Mathematical Model for Cyber Security

Abstract

Cyber-physical systems (CPS), such as smart grids, industrial control systems, and autonomous infrastructure, are increasingly targeted by sophisticated cyberattacks that exploit sensor and actuator vulnerabilities. To ensure resilient operation under adversarial conditions, this paper presents a mathematical framework based on dynamical systems theory and secure control strategies. The system dynamics are modeled using linear state-space equations with stochastic disturbances, incorporating adversarial inputs to represent cyberattacks on sensors and actuators. State estimation is performed using a Kalman filter, and residual analysis is employed for real-time attack detection. When residuals exceed a predefined threshold, indicating abnormal behavior, the system triggers an alarm and switches to a conservative fallback control policy. Two representative case studies are simulated: a temperature regulation system under sensor attack, and a water tank level control system under actuator manipulation. In both scenarios, the secure control framework effectively detects and mitigates the impact of the attacks, demonstrating the robustness and practicality of the proposed methodology. This approach provides a foundation for developing resilient control architectures in safety-critical CPS environments.

Introduction

Cyber-Physical Systems (CPS) integrate computation, communication, and physical processes, widely used in smart grids, autonomous vehicles, industrial automation, and medical devices. While CPS bring operational benefits, their close coupling with networks exposes them to unique cyberattacks that can cause direct physical harm, such as sensor spoofing or actuator manipulation.

Challenges:

• Attacks on control loops—targeting sensors and actuators—can destabilize systems.

• Traditional IT security tools (firewalls, signature detection) are inadequate for detecting stealthy, model-aware attacks.

• There is a growing need for model-based secure control frameworks that detect, isolate, and mitigate attacks in real-time.

Existing Research and Techniques:

• Control-theoretic methods like Model Predictive Control (MPC) and constrained resilient estimation (CARE) improve detection and response.

• Statistical methods and Kalman filtering aid in detecting false data injections and replay attacks.

• Machine learning (ensemble classifiers, graph convolutional networks) enhances anomaly detection and malware classification.

• Watermarking and signal perturbation techniques help expose stealthy attacks.

• Moving-target defenses and crypto-based embedded system designs strengthen CPS security.

• Integrated frameworks combine state estimation, robust control, and AI-driven anomaly detection.

Proposed Work and Novelty:

• Develops a mathematically grounded dynamical system model representing CPS under normal and adversarial conditions.

• Incorporates cyberattacks as unknown inputs (disturbances) in a linear time-invariant (LTI) state-space framework.

• Uses a Kalman filter-based state estimator to monitor residuals (discrepancies between estimated and actual outputs) for early attack detection.

• Implements threshold-based anomaly detection for identifying both abrupt and stealthy attacks.

• Designs a fallback secure control strategy to maintain system stability and safety during attacks.

• Validated with case studies on temperature control and water tank systems to demonstrate adaptability and robustness.

• Modular and extensible framework suitable for diverse CPS applications like smart grids and industrial IoT.

Technical Foundations:

• CPS modeled by linear state-space equations incorporating unknown actuator and sensor attack inputs.

• Kalman filter performs recursive state estimation, with residuals triggering alarms when exceeding thresholds.

• Secure control includes observer design, robust/optimal control under attack constraints, and switching to conservative fallback controllers.

• Reachability analysis ensures system states remain within safe bounds despite attacks.

Objectives:

• Model CPS dynamics with attack representation.

• Detect anomalies using residual analysis.

• Mitigate attacks via resilient control strategies.

• Validate through simulations on practical CPS scenarios.

• Lay groundwork for real-time secure CPS implementations in safety-critical domains.

Conclusion

In this study, we developed a dynamical systems-based framework for modeling, detecting, and mitigating cyberattacks in Cyber-Physical Systems (CPS). By incorporating cyber threats such as sensor spoofing and actuator tampering as unknown input disturbances into a linear state-space model, we applied Kalman filter-based state estimation to monitor system behavior in real-time. The use of residual analysis enabled the identification of attack signatures by comparing expected and actual system outputs. A threshold-based decision logic triggered alerts when abnormal deviations were detected, enabling timely detection of both abrupt and stealthy attacks. Furthermore, the introduction of a fallback secure control mechanism allowed the system to operate safely under attack conditions by switching control laws or isolating compromised subsystems. The proposed framework was validated using case studies such as a temperature control system and a water tank level regulator, demonstrating strong detection performance, robustness to noise, and resilience to cyber-induced disruptions. This work not only offers a mathematically grounded and practically implementable solution to secure CPS environments but also emphasizes the role of control theory in cybersecurity—an area often overlooked in favor of purely software-based approaches. Although the proposed method shows promising results, several directions exist for future exploration. One key area is the extension of the model to nonlinear and hybrid CPS systems, where linear assumptions may not capture complex behaviors. The incorporation of machine learning-based anomaly classification on top of residual signals could improve detection accuracy, especially in identifying the type and location of the attack. Furthermore, real-time implementation on embedded hardware platforms such as Raspberry Pi or Arduino-based controllers can help validate practical deployment in industrial or IoT settings. Another avenue is the development of distributed detection and control algorithms for large-scale CPS such as smart grids and intelligent transportation systems, where centralized solutions are often impractical. Integration with blockchain-based logging mechanisms could further enhance accountability and post-attack forensics. Finally, a formal stability and security certification framework based on Lyapunov theory or passivity concepts could be established to guarantee system safety even under sustained cyber threats.

References

[1] Xing, W., & Shen, J. (2024). Security control of cyber–physical systems under cyber attacks: A survey. Sensors, 24(12), 3815. [2] Li, L., Ding, S. X., Zhou, L., Zhong, M., & Peng, K. (2024). The system dynamics analysis, resilient and fault?tolerant control for cyber?physical systems. arXiv. [3] Huang, S., Poskitt, C. M., & Shar, L. K. (2024). Security modelling for cyber?physical systems: A systematic literature review. arXiv. [4] Lakshminarayana, S., Karachiwala, J. S., Teng, T. Z., Tan, R., & Yau, D. K. Y. (2019). Performance and resilience of cyber?physical control systems with reactive attack mitigation. arXiv. [5] Baroumand, A., et al. (2023). Attack detection and fault?tolerant control of interconnected cyber?physical systems against simultaneous replayed time?delay and false?data injection attacks. IET Control Theory & Applications. [6] Wan, W., Kim, H., Hovakimyan, N., & Voulgaris, P. (2021). Constrained attack?resilient estimation of stochastic cyber?physical systems. arXiv. [7] Mustafa, A., Mazouchi, M., & Modares, H. (2019). Secure event?triggered distributed Kalman filters for state estimation over wireless sensor networks. arXiv. [8] Chamanbaz, M., Dabbene, F., & Bouffanais, R. (2019). A physics?based attack detection technique in CPS: A model predictive control co?design approach. arXiv. [9] Ye, D., & Zhang, T. Y. (2019). Summation detector for false data?injection attack in cyber?physical systems. IEEE Transactions on Cybernetics. [10] Mo, Y., & Sinopoli, B. (2015). On the performance degradation of cyber?physical systems under stealthy integrity attacks. IEEE Transactions on Automatic Control. [11] Zhang, D., Wang, Q. G., Feng, G., Shi, Y., & Vasilakos, A. V. (2021). A survey on attack detection, estimation and control of industrial cyber–physical systems. ISA Transactions. [12] Manandhar, K., Cao, X., Hu, F., & Liu, Y. (2014). Detection of faults and attacks including false data injection attack in smart grid using Kalman filter. IEEE Transactions on Control Network Systems. [13] Malik, M. I., Ibrahim, A., Hannay, P., & Sikos, L. F. (2023). Developing resilient cyber?physical systems: A review of state?of?the?art malware detection approaches. Computers. [14] Daniel, A., Deebalakshmi, R., Thilagavathy, R., et al. (2023). Optimal feature selection for malware detection in CPS using graph convolutional network. Computers & Electrical Engineering, 108, 108689. [15] Liu, J., Tang, Y., Zhao, H., et al. (2023). CPS attack detection under limited local information: An ensemble multi-node multi-class classification approach. ACM Transactions on Sensor Networks. [16] Longari, S., Pozone, A., Leoni, J., et al. (2023). CyFence: Securing cyber?physical controllers via trusted execution environment. IEEE Transactions on Emerging Topics in Computing. [17] Chaitanya, S. M. K., & Choppakatla, N. (2023). A novel embedded system for CPS using crypto mechanism. Multimedia Tools and Applications, 82(26), 40085–40103. [18] Rosado, D. G., Santos?Olmo, A., & Sánchez, L. E. (2022). Managing cybersecurity risks of cyber?physical systems: The MARISMA?CPS pattern. Computers in Industry, 142, 103715. [19] Sun & Yang (2019) discuss MPC?based methods for replay, denial?of?service, and covert attack resiliency. [20] Franzè et al. (2021–2022) series of works on MPC for attack detection and control in networked CPS. [21] Zhu & Martinez (2014) early watermarking-based secure control in CPS. [22] Zhai & Vamvoudakis (2021) propose moving target defense frameworks for discrete-time CPS under sensor/actuator attacks. [23] Humayed et al. (2017) foundational survey on CPS attacks (background). [24] Yampolskiy et al. (2013) early taxonomy of CPS threats. [25] Kim et al. (2022) updated threat-and-attack survey in CPS contexts. [26] Gyamfi & Jurcut (2022) online anomaly detection in CPS. [27] Alsulami et al. (2023) incremental learning methods for CPS anomaly detection. [28] Nakayama et al. (2019) propose G?KART: causal Kalman+adaptive threshold to detect stealthy FDIA in ICS.

Copyright

Copyright © 2025 S.V. Srinivasarao, Dr. G. Bhaskar Reddy, Kapu. Ananthalakshmi, Dr. N. Sathiyaseelan. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.