Digital Twin and Ontology based DDoS Attack Detection in a Smart-Factory 4.0

Industry 4.0 brings about automation of smart factories, where the factory operations can be monitored and controlled remotely. This automation enhances the work flow efficiency. However, the Industry 4.0 associated digitization and networking in the smart factories makes them vulnerable to cyberattacks, because of the usage of weak passwords, open-source software, and communication protocols used in building them. These vulnerabilities make Distributed Denial of Service (DDoS) attacks plausible. DDoS attacks can not only disrupt the normal operations, but also cost in terms of the brand-name, trust, and reputation loss. The solution is to quickly detect and mitigate these attacks. This paper describes a Digital Twin (DT) based approach for detection of DDoS cyber-attacks in smart factories. An ontology-based intrusion detection system is proposed, in which the DT that replicates the physical system, learns the normal operation of the physical network, and remembers it. Whenever the physical system's Quality of Service (QoS) metrics deviate from normality, an automated query to the knowledge base generates an alert. This paper presents the architecture and the functional test results of the prototype developed. This prototype has the advantages of context awareness, re-usability of model in complex contexts, and support for Relational Database (RD).