The sophistication of new malware attacking control systems includes targeted zero-days attacks, rootkits created for control systems, and software signed by trusted certificate authorities. This paper shows how to incorporate knowledge of the physical system under control to detect attacks that change the behavior of the targeted control system.
