Chapter 4 — OT, IoT and cyber-physical security: competing explanations
Lesson map
Lesson 04 published. Map, example, EX021.
flowchart TD
N0["Learning outcomes and connection"]
N1["4.1 Rivals for a CUSUM advantage"]
N2["4.2 Architectural rival"]
N3["Chapter synthesis"]
N0 --> N1 --> N2 --> N3
N3 --> EX["Worked example"]
EX --> Q["Exercise EX021"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["4.1 Rivals for a CUSUM advantage"]
N2["4.2 Architectural rival"]
N3["Chapter synthesis"]
N0 --> N1 --> N2 --> N3 --> Q["EX021"]
[Learning outcomes and connection]
|
v
[4.1 Rivals for a CUSUM advantage]
|
v
[4.2 Architectural rival]
|
v
[Chapter synthesis]
|
v
[Worked example] --> [Exercise EX021]
Learning outcomes and connection
After this chapter you can (1) list rival explanations for a detection result, (2) design observations that discriminate among them, and (3) revise claims when a rival survives.
4.1 Rivals for a CUSUM advantage
(1) Thresholds tuned on test data. (2) Simulator too clean (no calibration bias). (3) Attack magnitude chosen to suit CUSUM. (4) Band alarm set unusually tight or loose. (5) Evaluation uses point-adjusted F1. Each rival has a test: separate-seed tuning, bias sweeps, gain sweeps, report band false-alarm rate, report event metrics.
Write rivals before you see results. After results, it is too easy to invent only the rivals you already beat. Give the list to a colleague who has not seen Lab 3 and ask what they would add. Control engineers often add model-structure rivals; security researchers often add adaptive-adversary rivals. Both belong on the list even if a master's timeline can only partly test them.
4.2 Architectural rival
A deeper rival: "CUSUM only works because the flow meter is independent; if both sensors share a PLC, the method fails." This is not a confound to eliminate — it is a boundary condition to measure (class B). Surviving rivals become part of the claim. Many OT papers bury this kind of result in a limitations paragraph; masters examiners increasingly ask for it in the abstract. Treat a confirmed boundary as a finding: defenders learn that independent sensing paths are load-bearing assumptions.
The same logic applies elsewhere. A segmentation design that fails when engineering workstations retain permanent write paths has discovered a boundary. A protocol filter that fails when traffic is tunnelled inside another protocol has discovered a boundary. Measure them and put them where readers look first.
4.3 Worked example
After Lab 3, rivals (1) and (5) are addressed by design; rival (2) needs Lab 6-style bias/orifice sweeps; rival (3) needs a gain sweep; rival (4) is addressed by reporting the band's 11/80 false-alarm runs. The architectural rival is confirmed by class B = 0/80.
Write this mapping as a table in the dissertation: rival, test, status, evidence. Rivals that are only partly tested, such as the gain sweep if time runs short, stay in the table marked open rather than disappearing. The architectural rival moves from the limitations chapter into the results, because class B is a measured outcome, not an untested worry.
4.4 Common errors and limits
Listing rivals without tests; treating a confirmed boundary as a failure to hide.
A rival without a test is a worry, not part of the analysis. Each one needs an observation that would come out differently if it were true. When a rival survives, as the architectural rival does in class B, report it as a finding with its numbers. Hiding it would leave readers believing the residual method protects loops where one device controls both measurements. The class B result is the clearest example in this study.
Exercises — chapter 4
- EX021 — Five rivals for zone segmentation. Write five rivals for "zone segmentation reduces attacks" and one test each. Rubric: 3 = five rivals each with a test; 2 = three rivals with tests; 1 = rivals without tests; 0 = none.
- EX022 — Gain sweep for Urbina-style impact. Design a gain sweep that would support or refute rival (3); predict the pattern if Urbina-style impact bounding holds. Rubric: 3 = gain sweep design + Urbina-style pattern prediction; 2 = sweep without prediction; 1 = vague; 0 = none.
- EX023 — Why class B failure strengthens the thesis. Explain why class B failure strengthens rather than weakens a careful thesis. Rubric: 3 = class B failure as characterized limit that sharpens claims; 2 = 'failure is honesty' without limit link; 1 = hides failure; 0 = none.
- EX024 — Untested rivals under point-adjusted F1. For a study reporting only point-adjusted F1, which rivals remain untested?. Rubric: 3 = lists untested rivals (delay, FA, impact, aware adversary, etc.); 2 = two rivals; 1 = one; 0 = none.
- EX025 — Causal diagram to overfill at alarm. Write a causal diagram (as a bullet list of nodes and arrows) from attacker capability to overfill at alarm. Rubric: 3 = nodes/arrows from capability→spoof→residual/band→alarm→overfill; 2 = nodes without arrows; 1 = partial; 0 = none.
- EX026 — Negative control for residual CUSUM. Propose a negative control: an attack that should not trigger the residual CUSUM if the warrant is correct. Rubric: 3 = negative control attack that should not trip residual if warrant holds; 2 = control without warrant link; 1 = vague; 0 = none.
Chapter synthesis
Rivals with tests turn a comparison into a contribution; confirmed boundaries belong in the abstract.
Continue studying — chapter 04 of 08
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →