On Attacker Models and Profiles for Cyber-Physical Systems

Attacker models are a fundamental part of research on security of any system. For different application scenarios, suitable attacker models have to be chosen to allow comprehensive coverage of possible attacks. We consider Cyber-Physical Systems (CPS), that typically consist of networked embedded systems which are used to sense, actuate, and control physical processes. The physical layer aspects of such systems add novel attack vectors and opportunities for defenses, that require extended models of attackers' capabilities. We develop a taxonomy to classify and compare attacker models in related work. We show that, so far, there are no commonly used attacker models for such CPS. In addition, concepts of what information belongs in an attacker model are widely different among the community. To address that problem, we develop a framework to classify attacker models and use it to review related work on CPS Security. Using our framework, we propose a set of attacker profiles and show that those profiles capture most types of attackers described in the related work. Our framework provides a more formal and standardized definition of attacker model for CPS, enabling the use of well-defined and uniform attacker models in the future.