Industrial control system attacks are usually documented in terms of the plant where they occurred: its sensors, actuators, process stages, and control logic. Yet many attacks express a more general physical pattern--such as suppressing flow, corrupting chemical dosing, or driving a vessel toward overflow--that may also matter in a different plant. The challenge is deciding when such a threat remains meaningful on a new system rather than relying on similar component names or broad semantic labels. We present XPhysICS, a methodology for grounding documented cyber-physical threats onto a specific target system. XPhysICS converts source evidence into a provenance-linked description of what is manipulated, what physical consequence is expected, and what observations the evidence calls for. Once this analyst-guided abstraction, its vocabulary and schema version, and a target contract are fixed, XPhysICS applies deterministic grounding checks. An accepted result can be represented as a validation slice that records the mapped roles, signals, dependencies, and context intended to support later evaluation. We study 83 threat abstractions across continuous-process and manufacturing sources using separate evaluation denominators. The continuous-process study evaluates 78 abstractions against target contracts spanning water treatment, water distribution, hydropower, and chemical processes. Selected cases are exercised through controlled perturbations of simulator-role signals. We also test compatibility with several analysis styles, including the released upstream GeCo implementation, and conduct a three-objective, one-target realizability study using a paper-derived search reproduction. Across these evaluated settings, the results support treating explicit target checks and traceable evidence as separate from semantic similarity alone.
Figures & tables
Figure 1. Recurring cyber–physical threat patterns across ICS domains. Water-treatment, manufacturing, and oil/chemical-process systems may expose similar physical roles, including pumps, valves, tanks, interlocks, and control interactions, despite differences in plant topology, process structure, and physical medium.
Figure 2. Overview of XPhysICS . Evidence from a documented source threat and a target system is converted into a threat abstraction and target contract. The grounder applies the implemented eligibility checks and either does not accept a candidate when one or more checks fail or returns a target-specific validation slice. Execution and downstream analysis occur beyond the grounding boundary. CrossPLC provides optional controller-code enrichment.
Figure 3. Source-backed worked grounding example. SWaT attack 36 is recorded as SWAT-2026-031 , with a LIT-101 low-reading manipulation and a reported tank-overflow consequence. The recorded v1 structural grounding maps its level-sensor role to the SPHERE-WT RW_Tank_Level signal. This illustration does not claim that the source attack was executed on WT or that a downstream consumer detected it.
Construct
Operational definition
Origin / assignment
Effect family f
Normalized physical-consequence category drawn from a closed, versioned extraction vocabulary. Target grounding operates over the narrower grounding vocabulary declared in scope by the target contract (Section 3.3 ).
OTThreat-informed vocabulary; analyst- or parser-assigned.
Manipulated roles Rm
Source-side component roles manipulated by the threat, represented by an identifier and functional role with optional process-stage context.
XPhysICS -specific; analyst- or parser-assigned.
Consequence roles Rc
Components or consequence records associated with the realized physical effect f following manipulation of Rm .
XPhysICS -specific; assigned from supporting source evidence.
Observability obligations O
Signals or observations indicated by the source evidence as relevant to assessing the stated effect; these obligations seed target-side slice construction (Section 3.4 ).
XPhysICS -specific; may be empty when the source evidence does not identify corresponding observations.
Provenance Π
Evidence-lineage metadata linking populated abstraction fields to the source document, supporting excerpt, extraction method, and confidence assignment.
OTThreat-informed; provenance metadata are recorded by the evidence workflow, while confidence may involve analyst or reviewer judgment.
Table 1. Operational definitions of the source threat abstraction τ=(f,Rm,Rc,O,Π) . Origin distinguishes OTThreat-informed constructs from XPhysICS -specific constructs.
Contract component
Role in XPhysICS
Effect-family scope
Declares the source-threat effect families within the target’s current grounding scope.
Target signals and roles
Defines the target signal-and-role surface over which candidate mappings are evaluated.
Dependency relationships
Provides target relationships used during validation-slice construction and dependency/connectivity evaluation.
Threat-surface scope
Declares the boundary directions and threat classes represented by the target study.
Target rules and context
Defines the target rules and operating context used to determine rule-surface applicability and support subsequent slice evaluation.
Table 2. Target-contract components used by XPhysICS for grounding and validation-slice construction.
Our OTThreat-aligned audit layer links paper-facing threat objects to source evidence; it is provenance support, not the grounding algorithm.
Manual extraction sample
20 sampled items: 14 full pass, 6 partial, 0 fail
A bounded spot-check found no outright abstraction failures among sampled paper-facing records.
Table 3. Source semantics and provenance. XPhysICS extracts typed source-threat abstractions and preserves field-level evidence before target grounding. Counts are evaluation artifacts produced by XPhysICS , not external benchmark labels.
Figure 4. Continuous-process grounding coverage across target SUT families. Rows denote source threat corpora and columns denote target process families. Each cell reports accepted groundings relative to the source-threat denominator for that row. The matrix comprises 78 continuous-process abstractions from SWaT, WADI, and OilTreatment; the five Fischertechnik manufacturing abstractions are evaluated separately under a manufacturing/program-artifact denominator.
Grounding and target case
Target-side result and interpretation
SWaT → WT: Tank-level high spoof. Positive level offset on the WT tank slice; a target-side probe, not a direction-matched replay of SWaT attack 36.
Nominal-subtracted analysis yields three invariant violations: two rate-of-change and one mass-balance. This is the cleanest WT invariant case.
SWaT → WT: Pump-flow low spoof. Pump/flow suppression instantiated on the WT slice.
Raw analysis yields nine correlation violations, but nominal-subtracted analysis yields zero. We treat this as nominal-confounded and do not count it as a clean invariant success.
WADI → WD: Supply-flow low spoof. Low-flow effect instantiated on the WD supply slice.
No baseline invariant violations occur; the first firing appears only at the −64 perturbation boundary with shallow range/correlation evidence. We report this as a near-threshold boundary case.
WADI → WD: Supply-flow high idle. High-flow/pressure effect instantiated during an idle supply condition.
The slice produces 11 range violations, giving a clean WD flow/pressure case.
WADI → WD: NaOCl level step. Dosing/storage-level perturbation instantiated on the WD chemical slice.
The slice produces three mass-balance/rate-of-change violations. This is a clean WD dosing case, although it is outside the GeCo predictive surface.
Table 4. Water-domain validation-slice outcomes. Controlled target-side perturbations probe slices supported by accepted groundings; they need not be direction-matched replays of source attacks. Outcomes are labeled as clean, nominal-confounded, or near-threshold.
Consumer family
WT slice results
WD slice results
Role in evaluation
Invariant checks
Raw 2/2; 1 clean case remains after nominal subtraction.
2/3; high-flow and NaOCl are strong, low-flow is partial.
2/3 hits; nominal FPR 0.0; mean F1 0.1025; NaOCl outside modeled surface.
Bounded predictive compatibility lane.
SAIN-style state-aware ( Abbas et al., 2024 )
2/2 hits; nominal FPR improves from 0.0167 to 0.0; mean F1 0.66.
3/3 hits; nominal FPR 0.0; mean F1 1.0.
Bounded state-aware compatibility lane.
SCAPHY-style phase-aware ( Ike et al., 2022 )
2/2 hits; nominal FPR 0.0; mean F1 0.5661.
3/3 hits; recovers low-flow case; nominal FPR 0.0; mean F1 0.57.
Bounded phase/context-aware compatibility lane.
Table 5. Consumer utility from shared validation slices. Rows consume the same WT/WD slice artifacts using different bounded analysis styles.
Case
Effect / perturbation
Observed response
Interpretation
SWaT → Hydro: reservoir level
overflow, HY_Res_Level +20
range, rate-of-change fire (2/2)
Both declared rule types respond
SWaT → Hydro: turbine speed
speed excursion, HY_Speed_Pct +70
range, rate-of-change fire (2/2)
Both declared rule types respond
SWaT → Hydro: flow
pressure/flow, HY_Flow −90
range fires only (1/3)
Limited observed dependency-rule response
WADI → GRFICS: tank pressure
pressure/flow, TE_Tank_Pressure +1500
rate-of-change fires only (1/2)
Limited observed rule response
WADI → GRFICS: tank level
overflow, TE_Tank_Level +40
rate-of-change and causality responses
Mixed observed rule response
WADI → GRFICS: feed-1 flow
pressure/flow, TE_Feed1_Flow −250
causality, range fire (2/3)
Broadest observed GRFICS rule response
Table 6. Bounded-support validation slices on hydro and chemical-process targets. All nine satisfy the reported slice-adequacy requirements but lack nominal-subtracted baselines; the observed responses therefore characterize slice executability and bounded consumer compatibility rather than clean consumer outcomes. † Shared Hydro executions provide convergent source-side grounding evidence while sharing the same target-side execution evidence.
Appendix figures & tables7 assets
Supplementary material from the paper’s appendix.
Appendix
Evidence object
Appendix detail
Structured extraction
Result: 83 threats from 12 documents; 55 high-confidence, 18 medium-confidence, and 10 low-confidence. The source set includes SWaT ( Mathur and Tippenhauer, 2016 ) (51), WADI ( Ahmed et al., 2017 ) (17), OilTreatment (10), and Fischertechnik (5). Claim boundary: these are coverage and confidence counts for the paper-facing corpus, not a full extraction precision/recall evaluation.
WADI ( Ahmed et al., 2017 ) deepening
Result: naive PDF parsing yields 2 rows; XPhysICS recovers 15 A1 threats and 14 A2 attack windows, a 7.5 × gain in attack-level threat records. Claim boundary: A1 seeds extraction, A2 contributes timing/observability windows, and A3 provides clean context; this is source-specific extraction, not a general PDF-table benchmark.
CISS ( iTrust, Centre for Research in Cyber Security, 2019 ) semantics
Result: 187 parsed rows, 73 process-relevant rows, and 20 high-confidence derived threats from CISS ( iTrust, Centre for Research in Cyber Security, 2019 ) . Claim boundary: CISS contributes source semantics and observability support; we do not treat it as perturbation replay.
Manual sample
Result: 20 sampled items: 14 full pass, 6 partial, and 0 fail. Claim boundary: this bounded spot-check found no outright abstraction failures, but it is not a full precision/recall measurement.
XPhysICS evidence ledger
Result: 333 curated threats, 1,947 field-level evidence spans, and 100% core-field coverage. Claim boundary: the ledger is an artifact of XPhysICS , aligned with OTThreat ( Paul et al., 2024 ) ; it supports provenance and auditability, not the grounding algorithm itself.
Appendix
Table 7. Source-evidence and extraction ledger used in the evaluation, including provenance metadata and manual spot-check results.
Grounding case
Detailed outcome
SWaT → WT: tank-level high spoof
Adequacy: target signals declared in the WT contract; 100% source/target/dependency coverage; timing evaluable. Outcome: nominal-subtracted delta yields 3 violations: 2 rate-of-change and 1 mass-balance. Interpretation: clean WT invariant case.
SWaT → WT: pump-flow low spoof
Adequacy: target signals declared in the WT contract; 100% source/target/dependency coverage; timing evaluable. Outcome: raw analysis yields 9 correlation violations, but nominal-subtracted delta yields 0. Interpretation: nominal-confounded; not counted as a clean invariant success.
WADI → WD: supply-flow low spoof
Adequacy: target signals declared in the WD contract; 100% source/target/dependency coverage; partial verdict. Outcome: no baseline invariant violations; first firing occurs at −64 with shallow range/correlation evidence. Interpretation: near-threshold boundary case.
WADI → WD: supply-flow high idle
Adequacy: target signals declared in the WD contract; 100% source/target/dependency coverage; strong verdict. Outcome: 11 range violations. Interpretation: clean WD flow/pressure case.
WADI → WD: NaOCl level step
Adequacy: target signals declared in the WD contract; 100% source/target/dependency coverage; strong verdict. Outcome: 3 mass-balance/rate-of-change violations. Interpretation: clean WD dosing case; outside the GeCo-style predictive surface.
Appendix
Table 8. Detailed water-domain validation-slice evidence, including slice adequacy, controlled-perturbation metadata, raw consumer response, nominal-subtracted outcome, and interpretation. Target signals are defined by the corresponding SPHERE target contracts.
Table 9. Adequacy and consumer-response metadata for the nine Hydro/GRFICS bounded-support cases. “Earliest” denotes the sample index of the first recorded rule violation; the controlled perturbation begins at sample 20 for every case. Observed rule responses characterize bounded consumer behavior without a nominal-subtracted baseline.
Consumer family
Bounded implementation details
Invariant checks
Slice inputs: signal ranges, correlations, mass-balance relationships, and rate-of-change constraints. Calibration: thresholds from nominal traces. Scoring: violation count and nominal-subtracted delta. Boundary: native XPhysICS consumer and primary validation lane.
GeCo-style predictive ( Wolsing et al., 2025 )
Slice inputs: time-series windows and signal correlations. Calibration: nominal-trace training and threshold calibration. Scoring: hit/miss, nominal FPR, and F1. Boundary: bounded predictive lane inspired by GeCo; not upstream code reuse or faithful reproduction.
SAIN-style state-aware ( Abbas et al., 2024 )
Slice inputs: target signals and coarse discrete process state. Calibration: state-conditioned thresholds from nominal traces. Scoring: hit/miss, nominal FPR, and F1. Boundary: bounded state-aware lane; not full SAIN reproduction.
SCAPHY-style phase-aware ( Ike et al., 2022 )
Slice inputs: target signals, phase labels, and operating context. Calibration: phase-segmented nominal calibration. Scoring: hit/miss, nominal FPR, and F1. Boundary: bounded phase/context-aware lane; not full SCAPHY reproduction.
Appendix
Table 10. Bounded consumer implementations over the common validation-slice representation. The “-style” lanes are XPhysICS -native implementations of selected analysis patterns motivated by the corresponding published systems and are evaluated as bounded consumers rather than reproductions of those systems.
Prototype adapter
Verified prototype evidence and claim boundary
Post-analysis classification/typing
Result: at 1 FA/hr, baseline P/R/F1 was 0.375/1.000/0.545; adding XPhysICS semantics yielded 1.000/0.667/0.800, corresponding to a precision gain of +0.625 and F1 gain of +0.255. What it exercises: post-analysis typing over detector windows using grounded temporal predicates and provenance. Boundary: these measurements characterize an earlier XPhysICS prototype adapter only. SCADMAN is cited as motivating literature and was not independently reproduced here; the evaluated prototype does not implement SCADMAN’s control-flow-attestation mechanism and therefore does not measure SCADMAN performance or mechanism fidelity.
Provenance-workflow adapter
Result: 17/17 rule templates instantiated, 2,074 typed physics-consistent mappings, and 0.95 reproducibility across reruns. What it exercises: rule expansion, provenance-pack generation, eligibility checks, and typed path export. Boundary: these measurements characterize the prototype provenance workflow only. ICSTracker is cited as motivating literature; because implementation fidelity has not been independently established, these results do not constitute an ICSTracker reproduction or performance evaluation.
Appendix
Table 11. Prototype downstream-adapter evidence. Measurements characterize the XPhysICS -authored adapters under the evaluated configurations; SCADMAN and ICSTracker motivate the corresponding analysis patterns but are not executed as baselines.
Table 12. Extension evidence ledger. Each row identifies the evaluated extension, its principal result, the XPhysICS capability exercised, and the evidentiary scope of the result.
Figure 5. TXT → S7 manufacturing/program-artifact grounding. Fischertechnik/TXT source abstractions are evaluated against a Siemens S7 target surface using the available program, tag, and state evidence. The study is reported under a manufacturing/program-artifact denominator separate from the continuous-process grounding matrix in Figure 4 .
Threat modeling for cyber-physical systems (CPS) remains a largely manual exercise. This project presents SMSI (System Model Security Inference), a hybrid neuro-symbolic pipeline that starts from a SysML architecture model and produces a prioritized list of NIST 800-53 security controls. The prototype has three main stages: a deterministic parser mapping system components to vulnerabilities via the NVD; a family of retrieval and classification models linking vulnerabilities to MITRE ATT&CK techniques; and a control recommender. We explore three approaches for CVE-to-ATT&CK mapping: a supervised classifier using fine-tuned SecureBERT+, retrieval-based dense encoders, and a zero-shot LLM approach using Gemma-4 26B. We validate the pipeline on a healthcare IoT gateway with nine software components. For the ATT&CK-to-NIST stage, pretrained SecureBERT achieves the highest control retrieval scores, demonstrating that dense embeddings provide a strong basis for automated control recommendation.
RoÝah Radaideh, Ali Khreis
School of Electrical Engineering and Computer Science, University of Ottawa, Ottawa, ON, Canada
In cyber-physical systems (CPSs), fault tolerance is traditionally achieved by analysing sensor and actuator outputs, detecting progressive drift or sudden failures, and initiating suitable tolerance mechanisms. Reasonable under general failure models, this approach fails to capture nuanced disruptions caused by cyberattacks, which may employ subtle strategies. This is particularly critical in embodied CPSs, where computational and physical devices not only have an active role in task completion, but also in embodiment preservation (that is, maintaining the system's physical integrity). To prevent structural physical damage, embodied CPSs require a framework that enables proactive response to cyberattacks. This paper proposes a formal dependability framework that incorporates IDS information into resilience evaluation predicates, enabling assessment of tolerance to disruption and degradation. The framework supports structured reasoning about how cyberattacks affect task execution and embodiment preservation, and whether mitigation strategies must be deployed. Analytical examples demonstrate its analytical capability and soundness, establishing a theoretical foundation for dependable and secure embodied CPSs.
Alberto Giaretta
Department of Computer Science, Örebro University, Sweden · AI, Robotics and Cybersecurity Center (ARC), Örebro University, Sweden
In embodied cyber-physical systems, active cyberattacks pose an immediate threat not just to data, but to physical integrity and human safety. While existing security approaches excel at detection, they lack the runtime mechanisms to determine whether a disruption is tolerable or if performance degradation remains within safe operational bounds. This gap leaves autonomous systems vulnerable to graceful failure paralysis, where they cannot distinguish between a safe, degraded state and a catastrophic hazard during an ongoing attack. This paper presents RobResilience, an implementation of a formal resilience framework for embodied cyber-physical systems in a Webots simulation environment, using a PR2 robot and ROS2. The framework evaluates three predicates at runtime: tolerable disruption (δ), tolerable degradation (γ), and mitigation feasibility (μ), over a compromised device set derived from IDS confidence scores. When resilience is lost, the framework triggers available mitigation strategies. We evaluate our implementation through eight attack scenarios that systematically cover all possible combinations of the predicate state space, varying attack targets, degradation rates, and mitigation availability. Results confirm that the runtime behaviour of the implementation is consistent with the theoretical definitions.