Dynamic Cyber-physical Systems Research Articles

TRIPLE: A blockchain-based digital twin framework for cyber–physical systems security

Cyber–physical systems (CPSs) are being increasingly adopted for industrial applications, yet they involve a dynamic threat landscape that requires CPSs to adapt to emerging threats during their operation. Recently, digital twin (DT) technology (which refers to a virtual representation of a product, process, or environment) has emerged as a suitable candidate to address the security challenges faced by dynamic CPSs. DT has the capability of strengthening the security of CPSs by continuously mapping the physical to twin counterparts to detect inconsistencies. The existing DT-based security solutions are constrained by untrustworthy data dissemination as well as limited data sharing among the involved stakeholders, which, in turn, limit the ability of DTs to run accurate simulations or make valid decisions. To address these challenges, this paper proposes a modular framework called TRusted and Intelligent cyber-PhysicaL systEm (TRIPLE), that leverages blockchain, DTs, and threat intelligence (TI) to secure CPSs. The blockchain-based DT components in the framework provide data integrity, traceability, and availability for trusted DTs. Furthermore, to accurately and comprehensively model system states, the framework envisions fusing process knowledge for modeling DTs from system specification-based and learning-based information and other sources, including infrastructure-as-code (IaC) and knowledge base (KB). The framework also integrates TI for future-proofing against emerging threats, such that threats can be detected either reactively by mapping the behavior of physical and virtual spaces or proactively by TI and threat hunting. We demonstrate the viability of the framework through a proof of concept. Finally, we formally verify the TRIPLE framework to demonstrate its correctness and effectiveness in enhancing CPS security.

ADT: Time series anomaly detection for cyber-physical systems via deep reinforcement learning

Cyber-physical systems (CPS) play a vital role in modern society across various sectors, ranging from smart grid to water treatment, and their security has become one of the major concerns. Due to the significantly growing complexity and scale of CPS and cyber-attacks, it is imperative to develop defense and prevention strategies specifically for CPS that are adaptive, scalable, and robust. An important research and application direction in this domain is time series anomaly detection within CPS utilizing advanced machine learning techniques, such as deep learning and reinforcement learning. However, many anomaly detectors fail to balance between detection performance and computational overhead, limiting their applicability in CPS. In this paper, we introduce a novel agent-based dynamic thresholding (ADT) method based on the deep reinforcement learning technique, i.e. deep Q-network (DQN), to model thresholding in anomaly detection as a Markov decision process. By utilizing anomaly scores generated from an autoencoder and other useful information perceived from a simulated environment, ADT performs the optimal dynamic thresholding control, facilitating real-time adaptive anomaly detection for time series. Rigorous evaluations were conducted on realistic datasets from water treatment and industrial control systems, specifically SWaT, WADI, and HAI, comparing against established benchmarks. The experimental results demonstrate ADT's superior detection performance, dynamic thresholding capability, data-efficient learning, and robustness. Notably, ADT, even when trained on minimal labeled data, consistently outperforms benchmarks with F1 scores ranging from 0.995 to 0.999 across all datasets. It is effective even in challenging scenarios where the environmental feedback is noisy, delayed, or partial. Beyond its direct application as an advanced anomaly detector, ADT possesses the versatility to act as a lightweight dynamic thresholding controller, boosting other anomaly detection models. This underscores ADT's considerable promise in sophisticated and dynamic CPS environments.

Advancements in enhancing cyber-physical system security: Practical deep learning solutions for network traffic classification and integration with security technologies.

Traditional network analysis frequently relied on manual examination or predefined patterns for the detection of system intrusions. As soon as there was increase in the evolution of the internet and the sophistication of cyber threats, the ability for the identification of attacks promptly became more challenging. Network traffic classification is a multi-faceted process that involves preparation of datasets by handling missing and redundant values. Machine learning (ML) models have been employed to classify network traffic effectively. In this article, we introduce a hybrid Deep learning (DL) model which is designed for enhancing the accuracy of network traffic classification (NTC) within the domain of cyber-physical systems (CPS). Our novel model capitalizes on the synergies among CPS, network traffic classification (NTC), and DL techniques. The model is implemented and evaluated in Python, focusing on its performance in CPS-driven network security. We assessed the model's effectiveness using key metrics such as accuracy, precision, recall, and F1-score, highlighting its robustness in CPS-driven security. By integrating sophisticated hybrid DL algorithms, this research contributes to the resilience of network traffic classification in the dynamic CPS environment.

Towards Aspect Based Components Integration Framework for Cyber-Physical System

Cyber-Physical Systems (CPS) comprise interactive computation, networking, and physical processes. The integrative environment of CPS enables the smart systems to be aware of the surrounding physical world. Smart systems, such as smart health care systems, smart homes, smart transportation, and smart cities, are made up of complex and dynamic CPS. The components integration development approach should be based on the divide and conquer theory. This way multiple interactive components can reduce the development complexity in CPS. As reusability enhances efficiency and consistency in CPS, encapsulation of component functionalities and a well-designed user interface is vital for the better end-user's Quality of Experience (QoE). Thus, incorrect interaction of interfaces in the cyber-physical system causes system failures. Usually, interface failures occur due to false, and ambiguous requirements analysis and specification. Therefore, to resolve this issue semantic analysis is required for different stakeholders’ viewpoint analysis during requirement specification and components analysis. This work proposes a framework to improve the CPS component integration process, starting from requirement specification to prioritization of components for configurable. For semantic analysis and assessing the reusability of specifications, the framework uses text mining and case-based reasoning techniques. The framework has been tested experimentally, and the results show a significant reduction in ambiguity, redundancy, and irrelevancy, as well as increasing accuracy of interface interactions, component selection, and higher user satisfaction.

Divergence-Based Transferability Analysis for Self-Adaptive Smart Grid Intrusion Detection With Transfer Learning

Machine learning is a popular approach to security monitoring and intrusion detection in cyber-physical systems (CPS) like the smart grid. However, these highly dynamic CPS operating in open environments can result in significant data distribution divergence, which may require the adaptation of a learned model. While transfer learning has been an effective approach to retain the performance against the divergence, there is still limited work on a more fundamental question that can be called <i>transferability</i>: when should one apply transfer learning? To address this challenge, this paper proposes a divergence-based transferability analysis to decide whether to apply transfer learning and autonomically adapt learning-based intrusion detectors. This work first identifies three metrics used to measure the divergence between data distributions, and then explores the relation between detector&#x2019;s accuracy drop and divergence in extensive temporal, spatial, and spatiotemporal experiments. Two regression models are trained to approximate the divergence-accuracy relation and then used to predict an accuracy drop which determines whether to apply transfer learning. Finally, a state-of-the-art domain adversarial neural network (DANN) classifier is adopted as the transfer learning model. Datasets from real normal operation profiles and simulated attacks are used to validate the effectiveness of the proposed transferability analysis against variations in attack timing, locations, and both. In all three scenarios, the proposed analysis demonstrated high accuracy in predicting accuracy drop from the divergence, with an RMSE lower than 4.20&#x0025;, and the DANN can be timely triggered to achieve an accuracy improvement over 5.00&#x0025;.

CycleStyleGAN-Based Knowledge Transfer for a Machining Digital Twin.

Digitalisation of manufacturing is a crucial component of the Industry 4.0 transformation. The digital twin is an important tool for enabling real-time digital access to precise information about physical systems and for supporting process optimisation via the translation of the associated big data into actionable insights. Although a variety of frameworks and conceptual models addressing the requirements and advantages of digital twins has been suggested in the academic literature, their implementation has received less attention. The work presented in this paper aims to make a proposition that considers the novel challenges introduced for data analysis in the presence of heterogeneous and dynamic cyber-physical systems in Industry 4.0. The proposed approach defines a digital twin simulation tool that captures the dynamics of a machining vibration signal from a source model and adapts them to a given target environment. This constitutes a flexible approach to knowledge extraction from the existing manufacturing simulation models, as information from both physics-based and data-driven solutions can be elicited this way. Therefore, an opportunity to reuse the costly established systems is made available to the manufacturing businesses, and the paper presents a process optimisation framework for such use case. The proposed approach is implemented as a domain adaptation algorithm based on the generative adversarial network model. The novel CycleStyleGAN architecture extends the CycleGAN model with a style-based signal encoding. The implemented model is validated in an experimental scenario that aims to replicate a real-world manufacturing knowledge transfer problem. The experiment shows that the transferred information enables the reduction of the required target domain data by one order of magnitude.

Enterprise Thinking for Self-aware Systems

The paper aims to provide high-level guidance for architects of cyber-physical enterprises. We propose that interactions within such systems should be largely self-determined, based on system self-awareness and dynamic re-configuration, with the architecture evolving based on a set of foundational principles, rather than being pre-defined by an external designer. We investigate the suitability of typical development life cycles and identify architectural challenges in the context of dynamic cyber-physical systems that utilize the power of the Internet of Things. Desired systemic attributes are defined, which are necessary for making suitable core architectural choices. The application of the findings is exemplified through a case study, a synthesis of issues, and implications for further research.

Online Mode Switch Algorithms for Maintaining Data Freshness in Dynamic Cyber-Physical Systems

Maintaining the freshness of real-time data is one of the crucial design issues in cyber-physical systems (CPS). Past studies have focused on designing update algorithms to minimize the workload imposed by a fixed set of update tasks while ensuring the temporal validity of data. In this paper, we revisit this problem in dynamic cyber-physical systems (DCPS) which may exhibit multi-modal behavior. Any solution to this problem must recognize that: (1) different update algorithms may be needed in different modes according to the workload in each mode, and (2) temporal validity of data must be maintained not only in each mode but also during the mode switch. To strike a balance between data freshness and system schedulability, we propose a utilization-based scheduling selection (UBSS) strategy. We first introduce two synchronous mode switch algorithms, named search-based switch (SBS) and adjustment-based switch (ABS) to search for the proper switch point online and execute all update tasks in the new mode synchronously. SBS checks for temporal validity at the beginning time slot of each idle period in the schedule, while ABS relaxes this restriction through schedule adjustment. To support immediate mode switch, we propose an asynchronous switch algorithm named instant switch (IS) to reduce the switch delay. IS schedules outstanding jobs from the old mode together with the jobs in the new mode using the least-available-laxity-first scheduling policy. Our experimental results demonstrate the effectiveness of these three algorithms. They also show that UBSS strategy can significantly outperform a single fixed update algorithm in terms of maintaining better data freshness while incurring only limited online switch overhead.

Distributed Execution of Scenario-based Specifications of Structurally Dynamic Cyber-Physical Systems

Cyber-physical systems are found in many areas, e.g., manufacturing or smart cities. They consist of multiple components that cooperate to provide the desired functionality. This need for cooperation causes complex interactions between components, which makes developing cyber-physical systems difficult, especially systems whose component structure changes dynamically at runtime. We have created a formal, scenario-based specification method which makes it easier to develop distributed cyber-physical systems. We previously presented an approach for the distributed execution of such specifications based on naive and inefficient broadcasting. In this paper we propose a more efficient approach which uses the available network resources more economically.

Service-oriented approach to fault tolerance in CPSs

Cyber-physical systems (CPSs) are open and interconnected embedded systems that control or interact with physical processes. Failures in CPSs can lead to loss of production time, damage to the equipment and environment, or loss of life, meaning that dependability and resilience are key properties for their design. However, existing fault tolerance and safety approaches are inadequate for complex, networked and dynamic CPSs. Service-orientation, on the other hand, is generally considered to be a robust architectural style, but there is a limited amount of research on fault tolerance of service-oriented architecture (SOA), especially on distributed real-time systems. We propose an approach that utilizes the loosely coupled nature of services to implement fault tolerance using a middleware-based real-time SOA (RTSOA) for CPSs. The approach, based on the concepts of fault isolation and recovery at the service level, is empirically evaluated using a demanding bilateral teleoperation (remote handling) application. The empirical evaluation demonstrates that RTSOA supports real-time fault detection and recovery, use of services as a unit of fault isolation, and it provides capability to implement fault tolerance patterns flexibly and without significant overhead.