# Limitations on Observability of Effects in Cyber-Physical Systems

## TL;DR

This paper explores how cyber-physical system attacks create observable effects called Process Model Inconsistency (PMI), revealing that even complete models can exhibit inconsistencies, impacting attack detection strategies.

## Contribution

It introduces a formal framework linking process model properties to attack observability, highlighting that inconsistencies can occur even in correct models.

## Key findings

- Incomplete models lead to inconsistency
- Inconsistencies can occur in correct models
- Implications for attack detection in CPS

## Abstract

Increased interconnectivity of Cyber-Physical Systems, by design or otherwise, increases the cyber attack surface and attack vectors. Observing the effects of these attacks is helpful in detecting them. In this paper, we show that many attacks on such systems result in a control loop effect we term Process Model Inconsistency (PMI). Our formal approach elucidates the relationships among incompleteness, incorrectness, safety, and inconsistency of process models. We show that incomplete process models lead to inconsistency. Surprisingly, inconsistency may arise even in complete and correct models. We illustrate our approach through an Automated Teller Machine (ATM) example, and describe the practical implications of the theoretical results.