Modeling cyber effects in cyber-physical systems with DEVS

Increased interconnectivity of Cyber-Physical Systems, by design or otherwise, increases the cyber attack surface and attack vectors. It is not always desirable to do cyber risk assessment of such interconnected systems by cyber attacks on the entire system. This paper presents a formal approach for simulating cyber effects for cyber risk assessment of subcomponents of such systems using a control component based on Discrete EVent System (DEVS) models. Our approach first separates components of a system that may be directly attacked, from components of the system whose behavior need to be studied for the impact originating from those attacks. The cyber attack effects are simulated through interception of communications among the separated components. We define the types of cyber effects, and show an example of how an attack may be simulated with a control component through a case study.