Cyber-physical systems (CPSs) constitute the backbone of critical infrastructures such as power grids or water distribution networks. Operating failures in these systems can cause serious risks for society. To avoid or minimize downtime, operators require real-time awareness about critical incidents. However, online event identification in CPSs is challenged by the complex interdependency of numerous physical and digital components, requiring to take cyber attacks and physical failures equally into account. The online event identification problem is further complicated through the lack of historical observations of critical but rare events, and the continuous evolution of cyber attack strategies. This work introduces and demonstrates CyPhERS, a Cyber-Physical Event Reasoning System. CyPhERS provides real-time information pertaining the occurrence, location, physical impact, and root cause of potentially critical events in CPSs, without the need for historical event observations. Key novelty of CyPhERS is the capability to generate informative and interpretable event signatures of known and unknown types of both cyber attacks and physical failures. The concept is evaluated and benchmarked on a demonstration case that comprises a multitude of attack and fault events targeting various components of a CPS. The results demonstrate that the event signatures provide relevant and inferable information on both known and unknown event types.

翻译：信息物理系统（CPS）构成了电网或供水网络等关键基础设施的骨干。此类系统的运行故障可能对社会造成严重风险。为避免或缩短停机时间，操作人员需实时掌握关键事件的态势感知信息。然而，CPS中物理与数字组件间的复杂相互依赖性要求必须同等考虑网络攻击与物理故障，这对在线事件识别构成挑战。此外，关键但罕见事件的历史观测数据匮乏以及网络攻击策略的持续演变进一步加剧了在线事件识别难题。本文介绍并展示了CyPhERS（信息物理事件推理系统）。该系统无需依赖历史事件观测数据，即可实时提供CPS中潜在关键事件的发生情况、位置、物理影响及根因信息。CyPhERS的核心创新在于其能为已知与未知类型的网络攻击及物理故障生成信息丰富且可解释的事件签名。我们在包含多种针对CPS组件攻击与故障事件的演示案例上对该概念进行了评估与基准测试。结果表明，事件签名为已知与未知事件类型均能提供相关且可推理的信息。