Cyber-physical systems (CPS) are at the intersection of digital technology and engineering domains, rendering them high-value targets of sophisticated and well-funded cybersecurity threat actors. Prominent cybersecurity attacks on CPS have brought attention to the vulnerability of these systems, and the soft underbelly of critical infrastructure reliant on CPS. Security modelling for CPS is an important mechanism to systematically identify and assess vulnerabilities, threats, and risks throughout system lifecycles, and to ultimately ensure system resilience, safety, and reliability. This literature review delves into state-of-the-art research in CPS security modelling, encompassing both threat and attack modelling. While these terms are sometimes used interchangeably, they are different concepts. This article elaborates on the differences between threat and attack modelling, examining their implications for CPS security. A systematic search yielded 428 articles, from which 15 were selected and categorised into three clusters: those focused on threat modelling methods, attack modelling methods, and literature reviews. Specifically, we sought to examine what security modelling methods exist today, and how they address real-world cybersecurity threats and CPS-specific attacker capabilities throughout the lifecycle of CPS, which typically span longer durations compared to traditional IT systems. This article also highlights several limitations in existing research, wherein security models adopt simplistic approaches that do not adequately consider the dynamic, multi-layer, multi-path, and multi-agent characteristics of real-world cyber-physical attacks.

中文翻译：

---

网络物理系统的安全建模：系统文献综述

网络物理系统（CPS）处于数字技术和工程领域的交叉点，使其成为经验丰富且资金充足的网络安全威胁参与者的高价值目标。针对 CPS 的突出网络安全攻击引起了人们对这些系统的脆弱性以及依赖 CPS 的关键基础设施的软肋的关注。 CPS 的安全建模是系统地识别和评估整个系统生命周期中的漏洞、威胁和风险的重要机制，并最终确保系统的弹性、安全性和可靠性。本文献综述深入研究了 CPS 安全建模的最新研究，包括威胁和攻击建模。虽然这些术语有时可以互换使用，但它们是不同的概念。本文详细阐述了威胁和攻击建模之间的差异，研究了它们对 CPS 安全性的影响。系统检索共找到 428 篇文章，从中选出 15 篇，分为三类：关注威胁建模方法、攻击建模方法和文献综述。具体来说，我们试图研究当今存在的安全建模方法，以及它们如何在 CPS 的整个生命周期中解决现实世界的网络安全威胁和特定于 CPS 的攻击者能力，与传统 IT 系统相比，其持续时间通常更长。本文还强调了现有研究中的一些局限性，其中安全模型采用简单化的方法，没有充分考虑现实世界网络物理攻击的动态、多层、多路径和多代理特征。