Cyber-physical systems (CPSs), like train control and management systems
(TCMS), are becoming ubiquitous in critical infrastructures. As safety-critical
systems, ensuring their dependability during operation is crucial. Digital
twins (DTs) have been increasingly studied for this purpose owing to their
capability of runtime monitoring and warning, prediction and detection of
anomalies, etc. However, constructing a DT for anomaly detection in TCMS
necessitates sufficient training data and extracting both chronological and
context features with high quality. Hence, in this paper, we propose a novel
method named KDDT for TCMS anomaly detection. KDDT harnesses a language model
(LM) and a long short-term memory (LSTM) network to extract contexts and
chronological features, respectively. To enrich data volume, KDDT benefits from
out-of-domain data with knowledge distillation (KD). We evaluated KDDT with two
datasets from our industry partner Alstom and obtained the F1 scores of 0.931
and 0.915, respectively, demonstrating the effectiveness of KDDT. We also
explored individual contributions of the DT model, LM, and KD to the overall
performance of KDDT, via a comprehensive empirical study, and observed average
F1 score improvements of 12.4%, 3%, and 6.05%, respectively.

提出了一种名为 KDDT 的新方法用于列车控制和管理系统 (TCMS) 的异常检测，该方法利用语言模型 (LM) 和长短期记忆 (LSTM) 网络来提取背景和时间特征，在实证研究中，KDDT 表现出了卓越的性能。