PhD Defence | A data-centric approach towards identification and prediction of anomalies in industrial cyber-physical systems

As complexity of computing machinery, or any design for that matter, grows, the risk of

unwanted operational circumstances increases. This could mean that the design will not

function as intended, or the design will not function as efficiently as expected. In

extreme cases, the design will stop functioning altogether. In other words, the design

will demonstrate anomalous behaviour, while normal behaviour being what the designer had

intended to achieve. As complexity grows, it is harder for the designer to consider every

possible operational corner case, especially when the design is interacting with the

physical realm.

One of the main sources of complexity growth is the computerisation of digital systems,

controlling machinery. The term computerisation refers to the dominance of software in

providing and diversifying new operational capabilities. As an example that we all can

relate to, think of the evolution of cell phones into modern smart phones. As software is

a cyber entity and not directly bound by physical limitations, its growth has been

exponential through the years.

This thesis takes a step towards the detection and identification of anomalous behaviour

within a specific subset of industrial machinery, namely, industrial Cyber-Physical

Systems (CPS). In this endeavour, CPS are considered a high-value target, as their

applications in high-tech industry and infrastructure are numerous.

As a prelude, techniques on the generation of a high-level view of the system, using

communication-centric monitoring and modelling, have been elaborated. This approach

intends to cut through the system’s complexity and capture the essence of its behaviour,

as well as to generate a simplified digital twin. The composed solution takes advantage

of fingerprinting and Machine Learning (ML) techniques and algorithms in tandem, blending

them in a single data-centric pipeline. Here, sensory data revealing Extra-Functional

Behaviour (EFB), is considered as the sole source of the information, revealing the

ongoing behavioural patterns of the system under scrutiny. Such behavioural patterns are

efficiently represented in what we call as behavioural signatures, constructed using

data transformations and regression techniques. Similarly in this context, we consider

reference behavioural signatures as behavioural passports. With such constructs in

place, one can perform statistical tests and quantitatively detect deviations.

The role of Artificial Intelligence (AI) is twofold here. On the one hand, traditional ML

algorithms were deployed with the intention of achieving highest possible accuracy. On

the other hand, deep learning through Convolutional Neural Networks (CNN) has been

utilised as an alternative to achieve identification from a poor information position.

That is, when the scarcity of information related to the design’s specifics, or the

restriction of access to the system’s internals, has to be negotiated. The thesis also

delves into the qualitative differences of the two AI approaches.