Improving the Robustness of Industrial Cyber–Physical Systems Through Machine Learning-Based Performance Anomaly Identification
Abstract
We propose a versatile and fully data-centric methodology towards anomaly detection and
identification in modern industrial Cyber–Physical Systems (CPS). Our motivation behind this move is
the ever-growing computerisation in these systems, in the form of complex distributed computing
nodes, running complex distributed software. Industrial CPS also demonstrate heavy deployment of
hardware sensors, as well as an increasing role for software. We observe the insufficiency and
costliness of design-time measures in prevention of anomalies. As our main contribution, our
methodology is taking advantage of this data-rich environment by means of Extra-Functional Behaviour
(EFB) monitoring, analytics pipelines and Artificial Intelligence (AI). Specifically, we demonstrate
the use of compartmentalisation of execution timelines into distinct units, i.e., execution phases.
We introduce the generation of representations for these phases, i.e., behavioural signatures and
behavioural passports, as our way of behavioural fingerprinting. Composed using regression modelling
techniques, signatures as the representation of ongoing behaviour, are compared to passports,
representing reference behaviour. The comparison is done by means of goodness-of-fit scores,
creating quantifiable measures of deviation between different recorded behaviours. We have used both
partially synthetic and real-world traces in our experiments, depending on the use-case. We have
also followed both white box and black box approaches for our use-cases, with discussions on the
pros and cons of each.
The effectiveness of our data-centric methodology is demonstrated by two proofs-of-concept from the
industry, to represent the two ends of the industrial CPS complexity spectrum, with one being a
large semiconductor photolithography machine, while the other is an image analysis platform. Each
use-case comes with its own characteristics and limitations, confirming the flexibility of our
methodology and the relevance of its integral steps in the approach towards the initial analysis and
data transformations. The results of anomaly classification show overall high accuracies, as high as
99% in certain set-ups. These results show the capability of our data-centric methodology, suiting
the presented modern industrial CPS designs.