Improving the Robustness of Industrial Cyber–Physical Systems through Machine Learning-Based Performance Anomaly Identification
Abstract
We propose a versatile and fully data-centric methodology towards anomaly detection and
identification in modern industrial Cyber–Physical Systems (CPS). Our motivation behind
this move is the ever-growing computerisation in these systems, in the form of complex
distributed computing nodes, running complex distributed software. Industrial CPS also
demonstrate heavy deployment of hardware sensors, as well as an increasing role for
software. We observe the insufficiency and costliness of design-time measures in
prevention of anomalies. As our main contribution, our methodology is taking advantage
of this data-rich environment by means of Extra-Functional Behaviour (EFB) monitoring,
analytics pipelines and Artificial Intelligence (AI). Specifically, we demonstrate the
use of compartmentalisation of execution timelines into distinct units, i.e., execution
phases. We introduce the generation of representations for these phases, i.e.,
behavioural signatures and behavioural passports, as our way of behavioural
fingerprinting. Composed using regression modelling techniques, signatures as the
representation of ongoing behaviour, are compared to passports, representing reference
behaviour. The comparison is done by means of goodness-of-fit scores, creating
quantifiable measures of deviation between different recorded behaviours. We have used
both partially synthetic and real-world traces in our experiments, depending on the
use-case. We have also followed both white box and black box approaches for our
use-cases, with discussions on the pros and cons of each.
The effectiveness of our data-centric methodology is demonstrated by two
proofs-of-concept from the industry, to represent the two ends of the industrial CPS
complexity spectrum, with one being a large semiconductor photolithography machine,
while the other is an image analysis platform. Each use-case comes with its own
characteristics and limitations, confirming the flexibility of our methodology and the
relevance of its integral steps in the approach towards the initial analysis and data
transformations. The results of anomaly classification show overall high accuracies, as
high as 99% in certain set-ups. These results show the capability of our data-centric
methodology, suiting the presented modern industrial CPS designs.