Method of detecting cyber attacks on a cyber physical system which includes at least one computing device coupled to at least one sensor and/or actuator for controlling a physical process

A method of detecting cyber-attacks on a cyber physical system which includes at least one computing device communicatively coupled to at least one sensor and/or actuator for controlling a physical process, the method comprises:

• (i) deriving invariants for the at least one computing device, based on a system design of the cyber physical system or computer code configured to control the cyber physical system in relation to the physical process or data collected from the cyber physical system during testing or operation of the cyber physical system, the invariants defining a set of conditions that enable determination from the at least one sensor and/or actuator regarding process anomalies of the physical process being controlled, the invariants comprising at least one state-dependent invariant that defines a state of the at least one sensor and/or actuator and at least one state-agnostic invariant derived from the cyber-physical system's physics and chemistry properties;
• (ii) configuring the invariants as corresponding invariant computer program;
• and
• (iii) executing the invariant computer program on the at least one computing device to monitor the physical process via the at least one sensor and/or actuator and detect the process anomalies for detecting the cyber-attacks, wherein step (iii) further includes retrieving measurements from the at least one sensor and/or actuator, and matching the retrieved measurements against the set of conditions defined in the invariants to detect the anomalies in operation of the at least one sensor and/or actuator.