Cyber-physical systems (CPSs), like train control and management systems (TCMS), are becoming ubiquitous in critical infrastructures. As safety-critical systems, ensuring their dependability during operation is crucial. Digital twins (DTs) have been increasingly studied for this purpose owing to their capability of runtime monitoring and warning, prediction and detection of anomalies, etc. However, constructing a DT for anomaly detection in TCMS necessitates sufficient training data and extracting both chronological and context features with high quality. Hence, in this paper, we propose a novel method named KDDT for TCMS anomaly detection. KDDT harnesses a language model (LM) and a long short-term memory (LSTM) network to extract contexts and chronological features, respectively. To enrich data volume, KDDT benefits from out-of-domain data with knowledge distillation (KD). We evaluated KDDT with two datasets from our industry partner Alstom and obtained the F1 scores of 0.931 and 0.915, respectively, demonstrating the effectiveness of KDDT. We also explored individual contributions of the DT model, LM, and KD to the overall performance of KDDT, via a comprehensive empirical study, and observed average F1 score improvements of 12.4%, 3%, and 6.05%, respectively.

翻译：信息物理系统（CPS），如列车控制与管理系统（TCMS），正日益成为关键基础设施的核心组成部分。作为安全关键系统，确保其在运行过程中的可靠性至关重要。数字孪生（DT）因其具备运行时监控与预警、异常预测与检测等能力，被越来越多地应用于该领域。然而，为TCMS构建用于异常检测的数字孪生需要充足的训练数据，并需高质量地提取时间序列特征与上下文特征。为此，本文提出一种名为KDDT的新型TCMS异常检测方法。KDDT分别利用语言模型（LM）和长短期记忆网络（LSTM）提取上下文特征与时间序列特征。为扩充数据量，KDDT借助知识蒸馏（KD）技术利用域外数据。我们采用来自行业合作伙伴阿尔斯通的两组数据集对KDDT进行评估，分别获得0.931和0.915的F1分数，验证了KDDT的有效性。通过全面的实证研究，我们还分别探究了DT模型、LM和KD对KDDT整体性能的个体贡献，观察到其平均F1分数分别提升了12.4%、3%和6.05%。