Detection of Cyber-Physical Attacks using Physical Model with Nonparametric EWMA Detector

Industrial Control System (ICS) can suffer of cyber-physical attacks resulting in accident, damage, or financial loss. The be detected both physical space cyberspace the ICS. detection based on models system. To model system this study uses a data-driven modeling approach as an alternative analytic one. This using dynamic mode decomposition method with control (DMDc) assuming full state measurement. attack detector used some researches predictive is cumulative sum (CUSUM), which only applies to normally distribute residual data. detect any attack, research nonparametric exponentially weighted moving average (EWMA) detector. data set from testbed Secure Water Treatment (SWaT). was successful detecting 8 out 10 first SWaT subsystem. demonstrates that DMDc results better goodness fit and EWMA when do not follow normal distribution.