# XPhysICS: Cross-Physical-Domain Threat Grounding for Industrial Control Systems Security

arXiv: https://arxiv.org/abs/2609.30805 · HTML: https://mlsanity.com/paper/2609.30805/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 7 of its 38 references that are in the map.
- First posted on arXiv 25 Sep 2026.

## Builds on (most cited first, 7 of 7)

- [Representing Time-Continuous Behavior of Cyber-Physical Systems in Knowledge Graphs](https://mlsanity.com/paper/2506.13773/) (2025)
- [Control Behavior Integrity for Distributed Cyber-Physical Systems](https://mlsanity.com/paper/1812.08310/) (2018)
- [An Ontological Metamodel for Cyber-Physical System Safety, Security, and Resilience Coengineering](https://mlsanity.com/paper/2006.05304/) (2020)
- [Cyberphysical Security Through Resiliency: A Systems-centric Approach](https://mlsanity.com/paper/2011.14469/) (2020)
- [PowerDuck: A GOOSE Data Set of Cyberattacks in Substations](https://mlsanity.com/paper/2207.04716/) (2022)
- [A Model-Based Approach to Security Analysis for Cyber-Physical Systems](https://mlsanity.com/paper/1710.11442/) (2017)
- [Data Driven Vulnerability Exploration for Design Phase System Analysis](https://mlsanity.com/paper/1909.02923/) (2019)

## Abstract (arXiv)

Industrial control system attacks are usually documented in terms of the plant where they occurred: its sensors, actuators, process stages, and control logic. Yet many attacks express a more general physical pattern--such as suppressing flow, corrupting chemical dosing, or driving a vessel toward overflow--that may also matter in a different plant. The challenge is deciding when such a threat remains meaningful on a new system rather than relying on similar component names or broad semantic labels. We present XPhysICS, a methodology for grounding documented cyber-physical threats onto a specific target system. XPhysICS converts source evidence into a provenance-linked description of what is manipulated, what physical consequence is expected, and what observations the evidence calls for. Once this analyst-guided abstraction, its vocabulary and schema version, and a target contract are fixed, XPhysICS applies deterministic grounding checks. An accepted result can be represented as a validation slice that records the mapped roles, signals, dependencies, and context intended to support later evaluation. We study 83 threat abstractions across continuous-process and manufacturing sources using separate evaluation denominators. The continuous-process study evaluates 78 abstractions against target contracts spanning water treatment, water distribution, hydropower, and chemical processes. Selected cases are exercised through controlled perturbations of simulator-role signals. We also test compatibility with several analysis styles, including the released upstream GeCo implementation, and conduct a three-objective, one-target realizability study using a paper-derived search reproduction. Across these evaluated settings, the results support treating explicit target checks and traceable evidence as separate from semantic similarity alone.