Abstract:Smart manufacturing (SM) systems utilize run-time data to improve productivity via intelligent decision-making and analysis mechanisms on both machine and system levels. The increased adoption of cyber-physical systems in SM leads to the comprehensive framework of cyber-physical manufacturing systems (CPMS) where data-enabled decision-making mechanisms are coupled with cyber-physical resources on the plant floor. Due to their cyber-physical nature, CPMS are susceptible to cyber-attacks that may cause harm to the manufacturing system, products, or even the human workers involved in this context. Therefore, detecting cyber-attacks efficiently and timely is a crucial step toward implementing and securing high-performance CPMS in practice. This paper addresses two key challenges to CPMS cyber-attack detection. The first challenge is distinguishing expected anomalies in the system from cyber-attacks. The second challenge is the identification of cyber-attacks during the transient response of CPMS due to closed-loop controllers. Digital twin (DT) technology emerges as a promising solution for providing additional insights into the physical process (twin) by leveraging run-time data, models, and analytics. In this work, we propose a DT framework for detecting cyber-attacks in CPMS during controlled transient behavior as well as expected anomalies of the physical process. We present a DT framework and provide details on structuring the architecture to support cyber-attack detection. Additionally, we present an experimental case study on off-the-shelf 3D printers to detect cyber-attacks utilizing the proposed DT framework to illustrate the effectiveness of our proposed approach. Note to Practitioners—This work is motivated by developing a general-purpose and extensible digital twin-enabled cyber-attack detection framework for manufacturing systems. Existing works in the field consider specialized attack scenarios and models that may not be extensible in practical manufacturing scenarios. We utilize digital twin (DT) technology as a key enabler to develop a systematic and extensible framework where we identify the abnormality of a resource and detect if the abnormality is due to an attack or an expected anomaly. We provide several remarks on how our proposed framework can extend existing industrial control systems (ICS) and can accommodate further extensions. The presented DTs utilize data-driven machine learning models, physics-based models, and subject matter expert knowledge to perform detection and differentiation tasks in the context of expected anomalies and model-based controllers that control the manufacturing process between multiple setpoints. We utilize a model predictive controller on an off-the-shelf 3D printer to run the process, and stage anomalies and cyber-attacks that are successfully detected by the proposed framework.

TMAP: A Threat Modeling and Attack Path Analysis Framework for Industrial IoT Systems (A Case Study of IoM and IoP)

Threat Assessment for Power Industrial Control System Based on Descriptive Vulnerability Text

Defense of Advanced Persistent Threat on Industrial Internet of Things With Lateral Movement Modeling

Assessing Risks and Modeling Threats in the Internet of Things

Analyzing the Attack Surface and Threats of Industrial Internet of Things Devices

AI-based Identification of Most Critical Cyberattacks in Industrial Systems

Cybersafety: A System-theoretic Approach to Identify Cyber-vulnerabilities & Mitigation Requirements in Industrial Control Systems

Taxonomy for Cybersecurity Threat Attributes and Countermeasures in Smart Manufacturing Systems

Vulnerabilities and Attacks Against Industrial Control Systems and Critical Infrastructures

A threat modeling framework for IoT-Based botnet attacks

Advanced Persistent Threats and Their Defense Methods in Industrial Internet of Things: A Survey

An Experimental Analysis of Security Vulnerabilities in Industrial IoT Devices

A Threat Hunting Framework for Industrial Control Systems

Digital Twin-Based Cyber-Attack Detection Framework for Cyber-Physical Manufacturing Systems

DLTIF: Deep Learning-Driven Cyber Threat Intelligence Modeling and Identification Framework in IoT-Enabled Maritime Transportation Systems

A Model Based Framework for Testing Safety and Security in Operational Technology Environments

Analysis of Security Issues and Countermeasures for the Industrial Internet of Things

Industrial IoT, Cyber Threats, and Standards Landscape: Evaluation and Roadmap

A Machine Learning based Threat Intelligence Framework for Industrial Control System Network Traffic Indicators of Compromise

An Integrated Cyber-Physical Risk Assessment Framework for Worst-Case Attacks in Industrial Control Systems

Requirements and Recommendations for IoT/IIoT Models to automate Security Assurance through Threat Modelling, Security Analysis and Penetration Testing