(375d) A Distributed Data-Driven Predictive Modeling Approach for Cyber-Process Incident Identification Using Spectral Community Detection

Cyber-physical systems (CPS) are characterized by their intricate interconnections between physical and digital elements. They are particularly vulnerable to unwanted incidents that can lead to catastrophic consequences, including operational disruptions and safety hazards. Machine learning (ML) models can identify potential harmful incidents by learning from process history data [1]. However, the effectiveness of ML models in complex systems is constrained by system intricacy and nonlinearity. For highly integrated systems, the necessity for extensive data sets poses a challenge, often making it impractical to leverage these models.

Centralized ML-based approaches for process incident detection require significant computational power and often result in false positive predictions. On the other hand, using decentralized methods where an independent ML model represents each process is limited by communication overhead [2], frequent synchronization [3], and complexity for integrated systems with recycles [4, 5]. Distributed data-driven modeling offers a valuable alternative to traditional methods based on identifying highly interactive variables through community detection.

This study proposes a distributed ML-based approach for incident detection in a highly integrated process system, bypassing data collection, communication, and computational limitations while maintaining detection accuracy. Initially, we employed a spectral community detection technique to identify communities within systems [6]. This method differs from the traditional hierarchical community detection strategies, which consecutively divide subsystems until achieving maximum modularity. Instead, spectral community detection partitions the system into a predetermined number of subsystems in a single step. Furthermore, we leverage data from each community to develop community-based long short-term memory (LSTM) models for predicting the system’s reference dynamics that can be utilized for incident detection. In this framework, each LSTM model learns the normal operations of its community, considering the integrated dynamics. We evaluate the proposed framework by simulating the integrated system under several process incident scenarios. The LSTM models can recognize faulty or falsified dynamics within the community, which allows for detecting the type and source of the incident among the communities.

References:
[1] Brayden Sundberg and Davood B. Pourkargar. Cyberattack awareness and resiliency of integrated moving horizon estimation and model predictive control of complex process networks. In Proceedings of the American Control Conference (ACC), pages 3815–3820. IEEE, 2023.

[2] Scarlett Chen, Zhe Wu, and Panagiotis D. Christofides. Cyber-security of decentralized and distributed control architectures with machine-learning detectors for nonlinear processes. In 2021 American Control Conference (ACC), pages 3273–3280. IEEE, 2021.

[3] Dana Alsagheer, Lei Xu, and Weidong Shi. Decentralized machine learning governance: Overview, opportunities, and challenges. IEEE Access, 2023.

[4] Yuwei Sun, Hideya Ochiai, and Hiroshi Esaki. Decentralized deep learning for multi-access edge computing: A survey on communication efficiency and trustworthiness. IEEE Transactions on Artificial Intelligence, 3(6):963–972, 2021.

[5] Prashant Mhaskar, Adiwinata Gani, Nael H.. El-Farra, Charles McFall, Panagiotis D. Christofides, and James F Davis. Integrated fault-detection and fault-tolerant control of process systems. AIChE Journal, 52(6):2129–2148, 2006.

[6] Amir M. Ebrahimi and Davood B. Pourkargar. Distributed model predictive control of integrated process networks based on an adaptive community detection approach. In Proceedings of the American Control Conference (ACC), in press. IEEE, 2024.