A combined discriminative and generative behavior model for cyber physical system defense

In this position paper we explore the use of behavior models as an enabling methodology in the promotion of a more holistic understanding of CPS that can bridge both cyber and physical domains. Thus, we investigate the use of aggregate behavior analysis techniques combined in both cyber and physical domains. Ultimately, our work focuses on the development of a cyber-physical behavior model that leverages behavior aggregation promoting the creation of a long-view sense-making capability driven by both cyber and physical observations. We look to the use of this approach to establish the ability to anticipate malicious activity in CPS, rather that react.