Anomaly Localization in Industrial Cyber-Physical Systems Via a Digital Twin-Driven Multi-Task Network

Localization of anomalies triggered by cyberattacks in industrial cyber-physical systems (ICPSs) is essential for implementing effective security measures due to the potential threats posed by such attacks. Identifying anomalies involves detecting deviations from normal behavior. This paper presents a digital twin-driven multi-task network (DTMTN) for anomaly localization in ICPSs. The DTMTN approach leverages the intrinsic characteristics of the ICPS, modeled within the digital twin, to predict system states. However, as constructing an accurate digital twin model is often impractical, the approach incorporates a multi-task network to enhance prediction reliability. This network serves two primary functions: it compensates for prediction inaccuracies and reconstructs deviations, thereby improving overall prediction accuracy. When an anomalous state occurs, DTMTN predicts normal system behavior to reconstruct the anomaly, allowing the original normal state to be inferred. The resulting prediction deviations are then analyzed to accurately pinpoint the location of the anomaly. Experiments conducted on a simulation testbed of a fluid catalytic cracking fractionation unit validate the effectiveness of the proposed approach.