Cyber-physical systems (CPSs), like train control and management systems (TCMS), are becoming ubiquitous in critical infrastructures. As safety-critical systems, ensuring their dependability during operation is crucial. Digital twins (DTs) have been increasingly studied for this purpose owing to their capability of runtime monitoring and warning, prediction and detection of anomalies, etc. However, constructing a DT for anomaly detection in TCMS necessitates sufficient training data and extracting both chronological and context features with high quality. Hence, in this paper, we propose a novel method named KDDT for TCMS anomaly detection. KDDT harnesses a language model (LM) and a long short-term memory (LSTM) network to extract contexts and chronological features, respectively. To enrich data volume, KDDT benefits from out-of-domain data with knowledge distillation (KD). We evaluated KDDT with two datasets from our industry partner Alstom and obtained the F1 scores of 0.931 and 0.915, respectively, demonstrating the effectiveness of KDDT. We also explored individual contributions of the DT model, LM, and KD to the overall performance of KDDT, via a comprehensive empirical study, and observed average F1 score improvements of 12.4%, 3%, and 6.05%, respectively.

翻译：信息物理系统（CPS），如列车控制与管理系统（TCMS），正广泛部署于关键基础设施中。作为安全关键系统，确保其运行期间的可靠性至关重要。数字孪生（DT）凭借其在运行时监控预警、异常预测与检测等方面的能力，已日益成为该领域的研究热点。然而，为TCMS构建用于异常检测的数字孪生需要充足的训练数据，并需高质量地提取时序特征与上下文特征。为此，本文提出一种名为KDDT的新型TCMS异常检测方法。KDDT分别采用语言模型（LM）和长短期记忆网络（LSTM）提取上下文特征与时序特征。为扩充数据量，KDDT通过知识蒸馏（KD）技术利用领域外数据。我们使用来自行业合作伙伴阿尔斯通的两个数据集对KDDT进行评估，分别获得0.931和0.915的F1分数，验证了该方法的有效性。通过全面的实证研究，我们还分别探究了数字孪生模型、语言模型和知识蒸馏对KDDT整体性能的单项贡献，观察到其平均F1分数分别提升12.4%、3%和6.05%。