Ensuring the resilience of computer-based railways is increasingly crucial to account for uncertainties and changes due to the growing complexity and criticality of those systems. Although their software relies on strict verification and validation processes following well-established best-practices and certification standards, anomalies can still occur at run-time due to residual faults, system and environmental modifications that were unknown at design-time, or other emergent cyber-threat scenarios. This paper explores run-time control-flow anomaly detection using process mining to enhance the resilience of ERTMS/ETCS L2 (European Rail Traffic Management System / European Train Control System Level 2). Process mining allows learning the actual control flow of the system from its execution traces, thus enabling run-time monitoring through online conformance checking. In addition, anomaly localization is performed through unsupervised machine learning to link relevant deviations to critical system components. We test our approach on a reference ERTMS/ETCS L2 scenario, namely the RBC/RBC Handover, to show its capability to detect and localize anomalies with high accuracy, efficiency, and explainability.

翻译：随着计算机化铁路系统的复杂性与关键性日益提升，确保其韧性以应对不确定性与动态变化变得至关重要。尽管此类系统软件遵循成熟的最佳实践与认证标准，并经过严格的验证与确认流程，但运行时仍可能出现异常，原因包括设计时未知的残留缺陷、系统及环境变更，或其他新兴网络威胁场景。本文探讨利用过程挖掘技术实现运行时控制流异常检测，以增强ERTMS/ETCS L2（欧洲铁路交通管理系统/欧洲列车控制系统二级）的韧性。过程挖掘能够从系统执行轨迹中学习实际控制流，从而通过在线一致性检查实现运行时监控。此外，本研究采用无监督机器学习进行异常定位，将关键偏差关联至系统核心组件。我们在典型ERTMS/ETCS L2场景——即RBC/RBC交接流程——中测试所提方法，结果表明该方法能以高精度、高效率及可解释性实现异常检测与定位。