Performance Anomaly Detection of Cyber-Physical Systems

Journal of Systems Architecture

This work demonstrates the use of compartmentalisation of execution timelines into distinct units, i.e., execution phases, and introduces the generation of representations for these phases, i.e., behavioural signatures and behavioural passports, as their way of behavioural fingerprinting.

Comparative analysis of unsupervised anomaly detection techniques in industrial systems

A comparative evaluation of unsupervised anomaly detection techniques using the PyOD Python library, applied to three representative industrial scenarios: Intrusion Detection, Fault Detection, and Predictive Maintenance, offers valuable guidance for selecting robust anomaly detection models in industrial applications beyond cybersecurity.

Adaptive Real-Time Systems —From Specification to Execution—

Towards Model-based Run-time Cybersecurity: On Control-Flow Anomaly Detection, Attack Identification, and Hardware Monitoring

The proposed combination of control-flow anomaly detection, attack-tree based intrusion identification, and hardware-based monitoring can improve not only anomaly detection, but also the diagnostic precision of attack-tree-based cyber-attack identification.

Real-time anomaly detection in distributed manufacturing: a high-resolution statistical SCADA framework

Real-time anomaly detection in distributed manufacturing environments often relies on rigid timeout thresholds that may fail to identify missing workpieces or abnormal mechanical behavior until a critical failure occurs. This study presents a high-resolution, statistics-based anomaly detection framework for a Fischertechnik 24 V platform coordinated through a centralized Python supervisory control and data acquisition (SCADA) layer with multiple ESP32 microcontrollers. A statistically normal behavior was established from 10 identical production runs at 10 ms resolution using the mean and standard deviation of movement durations and event timing. The real-time SCADA Watchdog was evaluated through repeated intentional physical fault injection across a complex manufacturing process. The results showed that the framework successfully detected missing/stuck expected events and duration-based temporal deviations in real time, provided precise fault localization, stopped the process for critical missing/stuck anomalies, and logged non-terminal duration anomalies under the implemented monitoring configuration. These findings demonstrate that statistical monitoring can provide effective real-time anomaly detection for distributed manufacturing systems.

Cybersecurity for Self-Programming Systems

An operational blueprint for an Autonomous Defensive Layer (ADL) is suggested that enforces tight micro-virtualization, continuous shadow reasoning execution, and deterministic formal verification pipelines to safeguard the upcoming generation of computing runtimes.