retrieved from http:\/\/www.secdev.org\/projects\/scapy\/doc\/.  xscapy. 2015. Scapy packet manipulation program. Version 2.3.1. Retrieved from http:\/\/www.secdev.org\/projects\/scapy\/doc\/."},{"key":"e_1_2_1_120_1","volume-title":"Proceedings of the American Control Conference (ACC\u201916)","author":"Yong S. Z."},{"key":"e_1_2_1_121_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11837-016-1937-7"}],"container-title":["ACM Computing Surveys"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3203245","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3203245","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3203245","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T21:08:47Z","timestamp":1750194527000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3203245"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,7,25]]},"references-count":119,"journal-issue":{"issue":"4","published-print":{"date-parts":[[2019,7,31]]}},"alternative-id":["10.1145\/3203245"],"URL":"https:\/\/doi.org\/10.1145\/3203245","relation":{},"ISSN":["0360-0300","1557-7341"],"issn-type":[{"value":"0360-0300","type":"print"},{"value":"1557-7341","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018,7,25]]},"assertion":[{"value":"2017-05-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2018-03-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2018-07-25","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}