Publication Type

Conference Proceeding Article

Version

acceptedVersion

Publication Date

10-2025

Abstract

Cyber-physical systems (CPSs) are used extensively in critical infrastructure, underscoring the need for anomaly detection systems that are able to catch even the most motivated attackers. Traditional anomaly detection techniques typically do `one-off' training on datasets crafted by experts or generated by fuzzers, potentially limiting their ability to generalize to unseen and more subtle attack strategies. Stopping at this point misses a key opportunity: a defender can actively challenge the attacker to find more nuanced attacks, which in turn can lead to more effective detection capabilities. Building on this concept, we propose Evo-Defender, an evolutionary framework that iteratively strengthens CPS defenses through a dynamic attacker-defender interaction. Evo-Defender includes a smart attacker that employs guided fuzzing to explore diverse, non-redundant attack strategies, while the self-evolving defender uses incremental learning to adapt to new attack patterns. We implement Evo-Defender on two realistic CPS testbeds: the Tennessee Eastman process and a Robotic Arm Assembly Workstation, injecting over 600 attack scenarios. In end-to-end attack detection experiments, Evo-Defender achieves up to 2.7% higher performance than state-of-the-art baselines on unseen scenarios, while utilizing training data more efficiently for faster and more robust detection.

Keywords

Cyber-physical systems, benchmark generation, incremental learning, defense strategies

Discipline

Software Engineering

Research Areas

Cybersecurity; Software and Cyber-Physical Systems

Areas of Excellence

Digital transformation

Publication

Proceedings of the 28th International Symposium on Research in Attacks, Intrusions and Defenses (RAID'25), Gold Coast, Australia, October 19-22

First Page

425

Last Page

439

Identifier

10.1109/RAID67961.2025.00028

Publisher

IEEE

City or Country

Piscataway, NJ

Additional URL

https://doi.org/10.1109/RAID67961.2025.00028

Download

Share

COinS