Digital twins are opening doors for better products across automotive, health care, aerospace, and other industries. According to a new study by a team of researchers at the National Institute of Standards and Technology (NIST) and the University of Michigan, cybersecurity may also fit neatly into the digital twin portfolio.
As more robots and other manufacturing equipment become remotely accessible, new entry points for malicious cyberattacks are created. To keep pace with the growing cyber threat, the team devised a cybersecurity framework that brings digital twin technology together with machine learning and human expertise to flag indicators of cyberattacks.
In a paper published in IEEE Transactions on Automation Science and Engineering, the NIST and University of Michigan researchers demonstrated the feasibility of their strategy by detecting cyberattacks aimed at a 3D printer in their lab. They also note that the framework could be applied to a broad range of manufacturing technologies.
Cyberattacks can be incredibly subtle and thus difficult to detect or differentiate from other, sometimes more routine, system anomalies. Operational data describing what is occurring within machines — sensor data, error signals, digital commands being issued or executed, for instance — could support cyberattack detection. However, directly accessing this kind of data in near real time from operational technology (OT) devices, such as a 3D printer, could put the performance and safety of the process on the factory floor at risk. Without looking under the hood of the hardware, cybersecurity professionals may be leaving room for malicious actors to operate undetected.
Looking in the Digital Mirror
Digital twins are closely tied to their physical counterparts, from which they extract data and run alongside in near real time. When it’s not possible to inspect a physical machine while it’s in operation, its digital twin is the next best thing. In recent years, digital twins of manufacturing machinery have armed engineers with an abundance of operational data, helping them accomplish a variety of feats (without impacting performance or safety), including predicting when parts will start to break down and require maintenance. In addition to spotting routine indicators of wear and tear, digital twins could help find something more within manufacturing data, including detecting anomalies such as cyberattacks.
The team built a digital twin to emulate the 3D printing process and provided it with information from the real printer. As the printer built a part (a plastic hourglass in this case), computer programs monitored and analyzed continuous data streams including both measured temperatures from the physical printing head and the simulated temperatures being computed in real time by the digital twin.
The researchers launched waves of disturbances at the printer. Some were innocent anomalies, such as an external fan causing the printer to cool, but others, some of which caused the printer to incorrectly report its temperature readings, represented something more nefarious. Using a process of elimination, the programs analyzing both the real and digital printers were pattern-recognizing machine learning models trained on normal operating data in bulk.
If these models detected an irregularity, they passed the baton off to other computer models that checked whether the strange signals were consistent with anything in a library of known issues, such as the printer’s fan cooling its printing head more than expected. Then the system categorized the irregularity as an expected anomaly or a potential cyber threat. In the last step, a human expert is meant to interpret the system’s finding and then make a decision.
The framework provides tools to systematically formalize the subject matter expert’s knowledge on anomaly detection. If the framework hasn’t seen a certain anomaly before, a subject matter expert can analyze the collected data to provide further insights to be integrated into and improve the system. The expert could either confirm the cybersecurity system’s suspicions or teach it a new anomaly to store in the database. As time goes on, the models in the system would theoretically learn more and more, and the human expert would need to teach them less and less. In the case of the 3D printer, the team checked its cybersecurity system’s work and found it was able to correctly sort the cyberattacks from normal anomalies by analyzing physical and emulated data.
But despite the promising showing, the researchers plan to study how the framework responds to more varied and aggressive attacks in the future, ensuring the strategy is reliable and scalable. Their next steps will likely also include applying the strategy to a fleet of printers at once, to see if the expanded coverage either hurts or helps their detection capabilities.