Anomaly Classification to Enable Self-healing in Cyber Physical Systems Using Process Mining

Abstract

Industrial Cyber Physical Systems (CPS) are large-scale critical infrastructures that are vulnerable to cyberattacks with wide-ranging consequences. Being a combination of heterogeneous devices and protocols, the large-scale CPS anomaly is also exposed to critical vulnerabilities. These vulnerabilities are treated in terms of anomalies and cyberattacks, and their detection and corresponding self-healing mechanisms on large-scale critical infrastructures can be challenging because of their massive size and interconnections. With the objective of process optimization through anomaly detection and conformance-checking approach, the present work addresses different issues, such as event log generation with tools such as PLG 2.0 for data-driven approach. Self-healing is enabled through machine learning models based on anomaly classification ensemble learning-based machine learning models. The work uses process mining to analyze event log files, and then combinations of conformance-checking methods with ensemble classification models were used to best classify anomalies. Finally, the proposed work establishes that, in comparison to techniques like KNN and C-SVC, the proposed ensemble models perform better, with an accuracy of 84.7% using trace alignment as a conformance technique with gradient boosting to classify anomalies, with the end objectives of process improvement.