Abstract
While cyber-physical systems are widely deployed and known to be difficult to analyze due to their increasing complexity, the number of sophisticated attacks against them have been constantly growing. This necessitates semi-automated intrusion response and recovery capabilities for timely termination of ongoing attacks and effective recovery of the infrastructural normal and safe operations. In this paper, we present CPR, a cyber-physical response system to protect power grid critical infrastructures, and discuss major challenges in theoretical formulation and practical deployment of fully-automated tolerance capabilities in settings where continuous physical dynamics continuously interact with cyber-side discrete computation logic. Our evaluation results show that CPR leverages its hybrid cyber-physical formulation, and efficiently selects optimal joint response strategies in both physical and cyber networks.