Abstract
Evaluating the security of Cyber-Physical Systems (CPS) is challenging, mainly because it brings risks that are not acceptable in mission-critical systems like Industrial Control Systems (ICS). Model-based approaches help to address such challenges by keeping the risk associated with testing low. This paper presents a novel modelling framework and methodology that can easily be adapted to different CPS. Based on our experiments, HybLearner takes less than 140 s to build a model from historical data of a real-world water treatment testbed, and HybTester can simulate accurately about 60min ahead of normal behaviour of the system including transitions of control strategies. We also introduce a security metrics (time-to-critical-state) that gives a measurement of how fast the system might reach a critical state, which is one of the use cases of the proposed framework to build a model-based attack detection mechanism.