AWARE-RG: Abstraction Aware Explanation of Resiliency Graphs for Cyber Physical Systems

Shadaab Kawnain Bashir; Rakesh Podder; Philip D. Hopkins; Sarath Sreedharan; Indrakshi Ray; Indrajit Ray

cs.CROct 14, 2026

AWARE-RG: Abstraction Aware Explanation of Resiliency Graphs for Cyber Physical Systems

Authors: Shadaab Kawnain Bashir, Rakesh Podder, Philip D. Hopkins, Sarath Sreedharan, Indrakshi Ray, Indrajit Ray

Organizations: Computer Science Department, Colorado State University, Fort Collins, Colorado, USA

Abstract

Understanding the security posture of cyber physical systems (CPS) requires reasoning across both information technology (IT) and operational technology (OT). However, a security analyst often holds an incomplete, role-specific view of the underlying system which has most likely resulted from their knowledge limited by a need-to-know framework. Such an incomplete view can potentially lead them to incorrectly assess if a cyber attack produces an untoward physical consequence resulting in making uninformed decisions about system resilience. In this work, we present AWARE-RG (Abstraction Aware Explanation of Resiliency Graphs), a semi-automated, human-in-the-loop framework that provides an analyst with a role-bounded, need-to-know explanations of resiliency paths in a CPS. The AWARE-RG abstraction structure is derived using Formal Concept Analysis over MITRE ATT&CK for ICS tactics, ordered by the ICS Cyber Kill Chain. For valid attack-fault queries, plan repair and backward means-end analysis identify the missing dependencies, explain why the physical hazard is reachable, and suggest defensive strategies. For invalid attack-fault queries, AWARE-RG localizes the first abstraction level at which the path fails, and reports confirmed blocking conditions as hardening pointers.

Figures & tables

Fig. 1: AWARE-RG explanation pipeline with guided abstraction search.

Fig. 2: An overview of the Lattice creation pipeline.

Predicate	Tactic	Unit
compromised-customer-pc	Initial Access	$K_{1}$
access-to-windows-server	Lateral Movement	$K_{2}$
vul-CVE-2019-0575	Execution	$K_{3}$
vul-CVE-2019-0584	Execution	$K_{3}$

TABLE I: Predicate mappings and FCA knowledge units in the running example. Predicates with identical tactic assignments belong to the same knowledge unit.

Stage	MITRE ATT&CK for ICS Tactic	ICS Cyber Kill Chain Stage	Order	Ex.
Stage 1 (IT)	Initial Access	Cyber Intrusion	$S_{1}$	$\star$
	Execution	Cyber Intrusion	$S_{2}$	$\star$
	Persistence	SEDE	$S_{3}$
	Privilege Escalation	SEDE	$S_{4}$
	Command and Control	Management & Enablement	$S_{5}$
	Discovery	SEDE	$S_{6}$	$\star$

TABLE II: Two stage mapping of MITRE ATT&CK for ICS tactics to the ICS Cyber Kill Chain. Rows marked

\star

are instantiated in the running example. SEDE : Sustainment, Entrenchment, Development & Execution.

Panel of Figure 5 — Fig. 3: AWARE-RG lattice for the running example, showing both branches and two representative bridge families; the rest follow by the same construction. Edge labels show which knowledge unit was removed. $S$ concepts denote low-level system knowledge, $C$ concepts the corresponding high-level abstractions used in bridge nodes.

Bridge Node	Primary Pred.	Added $C_{i}$	Opp. $S_{i}$ ?	P1
$\text{MIT}_{3}$ - $\text{MOT}_{1}$	$\{S_{1},S_{12}\}$	$\{C_{7},C_{11}\}$	No	✓
$\text{MIT}_{3}$ - $\text{MOT}_{2}$	$\{S_{1},S_{12}\}$	$\{C_{11}\}$	No	✓
$\text{MIT}_{2}$ - $\text{MOT}_{1}$	$\{S_{1},S_{2},S_{12}\}$	$\{C_{7},C_{11}\}$	No	✓
$\text{MIT}_{0}$ - $\text{MOT}_{2}$	$\{S_{1},S_{2},S_{6},S_{7},S_{12}\}$	$\{C_{11}\}$	No	✓
$\text{MOT}_{2}$ - $\text{MIT}_{3}$	$\{S_{11},S_{12}\}$	$\{C_{1}\}$	No	✓
$\text{MOT}_{1}$ - $\text{MIT}_{2}$	$\{S_{7},S_{11},S_{12}\}$	$\{C_{1},C_{2}\}$	No	✓

TABLE III: Verification of Property 1 for bridge nodes.

Query Variant	Analyst	Queries	Artifacts	Node Acc.	Repair P/R	Diag. Acc.	GVR	Leak.	Bnd.
Path Validity Analysis
Complete	IT	13	39	100%	–	–	0%	0/39	–
Repaired	IT	12	36	100%	0.95/0.92	–	3%	0/36	–
Complete	OT	13	39	100%	–	–	0%	0/39	–
Repaired	OT	12	36	92%	0.91/0.88	–	5%	0/36	–
Path Invalidity Analysis

TABLE IV: Path Validity and Invalidity Analysis across 100 queries and IT and OT analyst profiles. Node Acc. : explanation-node selection accuracy against ground truth. Repair P/R : precision and recall of missing condition identification. Diag. Acc. : diagnosis accuracy of blocking conditions. GVR : grounding violation rate. Leak. : out-of-view predicate symbol (lexical). Bnd. : boundary predicates disclosed within

\mathit{Pred}(n_{\mathit{fail}})

, authorized rather than leaked. – : not applicable.

Configuration	Pred. Exposed	Lattice Nodes	No Expl. Node	Lexical Leakage Rate
No Abstraction Baseline ( $M^{RG}$ )	90	–	0	100%
Vanilla HELM (unpruned)	6.3	$2^{90}$	0	0%
No Bridge Ablation	5.1	7	34/100	0%
AWARE-RG (ours)	6.1	31	0	0%

TABLE V: Ablation and baseline comparison. Pred. Exposed : mean predicates exposed per explanation. Lattice Nodes : total nodes in the abstraction structure. No Expl. Node : queries with no valid explanation node within the analyst’s branch. Lexical Leakage : out-of-view predicate leakage.

T	Attack Strategy	Mitigation	Effective	Info Leaked
$T_{1}$	Ambiguous CVE description	Human review	Yes	No
$T_{1}$	Generic action phrasing	Human review	Yes	No
$T_{2}$	Incomplete IT path probing	Bridge node policy	Yes	No
$T_{2}$	Incomplete OT path probing	Bridge node policy	Yes	No
$T_{3}$	Same query, IT vs. OT output comparison	Node selection policy	Yes	No

TABLE VI: Threat mitigation evaluation. Info Leaked : whether any opposite domain

S_{i}

predicate appeared in an output returned to the adversary

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Security Analyst	Query & Steps	Hardening Recommended by AWARE-RG	Runtime (s)
IT	Query: Why does this attack-fault path not lead to flare flameout? Steps: 1. Exploit CVE-2018-0296 on Windows Server to gain internal network access. 2. Exploit CVE-2017-9312 on Allen-Bradley ControlLogix PLC. 3. PLC compromise causes flare flameout.	Restrict or monitor access to Allen-Bradley ControlLogix PLC port 1132/TCP to block the attack path.	156
IT	Query: Why does this attack-fault path not lead to flare flameout? Steps: 1. Exploit CVE-2017-9312 on Allen-Bradley ControlLogix PLC. 2. Compromised PLC causes process valve to become blocked closed. 3. Blocked valve causes manual isolation valve to close. 4. Closed isolation valve causes low pilot supply pressure. 5. Low pilot supply pressure leads to pilot extinction. 6. Pilot extinction causes flare flameout.	The blocking condition is the absence of a blocked process valve, which is a prerequisite for the manual isolation valve to close. Preserve this condition to maintain the resilience boundary.	134
IT	Query: Why does this attack-fault path not lead to flare flameout? Steps: 1. Compromised PLC causes process valve to become blocked closed. 2. Blocked valve causes manual isolation valve to close. 3. Closed isolation valve causes low pilot supply pressure. 4. Low pilot supply pressure leads to pilot extinction. 5. Pilot extinction causes flare flameout.	Monitor and detect PLC process control integrity; promptly identify and address any impairment to preserve the blocking condition.	104
OT	Query: Why does this attack-fault path not lead to flare flameout? Steps: 1. Closed isolation valve causes low pilot supply pressure. 2. Low pilot supply pressure leads to pilot extinction. 3. Pilot extinction causes flare flameout.	The blocking condition is the open isolation valve; ensure the isolation valve state is monitored and preserved to prevent downstream fault propagation.	75
OT	Query: Why does this attack-fault path not lead to flare flameout? Steps: 1. Exploit CVE-2018-0296 on Windows Server to gain internal network access. 2. Access PLC port 1132/TCP on Allen-Bradley ControlLogix PLC. 3. Exploit CVE-2017-9312 on Allen-Bradley ControlLogix PLC. 4. Compromised PLC causes process valve to become blocked closed. 5. Blocked valve causes manual isolation valve to close. 6. Closed isolation valve causes low pilot supply pressure. 7. Low pilot supply pressure leads to pilot extinction. 8. Pilot extinction causes flare flameout.	Path is not invalid.	151
OT	Query: Why does this attack-fault path not lead to flare flameout? Steps: 1. Exploit CVE-2018-0296 on Windows Server to gain internal network access. 2. Exploit CVE-2017-9312 on Allen-Bradley ControlLogix PLC. 3. Compromised PLC causes process valve to become blocked closed. 4. Blocked valve causes manual isolation valve to close. 5. Pilot extinction causes flare flameout.	Restrict access to PLC port 1132/TCP to prevent exploitation of CVE-2017-9312 and block the attack-fault path.	141

Appendix

TABLE VII: Path Invalidity analysis results across IT and OT analyst profiles. Each row shows a query submitted to AWARE-RG, the hardening recommendation derived strictly from the invalidity causing predicates at

\mathit{Pred}(n_{\mathit{fail}})

and runtime.

Security Analyst	Query & Steps	Repair Count	Defensive Recommendations by AWARE-RG	Execution (s)
IT	Query: Why does this attack-fault path lead to flare flameout? Steps: 1. Access PLC port 1132/TCP on Allen-Bradley ControlLogix PLC from internal network. 2. Exploit CVE-2017-9312 on Allen-Bradley ControlLogix PLC. 3. Compromised PLC causes process valve to become blocked closed.	2	Ensure proper firewall configuration to prevent unauthorized access to the internal network.	177
IT	Query: Why does this attack-fault path lead to flare flameout? Steps: 1. Access PLC port 1132/TCP on Allen-Bradley ControlLogix PLC from internal network. 2. Compromised PLC causes process valve to become blocked closed.	1	1. Ensure proper firewall configuration to prevent unauthorized internal network access. 2. Implement robust process-control measures to prevent impairment.	141
IT	Query: Why does this attack-fault path lead to flare flameout? Steps: 1. Exploit CVE-2017-9312 on Allen-Bradley ControlLogix PLC. 2. Compromised PLC causes process valve to become blocked closed.	1	1. Segment network and require strong authentication before the missing network-access condition can become true. 2. Allowlist PLC communication and block unauthorized access to PLC port. 3. Detect, isolate, and recover compromised asset state. 4. Add monitoring, alarms, or interlocks around the fault.	122
OT	Query: Why does this attack-fault path lead to flare flameout? Steps: 1. Compromised PLC causes process valve to become blocked closed. 2. Blocked valve causes manual isolation valve to close. 3. Closed isolation valve causes low pilot supply pressure. 4. Low pilot supply pressure leads to pilot extinction. 5. Pilot extinction causes flare flameout.	4	Ensure PLC remains online and operational to prevent unauthorized access and denial-of-service attacks.	168
OT	Query: Why does this attack-fault path lead to flare flameout? Steps: 1. Compromised PLC causes process valve to become blocked closed. 2. Blocked valve causes manual isolation valve to close. 3. Closed isolation valve causes low pilot supply pressure. 4. Pilot extinction causes flare flameout.	3	Monitor for missing process-control impairment condition and trigger isolation or safe-mode response.	182
OT	Query: Why does this attack-fault path lead to flare flameout? Steps: 1. Compromised PLC causes process valve to become blocked closed. 2. Closed isolation valve causes low pilot supply pressure. 3. Low pilot supply pressure leads to pilot extinction. 4. Pilot extinction causes flare flameout.	3	Ensure PLC remains online and operational to prevent unauthorized access and denial-of-service attacks.	175

Appendix

TABLE VIII: Path Validity Analysis results across IT and OT analyst profiles. Repair Count denotes the number of actions inserted by plan repair, representing conditions absent from the analyst’s knowledge. Defensive Recommendations are derived strictly from repair predicates and bounded by the analyst’s authorized abstraction view. Runtime reports end-to-end execution time in seconds.

Analyst (Malicious)	Query & Steps	Attacker’s Intention	AWARE-RG Explanation	Lattice Node	Justification
IT	Can internal network access allow the attacker to reach PLC port 1132/TCP? 1. Exploit VPN/firewall vulnerability on Windows Server. 2. Access PLC port 1132/TCP from internal network.	Determine whether firewall exploitation provides a viable path to the PLC communication port.	Path is repairable: firewall exploitation establishes internal network access ( $S_{1}$ , $S_{2}$ ), but direct PLC port reachability requires additional network conditions absent from the analyst’s model. Missing knowledge: intermediate network segmentation predicates.	$\text{MIT}_{0}$ - $\text{MOT}_{2}$	Repair identifies missing network predicates; defensive strategy is bounded to IT abstraction view with OT consequence communicated at $C_{11}$ only.
OT	Why does this attack-fault path lead to flare flameout? 1. Exploit CVE-2017-9312 from internal network to compromise Allen-Bradley ControlLogix PLC. 2. Compromised PLC causes valve to become blocked closed. 3. Blocked valve causes manual isolation valve to close. 4. Closed isolation valve causes low pilot supply pressure. 5. Low pilot supply pressure causes pilot extinction. 6. Pilot extinction causes flare flameout.	Confirm that PLC compromise propagates through the physical fault chain to trigger flare flameout.	Path is repairable: OT fault chain is valid but IT side access prerequisites (network access, port reachability) are absent from the analyst’s model. Missing knowledge: IT access conditions communicated at $C_{1}$ abstraction level.	$\text{MOT}_{2}$ - $\text{MIT}_{3}$	Repair exposes missing IT prerequisites at $C_{1}$ only; no IT side $S_{i}$ predicates are disclosed to the OT analyst, consistent with Property 1 .

Appendix

TABLE IX: Illustrative queries submitted to AWARE-RG across IT and OT analyst profiles. Lattice Node denotes the explanation node selected by AWARE-RG. Attacker’s Intention describes the adversarial goal inferred from the query. AWARE-RG Explanation summarizes the generated need-to-know explanation. Justification describes how the attack is bounded or stopped.

CPS Security

See all 25 papers

A Formal Resilience Framework for Cyber-Physical Embodied Systems under Device-Level Cyberattacks
Jun 15, 2026Alberto GiarettaCyber-Physical Systems Cybersecurity
Department of Computer Science, Örebro University, Sweden · AI, Robotics and Cybersecurity Center (ARC), Örebro University, Sweden
RobResilience: Implementing and Evaluating a Resilience Framework for Cyber-Physical Embodied Systems
Sep 15, 2026Gysella Imrell, Emanuele Miotto, Mahya Mohammadi Kashani +2Cyber-Physical Systems Autonomous Cyber Defense
Örebro University Örebro, Sweden · University of Padua Padua, Italy
Operationalizing Cyber Threat Intelligence with GraphRAG
Aug 13, 2026Atul Kabra, Prakhar Paliwal, Manjesh K. HanawalCyber Threat Intelligence Graph Retrieval-Augmented Generation
MLiONS, Department of IEOR, IIT Bombay Mumbai, Maharashtra, India

Jun 15, 2026J/K move · Enter open · S save

A Formal Resilience Framework for Cyber-Physical Embodied Systems under Device-Level Cyberattacks

Alberto Giaretta

Department of Computer Science, Örebro University, Sweden · AI, Robotics and Cybersecurity Center (ARC), Örebro University, Sweden

Cyber-Physical Systems Cybersecurity CPS Security

Open paper AskPDF arXiv

In cyber-physical systems (CPSs), fault tolerance is traditionally achieved by analysing sensor and actuator outputs, detecting progressive drift or sudden failures, and initiating suitable tolerance mechanisms. Reasonable under general failure models, this approach fails to capture nuanced disruptions caused by cyberattacks, which may employ subtle strategies. This is particularly critical in embodied CPSs, where computational and physical devices not only have an active role in task completion, but also in embodiment preservation (that is, maintaining the system's physical integrity). To prevent structural physical damage, embodied CPSs require a framework that enables proactive response to cyberattacks. This paper proposes a formal dependability framework that incorporates IDS information into resilience evaluation predicates, enabling assessment of tolerance to disruption and degradation. The framework supports structured reasoning about how cyberattacks affect task execution and embodiment preservation, and whether mitigation strategies must be deployed. Analytical examples demonstrate its analytical capability and soundness, establishing a theoretical foundation for dependable and secure embodied CPSs.

Abstract

CPS Security

Explore similar work

A Formal Resilience Framework for Cyber-Physical Embodied Systems under Device-Level Cyberattacks

RobResilience: Implementing and Evaluating a Resilience Framework for Cyber-Physical Embodied Systems

Operationalizing Cyber Threat Intelligence with GraphRAG