Modern cyber-physical systems (CPS) such as robotic and autonomous technologies, power

and manufacturing plants, industrial systems, IoT, medical, smart and connected devices, feature a tight integration between communication, computation, and actuation. While this interaction enables more automated and intelligent systems, it also introduces vulnerabilities to cyber and physical attacks which can manipulate the system’s integrity compromising safety (= something bad will never happen) and liveness (= something good will eventually happen) properties. Moreover, in the last few years, we have assisted to a large increase in the deployment of machine learning techniques on such CPS to perform decision making quickly. While these learning enabled components (LECs) are powerful in automating decisions and producing solutions quickly, they have been proven to be vulnerable to cyber-attacks simply by manipulating the information provided as input to the LEC. This proposal targets the aforementioned problems by designing a general runtime monitoring framework to detect cyber-attacks on sensors, actuators, on-baord computer, and the communication infrastructure of a CPS while assessing attack intent and the associated risk based on the context and environment in which the CPS is operating. Our proposed monitor builds on the following observation that given an input action there is an expected output and if a LEC is used, the result should not be too different from closely related training data. An attack, even if stealthy, will have to violate these assumptions in order to hijack a system. The proposed framework computes residuals defined as the difference between the received and the expected measurement and uses statistical tests and decision tree analysis to check for consistencies. A reachability analysis technique is also proposed to predict the outcome of the system and identify and minimize risk of reaching unsafe states.