Secure and Smart Cyber-Physical Systems by Uttam Ghosh
Secure and Smart Cyber-Physical Systems by Uttam Ghosh
Features
• Presents cutting-edge topics and research in IoT and CPS.
• Includes contributions from leading worldwide researchers.
• Focuses on CPS architectures for secure and smart environments.
• Explores AI/ML and blockchain approaches for providing security and privacy to CPS
including smart grids, smart cities, and smart healthcare.
• Provides comprehensive guidance into the intricate world of software development for
medical devices.
• Covers a blueprint for the emergence of 6G communications technology in Industry 5.0
and federated-learning-based secure fnancial services.
This book covers state-of-the-art problems, existing solutions, and potential research
directions for CPS researchers, scholars, and professionals in both industry and academia.
Secure and Smart
Cyber-Physical Systems
Typeset in Sabon
by Apex CoVantage, LLC
Dedication
Preface ix
Acknowledgments xiii
About the Editors xiv
Contributors xvii
Abbreviations xix
Introduction
Around the world today, technology continues to become more and more pervasive with
dynamic innovation processes increasingly impacting societies and their governments, in-
dustries, communities, and individuals. For example, integrating Internet-connected things
with other devices creates larger systems of systems that solve the world’s most challeng-
ing and technological problems. One of the most popular revolutions of technology is the
Cyber-Physical System (CPS). CPS is an integration of cyber world (computation and com-
munication systems) and man-made physical world (e.g., utility networks, vehicles, and
factories.) formed by using sensors and actuators. Cyber systems make the physical infra-
structures smarter, more secure, and reliable, and fully automated systems foster a more
efcient, resilient, and sustainable built environment. In the near future (industry 4.0 revo-
lution or 4IR), CPSs will become the new “techno-economic” paradigm.
CPS have become ubiquitous and the core of modern critical infrastructure and in-
dustrial applications in recent years. CPSs such as self-driving cars, drones, and
intelligent transportation rely heavily on machine learning techniques for ever-
increasing levels of autonomy. Further, the deployed sensors generate a massive amount
of real-time Big data from the physical infrastructure and send it to the cyber systems
using communication infrastructure (such as switches and routers). In turn, the cyber sys-
tems also send feedback to the physical devices using the communication infrastructure.
On the other hand, these systems provide an appeal to attackers. Cybersecurity is, thus,
of prime concern in CPSs. Due to the success of Deep Learning (DL) in a multitude of
domains, the development of DL-based CPS security applications has received increased
interest in the past few years. However, despite the broad body of work on using DL for
ensuring the security of CPSs, to our best knowledge, very little work exists where the
focus is on the development of these DL applications. DL based on artifcial neural net-
works is a very popular approach to modeling, classifcation, and the recognition of com-
plex data including images, voice, and text. The unparalleled precision of DL approaches
has made them the cornerstone of new Internet-based AI-based services. Commercial
businesses gathering user data on a large scale were the main benefciaries of this phe-
nomenon since the performance of DL techniques is directly proportional to the amount
of data available for training. The vast collection of data required for DL poses clear
privacy problems. Highly sensitive personal data such as photos and voice recordings of
users, that is collected by some companies, is kept indefnitely. Users cannot uninstall it,
nor restrict the purposes for which it is being used. In addition, data stored internally is
x Preface
subject to legal subpoenas and extra judicial monitoring. For example, data owners, such
as healthcare institutions and organizations that may want to apply DL methods to clini-
cal records and are prevented from sharing data due to privacy and confdentiality con-
cerns, beneft from DL on a large scale.
Target Group
This book explores the advanced technologies used to facilitate the transformation of these
novel spaces into a pervasive environment with the development of computational and
physical infrastructures into a single habitat that facilitates the professional researchers and
application developers of solutions. AI and Big data can be ofered as an elective course for
graduate and postgraduate computer science engineering students to impart knowledge of
current trends, scope, and technology in mobile applications and the physical structure of
pervasive management. Furthermore, the system designers, industry personnel, and policy-
makers working for the transformation of the ubiquities of computing with the employment
of security professionals will beneft.
of CPS, and major challenges encountered during the successful implementation of cyber
physical medication systems.
Chapter 7: Service-Oriented Distributed Architecture for Sustainable Secure Smart City
underpins several challenges in the process of adopting an urban space as a smart city.
Given the importance of urban data accumulation, storage, retrieval, and the simultane-
ous deployment of networked infrastructure, it proposes a high-level framework to better
represent the various subsystems of this computing model. The framework is essentially a
hierarchical model that represents the fow and storage of urban data, as well as the partici-
pation of diferent actors in the provision of services to citizens. It ensures an incremental
implementation of a smart city and provides a seamless integration of new services as they
are needed.
Chapter 8: A Comprehensive Security Risk Analysis of Clif Edge on Cyber-Physical
Systems discusses the protection threats including concerns in a CPS and recognizes the
reasonable vulnerabilities, attack arguments, opponent’s features, and an assemblage of
provocations that necessitate being inscribed. Further, the chapter discusses some recom-
mendations and failures in CPS.
Chapter 9: Securing Financial Services with Federated Learning and Blockchain gives an
in-depth look at how Blockchain and federated learning (FL) are used in fnancial services.
It starts with an overview of recent developments in both use cases. It explores and discusses
existing fnancial service vulnerabilities, potential threats, and consequent risks. The chap-
ter focuses on addressing the issues present in fnancial services and how the integration
of Blockchain technology and FL can contribute to solving these challenges. These issues
include data protection, storage optimization, and making more money in fnancial services.
The chapter presents various Blockchain-enabled FL methods and provides possible solu-
tions to solve several challenges including cost-efectiveness, automation, and security con-
trol in fnancial services. It also provides future research directions at the end of the study.
Chapter 10: A Comprehensive Survey on Blockchain-Integrated Smart Grids provides
an overview of Blockchain technology and a number of recent research works presented in
diferent literature on Blockchain integration into smart grid systems for energy manage-
ment, energy trading, security and privacy, microgrid management, and electric vehicle
management. It also presents the limitations and future directions of applying Blockchain
in smart grids.
Acknowledgments
First and foremost, praises and thanks to God, the Almighty, for His abundant blessings
and guidance, which have illuminated our path and enabled us to successfully complete this
book. We extend our heartfelt appreciation to all the contributors, whose valuable insights
and dedication have enriched the content and depth of this project. We are indebted to the
dedicated publishing team at CRC Press, whose expertise and commitment have played
an important role in shaping and bringing this book to fruition. Last but not the least, we
would like to acknowledge our families and friends for their patience, understanding, and
encouragement during the countless hours spent on this project.
It should be specifcally noted that for this project, Uttam Ghosh has been partly sup-
ported by the US NSF under grants award numbers 2219741 and 2334391, also Visiting
Faculty Research Program (VFRP) with the Information Assurance Branch of the AFRL,
Rome, NY, United States; and the Information Institute (II).
Uttam Ghosh, PhD
Meharry Medical College, United States
Fortune S. Mhlanga, PhD
Meharry Medical College, United States
Danda B. Rawat, PhD
Howard University, United States
About the Editors
technology-driven enterprise data ecosystem that plays a critical role in achieving success in
programs and initiatives across the entire Meharry enterprise as it caters for all data storage,
harmonization, management, stewardship, and business intelligence in Meharry’s clinical,
research, academic, and business enterprises. Previously, Mhlanga served as Founding Dean
of the College of Computing and Technology and Professor of Computer Science, Data Sci-
ence, and Software Engineering at Lipscomb University. His tenure at Lipscomb began in
August 2011 as Director of the then newly established School of Computing and Informat-
ics. He led the school through a period of growth that resulted in its transformation into the
College of Computing and Technology in 2014, ofering 11 bachelor’s degrees and 3 mas-
ter’s degrees. Before his appointment at Lipscomb, Mhlanga was Professor of Computer
Science in the School of IT & Computing (SITC) from August 2007 to July 2011. He also
served as Director of the SITC during his last year at ACU. From 2002 to 2007, he served
as Associate Professor and subsequently Professor and Founding Chair of the computer sci-
ence department at Faulkner University. Mhlanga was the Founding Director of the Infor-
matics and Electronics Institute at the Scientifc and Industrial Research and Development
Centre in Harare, Zimbabwe, from 1998 to 2002. He was Senior Lecturer in the computer
science department at the University of Zimbabwe from 1993 to 1994 and subsequently
served as Chair of the department until December 1997. Mhlanga has published widely in
computing, technology, and computational sciences including modeling and simulation.
His experience also includes several domestic and internationally based academic and re-
search fellowships. Mhlanga earned his bachelor’s degree in computer science from Harding
University in 1984, and his master’s and PhD degrees in computer science from the New
Jersey Institute of Technology in 1989 and 1993, respectively. His PhD work focused on
database systems and resulted in the conception of a Data Model and Query Algebra for
Ofce Documents.
GSU in 2015, the Best Paper Awards (IEEE CCNC, IEEE ICII, IEEE DroneCom and
BWCA), and Outstanding PhD Researcher Award in 2009. He has delivered over 50 key-
notes and invited speeches at international conferences and workshops. Dr. Rawat has pub-
lished over 300 scientifc/technical articles and 11 books. He has been serving as Editor/
Guest Editor for over 100 international journals including being Associate Editor of IEEE
Transactions on Cognitive Communications and Networking, Associate Editor of IEEE
Transactions of Service Computing, Editor of IEEE Internet of Things Journal, Associate
Editor of IEEE Transactions of Network Science and Engineering, and Technical Editor of
IEEE Network. Dr. Rawat earned a PhD from Old Dominion University, Norfolk, Virginia.
Dr. Rawat is Senior Member of IEEE and ACM, a member of ASEE and AAAS, and Fellow
of the Institution of Engineering and Technology (IET). He is ACM Distinguished Speaker
(2021–2023).
Contributors
Chapter Contents
1.1 Introduction 1
1.2 Cyber-Physical Systems 2
1.2.1 Data Characteristics 4
1.2.2 Computing Framework 4
1.3 Machine Learning 5
1.3.1 ML Models 6
1.3.2 Feature Extraction Techniques 8
1.3.3 DL Models 8
1.4 CPS Applications 16
1.4.1 CPS Infrastructure Security 16
1.4.2 Critical Infrastructure 19
1.5 Adapting ML models 21
1.5.1 Model Compression Techniques 22
1.5.2 Accelerators 23
1.6 Open-Ended Research Challenges and Future Directions 23
1.6.1 Data Scarcity and Scalability for DL Models 23
1.6.2 Sensitivity and Security of ML and DL Models 24
1.6.3 Adversarial ML and Cyber Threats 24
1.6.4 Legislative Challenges for ML in Security 24
1.6.5 Explainability of ML and DL Methods in CPS 25
1.7 Summary 25
Acknowledgment 25
Bibliography 25
1.1 Introduction
Cyber-Physical System (CPSs) consist of physical systems interconnected with multiple software
algorithms to form an intelligent system. With the evolution of the Internet, there has been a
huge transformation of how the objects in a system are connected. Nowadays, the intercon-
nected traditional objects are transformed to smart objects, allowing people to interact with the
engineered systems CPS is an amalgamation of sensors, control, computation, and networking
integrating into the physical systems that connect each other and also connect them to Internet.
Technological advancements are not confned to a particular area when it comes to CPS. The
advancements can be observed in the embedded sensors, software frameworks for data analyt-
ics, communication protocols, and computing resources to name a few. CPS contains devices or
things connected to the Internet to form a network to communicate and exchange data among
each other. This network of devices in a CPS is called the Internet of Things (IoT). The things in
IoT that are the physical objects are an integral part of our daily life which can be as simple as a
smartwatch tied to the wrist, smart bulb controlled by voice command, a smart refrigerator that
remembers weekly groceries to more sophisticated devices like wearable heart monitor, Radio
Frequency Identifcation (RFID) devices, smart parking lots, self-driving cars, smart building,
and many more. The heart of all these devices are various sensors that are embedded which col-
lect data based on the time interval set for the device. Therefore, IoT is driving the world toward
sensor-rich data that are continuously streamed and exchanged with each other through better
computing resources, sensing devices, and communication capabilities.
CPS applications can be applied to a wide range of applications namely: Consumer appli-
cations like a smart home; critical infrastructure applications like smart grid and smart city;
industrial applications like agriculture and manufacturing; and organizational applications
like healthcare, transportation, and military applications.One of the main objectives of CPS
is to provide intelligent services.
According to a forecast by International Data Corporation, there will be 41.6 billion IoT
devices that will be connected by 2025 which will inherently become a part of CPS. As the
network becomes large scale, new challenges arise with privacy and security, data storage,
communications, computations, and management of the devices in the network. As IoT gen-
erates a huge amount of data, traditional data processing and storage will not work for such
networks. The data obtained from IoT devices can be used for improving the user experience
or enhancing the IoT framework performance. The data can be studied for pattern behavior,
predictions, and assessments of the IoT network. Also, the data representation in an IoT net-
work is heterogeneous, and the devices generate a continuous stream of raw data. Therefore,
a single data-processing framework cannot be applied to the IoT-generated data which paves
the way for a need for new computational methods instead of traditional methods.
Also, the decision-making process and control actions of CPS in certain computing layers
demand real-time solutions. Traditional analytical methods are not suitable for achieving
real-time solutions. Therefore, data-driven methods are explored to minimize the computa-
tions and achieve real-time solutions. The most commonly used data-driven method is ML.
ML methods can extract useful information from the data generated. This enables in better
automation process, and the devices can change their behavior or take necessary actions
based on the knowledge inferred from the data which is a vital characteristic of a CPS. The
convergence of ML also improves communication and computations. While DL is a subset
of ML, they both have diferent capabilities. Therefore, in this chapter, we distinguish ML
and DL methods separately. ML and DL approaches have seen tremendous advancements
in the last decade. ML and DL methods have been implemented to a wide spectrum of ap-
plications from image processing, stock market analysis, behavioral analysis, and natural
language processing to mention a few. They have shown promising results with close to hu-
man performance. ML and DL have proven to be strong tools for huge data volumes.
simplifed lifestyle with a reduction in cost, energy, and time. CPS also has potential applica-
tions which can beneft multiple industries. In CPS, the physical and networking devices are
connected and exchange data with or without any human intervention or inputs. The layer in
which the devices of the CPS are connected through the Internet or network is known as IoT.
Therefore, in many applications, IoT can be treated as a subset of CPS as shown in Figure 1.1.
The models that consist of CPS and IoT have a certain degree of overlap based on the
requirements of the application. Based on the percentage of overlap between CPS and IoT,
the models are divided in four categories as described in Figure 1.2. In this chapter, the main
focus is the model in which IoT is the subset of CPS.
CPS applications involve Internet, and inherently, the devices connected in the applica-
tion become IoT devices. The aim of IoT is similar to the CPS to achieve a smarter environ-
ment except without any human interaction, making it a completely automated process.
Therefore, majority of ML and DL models are implemented and tested at the IoT layer as it
is well known for Big data and fast streaming data generation. The ML/DL models which
are implemented for IoT are inherently part of CPS. Depending on the application and
needs, appropriate data processing and preparation methods need to be performed. The
fow of data can be summarized as follows: the raw data of the environment is collected
from the IoT devices and sensors; the important features or knowledge from the data is
extracted; the data is sent to other objects, servers, or devices via the Internet. In recent
years, Big data and data analytics for IoT have gained immense research interests due to
the following reasons:
1. Huge volume of data generated: A huge number of devices are deployed for various IoT
applications in a CPS, and these devices/sensors will generate continuous streams of data.
For example, in a smart grid, phasor measurement units (PMU) are placed to capture
the phasor values of the grid in real time. The phasor data generated by PMU is a huge
volume of continuous data.
2. Heterogeneous data: IoT network consists of a large variety of devices due to the conver-
gence of multiple applications and their requirements. Therefore, the data acquired by
diferent applications have diferent parameters sampled at varying times that result in
heterogeneous data. For example, IoT devices/sensors used for smart homes are diferent
from the devices/sensors used in military surveillance.
3. Inconsistency and noisy data: Inconsistency in IoT data is an inevitable problem due to
uncertainties associated with the devices/sensors. The data captured can be noisy due to
faulty devices or cyber intrusion. This leads to noisy data or gross errors in the data dur-
ing transmission and acquisition. For example, the data from PMU could be modifed by
cyberattacks during transmission from a device to the cloud.
The Big data characteristics can be described through the 6Vs presented in (1): volume,
variety, velocity, veracity, variability, and value. Based on the reasons described, the data
generated by a CPS application can be characterized in terms of Big data characteristics.
1. Volume: The devices in CPS generate huge amounts of data, clearly indicating Big data.
2. Velocity: The data generated by the devices in CPS are sampled at very high velocity in
general. However, the velocity of the data generated changes over time and is dependent
on the application.
3. Variety: The data is heterogeneous in nature. The data representation acquired from the
devices consists of various data types like time-series data, images, audio signals, video,
sensor measurements in diferent system of units, and many more.
4. Veracity: It refers to the trustworthiness, quality, and reliability of the data generated
from the devices. It plays an important factor in an intelligent decision-making approach.
5. Variability: This refers to the data fow at diferent rates. CPS consists of various devices
that generate data at diferent time intervals. Also, the data fow in IoT networks can be
at specifc times like the exchange of data in wearable devices during a particular mode.
6. Value: It is the crucial characteristic of Big data. It refers to information that can be
obtained from the data collected in business terms. In IoT, the value of the data can be
derived on the basis of the application.
1. Cloud computing: In this computing architecture, the computing resources are located
in remote locations, and the data is sent over the Internet. The resources are used to
Machine Learning and Deep Learning Approaches 5
store, gather, analyze, and process the data. Cloud computing supports diferent types of
services based on the requirements like i) infrastructure as a service (IaaS), ii) platform
as a service (PaaS), iii) software as a service, iv) mobile backend as a service (MBaaS).
The cloud architectures vary depending on the user scenario as public, private, hybrid,
or community-based architecture (2).
2. Edge computing: In this architecture, the computing and data processing happen at the
source of the data or close to it in terms of physical location. In this computing frame-
work, the devices are not continuously connected to the network; therefore, the only
inference can be performed at the edge. The major advantages of edge computing are i)
low latency (there is no data transfer between the central server and the device) and ii)
increased analytical efciency. Edge computing is more suitable for time-sensitive prob-
lems that demand real-time operations (2). Edge computing can be adhoc in nature and
does not require extensive planning like cloud computing. In the near future, it has been
predicted that around 45% of the IoT data will use edge architecture (3).
3. Fog computing: Here, the computing architecture can be categorized between edge com-
puting and cloud computing. This was proposed by Cisco to address the latency issues
caused by time-sensitive applications (4). Fog computing provides limited computing,
storage, and networking facilities through virtual platforms.
1. Supervised learning: In this type of learning, each input has its corresponding output
labels. The objective of the learning algorithm is set. The learning algorithms try to learn
the relationship between the input dataset and the output labels that are used for predict-
ing the output label of the new set in similar input data.
6 Secure and Smart Cyber-Physical Systems
2. Unsupervised learning: In this type of learning, the ML learning algorithm receives only
the input data, and the output labels are not specifed. Therefore, defning a common
objective for this type of learning is difcult. It is commonly used to classify the data into
diferent groups.
3. Reinforcement learning: In this, the algorithm learns an appropriate action or sequence
of actions that need to be performed on the basis of the reward function. The agents
learn through feedback mechanisms after interacting with the environment. These algo-
rithms are applied widely in highly dynamic applications like robot control where the
tasks are accomplished without a defned outcome. The reward function determines the
success and failure of the agent (5).
Along with the above three learning algorithms, semi-supervised ML algorithm is used when
the majority of the data is not suitable for supervised learning. This learning method falls be-
tween unsupervised and supervised learning. The general dataset is a combination of a small
amount of labeled data (i.e., each input data has a labeled output and a large amount of unla-
beled data used in unsupervised learning). In many practical applications, the labeled data ac-
quisition cost for training is high due to the requirement of human experts; whereas unlabeled
data acquisition is relatively inexpensive. Therefore, this method can be used for modeling
when there is a large set of unlabeled dataset combining with a small set of labeled dataset.
Most of the applications use ML models which are based on the above learning mecha-
nisms. In supervised learning, the type of tasks is dependent on the labels. The labels can be
discrete category values or continuous values. If the labels belong to a single discrete cat-
egory, the task is called a classifcation task; if the labels consist of one or more continuous
values, then the tasks are classifed as regression tasks. First, diferent types of ML models
are explained followed by DL models.
1.3.1 ML Models
1. Support vector machines (SVM): SVM is one of the ML models that is widely used in
both classifcation and regression tasks using supervised learning. It is a non-probabilistic
binary classifer in which the major objective is to fnd a hyperplane in an N-dimensional
space that separates both classes with a maximum margin. The data points falling on
either side of the hyperplane can be denoted as diferent classes. The number of hyper-
planes depends on the number of input features. For example, if the number of input
features is three, then the hyperplane is 2D. As the number of input feature increases, the
hyperplane dimension also increases. SVMs are among the best supervised learning mod-
els that can deal with high-dimensional datasets and have efcient memory usage. In (6),
the SVMs can be trained in an online fashion. SVM can be extended to solve regression
problems using the support vector regression (SVR) process. SVR model depends only
on a subset of the training data since the model only cares about training points within
the margin, and all the data points beyond the margin are rejected. The mathematical
equations to compute y and loss function are shown below. Model:
n
i1
y sign i yi xi , x b
Loss Function:
Hinge Loss = max(0,1 − y · f (x))
Machine Learning and Deep Learning Approaches 7
2. Naive Bayes (NB): NB is a probabilistic classifcation model based on Baye’s theorem with
an assumption of independence between the predictors. NB frst creates a frequency table
of all the classes and then creates a likelihood table from it. Based on the likelihood, it cal-
culates the posterior probability. NB is highly scalable and requires a small number of data
points for training. They can also deal with high-dimensional data points and trains fast.
3. K-nearest neighbors: KNN is a non-parametric classifcation model that classifes an un-
seen data point by looking at the K given data points in the training set that are closest to
the feature space. The commonly used distance metrics are Euclidean distance, Hamming
distance, or L∞ norm. Since the algorithm relies on distance for classifcation, if there are
multiple data represented in diferent physical quantities, it is suggested to normalize the
data before training. One of the major drawbacks of KNN is scalability. KNN requires
storing the entire training dataset which is cumbersome for large datasets.
4. Decision trees (DT): DT is a non-parametric supervised learning model that can be used for
classifcation and regression tasks. It is a decision-support tool with the main objective to
predict the value of the target variable based on simple decision tools based on features. DT
splits into multiple branches until a decision is made. The DT is drawn in an upside-down
fashion with its root at the top. Based on the decision it splits, a DT will have multiple
branches. The terminal node is called a leaf node which cannot be split any further since it
is the end of the branch. The performance of the trees can be increased by pruning which
involves the removal of branches that make use of features with low importance. DT is
simple to implement and understand. DT is independent of data features; therefore, data
preparation is minimal. However, DT is unstable because if there is a small change in the
data, it can lead to a completely diferent tree generation. DT can create complex trees that
cause overftting. The mathematical method to compute decision trees is given as
Model:
𝒴 = Tree(x)
Loss Function:
C
p
2
Gini Index 1 i
i1
5. Random forests (RF): RF is constructed by combining multiple DT that can be used for clas-
sifcation and regression tasks. Each tree is trained on a subset of data that is chosen randomly
with replacement. If there are M input variables, then each node gets m variables selected
randomly out of M where m «M, and the best split is used on these m values. The value of m
remains unchanged during forest growing. RF has high accuracy, but it causes overftting. A
large number of trees can make the algorithm slow and infeasible for real-time applications.
The below equation is the mathematical representation for computing random forests.
Model:
𝒴 = MajorityVote(Tree1(x),Tree2(x), … ,Treen(x))
which is minimum. K-means clustering is a very fast and scalable algorithm. However,
K-means assign one data point to one cluster which may result in inappropriate clusters.
Also, it is not robust for the outliers.
7. XGboost: XGBoost is an ML algorithm that has gained popularity in recent years. This
algorithm works well for structured and tabular data. It is a gradient-boosted DT that is
been developed for faster execution speed and higher performance. XGBoost algorithm
implements optimizations at hardware, software, and algorithmic levels. In XGBoost,
the process of sequential tree building is parallelized due to the loop interchangeable
property. The hardware resource is efciently utilized by allocating internal bufers in
each thread to store gradient statistics. The overftting of the model is prevented by pe-
nalizing through L1 and L2 regularization.
In Table 1.1, a summary of diferent ML models discussed above is presented with poten-
tial applications that can be implemented.
Feature extraction techniques are widely used in ML algorithms due to their inability to
handle a large number of variables in high-dimensional spaces. Some of the variables in
the dataset may be redundant or do not have dominating features that can be extracted by
the ML algorithm. Therefore, the variables which are redundant or have features that do
not distinguish signifcantly from others are removed, and only the dominating features are
retained using feature extraction techniques. It reduces the dimensions of the input dataset.
Hence, the number of resources required to describe the dataset is reduced and aids in ML
model efciency. Feature extraction techniques were widely implemented in the early 1990s
and 2000s due to hardware resource limitations. The common feature extraction technique
is principal component analysis (PCA) and canonical correlation analysis (CCA). In PCA,
the dimension of the data is reduced by projecting each data point onto only the frst few
principal components while preserving as much variation in the data as possible. There are
other similar techniques that are used for feature extraction like linear discriminant analysis
and independent component analysis. CCA is a linear dimensionality reduction technique
that infers the information from the cross-covariance matrices. CCA is closely related to
PCA. CCA deals with two or more vector of features, unlike PCA which deals with one
variable or a feature. Table 1.2 shows a brief comparison between CCA and PCA.
1.3.3 DL Models
DL model consists of multiple layers of artifcial neural networks (ANNs) that are trained
using supervised or unsupervised learning. DL which is a subset of ML can be classifed into
three categories: i) Generative models that are used for unsupervised learning, ii) discrimina-
tive models that are used for supervised learning, and iii) the hybrid models that can be classi-
fed as semi-supervised learning. The diferent DL models are discussed briefy in this chapter.
1. Fully connected deep neural network (FC-DNN) or multi layer perceptron (MLP): A fully
connected deep neural network consists of one input layer, multiple hidden layers, and an
output layer. Each layer has multiple neurons that are the processing units of the network. The
neurons receive multiple input signals coming from the external environment denoted by a
Table 1.1 Summary of Different ML Models
SVM Supervised Various It is a non-probabilistic model with low- Attack detection (7)
computational complexity Intrusion detection (8)
It aims to classify the input data into n Stability classification in smart grids (9)
dimensions by drawing a n–1 hyperplanes
It is suitable for high-dimensional datasets with
low memory usage
NB Supervised Various It calculates the posterior probability Securing DDoS attack (10)
It uses Bayes’ theorem to calculate the Smart agriculture (11)
probability of a particular feature set
Can deal with high-dimensional data
KNN Supervised Various The objective is to classify the new data point by Attack detection for small networks (7)
looking at the K closest points in the training set Anomaly detection (12)
For good performance, a new data point needs
to be closely associated with the training set
It requires storing the entire training set which
makes it non-scalable for large datasets
9
Can handle missing data
10 Secure and Smart Cyber-Physical Systems
set of input values or from other neurons connected to them. The relationship of each input is
calculated by multiplying the synaptic weight to validate all the information received by that
neuron. The weighted sum is then passed through an activation function to limit the output
of the neuron. Depending on the task defned, the output of the neuron can be a continuous
or discrete value. The neural network is supposed to learn the relationship between input
and output provided to the network. Once the network learns the relationship, it is capable
of predicting the output for any given input. To generalize the output, the weights associated
with the neurons need to be tuned by a training process using a suitable learning algorithm.
The training process begins with the initialization of random synaptic weights for the
network. The weights are adjusted or changed at the end of each iteration in a particular
direction to reduce the error between the desired and the actual outputs. An iteration to
complete the adjustment of the synaptic weights and the threshold for all the input patterns
presented to the network is called an epoch. The network is trained after going through the
defned number of epochs with the given training data; the network can be used for testing
other values. The error between the actual output and the desired output is termed as the
cost or loss function. The training algorithm aims at achieving the minimum cost function
to train the network by adjusting the weights for each layer to classify the data. It is crucial
to have correct weights at each layer to train the network. Therefore, the general method
for obtaining the weights updates of the networks is done by optimization methods. There
are several optimization methods like gradient descent, momentum, and RMSProp to up-
date the weights. The commonly used optimizer to train the network is the gradient descent
optimizer. This optimizer implements a full-batch fundamental backpropagation algorithm
which updates the weights for the entire dataset using its gradient. The weights must have the
negative direction of the gradient to fnd the global minimum. The cost function is minimized
to fnd its global minimum. One of the widely used training algorithms for FC-DNN is the
backpropagation algorithm. The training process using the backpropagation algorithm is
done by the successive application of two specifc stages: a) forward stage and b) backward
stage as shown in Figure 1.4. The forward stage is the frst stage, where the inputs from the
training data are inserted into the network inputs and are propagated layer-by-layer until the
output is calculated. In the second stage, diferences between the actual and desired outputs
are calculated and used to adjust the weights and thresholds of the neurons in the network.
Therefore, the successive application of forward and backward stages allows the synaptic
weights and thresholds of the neurons to be adjusted automatically in each iteration.
Machine Learning and Deep Learning Approaches 11
2. Convolution neural networks (CNN): FC-DNN is a dense network due to connections be-
tween each neuron in every layer limiting the network to scale. For images or vision-related
tasks, where the image contains the translation invariance characteristics that are not learned
in the FC-DNN networks. However, CNN solves this problem using convolutional kernels
that capture the translation invariance charateristics in the image. A typical CNN architec-
ture is shown in Figure 1.5. The input to a CNN typically is a grid topology. The data is rep-
resented either in a 1D grid or 2D grid which can be an image, audio signal, or video frame.
CNN extracts the features of the image using convolutional kernels in each hidden layer. The
output of the convolutional layer is the feature map. The feature map is obtained by calculat-
ing the inner products of the input and the flter. Each convolutional kernel can be diferent
sizes starting from 1 × 1. The general rule of thumb is to have few feature maps with a large
kernel size at the beginning of the CNN network so the large features are extracted. As the
network gets deep, more kernels with smaller sizes are used to extract nonlinear and smaller
features. In many CNN implementations, a small flter size is used to have deeper networks.
The convolution layer is followed by a detection layer which has an activation function.
12 Secure and Smart Cyber-Physical Systems
Usually, the activation function is rectifed linear unit (ReLU) for the CNN. Following the
detection layer, the pooling layer is applied. It downsamples the input data to reduce the
number of learnable parameters and number of computations in the network (usually by
half at every layer). The pooling layer operates over each activation map independently. Max
pooling and average pooling are used in the CNN architecture. The last layer of the CNN
architecture is the fully connected layer which converts the matrix to a 1D vector. The output
of the fully connected layer is the number of desired outputs. One of the major advantages
of using CNN over DNN is that each neuron in the DNN connects to all input dimensions;
whereas in CNN, only a small portion of the input is connected to a neuron. This helps in
the great reduction of the parameters that need to be trained. Given an input image or feature
map X with dimensions N × H × W × C, where N is the number of samples, H is the height,
W is the width, and C is the number of channels. The CNN applies convolutional flters or
kernels K, nonlinear activation functions σ, and pooling operations Pool.
The output feature map of a CNN layer Y can be obtained using the following math-
ematical formulation:
Y = σ(Conv(X, K) + b)
3. Recurrent neural networks (RNN): While CNN is suitable for a spatially oriented applica-
tion, RNN is suitable for time series applications. RNNs carry the information time step in
their internal memory which is known as hidden state ht making it suitable for time series or
sequential applications. A standard RNN unrolled in time is shown in Figure 1.6. The out-
put of ht is calculated from the input xt and the history ht−1 which is the output at time t − 1.
Block A in the fgure represents a layer of n neurons. Each neuron is equipped with a feed-
back loop that returns the current output as an input for the next step. However, for the
standard RNN, the number of hidden states to store temporal information is one. There-
fore, standard RNN is not suitable for long-term dependency of the data. Also, standard
RNN implementation results in vanishing gradients and gradient explosion. This problem
afects the weight updates during the training process leading to erroneous learning.
To overcome the problems posed by the standard RNN network, the variant called long
short-term memory network (LSTM) is developed. LSTM network is made up of LSTM cell
block shown in Figure 1.7 instead of standard RNN layer. The backbone component of the
LSTM network is the cell state that has a memory that helps to remember the past values
by accumulating the state information st at every time step t. The LSTM cell block consists
of three gates namely: input gate, forget gate, and output gate. The sigmoid activation func-
tion is applied to all three gates to accumulate the information and control the information
fow to trap the gradient in the cell. Based on which gate is activated, the input information
is accumulated, forgotten, or passed on to the next state. LSTM networks have proven to
perform better than the standard RNN networks.
Given an input sequence X = {x1,x2, … ,xT }, the LSTM computes hidden states H and cell
states C using input gate i, forget gate f, output gate o, and a candidate cell state C̃.
The LSTM equations are as follows:
it Wxi xt Whi ht 1 bi
ft Wxf xt Whf ht 1 bf
ot Wxo xt Who ht 1 bo
C t tanh Wxc xt Whc ht 1 bc
C f C i C
t t t 1 t t
h
t ot tanh
t Ct
4. Autoencoders (AE): AE is a type of DL model that falls under the unsupervised cat-
egory. AE network has two parts. First, the encoder learns a lower-dimensional feature
representation from an unlabeled dataset. Second, in the decoder, the code or the repre-
sentation features of the data try to reconstruct the original input data. The encoder and
decoder can have multiple hidden layers. AE has the same number of input and output
units. The basic architecture is shown in Figure 1.8. Due to their ability to reconstruct the
input at the output layer, autoencoders have a wide range of applications in industries for
14 Secure and Smart Cyber-Physical Systems
fault detections and anomaly detection. There are variants of AE namely, contractive au-
toencoder (CAE), variation autoencoder (VAE), sparse autoencoder (SAE), and de-noising
autoencoder (DAE).
The autoencoder objective function minimizes the reconstruction error between the input
X and the output X̂:
And VAE objective function combines a reconstruction loss and a regularization term
using the Kullback–Leibler (KL) divergence:
min (X, Xˆ , z)
q(z|X)[ log p(X | z)] KL(q(z | X) || p(z))
E, D
5. Generative Adversarial Networks (GANs): GANs are used for generative modeling us-
ing DNN like CNN and RNN. For a given training set, GANs learn to generate new data
with the same statistics as the training set. GANs consist of two neural networks: i) genera-
tive network and ii) discriminative network. The two networks work together to produce
high-quality and synthetic outputs. The generative networks learn from the input dataset
to generate new data. The discriminative model tries to classify the date if it is real (actual
input data from the domain) or fake (generated from the generative model). The network
is trained until the discriminative network cannot distinguish between the actual and fake
data. In GANs, two networks compete with each other based on zero-sum games in which
one network tries to maximize the value function, and the other network tries to minimize
it. The generative network generates a batch of samples in an unsupervised manner. The
discriminative network receives two inputs: i) output of the generative network and ii) the
real example from the domain to classify them as real or fake. The discriminative network
Machine Learning and Deep Learning Approaches 15
gets updated to get better at classifying the real and fake samples in the next round. The
generative networks get updated on the basis of how well the generator samples deceived
the discriminative network. In Figure 1.9, the GANs architecture is shown.
GANs have gained immense popularity due to the capability of generative high-quality real-
istic examples in a wide range of applications. It has shown promising results in cases of image-
to-image translation. The GAN objective function can be formulated as a minimax game:
6. Restricted Boltzmann Machine (RBM): RBM is a stochastic ANN that learns the prob-
ability distribution from a given training dataset. RBMs consist of two layers: a) visible
layer and b) hidden layer. The architecture of RBMs is shown in Figure 1.10. In RMBs, the
neurons are called nodes, and each node is connected to each other across the layers, but
no two nodes are connected in the same layer. The training data is assigned to the visible
node that needs to be learned. Then, the output of all the visible nodes is passed to each
hidden node in the hidden layer. Because of this, the RBMs form a symmetric bipartite
graph. The results from the hidden node are passed through the activation function to
produce one output for each hidden unit. The training of RBMs can use a backpropagation
algorithm and diferent weight optimization techniques. The main objective is to minimize
the error and maximize the product of all probabilities of the visible units. RBMs func-
tion in a similar fashion as AEs for a simple feed-forward network. RBMs are also used
as building blocks in deep belief networks (DBNs). RBMs are useful for dimensionality
reduction problems, regression, feature extraction, classifcation, and topic modeling.
7. Deep Belief Networks (DBNs): DBNs are generative models which consist of multiple
hidden layers which have interlayer connections but not intra-layer connections. DBNs are
composed of unsupervised networks like RBMs and AEs. DBNs learn to reconstruct the
input as well as extract the features in a hierarchical manner. Once the DBN is trained in an
unsupervised manner, DBNs can be further trained to perform classifcation tasks by adding
a softmax layer. The DBNs are trained in a greedy fashion with one layer at a time. This
makes the DBNs one of the most efcient and fast algorithms in DL. The architecture of the
DBNs is shown in Figure 1.11.
In Table 1.3, a summary of diferent DL models discussed above is presented with poten-
tial applications that can be implemented.
One of the major concerns in the CPS is the privacy and security of the data generated by
numerous devices in the system. A major threat for the security of CPS arises from the IoT
Table 1.3 Summary of Different DL Models
(Continued)
17
Table 1.3 (Continued)
18
Model Learning Input Data Characteristics Sample Applications
GANS Semi-supervised Various It simultaneously trains two models: i) a generative Clinical decision support
model that learns the data distribution and generates in healthcare (32)
data samples and ii) a discriminative model that Objection detection (33)
predicts the possibility that a sample originates from Cybersecurity of IoT
the training dataset via an adversarial process systems (34)
It is suitable for noisy data
It is unstable and has difficulty in learning to
generate discrete data
RBM Unsupervised, Various It is an unsupervised learning algorithm that uses Intrusion detection (35)
supervised deep generative models Anomaly detection in IoT
It uses a feedback mechanism that allows vital networks (36)
feature extractions
Training is computationally expensive
DBNs Unsupervised, Various It consists of stacked RBMs that are suitable for Traffic prediction (19)
supervised hierarchical feature extractions Stress monitoring in
It has greedy layer-wise training to improve healthcare (37)
performance for an unsupervised learning
Training is computationally expensive
Machine Learning and Deep Learning Approaches 19
layer since the data is communicated over the Internet, and the data is visible to the entire
world and easily accessible to hackers. This opens up a new research interest in implement-
ing ML and DL models in areas like preventing malicious attacks by detecting an intruder or
an unauthorized device/user and providing access control and authentication and detection
of malware attacks to name a few. Research in (38) gives a survey of learning techniques for
network intrusion detection systems (NIDS) for IoT. The survey in (39) gives a comprehen-
sive survey of ML approaches for intrusion detection systems. The performance and imple-
mentation details of various ML models such as SVM, DT, NB, and K-means clustering were
discussed. The research in (22) demonstrated the detection of DDoS attacks in IoT networks
using MLP networks. (40) uses ensemble-based ML algorithms to mitigate botnet attacks
against DNS, HTTP, and MQTT protocols that are utilized in IoT networks. The AdaBoost
algorithm was used to distribute the network data. NB, DT, and ANN are used for the detec-
tion of botnet attacks. The proposed method had a high detection rate and low positive rate
compared to the state-of-the-art techniques. The research in (41) demonstrates a multivari-
ate correlation analysis to detect the DoS attack. The study was conducted for various DoS
attacks for original data and normalized data. The detection rate of 99.95% was achieved
for normalized data for various attacks, whereas 95.25% detection rate was achieved for
the original data. In (42), the researchers propose a DNN approach for the user authentica-
tion technique for IoT-based human physiological and behavioral characteristics inherited
from their daily activities. The proposed authentication method achieves 94% and 91%
accuracy for 11 subjects for walking and stationary behaviors, respectively. The research
in (7) demonstrates cyberattack detection in smart grids using ML models. Based on the
results presented, SVM performs better in large-scale systems compared to other algorithms.
However, KNN performs better for small-scale systems. The traditional ML algorithms like
SVM, NB, and DT have a limitation when dealing with big network trafc data due to the
shallow network architecture (43) for malware detection and classifcation. DL methods
like CNN and RBMs are suitable for big network trafc data like IoT network data. Edge
intelligence in CPS (44, 45) is another vital research area that is being explored to avoid data
breaches and maintain the quality of the data in CPS. Processing and inferring the data at the
edge would reduce the data exchange between various layers and devices and minimize the
exposure to cyber threat.
ML and DL methods applied to a wide spectrum of applications like smart grids, health-
care, industries, agriculture, and transportation can be categorized as the critical infrastruc-
ture of CPS applications for a smart city. A brief literature review of ML and DL methods
applied to these applications are presented.
The power grid is no longer an unidirectional communication with the advanced digital
technologies for real-time analysis along with the integration of renewable energies to the
grid. Various ML and DL models are implemented to forecast the load requirements in
real-time. The research in (46) compares various ML models for load forecasting in a smart
grid. In this research, they used data-imaging conversion-based CNN for the time-series data
with temperature, weather, and date for load forecasting. The implementation of SVM for
predicting the stability of the grid using synchrophasor data collected during the post-fault
period of the system subjected to a large disturbance is shown in (9). Overall, 97% predic-
tion accuracy was obtained for simulated cases containing PMU data. They achieve the
20 Secure and Smart Cyber-Physical Systems
highest performance for the proposed method with SVM being the second-best method. The
researchers in (28) use a combination of CNN- and LSTM-based neural networks for resi-
dential energy consumption prediction. The CNN layer can extract the features between sev-
eral variables impacting the energy consumption, and the LSTM layer is used to obtain the
temporal information of the irregular trends in the time-series components. The proposed
CNN–LSTM network method achieves the prediction performance very close to the actual
data that was previously difcult to predict using the DNN method. The research in (47)
uses the RBM-based DL method to predict a building’s energy fexibility in real time. The re-
search in (48) implemented the CNN for transient stability assessment and instability mode
prediction. CNN is implemented to predict the stability of the system and classify the data
into stable, aperiodic unstable, and oscillatory unstable. The best performance was achieved
using the CNN when compared to other ML models with 97% accuracy. Along with CNN,
a new class of DNN called ConvLSTM network is used to predict the parameters of the
critical values like PMU voltage phasors to perform stability analysis is being researched in
(49). This research explores the application of DNN for system-wide parameter prediction.
A survey on various frameworks, performance, and challenges for the smart grid implemen-
tation can be found in (50).
Various methods are explored to produce healthy crops and efcient farming tech-
niques to provide a healthy and sustainable environment. There are several uses of ML
and DL models for smart agriculture for diferent stages of farming from soil testing to
harvesting. In (16), the research demonstrates the use of the RF method for yield pre-
dictions of sugarcanes. The prediction helps in making farm decisions like how much
nitrogen fertilizer to apply, maintenance of the miller, and labor schedules for milling.
The research in (51, 52) demonstrates the use of CNN-based DL method for plant dis-
ease detection. The research in (25) used CNN for the identifcation of citrus trees using
unmanned aerial vehicle imagery. The authors in (53) propose a multilevel DL architec-
ture land cover and crop-type classifcation from multi-temporal, multi source satellite
imagery. CNN implementation outperforms other ML models like RF and MLP with
85% accuracy in detecting major crops. The research in (54) used SVM for pest detec-
tion. DL is widely used in fruit detection and determining the stage of fruit for automatic
harvesting. The research in (55, 56) uses region-based CNN (R-CNN) for the analysis
of the fruit. A comprehensive review of ML and DL methods applied to agriculture is
provided in (57–59).
CPS, IoT, and ML methods are infused to bring better healthcare solutions and well-being
practices among individuals and communities. ML-based models are widely used in health-
care for various ailments’ detection. In (23), the authors propose the use of MLP in detecting
brain tumors using MRI images. The proposed model outperforms the NB method with
98.6% accuracy. CNN is implemented in assessing cardiovascular disease based on mam-
mograms (60). The results demonstrate that the DL approach achieves a level of detection
similar to the human experts. An overview of diferent ML algorithms applied in cardio-
vascular disease is provided in (61). Models have been implemented for ftness devices to
analyze the data and make predictions (62). The data collected from wearable smartwatches
such as participants, terrain, calories, and steps. DT and RF have the best performance
for participant prediction, whereas NB has the best performance for steps. CNN-based
framework is developed to provide the nutritional value of the food in real time (63).
The top-1 accuracy achieved is 85% in classifying the food. The research in (26) provides
Machine Learning and Deep Learning Approaches 21
visual support of calorie intake of the food using R-CNN-based DL model. Various DL
models are implemented for the early diagnosis and study of Alzheimer’s disease (64, 65).
A brief survey of ML models for cancer detection is studied in (66). Along with traditional
DL and ML methods with IoT, the recent research advancements are focused on Federated
Learning (FL) which is a distributed AI paradigm. FL is more benefcial in smart healthcare
as they don’t share any raw data for training. This addresses the main concern of using any
AI-related frameworks which is data privacy. The use of FL and its challenges are provided
in (67), and a survey of smart healthcare is summarized in (68). The research in (69) dis-
cusses about the efective use of cloud-based healthcare system using DL methods for IoT
healthcare in smart cities.
Transportation system is one of major CPS applications where most of the data are gener-
ated. As the automotive industry is making technologically advanced vehicles, it is important
to integrate the intelligent system. The research in (24) used CNN for real-time trafc sign
detection. This approach has 99.96% of accuracy in classifcation. The model is run on an
embedded GPU platform. With autonomous driving, driver assistant systems, mobile map-
ping services, and reliable services are demanded. Self-driving cars use DNN for real-time
analysis of various tasks like detecting the speed limit and identifying the pedestrians, traf-
fc signs, etc (70). (71, 72) researches driver behavior identifcation using DL models and
challenges associated with it. ML and DL algorithms have been explored for transportation
systems in various aspects. (73) discusses the use of CNN and LSTM networks for trafc
fow prediction of smart city planning using intelligent transportation systems. This method
incorporates the spacial and temporal features for better prediction of trafc fow. In (74, 75),
various ML algorithms applied for smart transportation are provided. Industries are incorpo-
rating advanced technologies with IoT and CPS called Industry 4.0. The industries must have
high-accurate intelligence to work efciently and productively. ML and DL models have been
used in many industrial applications making them intelligent with the reduction in operation
and maintenance costs. There are numerous research surveys conducted for ML and DL algo-
rithms implemented in industrial applications like smart machine process (76), fault diagnosis
(77), and autonomous order dispatching (78). A survey of current state-of-the-art CPS and
IoT technologies implemented for Industry 4.0 is discussed in (79). The progress of incorpo-
rating the technological advancements in Industry 4.0 to the need for more explanability in
AI is summarized in (80).
A typical DL model consists of millions of trainable parameters that require large computa-
tional and memory resources. To adapt to a resource constraint problem, research interests
in model compression have grown over the past few years.
1. Pruning: This is one of the model compression methods, in which the redundant and use-
less weights of the network are removed to reduce the network complexity and over-ft-
ting (83, 84) called the pruning technique. Recently, (85) demonstrated that pruning does
not impact the accuracy when applied to the state-of-the-art CNN models. In this method,
the dense network is converted into a sparse network, and the sparse values are stored
using a compressed sparse row (CSR). This method does not reduce the number of layers
in the original network. In Figure 1.12 , the concept of DNN pruning is demonstrated.
2. Quantization: A typical representation of weights and activations in deep networks are
32-bit foat point numbers. Quantization reduces the number of bits that represent these
weights and activations which in turn reduce the memory required for storing the values.
Quantization applied for the pruned network reduces the memory storage and compu-
tations signifcantly. The authors in (85) demonstrate the quantization technique for
pruned AleXNet with eight-bit representation without any compromise in accuracy.
3. Knowledge distillation (KD): In this method, two types of networks are trained: 1)
teacher network and 2) student network as shown in Figure 1.13. KD trains the student
network (i.e., a smaller network that mimics the large teacher network). The student
network utilizes the information contained in the soft targets from the teacher’s network
to aid the training of the student network. KD along with quantization enables model
compression which reduces the memory footprint and complexity of the networks. The
number of layers can reduce using KD in the student network (86). In research (87), the
KD can be applied for networks with unlabeled datasets.
1.5.2 Accelerators
With the growth of DL models, suitable hardware designs are developed to optimize the
memory footprint and power consumption in IoT devices. The main focus of developing
the accelerators for the device is on inference rather than training the DL models. Various
researches (88, 89) have been conducted to develop accelerators to adapt to IoT devices.
Along with hardware accelerators, various researches have been conducted using software
frameworks.
One-size-fts-all solution may not be achieved with DL models, as the model trained for
one domain might not be able to perform well for another problem in a similar domain.
The model needs to be retrained to ft into another domain. This might not be an issue for
static domains but challenging for real-time CPS applications as collecting and processing
24 Secure and Smart Cyber-Physical Systems
data, as well as retraining, can be difcult due to limited computational resources. Besides,
the representative data for each behavior are rare events (e.g., machine failure) causing an
imbalanced dataset for model retraining and thus negatively impacting on the inference
and decision-making. Heterogeneity in considered environments, as well as sensors, also
impacts ML–DL model scalability across the same domains. On the other hand, due to the
heterogeneity of the data collected from devices with diferent modality and granularity,
there could be ambiguity and spuriousness. Future work need to consider addressing these
challenges.
The data in CPS are typically collected from sensors, and sensors have diferent sensitivity
and operation levels in diferent environments. Thus, trained ML and DL models will also
be susceptible to change in data patterns leading to the butterfy efect. Such a swing in
model results can further pose additional challenges. First, the trained model cannot track
or detect issues in the sensors and change their operating characteristics. Second, the ML–
DL models become prone to security attacks such as Trojan attacks. An adversary can inject
false data and easily mislead the model inferences. More investigation is needed to tackle
the privacy and integrity of the models.
ML and DL models nourish the data, but adversaries can use ML and DL models for
malicious purposes. Such a branch of ML and DL is called adversarial machine learning
(AML). With AML, adversaries can perform spoofng attacks, generate realistic fake data,
and understand inferencing patterns of other ML and DL models by playing with the train-
ing parameters, thus misleading the learning system. GANs and other AML models with
perturbation can be used by adversaries to attack IoT networks and operations. Hence,
ML and DL models can backfre if they are not safeguarded from their vulnerabilities. On
the other hand, in critical infrastructure deployment, compromised data can be a threat to
human lives and device safety. Furthermore, the compromised data can also be another ap-
proach of adversarial attacks. Hence, it is important to ensure the security of IoT devices
and the health of the generated data for ML–DL training, and it is extremely important to
investigate the role and impact of AML approaches on IoT networks.
The infux of CPS services and applications is surging and spurring legislative discussion.
Most CPS applications are struggling with efcient and acceptable legislative policies. Con-
sidering ML and DL models are black box solutions, it is very challenging to convince or
sell ML and DL solutions and develop technology-oriented legislative policies. As ML and
DL models require data for training, the privacy of the users and data leakage become top
concerns while making policies. Furthermore, each country will have its own policies for
diferent applications; hence, one security framework might not work for other regions and
applications. It is apparent that the legislative policies decide the course for the success,
deployment, and adaptation of new technologies among consumers.
Machine Learning and Deep Learning Approaches 25
Every device in CPS generates data, and that data is processed as needed to train the diferent
ML/DL models. The results inferred from these models are based of from a black box calcula-
tions. In order to completely rely on the ML/DL results, the user must be completely confdent
of the data that has been used for training and testing the models; if not, it would simply be
treated as a garbage-in garbage-out scenario. Given the scarcity and quality of the data for cer-
tain areas of critical infrastructure, one cannot rely just on the ML/DL results to take the neces-
sary actions. There is a pressing need to more than ever to understand how the ML/DL model
concludes the results based on the data that is been used to train and interpret the calculations
at each layer. This is one of the major challenges that is hindering from completely deploying
AI-driven models in real-world scenarios. There are several software like LIME, Shapley values
to name a few that translate the ML/DL models to human understanding which could help us
to implement ML/DL models in confdence. In the future, more tools need to be developed in
understanding how the ML/DL models work to beneft their implementation.
1.7 Summary
ML and DL approaches have gained great attention in the last decade for various applica-
tions. With the growth of CPS for various applications and the number of devices connected
in the CPS, there is a need for efcient methods to process, analyze, and predict from the
data generated by these devices. One of the main objectives of CPS is to provide intelligent
services. Various researches have demonstrated that it is possible to achieve intelligent ser-
vices by combining the ML and DL approaches with CPS mainly with IoT. In this chapter,
we reviewed the characteristics of data generated in a CPS and a brief overview of various
ML and DL algorithms that are used for CPS applications. We also provided a brief litera-
ture review of ML and DL methods implemented for CPS security and critical infrastruc-
ture. From the literature, it is observed that ML and DL approaches have shown promising
results for various CPS applications. A brief discussion of adopting ML and DL methods
for IoT devices that are resource constraint and the recent advancements in the feld was
also carried out this chapter. Finally, we concluded the chapter by discussing the challenges
posed and future directions for using ML and DL approaches to IoT networks in CPS.
Acknowledgment
The LA-UR for this document is LA-UR-21–29411.
Bibliography
[1] M. H. ur Rehman, C. S. Liew, A. Abbas, P. P. Jayaraman, T. Y. Wah, and S. U. Khan, “Big Data
Reduction Methods: A Survey,” Data Science and Engineering, vol. 1, no. 4, pp. 265–284, 2016.
[2] S. K. Sharma and X. Wang, “Live Data Analytics with Collaborative Edge and Cloud Processing
in Wireless IoT Networks,” IEEE Access, vol. 5, pp. 4621–4635, 2017.
[3] W. Shi, J. Cao, Q. Zhang, Y. Li, and L. Xu, “Edge Computing: Vision and Challenges,” IEEE
Internet of Things Journal, vol. 3, no. 5, pp. 637–646, 2016.
[4] F. Bonomi, R. Milito, J. Zhu, and S. Addepalli, “Fog computing and its role in the internet of
things,” In Proceedings of the frst edition of the MCC workshop on Mobile cloud computing
(MCC ‘12), Association for Computing Machinery, New York, USA, pp. 13–16, 2012.
26 Secure and Smart Cyber-Physical Systems
[27] M. Z. Uddin, “A Wearable Sensor-Based Activity Prediction System to Facilitate Edge Comput-
ing in Smart Healthcare System,” Journal of Parallel and Distributed Computing, vol. 123, pp.
46–53, 2019.
[28] T.-Y. Kim and S.-B. Cho, “Predicting Residential Energy Consumption Using CNN-LSTM Neu-
ral Networks,” Energy, vol. 182, pp. 72–81, 2019.
[29] R. Das, A. Gadre, S. Zhang, S. Kumar, and J. M. Moura, “A Deep Learning Approach to IoT
Authentication,” in 2018 IEEE International Conference on Communications (ICC). IEEE,
2018, pp. 1–6.
[30] R. Alhajri, R. Zagrouba, and F. Al-Haidari, “Survey for Anomaly Detection of IoT Botnets Using
Machine Learning Auto-Encoders,” International Journal of Applied Engineering Research, vol.
14, no. 10, pp. 2417–2421, 2019.
[31] J. J. Q. Yu and J. Gu, “Real-time Trafc Speed Estimation with Graph Convolutional Generative
Autoencoder,” IEEE Transactions on Intelligent Transportation Systems, vol. 20, no. 10, pp.
3940–3951, 2019.
[32] Y. Yang, F. Nan, P. Yang, Q. Meng, Y. Xie, D. Zhang, and K. Muhammad, “GAN-Based Smei-
Supervised Learning Approach for Clinical Decision Support in Health-IoT Platform,” IEEE
Access, vol. 7, pp. 8048–8057, 2019.
[33] C. Wang, S. Dong, X. Zhao, G. Papanastasiou, H. Zhang, and G. Yang, “Saliency-GAN: Deep
Learning Semisupervised Salient Object Detection in the Fog of IoT,” IEEE Transactions on
Industrial Informatics, vol. 16, no. 4, pp. 2667–2676, 2019.
[34] A. Arora and Shantanu, “A Review on Application of GANs in Cybersecurity Domain,” IETE
Technical Review, pp. 1–9, 2020.
[35] A. Elsaeidy, K. S. Munasinghe, D. Sharma, and A. Jamalipour, “Intrusion Detection in Smart
Cities Using Restricted Boltzmann Machines,” Journal of Network and Computer Applications,
vol. 135, pp. 76–83, 2019.
[36] U. Fiore, F. Palmieri, A. Castiglione, and A. De Santis, “Network Anomaly Detection with the
Restricted Boltzmann Machine,” Neurocomputing, vol. 122, pp. 13–23, 2013.
[37] S.-H. Song and D. K. Kim, “Development of a Stress Classifcation Model Using Deep Belief
Networks for Stress Monitoring,” Healthcare Informatics Research, vol. 23, no. 4, pp. 285–292,
2017.
[38] N. Chaabouni, M. Mosbah, A. Zemmari, C. Sauvignac, and P. Faruki, “Network Intrusion
Detection for IoT Security Based on Learning Techniques,” IEEE Communications Surveys &
Tutorials, vol. 21, no. 3, pp. 2671–2701, 2019.
[39] A. L. Buczak and E. Guven, “A Survey of Data Mining and Machine Learning Methods for
Cyber Security Intrusion Detection,” EEE Communications Surveys & Tutorials, vol. 18, no. 2,
pp. 1153–1176, 2015.
[40] N. Moustafa, B. Turnbull, and K.-K. R. Choo, “An Ensemble Intrusion Detection Technique
Based on Proposed Statistical Flow Features for Protecting Network Trafc of Internet of
Things,” IEEE Internet of Things Journal, vol. 6, no. 3, pp. 4815–4830, 2018.
[41] Z. Tan, A. Jamdagni, X. He, P. Nanda, and R. P. Liu, “A System for Denial-of-Service Attack
Detection Based on Multivariate Correlation Analysis,” EEE Transactions on Parallel and Dis-
tributed Systems, vol. 25, no. 2, pp. 447–456, 2013.
[42] C. Shi, J. Liu, H. Liu, and Y. Chen, “Smart User Authentication through Actuation of Daily
Activities Leveraging WiFi-enabled IoT,” In Proceedings of the 18th ACM International Sympo-
sium on Mobile Ad Hoc Networking and Computing (Mobihoc ‘17). Association for Computing
Machinery, New York, NY, USA, Article 5, 1–10, 2017.
[43] S. Mahdavifar and A. A. Ghorbani, “Application of Deep Learning to Cybersecurity: A Survey,”
Neurocomputing, vol. 347, pp. 149–176, 2019.
[44] M. M. H. Shuvo, “Edge AI: Leveraging the Full Potential of Deep Learning,” in Recent Innova-
tions in Artifcial Intelligence and Smart Applications. Springer, 2022, pp. 27–46.
[45] R. Zhu, A. Anjum, H. Li, and M. Ma, “Edge Intelligence-Enabled Cyber-Physical Systems,”
Concurrency Computat Pract Exper, 35(13):e7500, 2023.
[46] X. Liu, Z. Xiao, R. Zhu, J. Wang, L. Liu, and M. Ma, “Edge Sensing Data-Imaging Conversion
Scheme of Load Forecasting in Smart Grid,” Sustainable Cities and Society, vol. 62, p. 102363, 2020.
[47] D. C. Mocanu, E. Mocanu, P. H. Nguyen, M. Gibescu, and A. Liotta, “Big IoT Data Mining
for Real-Time Energy Disaggregation in Buildings,” in 2016 IEEE International Conference on
Systems, Man and Cybernetics. IEEE, 2016, pp. 003765–003769.
[48] Z. Shi, W. Yao, L. Zeng, J. Wen, J. Fang, X. Ai, and J. Wen, “Convolutional Neural Network-
Based Power System Transient Stability Assessment and Instability Mode Prediction,” Applied
Energy, vol. 263, p. 114586, 2020.
28 Secure and Smart Cyber-Physical Systems
[49] S. Lakshmiranganatha, “HPC and Machine Learning Techniques for Reducing the Computation
Burden of Determining Time-Evolution of Complex Dynamic Systems,” Order No. 28323789
ed. University of Wyoming; 2021.
[50] M. A. Judge, A. Khan, A. Manzoor, and H. A. Khattak, “Overview of Smart Grid Implementation:
Frameworks, Impact, Performance and Challenges,” Journal of Energy Storage, p. 104056, 2022.
[51] J. G. A. Barbedo, “Plant Disease Identifcation from Individual Lesions and Spots Using Deep
Learning,” Biosystems Engineering, vol. 180, pp. 96–107, 2019.
[52] S. Sladojevic, M. Arsenovic, A. Anderla, D. Culibrk, and D. Stefanovic, “Deep Neural Netwroks
Based Recognition of Plant Diseases by Leaf Image Classifcation,” Computational Intelligence
and Neuroscience, vol. 2016, 2016.
[53] N. Kussul, M. Lavreniuk, S. Skakun, and A. Shelestov, “Deep Learning Classifcations of Land
Cover and Crop Types Using Sensing Data,” IEEE Geoscience and Remote Sensing Letters, vol.
14, no. 5, pp. 778–782, 2017.
[54] M.-A. Ebrahimi, M.-H. Khoshtaghaza, S. Minaei, and B. Jamshidi, “Vision-Based Pest Detection
Based on SVM Classifcation Method,” Computers and Electronics in Agriculture, vol. 137, pp.
52–58, 2017.
[55] I. Sa, Z. Ge, F. Dayoub, B. Upcroft, T. Perez, and C. McCool, “DeepFruits: A Fruit Detection
System Using Deep Neural Networks,” Sensors, vol. 16, no. 8, p. 1222, 2016.
[56] P. Chu, Z. Li, K. Lammers, R. Lu, and X. Liu, “DeepApple: Deep Learning-based Apple Detec-
tion Using a Suppression Mask R-CNN,” arXiv preprint arXiv:2010.09870, 2020.
[57] M. Pathan, N. Patel, H. Yagnik, and M. Shah, “Artifcial Cognition for Applications in Smart Ag-
riculture: A Comprehensive Review,” Artifcial Intelligence in Agriculture, vol. 4, pp. 81–95, 2020.
[58] M. Altalak, M. Ammad Uddin, A. Alajmi, and A. Rizg, “Smart Agriculture Applications Using
Deep Learning Technologies: A Survey,” Applied Sciences, vol. 12, no. 12, p. 5919, 2022.
[59] V. K. Quy, N. V. Hau, D. V. Anh, N. M. Quy, N. T. Ban, S. Lanza, G. Randazzo, and A. Muz-
irafuti, “IoT-Enabled Smart Agriculture: Architecture, Applications, and Challenges,” Applied
Sciences, vol. 12, no. 7, p. 3396, 2022.
[60] J. Wang, H. Ding, F. A. Bidgoli, B. Zhou, C. Iribarren, S. Molloi, and P. Baldi, “Detecting Car-
diovascular Disease from Mammograms with Deep Learning,” IEEE Transactions on Medical
Imaging, vol. 36, no. 5, pp. 1172–1181, 2017.
[61] S. J. Al’Aref, K. Anchouche, G. Singh, P. J. Slomka, K. K. Kolli, A. Kumar, M. Pandey, G. Ma-
liakal, A. R. van Rosendael, A. N. Beecy et al., “Clinical Applications of Machine Learning in
Cardiovascular Disease and Its Relevance to Cardiac Imaging,” European Heart Journal, vol.
40, no. 24, pp. 1975–1986, 2019.
[62] T. Reichherzer, M. Timm, N. Earley, N. Reyes, and V. Kumar, “Using Machine Learning
Techniques to Track Individuals & Their Fitness Activities,” In CATA 2017, pp. 119–124, 2017.
[63] R. Yunus, O. Arif, H. Afzal, M. F. Amjad, H. Abbas, H. N. Bokhari, S. T. Haider, N. Zafar, and
R. Nawaz, “A Framework to Estimate the Nutritional Value of Food in Real Time Using Deep
Learning Techniques,” IEEE Access, vol. 7, pp. 2643–2652, 2018.
[64] A. Ortiz, J. Munilla, J. M. Gorriz, and J. Ramirez, “Ensembles of Deep Learning Architecture for
the Early Diagnosis of the Alzheimer’s Disease,” International Journal of Neural Systems, vol.
26, no. 07, p. 1650025, 2016.
[65] F. Falahati, E. Westman, and A. Simmons, “Multivariate Data Analysis and Machine Learning
in Alzheimer’s Disease with a Focus on Structural Magnetic Resonance Imaging,” Journal of
Alzheimer’s Disease, vol. 41, no. 3, pp. 685–708, 2014.
[66] T. Saba, “Recent Advancement in Cancer Detection using Machine Learning: Systematic Survey
of Decades, Comparisons and Challenges,” Journal of Infection and Public Health, vol. 13, no. 9,
pp. 1274–1289, 2020.
[67] D. C. Nguyen, Q.-V. Pham, P. N. Pathirana, M. Ding, A. Seneviratne, Z. Lin, O. Dobre, and
W.-J. Hwang, “Federated Learning for Smart Healthcare: A Survey,” ACM Computing Surveys
(CSUR), vol. 55, no. 3, pp. 1–37, 2022.
[68] R. Verma, “Smart City Healthcare Cyber Physical System: Characteristics, Technologies and
Challenges,” Wireless Personal Communications, vol. 122, no. 2, pp. 1413–1433, 2022.
[69] S. M. Nagarajan, G. G. Deverajan, P. Chatterjee, W. Alnumay, and U. Ghosh, “Efective Task
Scheduling Algorithm with Deep Learning for Internet of Health Things (IOHT) in Sustainable
Smart Cities,” Sustainable Cities and Society, vol. 71, p. 102945, 2021.
Machine Learning and Deep Learning Approaches 29
Chapter Contents
2.1 Introduction 30
2.2 CPS Description 32
2.3 CPS Architecture 33
2.3.1 Layers of Attack Vector 37
2.4 Security in CPS 38
2.5 Methodology 39
2.5.1 General Approach for Security in CPS 39
2.5.1.1 Security Implementation Challenges 41
2.6 How Artifcial Intelligence Can Help Solve CPS Challenges 42
2.6.1 Results 43
2.7 Discussion 44
2.7.1 DDoS Attack in CPS 44
2.7.1.1 How Does DDoS Attack Afect CPS? 45
2.7.1.2 Understanding How to Prevent CPS from DDoS
Attack Using AI 45
2.7.1.2.1 ABOUT THE DATA SET 45
2.7.1.2.2 IMPORTING REQUIRED PYTHON LIBRARIES 45
2.7.1.3 Methodology 47
2.7.1.4 Data Pre-processing 47
2.7.1.5 Model 47
2.7.1.5.1 MODELS SELECTION 48
2.7.1.6 Training 48
2.7.1.7 Testing 49
2.7.1.8 Evaluation 49
2.7.2 Model Analysis 50
2.7.2.1 Pros and Cons of the Above ML Methods 51
2.8 Conclusion 52
References 52
2.1 Introduction
CPS is the next generation of intelligent systems that combine the inherent and comprehensive
embedding of communication and control technologies to integrate computational resources
with hardware facilities [5]. CPS combines computational and physical processes at the micro-
level by embedding computer and telecommunications kernels in hardware. CPS is a reactive
DOI: 10.1201/9781003376712-2
Securing Cyber-Physical Systems Using AI 31
Defnition 1.10 Cyber-physical systems (CPS) are a new class of computing systems that
combine complex computational and physical functionalities, and they may interact and
communicate with individuals in novel forms.
CPSs are computing networking and physical process integration [31]. Physical processes in
these systems are usually monitored and controlled by sophisticated embedded computing
and networking, which include feedback loops where physical activities afect calculations
and vice versa. The commercial and sociological capability of such platforms is far higher
than has been realized; therefore, heavy resources are primarily being invested globally to
advance this modern technology. The technology draws on the earlier yet quite new feld of
embedded systems which are processors and software installed in devices besides just comput-
ers including automobiles, toys, healthcare products, and laboratory equipment. CPS mixes
physical process dynamics with computer software and networking dynamics, giving frame-
works as well as modelling design and analysis approaches for the connected total system [31].
The capacity to communicate with and augment the possibilities of the surrounding
environment through computing communication and automation is a crucial component
for prospective technological advancements in this feld. The merging of engineering and
physical application domains with computer science engineering devices and cyberspace
worlds is the core idea behind CPS development. Physics simulation and realistic intangible
attributes like uncertainties in nature and volatility of the business are illustrations of fun-
damental natural concepts. At the same time, computer science and engineering fundamen-
tals concentrate on embedded applications, communications computing, and programming
methods. CPS has fve tiers of technological application, and the structure of such a system
is as described in the following:
• Cognition Level: The device is analysed after gathering data from other devices via the
network stack and contrasting it to other occurrences. Certain particular prediction al-
gorithms are used to forecast or determine the time of component failure based on previ-
ously gathered information.
• Confguration Level: Technicians and industrial managers may base decisions on input
from cyberspace to physical space, as well as system monitoring and administration. Si-
multaneously, the device by itself can decrease the damage by system failures, permitting
the rectifcation of mistakes as well as the implementation of precautionary measures.
CPSs are becoming increasingly prevalent in our daily lives, with the integration of physical
processes with computing and communication technologies. CPS has revolutionized several
industries, including healthcare, transportation, and energy management. However, this inte-
gration has also made these systems vulnerable to cyberattacks, which can have severe physi-
cal consequences, such as equipment damage, power outages, and even loss of life. Securing
CPS has, therefore, become a critical concern for industries, governments, and society as a
whole. CPS security involves the protection of these systems from cyber threats, ensuring
that they operate as intended and maintaining their confdentiality, integrity, and availabil-
ity. CPS security is a multidisciplinary feld that requires the collaboration of experts in com-
puter science, engineering, mathematics, and other related felds. However, the integration
of physical processes with computing and communication technologies makes these systems
vulnerable to cyberattacks [13], which can have severe physical consequences. For instance
a cyberattack on an industrial control system can result in equipment damage, power out-
ages, and even injuries or loss of life. Thus, securing CPS has become a critical concern for
industries, governments, and society as a whole. This chapter aims to explore the importance
of securing CPS, the potential risks and consequences of cyberattacks on these systems, and
the various techniques and approaches that can be used to ensure their security. Through this
research, we hope to raise awareness about the need for efective CPS security measures and
encourage further eforts to safeguard these systems [44]. The remainder of this project is
organized as follows: Section 2 talks about the description about CPS followed by Section 3
which discusses the architecture of CPS. Section 4 is focused on the security IN CPS, and Sec-
tion 5 explores the security methodologies in CPS, and next Section 6 about the relevance of
AI for the security challenges of CPS. Section 7 talks about the diferent cyberattack methods
in CPSs followed by conclusion in Section 8 and references at last.
control action, CPS increases the IoT’s processing and networking capabilities. Due to the
capacity to employ feedback control to tell a selection to act based on physical measure-
ments collected from the detectors, CPSs have a higher level of automation than IoT sys-
tems. They have the great capacity to examine practically every aspect of mortal endeavour
and conquer difculties. This has led to a great deal of interest in CPS from the academic
community, the government, and individuals with astuteness.
One of the defences against IoT and CPS when employed in crucial structures like ag-
riculture, health service, transportation, home automation, and power systems is the vast
volume of data that is created. This is due to the fact that the majority of gadgets are con-
tinually connected and switched on. As a result, the creation of Big data analytics (BDA),
IoT and CPSs, becomes important because they make data-based information available
for decisions on fault prediction diagnosis and preventative maintenance. Data analytics
is becoming less and less common as a technique to extract value from the generated data
by revealing regression patterns correlations and other relationships as they add new func-
tionality to the systems under stress as well as providing perception from vast volumes of
data. Despite all the hoopla surrounding CPS, its actual implementation to tackle practical
challenges is hampered by highly strict safety and security requirements such as the need to
function in real time and sensitivity to network difculties like latency.
Additionally, the impact a failure brings to human life and structure is more serious than
it is for typical information technology systems. Cybersecurity is now a hot topic in com-
puter science and information technology. Malware, adware, spyware, and ransomware
were used at frst to provide security, followed by frewall’s intrusion detection systems and
antivirus software (IDS). The growing interconnectedness is problematic since it expands
the attack surface and exposes these systems to adversarial conditioning. An important fac-
tor in the increase of cyberattacks is the failure of CPS’s detectors selectors and regulators.
Machine learning (ML) and artifcial intelligence (AI) algorithms have lately been employed
to improve the efectiveness of various systems.
Therefore, a prevalent type of cyberattack in CPS and other systems is the development of
techniques to tamper with the data or the input. As a result, the model is forced to generate
the erroneous labour. Particularly vulnerable to this are deep neural networks (DNNs) which
have grown to be widely employed to protect CPSs. The possibility of utilizing system pro-
tection techniques against it has also grown into a topic of concern. Adversaries may attack
systems using AI and ML algorithms that are designed to secure those systems to initiate ag-
gressive ofences. It has recently been proven that comparable assaults have a higher implicit
value. They utilize the perspiration of the defence systems to develop stronger harder-to-detect
and harder-to-check weapons, making them more advanced rapid and relatively afordable.
time-spatial and security afrmation. The network in CPS requires more strategic ampli-
fcations in handling time and security.
Heterogeneous: In CPS, many end devices have diferent processing potential security
measurements and communication procedures. Embedded end devices in CPS have the
potential to loop to process the information because they have fnite memory and com-
puting power. The processing potential of the device is distinct and brings a cluster of
challenges to system confguration.
Adaptability: The CPS end device’s application scheme is capable of change. The commut-
ing of surrounding domain coordinates leads to diferences in sensing data. An appropri-
ate and convenient design of CPS can acclimate to the environment.
Edward A. Lee argues that the networking requirements of CPSs which combine networking
and computation with physical dynamics make the case that CPS requires networks where
time is a semantic attribute rather than just being a quality criterion [30]. The design of the
CPS treats time as a semantic coordinate and not just a quality factor. If we talk about the
design of CPS, time is a semantic property not a factor for quality assurance. Don Kang et
al. presented an approach to subsidizing these requirements. In his proposed approach, he
discussed network-enabled real-time embedded databases (nRTEDBs) that can interact and
can be controlled with wireless sensors. This varies signifcantly from a traditional database as
it deals with both prediction and raw data. Three signifcant issues with system security that
must be taken into account are confdentiality, integrity, and availability.
We split CPS into two groups: Systems that are essential to security and systems that are
not. Then for the frst, there is a strong emphasis on physical security as well as other needs
like confdentiality integrity and availability. However, the latter emphasizes integrity and
availability while somewhat weakening security. In various settings there are various needs.
For instance although the demand for real-time performance is prioritized in smart home
systems, the secrecy aspect is crucial for military applications. The three components of CPS
security are: Perception security (ensuring the security and accuracy of data collected from
physical environments), transport security (preventing data from being lost during trans-
mission processes), and processing centre security (including physical security and safety
procedures on servers or workstations).
A typical CPS process was divided into four parts by Eric Ke Wang et al. [58].
(1) Monitoring: A key duty of CPS is to keep an eye on the environment and physical
processes. It is also used to provide feedback on any previous CPS activities in order to
maintain proper operations in the future.
(2) Deal with data aggregation and distribution through networking.Numerous sensors
may provide a large amount of data that must be combined or distributed for further
processing by analysers.
(3) Computing, this stage is used to reason about and examine the data gathered during
monitoring to see if the physical process complies with predetermined standards; ex-
ecute the steps decided upon during the computing stage.
(4) A context-aware security architecture for CPS was suggested in light of this.
security architecture covers mitigating current attacks as well as predicting potential attacks
and making necessary modifcations. As part of the system’s demand for self-adaptation, the
security framework in a changing environment should maintain the system’s safety.
Using a standards-based software component technology, SOA (service-oriented archi-
tecture) is a dynamically integrating paradigm used to combine loosely connected services
into a single workfow. We recommended the generic CPS architecture, which is based on
the SOA design as shown in Figure 2.2.
This architecture consists of fve tiers [19]:
The data source for the tiers mentioned above also known as the sensor tier is the perceive
tier. Environment awareness which is mostly accomplished by sensors and preliminary data
pre-processing which transfers the data to the data-processing layer are the duties of this tier.
One of the fundamental methods used in this sensor tier is the WSN (Wireless Sensor Network).
The computational and storage components that make up the data tier perform heterogeneous
data processing, including normalization noise reduction data storage and other related tasks.
Between the Producer and the Service lies this layer. The service layer ofers the standard system
operations such as decision-making task scheduling task analysis and consumer-facing APIs.
Several services are installed in this tier that communicate with one another.
The two layers that interact with the environment are the execution and perceived tiers;
the actuator might be a real object like an automobile or a bulb. It takes directives from the
system and puts them into action. Against access security to data security to device security,
the security assurance component is present across the whole system. Require a number
of measures to ensure system security from unauthorized access or malicious assaults. The
real-time distribution reliability scalability and other properties of CPS create a number of
design and implementation issues. The integration fexibility of services or components is
one of this suggested CPS architecture’s primary benefts. Because diverse needs call for dif-
ferent realizations of these layers, the architecture simplifes the intricacies of each tier [1].
Predictive analytics and CPSs are at the heart of industrial Big data [33, 34]. The physical
entities in cyberspace are connected and synthesized by CPSs [35, 38]. A digital twin model
is created in the CPS environment using information gathered from the IoT infrastructure to
represent a physical entity such as a machine or component in cyberspace [36]. Figure 2.3
illustrates a “5C” architecture that serves as a blueprint for the creation of CPS in industrial
applications [37]. We will extrapolate the “5C” levels in detail as follows.
(1) Connections: Finding a trustworthy, efective, and secure method of data acquisition
is the crucial next step. Typically, sending data from the edge to the central server
requires the use of a local agent and communication protocol. The current industrial
communication protocols available change based on the manufacturers of the machines
the suppliers of the controllers and the data-gathering systems. In order to synchronize
and ofer an efcient data-collection solution for various equipment [21] including MT-
Connect and SmartBox from Mazak and Cisco, a common tether-free communication
protocol is encouraged [38].
(2) Conversion Level: Data is collected from a variety of sources in the industrial setting,
including controllers, sensors, production systems (ERP MES etc.), and maintenance re-
cords. Each data point or signal might represent a distinct feature of the under surveillance
machine systems. Users can only make the best choice at the correct moment to increase
productivity when the data is transformed into “useful” information such as health indi-
ces and fault diagnosis fndings. For instance all data to information approaches for ro-
tary equipment, employing data-driven methods were included in the review study [34].
(3) Cyber Level: The machine health information may be created through the data-to-
information conversion level to describe the state of the system. Diferent info-graphs
at the cyber level make the health status of assets evident. Each physical asset may be
benchmarked against peers in various time periods once it has a digital twin at the cyber
level, a concept known as feet dimension. The data from each asset is used to generate
cyber avatars that represent each machine or system in more detail, giving consumers a
better understanding of system variance and life forecast [29, 24, 60]. Thus, feet mod-
elling in the cyberspace can beneft from a vast scale of comparable assets and improve
the robustness and dependability of the algorithms for asset health monitoring. Cyber
level algorithms on the other hand will be more adaptable to support dynamic operat-
ing regime changes and increase robustness, for example the algorithm can learn new
failure modes adaptively and enrich itself to be more robust and dependable. [61].
(4) Cognition Level: The machine can assess its probable failure and be aware of its poten-
tial degeneration, can assess its probable failure and be aware of its potential degen-
eration in advance by utilizing the online monitoring system. The system may use the
prediction algorithms to forecast possible failure and determine the remaining usable
life after learning from the past health assessment. Users may improve manufacturing,
operations, maintenance, scheduling, and logistics planning at this level with the use of
the predictive information to assist improved decision-making [6,40,47,17].
(5) Confguration: The machine’s health status may be monitored and visualized online
at the frst four levels, and the operation level can then get the health information. As
a result of the machine’s gradual deterioration, timely maintenance will signifcantly
minimize downtime and boost production. In order to limit the loss from machine
malfunction and eventually create a resilient system, operators and factory managers
38 Secure and Smart Cyber-Physical Systems
may make the best decision based on maintenance information while also allowing
the machine itself to lower its workload and modify the manufacturing schedule.
The “5C” architecture provides a methodical way to turn data into knowledge, explain-
production process risks, and make better “informed” decisions. Managers will have the
necessary data to calculate the facility-wide OEE with manufacturing transparency; with
predictive capabilities, all assets may be handled efciently with just-in-time maintenance.
In order to create a closed loop life cycle redesign lifespan deterioration information may
also be sent back to the equipment designer. As a result, an Industry 4.0 plant will move
away from traditional TPS management and towards self-aware, self-predictive, and self-
confguring processes.
(1) Secure Constrained Device: Constrained systems are incapable of completing compli-
cated encryption and decryption swiftly in real time. These devices are in responsibility
of attacks such as power analysis. The data is usually transmitted without encryption
or decryption. This can be mitigated by implementing lightweight cryptography and
numerous layers of systems such as isolating devices on a septate network.
(2) Secure Communication: The security problem with low-power devices is to guarantee
network connection. Low-power systems on the other hand do not encrypt data before
SVM RNN
Logistic Regression GAN
GTB CNN
J48 Decision Trees MLP
Random Forests LSTM
Securing Cyber-Physical Systems Using AI 39
transferring them over the network. To keep data confdential, employ a separate net-
work and segregate the device which aids in encrypted personal communications.
(3) Data Integration and Privacy: It is critical that information is primarily safely kept and
handled once it has transmitted across the network. It is critical to establish data pro-
tection in low-power systems, which involves forming sensitive material before it has
been recorded. Data management within a lawful and consistent framework is likewise
a signifcant difculty.
2.5 Methodology
The ISO/IEC 270012013 standard states that troubles might be purposeful, unintentional, or
environmental. The following are some exemplifcations of common pitfalls: Physical detri-
ment, natural disasters, the interruption of vital services, radiation, malfunctions, concession
of information (similar to wiretapping software tampering, etc.), specialized lapses, unauthor-
ized conduct (similar to data corruption), and concession of functions for illustration, forging.
and abuse of rights). Using the fndings of the study of recent security exploration (Figure 2.4),
a chart of pitfalls and attacks grounded on the functional model of CPS is suggested. The
chart branches come in the following: Kinds of attacks on detectors (seeing); assaults on se-
lectors (actuating); and attacks against selectors (actuation), computer factors (computing),
dispatches (communication), and feedback (E) are all exemplifcations of cyberattacks [18].
(1) Threats and failings that vitiate CPS detectors have been uncovered by experimenters
(similar to edging in fake radar signals bedazzling cameras with light GPS spoofng,
etc.). The trustability and delicacy of the data collecting process must be guaranteed
because CPSs are explosively tied to the physical process in which they’re integrated. To
ensure that any data obtained from a physical process can be trusted, detector security
requires methods to enhance physical authentication [18, 2].
(2) The Finite Energy Attack which includes for illustration the loss and modifcation of
particular packets the Finite Time Attack and Impulse attacks as well as the Bounded
Attack which results in the suppression of the control signal were two classes that
covered a wide range of implicit attacks in Djouadi et al. [12] analysis of the goods
of cyberattacks on selectors. The actuation control security refers to the fact that no
action may be taken during a unresistant-active or active mode of operation without
the necessary authorization. Since the CPS specifcations vary over time, the warrants’
specifcation must be dynamic.
40 Secure and Smart Cyber-Physical Systems
(3) The specifcs of attacks on computer resources are covered in the document and com-
prise DoS attacks, worms, viruses, and Trojan horses. In details on techniques for data
mining (DM) that can be applied to boost cybersecurity [54, 46]. The CPS might sustain
harm from a sneaky strike, underscoring the importance of robust security measures
and vigilance in safeguarding critical systems. The detecting methods must make sure
that the violations and measurement mistakes that are common in control systems won’t
result in a false alert. The attacker now has a place to hide. An integrity attack occurs
when a hacker alters actual data by obtaining a communication key for secure com-
munication or by capturing some network devices. The creation of solutions to protect
stored data in CPS platforms from physical or digital intrusions falls under the category
of storage security. From the attacker’s perspective, developing a false attack strategy
typically takes into account a variety of variable resources and security restrictions.
(4) Selective forwarding, packet spoofng, packet replaying, sybil attacks, and other com-
munication attacks that subvert system package routing can be employed to impede re-
source distribution between nodes in favor of malware. Any revision to the data might
Securing Cyber-Physical Systems Using AI 41
CPS includes embedded controllers in digital systems (cyberspace) and physical settings.
This integrated system is nevertheless vulnerable to several threats. Choo et al. research a
variety of security issues including both internal and external assaults. Potential issues can
arise with various systems. These include CPS integrated with IoT for healthcare-embedded
systems and green cryptography in smart building security. Privacy concerns in CPS trust
and security, emerging security schemes for embedded security, and handling sensitive data
in CPS are also among these potential issues. In addition, unresolved issues are brought on
by the diversity of technologies used in IoT-integrated CPS. The study by Wang et al. looked
at time synchronization attacks in CPS [9, 59]. Diferent attacks are found in CPS environ-
ments according to research by Ding et al. They are referred to as deception replay and DoS
attacks. Diferent attacks connected to CPS were identifed by Mahmoud et al. Jamming
attacks, deception attacks, DoS attacks, and replay attacks are among them [11, 45].
According to Sarker et al., data wisdom is playing a critical part in accelerating the re-
cent technological transition in cybersecurity. Data wisdom was developed to identify attacks
through data analysis as the quantum of data relating to cybersecurity events increased. The
quantum of training data is growing along with the number of circumstances, which helps to
automate the monitoring of cyberspace irruptions with the necessary intelligence. Machine
learning is essential in achieving this thing, since it excerpts useful information from numer-
ous cybersecurity data sources. It is known that the number of IoT use cases has sometimes
increased,; according to exploration by Sarker et al. [51], IoT use cases that include thousands
of linked resource-constrained devices present security enterprises in dispersed surroundings.
In such a case, an automated and intelligent system of covering cyberspace is needed to be
suitable to take prompt action when circumstances call for it. They also delved several data
sets employed for cybersecurity study. Among the data sets are KDD’99 Cup [22], NSL-KDD
[56], CAIDA [22], ISOT’10 [22], ISCX’12 [22], CTU-13 [14], UNSW-NB15, CIC-IDS2018
and CIC-IDS2017 [22], MAWI [25] CERT [42], DGA [15], Malware [63], and Bot-IoT [28].
While each of these distinctions are signifcant, we think that the way in which control
systems interact with the physical environment sets them apart from other IT systems. Gen-
erally speaking, information security has produced established technologies and design ten-
ets (authentication, access, control, message, integrity, separation of privilege, etc.) that can
aid in the prevention and response to assaults on control systems. However, information
protection has always been the main emphasis of computer security research. The impact
of assaults on estimate and control algorithms and eventually on the physical world has
not been taken into account by researchers. While the present information security tools
42 Secure and Smart Cyber-Physical Systems
can provide required mechanisms for the security of control systems, we contend that these
mechanisms alone are insufcient for the security of control systems defence.
We think that by comprehending how the control system interacts with the physical
world, we should be able
(1) To better comprehend the efects of an assault: It is important to note that there is cur-
rently no study on how an adversary would choose a strategy after gaining unauthor-
ized access to some control network devices.
(2) To create original attack-detection algorithms: By fguring out how the physical process
ought to react in response to our control instructions and sensor readings, we can tell
whether a hacker is interfering with the control or sensor data.
(3) To create new algorithms and architectural designs that are resistant to attacks: If an
attack is detected, we may be able to modify the control commands to improve the
system’s resilience.
Sargolzaei et al. investigated the use of machine learning for defect discovery using a case
study of a vehicular CPS. The False Data Injection (FDI) attack that leads to mishaps in ve-
hicular networks was the main emphasis. In order to help the driver or controller determine
the safe distance between his or her auto and the vehicle in front of it, they suggested a system
that recognizes FDI attacks and takes remedial action in order to induce the right signal. For
defect identifcation, it uses a neural network-grounded system. Goh et al. employed LSTM-
RNN to model the system and an unsupervised literacy system of deep literacy to identify the
anomalous gesture. A CPS can be told by one of two diferent time synchronization attacks
that use GPS. Time Synchronization (TS) assault and Stealth Time Synchronization (STS) at-
tack are the names of these types of attacks. ML approaches were delved into by Wang et al.
to stop similar assaults. They proposed a discovery approach grounded on Artifcial Neural
Networks (ANNs) that took advantage of performance in identifying the threats [50, 16, 59].
2.6.1 Results
sensors and networks to identify the patient’s physical state in real time, particularly
for essential patients like those with heart disease. The patient’s portable terminal de-
vices can constantly monitor the patient’s status and deliver timely alerts or forecasts.
Additionally, patients would fnd it much more convenient if medical equipment and
real-time data distribution worked together. The highly reputable medical CPSs’ devel-
opment and problems were discussed by Insup Lee and Oleg Sokolsky [32] who also
discussed the system’s reliance on software for the creation of new functions, the need
for network connections, and the need for ongoing patient monitoring to examine how
medical CPS may develop in the future. Cheolgi Kim et al. established a general frame-
work called the NASS (Network-Aware Supervisory Systems) to integrate medical de-
vices into a clinical interoperability system that makes use of actual networks to address
medical device interoperability concerns [8]. It ofers a development environment where
the supervisory logic for medical devices may be created using the presumption that op-
erates a perfect, reliable network. The case study demonstrates how well the NASS ar-
chitecture protects against actual network outages and is procedurally successful. More
aspects including a higher need for security, real-time processing, and network latency
will be taken into account while designing the medical CPS due to the uniqueness of
medical applications [28].
2.7 Discussion
2.7.1 DDoS Attack in CPS
Hackers or cyber criminals use DDoS (Distributed Denial of Service) attacks, a sort of mali-
cious cyberattack, to prevent intended users from accessing a host system network resource
or online service. DDoS attacks food the target system with thousands or millions of er-
roneous or undesired requests, overwhelming it and its supporting resources.
The goal of a DDoS attack is always to food the system, although how this is accom-
plished can change. Three main types of DDoS attacks are listed below.
• Application layer attacks: Application layer DDoS attacks are designed to directly target
the programme, focusing on specifc bugs or issues and stop the application from provid-
ing content to the user. New attack tactics and vectors are developed by attackers for
use in a new generation of attacks. When the defence gets good at blocking these new
attacks, the attacker develops a new type of attack and continues this cycle.
• Protocol attacks: To deplete server resources, attackers target intermediate communica-
tion devices like load balancers, routing engines, servers, and frewalls. It can overpower
mitigations such as frewalls at the edge, resulting in service interruption and DDoS.
• Volumetric attacks: Volumetric DDoS assaults are made to food internal networks with
a large amount of malicious trafc, including centralized DDoS mitigation scrubbing
capabilities. These DDoS assaults try to use up all available bandwidth, either inside the
target network or service or between it and the rest of the Internet. Numerous subtypes
belong to one of the general categories mentioned above, yet have their distinctive traits.
Here is a detailed list of modern DDoS attack techniques.
• Other attacks include SYN Flood, TCP Flood, SYN-ACK Flood, Fragmented ACK
Flood, Session Flood, UDP Flood, UDP-LAG Flood, PORTMAP Flood, DNS Flood,
NTP Flood, CHARGEN Flood, SSDP Flood, SNMP Flood, HTTP Flood, etc. We’ll ex-
amine how these modern DDoS attacks afect r-physical systems in the next section.
Securing Cyber-Physical Systems Using AI 45
CPSs are those that can act autonomously and make judgements on their own. Some exam-
ples of CPS are Smart Power Grid, Railway Systems Motion Sensors, etc. Let us see how a
DDoS attack afects a CPS by looking into an example:
According to the Department of Energy’s Electric Emergency and Disturbance Report for
March 2019 a DDoS attack had disrupted electrical grid operations in two sizable U.S.
population centres: Salt Lake County in Utah and Los Angeles County in California. The
Department of Energy acknowledged that the attack only resulted in “interruptions” in
“electrical system operations” not any disruptions in electrical distribution or outages. In
this context, “operations” refers to any computer systems used within the utility includ-
ing those that run ofce applications or operational software and does not necessarily
refer to the transmission of electricity to consumers.
This incident occurred in the year 2019 when there was a power outage in the cities men-
tioned above. The attackers tried to stop the power by fooding the system operations. This
is a perfect example to tell that how a DDoS attack afects a CPS [10].
In this section, we are going to work on building a few ML models using Python for the
CICDDoS2019 data set [48].
CICDDoS2019 [48] is an evaluation data set that contains BENIGN and the most up-to-
date Modern DDoS attacks. It is organized in a day-to-day format and includes the raw data
of network trafc and event logs per machine, which are exported to CSV fles for network
analysis. This data set has more than 80 trafc features, some of which are listed Table 2.2.
In this section, we are going to work on building a few ML models using Python.
Python libraries are blocks of code that contain built-in functions. These libraries provide
access to the necessary packages or modules that can be installed to complete specifc tasks.
A quick explanation of the libraries used in the framework is provided in this section.
(1) Pandas: By providing data operations and data structures, the Pandas’ library signif-
cantly aids in the study and manipulation of data, particularly time series and numerical
tables. On top of NumPy, the Pandas’ package was developed. It supports the efec-
tive implementation of a data frame. Series and data frames are the foundational data
structures on which Pandas is built. Data frames are a two-dimensional structure in the
form of a table with several columns, whereas series are a one-dimensional structure in
the form of a list of items. Row and column labels for homogeneous and heterogeneous
data types with or without missing data make up data frames. Pandas allow for the
transformation of data structures into data frame objects, handling of missing data, and
histogram or box plots.
46 Secure and Smart Cyber-Physical Systems
(2) Scikit-learn: The collection of various classifcation, grouping, and regression algo-
rithms in the Scikit-learn package helps learning and decision-making. It is a Python
module built on top of the machine learning library SciPy. A widely used software for
Python-based data science applications is called Scikit-learn. It allows the handling
of data mining and machine learning tasks like classifcation, clustering, regression,
dimensionality reduction, and model selection and ofers a clear interface to a range
of machine learning methods. Scikit-learn substantially aids data scientists in carry-
ing out machine learning projects by incorporating efcient versions of several widely
used algorithms.
(3) Matplotlib: The general-purpose Graphical User Interface (GUI) toolkits are the foun-
dation of the object-oriented Application Programming Interface (API) which plays a
crucial role in embedding the plots into programmes. Data can be represented as two-
dimensional graphs and diagrams using Matplotlib, including scatter plots, histograms,
and graphs using non-Cartesian coordinates. It substantially facilitates data science
project visualization and works with a variety of operating systems and graphics back-
ends. In the feld of scientifc Python, Matplotlib is also known as the cross-platform
everything-to-everyone approach, with the beneft of supporting many output types
and backends.
Securing Cyber-Physical Systems Using AI 47
2.7.1.3 Methodology
Flood attacks include delivering massive volumes of empty or useless packets to the victim
system to block communication between the two machines and clog up the entire net-
work. The challenge with a DDoS attack is modelling or estimating the trafc on the target
network.
The suggested approach seeks to produce two forms of network trafc:
The data should be preprocessed to achieve faster training and testing speeds, higher ac-
curacy, etc., which typically involves steps such as encoding, normalization, and feature
reduction using PCA.
Tag encoding is the process of metamorphosing tags into a numeric form so that they may
be interpreted by machines. The operation of those tags can also be better determined by
machine learning algorithms. It is a signifcant-supervised learning pre-processing step for
the structured data set. The class “tag” is decoded for this case.
When the colourful characteristics (variables) are on a lower scale, machine learning al-
gorithms generally perform more or meet more snappily, thus normalizing the data before
training the machine learning models as its standard practice.
Also, normalization reduces the acuteness of the training process to the magnitude of the
characteristics. As a result, following training, the coefcients improve. Point scaling is the
process of rescaling features to make them more training-friendly.
Principal component analysis or PCA [3] is a fashion for reducing the number of confnes
in large data sets by condensing a large collection of variables into a lower set that retains
the majority of the large set’s information. Accuracy naturally sufers as a data set’s vari-
ables are reduced, but the answer to dimensional reduction is to trade a little accuracy for
simplicity. Machine learning algorithms can analyse data much more fast and easy with
lower data sets because there are smaller gratuitous factors to reuse.
Figure 2.5 shows the correlation plot with all the features present in the data set. These
features are sorted and named to prepare the predicted models.
2.7.1.5 Model
The two aspects of supervised classifcation are the development of the learning ap-
proach and the creation of predicted labels. These activities are performed using Scikit-
learn [7].
48 Secure and Smart Cyber-Physical Systems
In this work, four distinct classifcation techniques—Naive Bayes, Decision Tree, Random
Forest, and Logistic Regression are tested and trained.
(1) Naive Bayes—This classifer is built on Bayes’ Theorems on the presumption of event
independence. Statistics refers to two events as independent if the chance of one hap-
pening does not afect an efect on the other. For example consider 𝑃 (𝐵 | 𝐴) to be the
measure of the likelihood of any given occurrence. Let 𝑃 (𝐵) represent the probability
of 𝐵 and 𝑃 (𝐴) represent the probability of 𝐴; 𝑃 (𝐴 | 𝐵) represents the likelihood of
𝐴 given 𝐵.
P(B | A)P(A)
P(A | B) (1)
P(B)
(2) Decision Tree—Decision tree classifes data depending on the values of the pertinent
attributes, starting at the root node. Every node represents a specifc feature and all of
its potential values. As it moves down from the root of the tree, the iterative method
evaluates the information learned for each characteristic in the training set. Informa-
tion gain is used to evaluate the level of selectivity imposed by the characteristics of the
target classes. With more information gained, the attribute’s value in categorizing each
observation rises. The root node is replaced by the characteristic that provides the most
information gain, and the programme continues to separate the data set by a selected
feature either to construct or create a node.
(3) Random Forest—Random Forest and other guided machine learning algorithms are
constantly used in retrogression and bracket problems. It builds decision trees from dif-
ferent samples using their normal for categorization and inviting votes for retrogression.
One of the most important features of the Random Forest Algorithm is its capacity to
handle data sets containing both statistical parameters as in vaticination and categorical
data as in bracket. It produces better results with regard to bracket problems.
(4) Logistic Regression—Analysis of scenarios where the dependent variable is binary
makes use of predictive analytic techniques like logistic regression most successful. Lo-
gistic regression is used to describe the data and also shows why a binary dependent
variable and various non-binary independent variables are correlated.
2.7.1.6 Training
During the training phase, training data is sent to the selected algorithms, so they can uti-
lize it to create machine learning models. As a result, the training set is used. At this point
in the process, the target attribute (class “Label”) must exist in the incoming data source.
Pattern recognition is used during the training phase to link the input characteristics with
the target property. Based on the patterns found, a model is developed. The DDoS at-
tack on the application layer dataset is used as the input data source for the training of
four algorithms in this study. The sort of network trafc such as an attack or about is the
target attribute. These are directly imported from the Scikit-learn library as depicted in
Table 2.3.
2.7.1.7 Testing
The models are evaluated using fctitious data after the conclusion of the modelling phase.
The unobserved data utilized at this time is the test set that was produced by the data split
(20%). Testing is carried out to assess a model’s capacity to represent data and its future
functionality. To ensure that the result of the test would only be used once, this study
wanted to make sure that any model alterations were made before testing. Performance
metrics used to evaluate the efectiveness of the DDoS datasets include accuracy precision
recall and F-measure. These are covered in the paragraph that follows.
2.7.1.8 Evaluation
(1) Confusion Matrix— A confusion matrix contains data on the current classifcation and
projected classifcation performed by a classifcation system or model. The matrix’s data
is regularly analysed to assess the efectiveness of these systems. Generally, every instance
that relates to but isn’t assigned to can have an entry in an x matrix. Ideally, all of-diago-
nals should be 0 to avoid categorization errors. It is feasible to pinpoint the precise faults
caused using the class confusion matrix. Table 2.4 shows the prediction table. Where:
• TP denotes the True Positive
• TN denotes the True Negative
• FP denotes the False Positive
• FN denotes the False Negative
Prediction
(2) Accuracy—The machine learning model’s accuracy is a metric used to determine which
model is best at identifying patterns and correlations between variables in a dataset using
the input or training data. Depending on how well a model can generalize to “unseen” data,
the better estimates and insights it can produce will in turn bring more commercial value.
TP TN
AC (2)
TP FN FP TP
50 Secure and Smart Cyber-Physical Systems
TP
F measure
2
TP FP (5)
These evaluation measures are loaded directly from Scikit-learn Metrics Library as shown
in Table 2.5.
The examination used the following metrics: Recall accuracy precision and F-measure as
shown in Table 2.6. The experiment’s fndings indicate that 99% and 99% respectively of
the DT and RF algorithms provide the highest levels of accuracy. The precision recall and
F-measure results were all 99% for both DT and RF.
2.8 Conclusion
The mutual penetration and integration of information space and physical space have directly
aided in the development of CPS-related theories and applications as science and technology
have advanced, and social production has improved. The CPS philosophy of “cooperative
design and efficient operation” separates it from the Internet of Things even though it shares
many characteristics with networked control systems, the latter being highly integrated and
intricately coordinated control systems. As a result of its distinctive technical benefits, CPS has
been extensively employed in important economic and social sectors, including smart manu-
facturing, smart transportation, telemedicine, power grids, and robotic systems. However,
several issues have also been found as CPS application technology developed. The addition
of the network layer forces CPS to address the physical layer’s random instability elements
in addition to the threat of hostile network layer assaults, which puts the system’s security in
grave jeopardy.
This chapter mainly investigates the security control and cross-layer architecture of CPS
under DoS attacks and looks at the impact of network assaults on the system from the
standpoints of control and communication. Active compensating methods with dynamic
output feedback control or passive control methods with state feedback are suggested for
continuous random DoS assaults. Additionally, a sliding mode control approach is recom-
mended, and the network layer is designed using game theory to account for attackers with
clever functions. Through the use of a cross-layer architecture, CPS’s security and stability
are effectively guaranteed against DoS assaults.
As the part of Discussion, we explicitly see that the model’s performance in relation to
the testing data is relatively high after applying machine learning techniques to the CICD-
DOS2019 dataset. This suggests that the model can be employed to foretell DDOS attacks.
As we can see, among the models Random Forest, Decision Tree, Naive Bayes, and Logistic
Regression, accuracy is the highest for Decision Tree. Since the patterns of DDOS attacks
can change over time, better pre-processing and techniques should be used to make better
predictions that would actually aid in controlling them like ensemble learning and deep
learning approaches, which would produce beneficial outcomes. Additional updating and
maintaining of the trained AI models are also required.
References
[1] Ahmad, I., Khan, M., Qadir, J., and Salahuddin, M. A. A comparative study of deep learning
architectures for detection of ddos attacks. arXiv preprint arXiv:1811.12808 (2018).
[2] Alguliyev, R., Imamverdiyev, Y., and Sukhostat, L. Cyber-physical systems and their security is-
sues. Computers in Industry 100 (2018), 212–223.
[3] Ali, M., Ahmed, E., ImRan, M., Yasin, M., and Iqbal, W. A DDoS attack detection using PCA
dimensionality reduction and support vector machine. In 2017 13th International Conference on
Emerging Technologies (ICET). IEEE, 2017, pp. 1–6.
[4] Amin, S., Cárdenas, A. A., and Sastry, S. S. Safe and secure networked control systems under
denial-of-service attacks. In International Workshop on Hybrid Systems: Computation and Con-
trol (2009). Springer, pp. 31–45.
Securing Cyber-Physical Systems Using AI 53
[5] Baheti, R., and Gill, H. Cyber-physical systems. The Impact of Control Technology 12, 1 (2011),
161–166.
[6] Celen, M., and Djurdjanovic, D. Operation-dependent maintenance scheduling in fexible manu-
facturing systems. CIRP Journal of Manufacturing Science and Technology 5, 4 (2012), 296–308.
[7] Chatterjee, K., Nandi, S., Chakraborty, T., Maiti, S., and Dasgupta, R. Feature selection ap-
proach to detect ddos attack using machine learning algorithms. Journal of Information Security
10, 4 (2019), 271–285.
[8] Cheolgi Kim, Mu Sun, Sibin Mohan, Heechul Yun, Lui Sha, and Tarek F. Abdelzaher. 2010. A
framework for the safe interoperability of medical devices in the presence of network failures.
In Proceedings of the 1st ACM/IEEE International Conference on Cyber-Physical Systems
(ICCPS ‘10). Association for Computing Machinery, New York, NY, USA, 149–158. https://doi.
org/10.1145/1795194.1795215
[9] Choo, K.-K. R., Kermani, M. M., Azarderakhsh, R., and Govindarasu, M. Emerging embedded
and cyber physical system security challenges and innovations. IEEE Transactions on Depend-
able and Secure Computing 14, 3 (2017), 235–236.
[10] CNBC. DDoS Attack Caused Interruptions in Power System Operations, 2019. https://www.
cnbc.com/2019/05/02/ddos-attack-caused-interruptions-in-power-system-operations-doe.html.
[11] Ding, D., Han, Q.-L., Xiang, Y., Ge, X., and Zhang, X.-M. A survey on security control
and attack detection for industrial cyber-physical systems. Neurocomputing 275 (2018),
1674–1683.
[12] Djouadi, S. M., Melin, A. M., Ferragut, E. M., Laska, J. A., Dong, J., and Drira, A. Finite energy
and bounded actuator attacks on cyber-physical systems. In 2015 European Control Conference
(ECC) (2015). IEEE, pp. 3659–3664.
[13] Farivar, F., Haghighi, M. S., Jolfaei, A., and Alazab, M. Artifcial intelligence for detection,
estimation, and compensation of malicious attacks in nonlinear cyber-physical systems and in-
dustrial IoT. IEEE Transactions on Industrial Informatics 16, 4 (2019), 2716–2725.
[14] Garcia, S., and Uhlir, V. The CTU-13 dataset. A labeled dataset with botnet, normal and back-
ground trafc. (2011). https://www.impactcybertrust.org/dataset_view?idDataset=945
[15] Glasser, J., and Lindauer, B. Bridging the gap: A pragmatic approach to generating insider threat
data. In 2013 IEEE Security and Privacy Workshops (2013). IEEE, pp. 98–104.
[16] Goh, J., Adepu, S., Tan, M., and Lee, Z. S. Anomaly detection in cyber physical systems using
recurrent neural networks. In 2017 IEEE 18th International Symposium on High Assurance
Systems Engineering (HASE) (2017). IEEE, pp. 140–145.
[17] Gupta, I., and Singh, A. K. Detection of DDoS attack using ensemble machine learning tech-
niques. In 2018 Second International Conference on Computing Methodologies and Communi-
cation (ICCMC). IEEE, 2018, pp. 196–199.
[18] Hahn, A., Thomas, R. K., Lozano, I., and Cardenas, A. A multi-layered and kill-chain based
security analysis framework for cyber-physical systems. International Journal of Critical Infra-
structure Protection 11 (2015), 39–50.
[19] Hu, L., Xie, N., Kuang, Z., and Zhao, K. Review of cyber-physical system architecture. In 2012
IEEE 15th International Symposium on Object/Component/Service-Oriented Real-Time Dis-
tributed Computing Workshops (2012). IEEE, pp. 25–30.
[20] Hull, B., Bychkovsky, V., Zhang, Y., Chen, K., Goraczko, M., Miu, A., Shih, E., Balakrishnan,
H., and Madden. 2006. S. Cartel: A distributed mobile sensor computing system. In Pro-
ceedings of the 4th International Conference on Embedded Networked Sensor Systems (Sen-
Sys ‘06). Association for Computing Machinery, New York, NY, USA, 125–138. https://doi.
org/10.1145/1182807.1182821
[21] Hung, M.-H., Cheng, F.-T., and Yeh, S.-C. Development of a web-services-based e-diagnostics
framework for semiconductor manufacturing industry. In 2003 IEEE International Conference
on Robotics and Automation (Cat. No.03CH37422). IEEE, 2003, pp. 122–135.
[22] Jamal, A. A., Majid, A.-A. M., Konev, A., Kosachenko, T., and Shelupanov, A. A review on
security analysis of cyber physical systems using machine learning. Materialstoday: Proceedings
80, 3 (2023), 2302–2306.
[23] Jazdi, N. Cyber physical systems in the context of industry 4.0. In 2014 IEEE International
Conference on Automation, Quality and Testing, Robotics. IEEE, 2014, pp. 1–4.
[24] Jin, C., Djurdjanovic, D., Ardakani, H. D., Wang, K., Buzza, M., Begheri, B., Brown, P.,
and Lee, J. A comprehensive framework of factoryto-factory dynamic feet-level prognostics
54 Secure and Smart Cyber-Physical Systems
and operation management for geographically distributed assets. In 2015 IEEE International
Conference on Automation Science and Engineering (Case) (2015). IEEE, pp. 225–230.
[25] Jing, X., Yan, Z., Jiang, X., and Pedrycz, W. Network trafc fusion and analysis against ddos
fooding attacks with a novel reversible sketch. Information Fusion 51 (2019), 100–113.
[26] Kholidy, H. A. Autonomous mitigation of cyber risks in the cyber–physical systems. Future
Generation Computer Systems 115 (2021), 171–187.
[27] Kim, C., Sun, M., Mohan, S., Yun, H., Sha, L., and Abdelzaher, T. F. A framework for the safe inter-
operability of medical devices in the presence of network failures. In Proceedings of the 1st ACM/
IEEE International Conference on Cyber-Physical Systems (ICCPS ‘10). 2010. Association for
Computing Machinery, New York, NY, USA, 149–158. https://doi.org/10.1145/1795194.1795215
[28] Koroniotis, N., Moustafa, N., Sitnikova, E., and Turnbull, B. Towards the development of realis-
tic botnet dataset in the internet of things for network forensic analytics: Bot-IoT dataset. Future
Generation Computer Systems 100 (2019), 779–796.
[29] Lee, Jay and Edzel Lapira. Fault detection in a network of similar machines using clustering approach.
Enginnering, computer science, (2012). https://api.semanticscholar.org/CorpusID:113068586
[30] Lee, E. A. Time-critical networking-invited presentation. In 2009 IEEE/LEOS Summer Topical
Meeting. (2009) IEEE, pp. 149–150.
[31] Lee, E. A. CPS foundations. In Proceedings of the 47th Design Automation Conference (DAC
‘10). Association for Computing Machinery, New York, NY, USA, 737 -742. https://doi.
org/10.1145/1837274.1837462
[32] Lee, I., Sokolsky, O., Chen, S., Hatclif, J., Jee, E., Kim, B., King, A., Mullen-Fortino, M., Park, S.,
Roederer, A. and Venkatasubramanian, K.K., 2011. Challenges and research directions in medical
cyber–physical systems. Proceedings of the IEEE, 100 (1), 75–90.
[33] Lee, J., Ardakani, H.D., Yang, S. and Bagheri, B., 2015. Industrial big data analytics and cyber-
physical systems for future maintenance & service innovation. Procedia cirp, 38, pp. 3–7.
[34] Lee, J. Keynote presentation: Recent advances and transformation direction of PHM. In Road-
mapping Workshop on Measurement Science for Prognostics and Health Management of Smart
Manufacturing Systems Agenda.https://www.nist.gov/el/intelligent-systems-division-73500/road-
mapping-workshop-measurement-science-prognostics-and, 2014
[35] Lee, J., Bagheri, B., and Jin, C. Introduction to cyber manufacturing. Manufacturing Letters
8 (2016), 11–15.
[36] Lee, J., Bagheri, B., and Kao, H.-A. A cyber-physical systems architecture for industry 4.0-based
manufacturing systems. Manufacturing Letters 3 (2015), 18–23.
[37] Lee, J., Jin, C., and BagheRi, B. Cyber physical systems for predictive production systems. Pro-
duction Engineering 11 (2017), 155–165.
[38] Lee, J., Jin, C., Liu, Z. Predictive Big Data Analytics and Cyber Physical Systems for TES Systems.
In Redding, L., Roy, R., Shaw, A. (eds) Advances in Through-life Engineering Services. Decision
Engineering (2017). Springer, Cham. https://doi.org/10.1007/978-3-319-49938-3_7
[39] Lee, J., Wu, F., Zhao, W., Ghafari, M., Liao, L., and Siegel, D. Prognostics and health management
design for rotary machinery systems—reviews, methodology and applications. Mechanical Systems
and Signal Processing 42, 1–2 (2014), 314–334. https://doi.org/10.1016/j.ymssp.2013.06.004
[40] Li, L., and Ni, J. Short-term decision support system for maintenance task prioritization. Inter-
national Journal of Production Economics 121, 1 (2009), 195–202.
[41] Lin, Y.-D., Chang, P.-K., Chen, J.-L., and Chen, C.-M. Information metrics for low-rate ddos
attack detection: A comparative evaluation. IEEE Transactions on Information Forensics and
Security 11, 10 (2016), 2229–2244.
[42] Lindauer, B., Glasser, J., Rosen, M., Wallnau, K. C., and Exactdata, L. Generating test data for
insider threat detectors. Journal of Wireless Mobile Networks, Ubiquitous Computing, and De-
pendable Applications 5 (2014) 80–94.
[43] Lv, Z., Chen, D., Lou, R., and Alazab, A. Artifcial intelligence for securing industrial-based
cyber–physical systems. Future Generation Computer Systems 117 (2021), 291–298.
[44] Lv, Z., Chen, D., Lou, R., and Alazab, A. Artifcial intelligence for securing industrial-based
cyber–physical systems. Future Generation Computer Systems 117 (2021), 291–298.
[45] Mahmoud, M. S., Hamdan, M. M., and Baroudi, U. A. Modeling and control of cyber-physical
systems subject to cyber attacks: A survey of recent advances and challenges. Neurocomputing
338 (2019), 101–115.
Securing Cyber-Physical Systems Using AI 55
[46] Mitchell, R., and Chen, R. Efect of intrusion detection and response on reliability of cyber
physical systems. IEEE Transactions on Reliability 62, 1 (2013), 199–210.
[47] Ni, J., and Jin, X. Decision support systems for efective maintenance operations. CIRP Annals
61, 1 (2012), 411–414.
[48] of New Brunswick, U. DDoS 2019 Data Set, 2019. https://www.unb.ca/cic/datasets/ddos-2019.
html.
[49] Salahdine, F., and Kaabouch, N. Security threats, detection, and countermeasures for physical
layer in cognitive radio networks: A survey. Physical Communication 39 (2020), 101001.
[50] Sargolzaei, A., Crane, C. D., Abbaspour, A., and Noei, S. A machine learning approach for
fault detection in vehicular cyber-physical systems. 2016 15th IEEE International Conference
on Machine Learning and Applications (ICMLA), Anaheim, CA, USA, 2016, pp. 636-640, doi:
10.1109/ICMLA.2016.0112.
[51] Sarker, I. H., Kayes, A., Badsha, S., Alqahtani, H., Watters, P., and Ng, A. Cybersecurity data
science: An overview from machine learning perspective. Journal of Big Data 7 (2020), 1–29.
[52] Shaukat, K., Luo, S., Varadharajan, V., Hameed, I. A., and Xu, M. A survey on machine learning
techniques for cyber security in the last decade. IEEE Access 8 (2020), 222310–222354.
[53] Silva, A. R., and VuRan, M. C. (CPS) 2: Integration of center pivot systems with wireless under-
ground sensor networks for autonomous precision agriculture. In Proceedings of the 1st ACM/
IEEE International Conference on Cyber-Physical Systems (2010), pp. 79–88.
[54] Singhal, A. Data warehousing and data mining techniques for cyber security (2007), vol. 31.
Springer Science & Business Media.
[55] Tantawy, A., Abdelwahed, S., Erradi, A., and Shaban, K. Model-based risk assessment for cyber
physical systems security. Computers & Security 96 (2020), 101864.
[56] Tavallaee, M., Bagheri, E., Lu, W., and Ghorbani, A. A. A detailed analysis of the KDD cup 99
data set. In 2009 IEEE Symposium on Computational Intelligence for Security and Defense Ap-
plications 2009. IEEE, pp. 1–6.
[57] Tomizuka, M. Automated highway systems-an intelligent transportation system for the next
century. In ISIE’97 Proceeding of the IEEE International Symposium on Industrial Electronics
(1997), vol. 1. IEEE, pp. PS1–PS4.
[58] Wang, E. K., Ye, Y., Xu, X., Yiu, S.-M., Hui, L. C. K., and Chow, K.-P. Security issues and chal-
lenges for cyber physical system. In 2010 IEEE/ACM Int’l Conference on Green Computing and
Communications & Int’l Conference on Cyber, Physical and Social Computing (2010). IEEE, pp.
733–738.
[59] Wang, J., Tu, W., Hui, L. C., Yiu, S.-M., and Wang, E. K. Detecting time synchronization attacks
in cyber-physical systems with machine learning techniques. In 2017 IEEE 37th International
Conference on Distributed Computing Systems (ICDCS) (2017). IEEE, pp. 2246–2251.
[60] Wang, T., Yu, J., Siegel, D., and Lee, J. A similarity-based prognostics approach for remaining
useful life estimation of engineered systems. In 2008 International Conference on Prognostics
and Health Management (2008). IEEE, pp. 1–6.
[61] Yang, S., Bagheri, B., Kao, H.-A., and Lee, J. A unifed framework and platform for designing of
cloud-based machine health monitoring and manufacturing systems. Journal of Manufacturing
Science and Engineering 137, 4 (2015), 040914
[62] Meng ZhiJun, Meng ZhiJun, Wang Xiu Wang Xiu, Zhao ChunJiang Zhao ChunJiang, and Xue
XuZhang Xue XuZhang. “Development of feld information collection system based on em-
bedded COM-GIS and pocketPC for precision agriculture.” Transactions of the Chinese Soci-
ety of Agricultural Engineering, 2005, 21 (4), 91–96. https://www.cabidigitallibrary.org/doi/
full/10.5555/20053130249
[63] Zhou, Y., and Jiang, X. Dissecting android malware: Characterization and evolution. In 2012
IEEE Symposium on Security and Privacy (2012). IEEE, pp. 95–109.
Chapter 3
Chapter Contents
3.1 Introduction 56
3.1.1 Motivation 57
3.2 Industry 5.0 58
3.2.1 Industry 5.0 58
3.2.1.1 Human-Centric 59
3.2.1.2 Resilient 60
3.2.1.3 Sustainable 60
3.2.2 Needs of Industry 5.0 60
3.2.3 Features of Industry 5.0 60
3.2.3.1 Smart Manufacturing 60
3.2.3.2 Predictive Maintenance 61
3.2.3.3 Hyper Customization 61
3.2.3.4 Cyber Physical Cognitive Systems 62
3.2.4 Applications of Industry 5.0 62
3.2.4.1 Intelligent Healthcare Development 62
3.2.4.2 Cloud Manufacturing 62
3.2.4.3 Supply Chain Managements 63
3.3 5G Technology 64
3.3.1 Advantages of 5G 65
3.3.2 Disadvantages of 5G 67
3.4 6G Technology 68
3.4.1 Advantages of 6G 69
3.4.2 Disadvantages of 6G 70
3.4.3 Comparison of 5G and 6G 71
3.5 Cyber-Physical System 72
3.5.1 Defnition (NIST) 72
3.5.2 Diferent Applications of Smart CPS 73
3.6 Digital Trust 74
3.7 Conclusions 76
Bibliography 77
3.1 Introduction
The frst industrial revolution began in 1780 with the production of mechanical power
from various sources, which was followed by the use of electrical energy for assembly lines.
DOI: 10.1201/9781003376712-3
Toward Fast Reliable Intelligent Industry 5.0 57
The production industry has used information technology to automate tasks. For instance,
the fourth industrial revolution, subsequently referred to as CPS [18,47], used IoT and
the cloud to connect the virtual and physical space. Although the standard of Industry 4.0
transformed the manufacturing sector, process optimization overlooked human resources,
leading to unemployment. Pioneers in the sector are therefore anticipating the next revolu-
tion in which machines and human intelligence will work together to create superior solutions.
The fourth industrial revolution intended to transform manufacturing agents into cyber-
physical systems (CPSs) from comprehensive physical systems through the efective integra-
tion of business operations and production.
This entails using IoT to integrate every component of the supply chain for the indus-
trial sector, from suppliers to production lines to end users [24]. Industry 4.0 employs CPS
through the IoT network to connect with every entity. Because of this, a cloud environ-
ment is used to store a large amount of data for efcient processing. Although Industry 4.0
transformed the manufacturing sector, process optimization overlooked human resources,
distributed computing, Big data analytics, ambient intelligence, virtual reality, edge com-
puting, and cybersecurity [18,25]. With increasing mass manufacturing, Industry 4.0 has
decreased production, logistical, and quality control expenses. Industry 4.0 has reduced the
cost of manufacturing, albeit at the expense of human costs through process optimization.
This unintentionally pushes employment backward and will increase labor union resist-
ance, which will hinder Industry 4.0’s full adoption [14]. This problem is anticipated to be
resolved by Industry 5.0 with greater human involvement. The manufacturing sector is con-
centrating on the unfavorable efects of managing waste properly and lessening its efects on
the ecosystem in response to the quickening rate of environmental damage caused by Indus-
try 2.0. Nothing about Industry 4.0 protects the environment. The next industrial revolution
has thus been sparked by the necessity for a technological answer to deliver manufacturing
methods that are pollution-free [31,58]. By lowering waste production through the bio-econ-
omy, which creates a pollution-free surrounding, Industry 5.0 maintains the sustainability of
civilization. The industrial revolution (1.0 to 5.0) has been depicted in Figure 3.1.
3.1.1 Motivation
By combining many technologies, including artifcial intelligence (AI), the Internet of Things
(IoT), cloud computing, CPSs, and cognitive computing, the Industry 4.0 standard has com-
pletely transformed the industrial industry. The basic idea behind Industry 4.0 is to build
the manufacturing sector “smart” by connecting machines and creating equipment that can
communicate with one another and control one another throughout their lives [42,55,56].
Process automation is given top attention in Industry 4.0 to minimize human involvement in
the production process [27,43]. The aim of Industry 4.0 is to boost performance and produc-
tivity for all users by utilizing machine learning (ML) to provide intelligence across devices
and apps [6,11,23,62].
Industry 5.0 is now being envisioned as a way to combine powerful, clever, and precise
machinery with the distinctive creativity of human professionals. Many technical futurists
think that Industry 5.0 will give production one more human touch [41]. Industry 5.0 is
anticipated to bring together humans’ critical, cognitive thinking and highly accurate tech-
nology. Another signifcant addition of Industry 5.0 is mass personalization, which allows
clients to choose customized items based on their preferences and requirements. Industry 5.0
will enable adaptability between humans and robots, greatly boost industrial efciency, and
enable accountability for interaction and ongoing monitoring.
58 Secure and Smart Cyber-Physical Systems
While Industry 4.0 focused on mass production with minimal waste and increased efciency,
Industry 5.0 aspires to achieve mass-customized production with zero waste, minimal cost,
and ultimate precision [32,61]. The idea of Industry 5.0 has yet to fully develop, though. For
instance, the discussion of the numerous defnitions and views of top industry researchers and
academicians about the Industry 5.0 perception is covered in Section 3.2. In order to build an
intelligent society where humans conduct innovative, creative jobs and robots (cobots) handle
the rest, all key Industry 5.0 concepts emphasize the coexistence of humans and robots. In this
regard, the European Commission (EC) developed a futuristic prototype to supplement the
industry 5.0 vision with resilience, human-centeredness, and sustainable approaches [1,21,31].
Industry 5.0 is a concept that transcends the term “industry.” Every industry and organiza-
tion that come to mind are covered. This indicates that it has a far broader application than
Industry 4.0. As a result, we must adopt a comprehensive and universal viewpoint that ap-
plies to all industries when considering the strategic implications of Industry 5.0. Industry 5.0
is a proposed new phase in the evolution of industry that builds upon the foundation of
Industry 4.0. While Industry 4.0 is focused on using digital technologies to automate and
optimize industrial processes, Industry 5.0 takes a more holistic approach that emphasizes
human-centricity, collaboration, and sustainability.
Industry 5.0 envisions a future in which advanced technologies such as robotics, arti-
fcial intelligence, and the Internet of Things are used not just to improve efciency and
Toward Fast Reliable Intelligent Industry 5.0 59
3.2.1.1 Human-Centric
According to the image, a human-centric strategy “promotes abilities, diversity, and em-
powerment.” The most signifcant change this implies is moving away from using people as
means (such as in the case of human resources) and moving toward using them as ends. Or,
to put it another way, there is a change in emphasis from organizations serving people to
individuals serving organizations. This is more extreme than it might initially appear to be.
Additionally, it fts in well with recent changes in the labor market.
Finding, serving, and retaining talent have become a considerably bigger task than dis-
covering, ofering, and retaining customers in several businesses and nations. If this trend
persists, the business plan must provide it with a legitimate home, and that’s what Indus-
try 5.0 aims to do. Today’s strategy is mostly focused on acquiring a competitive edge and
utilizing it to produce distinctive additional value for clients. The work of Michael Porter,
the most well-known design expert to date, is fundamentally infuenced by this mindset.
3.2.1.2 Resilient
A robust strategy is, in the words of the European Commission, “agile and resilient using
versatile and adaptable solutions.” Few would disagree that resilience is essential—today
and in the future in light of COVID-19, global supply constraints, and the Ukraine confict.
However, this transformation is more profound than it frst appears. While fexibility and
agility are currently higher on the corporate agenda, this does not automatically translate
into greater resilience. If resilience is to truly be one of the three main pillars of Industry 5.0,
then strategy’s main emphasis must shift from growth, proftability, and efectiveness to
building “anti-fragile” organizations that can anticipate, respond to, and learn the system-
atic way from any crisis order to ensure stable and long-term results.
3.2.1.3 Sustainable
With the many concerns we currently have over climate change, the concept of sustainabil-
ity hardly needs an introduction. A sustainable strategy “leads to action on sustainability
and respects planetary boundaries,” according to the European Commission. This suggests,
for instance, that organizations should focus on all 17 Sustainable Development Goals and
the 3 pillars of the Triple Bottom Line. The third pillar is also a major change, just like the
frst two. Corporate sustainability initiatives have thus far mostly been concentrated on
mitigating harm or engaging in green-washing but let’s leave that out of the conversation.
So it’s business as usual but with more responsibility.
Future industries must play a crucial role in providing solutions to pressing societal issues,
such as:
1) Protecting natural resources and the environment and combating climate change.
2) Adopting circular production models, developing and empowering ICT technologies,
and revising energy consumption regulations to ensure the efective use of natural as-
sets in the incident of external shocks, such as the COVID-19 pandemic (resiliency)
[46,48,60].
3) Hyper-connectivity in the digital age and developing digital skills for empowering indi-
viduals and promoting social stability (human-centric value). It is crucial that the ele-
ments of the Industry 5.0 vision achieve and make the 17 Sustainable Development
Goals (SDG) or Global Goals included in the United Nations’ Agenda 2030 possible [4].
Industries are dealing with numerous difculties as the globalization of the economy pro-
gresses. This is causing the production facilities to transition to impending changes like
predictive maintenance (PdM). Manufacturers have been leveraging developing technology,
such as CPS techniques and sophisticated analytical methodologies, to increase productivity
and efciency [52]. Industry transparency refers to the capacity to identify and evaluate am-
biguities in order to estimate industrial capacity and opportunity. In essence, the majority of
industrial plans presumptively anticipate constant equipment availability. However, in the
actual industry, it never actually occurs. Industries are dealing with numerous difculties
as the globalization of the economy progresses. This is causing the production facilities to
transition to impending changes like predictive maintenance.
In order to gain transparency, manufacturing facilities should switch to predictive main-
tenance. Modern prediction tools must be used in this transformation so that the workforce
can make wise decisions. These tools convert data into information in a systematic manner
and indicate uncertainties. Utilizing intelligent equipment and intelligent sensor networks,
the Internet of Things (IoT) implementation ofers the fundamental framework for preven-
tive maintenance. Predictive maintenance’s fundamental objective is to provide equipment
and systems with the ability to be aware of themselves.
Aiming to link machines, building smart supply chains, encouraging the manufacture of
smart products, and separating labor from automated sectors are all aspects of Industry 4.0.
However, Industry 4.0 has been unable to keep up with the rising need for customization,
whereas Industry 5.0 uses hyper customization to do so. Hyper customization is a personal-
ized marketing strategy that uses real-time data and cutting-edge technology like artifcial
intelligence, machine learning, cognitive systems, and computer vision to ofer each cus-
tomer more specialized goods, services, and content. Robotics and human intelligence com-
bined allow for the mass customization of items by producers. To accomplish this, various
functional material variations are communicated with other staf members with the goal of
customizing the product with various variations for consumer choice.
Industry 4.0 is intended for massive production with minimal waste and the highest ef-
fciency, but Industry 5.0 wants to achieve mass customization at the lowest possible cost
with the highest level of precision. Industries can organize manufacturing processes to in-
corporate client requests and market changes thanks to the interaction of humans, robots,
and cognitive systems. The transformation to an agile supply chain and manufacturing
process is the frst stage in hyper-personalizing. Additionally, the production team, con-
sumer preferences, and human intervention are required. Additionally, the viability of hyper
customization is heavily reliant on how economically viable the generated items are [61].
62 Secure and Smart Cyber-Physical Systems
CPS has gained popularity in recent years as a result of the development of technologies like
smart wearables, IoTs, cloud computing, fog and edge computing, and Big data analytics. The
manufacturing process has changed from using fully manual systems to using CPS as a result
of the fourth industrial revolution [30,57]. The IoT-enabled connection between CPSs serves
as the foundation for Industry 4.0. Huge amounts of efective, secure data sharing and storage
are made possible by cloud technology [12]. Additionally, cognitive techniques are used to
improve the performance of the system in a variety of applications, including intelligent sur-
veillance, industrial automation, smart grid, vehicular networks, and environment monitor-
ing. These applications are referred to as cyber-physical cognitive systems (CPCSs) [51,54].
The nodes of the CPCSs contain cognitive capacities like the ability to observe or study the
surroundings and take appropriate action.
In CPCSs, decision-making is mostly based on learning and knowledge. For human–
robot collaborative (HRC) production, the CPCS has been introduced. The HRC works
with a human and a robot to complete the assemblage of components in the manufactur-
ing sector. For this real-time collaboration project, machine–human cognitive integration is
modeled and used. The fourth industrial revolution’s advantages were constrained by the
ffth industrial revolution, which reinstates the use of human labor in production. Industry
5.0 is made possible by the ffth revolution, which makes it easier for skilled workers and
robots to collaborate to generate personalized goods and services [9].
These days, medical professionals use machine learning (ML) models to aid in the diagnosis
of patients’ illnesses. This aids in increasing the accuracy of disease diagnosis and thus helps
patients save a great deal of time and money [5,13]. However, given the circumstances, this
is insufcient. Technology that can guarantee individualized patient care, such as monitor-
ing measurements of blood pressure and sugar levels, and provide patients with individual-
ized treatment with support from doctors is urgently needed. The advent of Industry 5.0 can
enable this. Smart watches, intelligent sensors, and other intelligent wearables can continu-
ously capture a patient’s healthcare data in real time and save this data in the cloud.
The medical state of the patients can then be determined using ML methods. These smart
gadgets are able to connect with one another, and in the event that a doctor is needed, they
can provide the doctors with the information of the patient’s present condition and alert
them to treat the patient. Doctors can use cobots to do surgery on patients by using robots
that can communicate with one another. These are just a few instances of how Industry 5.0
can transform the healthcare sector. This revolution facilitates the production of implants,
customized gadgets, etc. Corobots could take care of regular tasks through Industry 5.0,
such as routine exams currently carried out by doctors. Doctors can focus on higher-level
of employment in this fashion for the prescription of drugs to the patients.
By incorporating cutting-edge technologies like cloud and EC, IoT, virtualization, and service-
oriented technologies, cloud manufacturing is an innovative technique to transform the con-
ventional manufacturing paradigm into an advanced manufacturing technique. Multinational
Toward Fast Reliable Intelligent Industry 5.0 63
stakeholders will work together in a cloud manufacturing process to run an efective and
afordable manufacturing process. Reliability, excellent quality, cost-efectiveness, and on-
demand capabilities are some of the characteristics that set cloud manufacturing apart. Ad-
ditionally, cloud manufacturing benefts the environment by removing the need for lengthy
raw material deliveries during the manufacturing process.
Cloud manufacturing enables designers to use manufacturing resources scattered across
many geographical zones while protecting their intellectual property, such as design fles for
manufacturing goods, by storing them in the cloud with strict access controls [3]. By doing
this, the designers are given the freedom to locate their manufacturing facilities nearer to
the raw materials as well as in nations where manufacturing is more afordable. Here, the
cloud is in charge of managing the operations of the manufacturing life cycle, including
service composition [29] and scheduling [19]. IoT sensors can be used to gather and evalu-
ate in the cloud the operating condition data of the manufacturing process [50]. The use of
cloud manufacturing as a service-oriented manufacturing framework was demonstrated by
Li et al. [26] and Tao et al. [49].
The potential business policies for cloud manufacturing, including the pay-as-you-go
business strategy, were described by Xu et al. [59]. Several energy-awareness-related re-
searches were done by researchers in cloud computing environments [33–36]. The upcom-
ing generation of cloud manufacturing systems, known as Industry 5.0, is anticipated to
support various and complicated requirements in the contexts of engineering, production,
and logistics. The development of EC features, 5G-based telecommunications networks,
and AI/ML technologies opens up new opportunities to signifcantly increase the capabili-
ties of future cloud manufacturing systems.
In order to fulfll demand and produce individualized and customized products more quickly,
companies can beneft from disruptive technologies that enable Industry 5.0, such as DT,
cobots, 5G and beyond, ML, IoT, and EC [28]. As mass customization is a core idea in
Industry 5.0, this aids supply chain management (SCM) in incorporating it into their manu-
facturing processes. The SCM, which consists of warehouses, inventory positions, assets,
and logistics, can be recreated digitally using DT. The DT includes all manufacturing sites,
suppliers, contract manufacturers, shipping channels, distribution centers, and client loca-
tions. From the design stage through construction and commissioning and on to operations,
DT provides assistance for the SCM during its full life cycle [37,22]. DT can sense real-world
data via IoT sensors by imitating real-time SCM systems. These data can be used by ML,
Big data, etc., to forecast the challenges encountered at various stages of SCM. Table 3.1
illustrates the paradigm shift from Industry 4.0 to Industry 5.0.
3.3 5G Technology
5G is the next generation of wireless connectivity, ofering a truly connected future. Industry
5.0 has been heralded as being one of the most important innovations in the industry. With 5G,
manufacturers can create more intelligent products that are online, ofine, mobile, or stationary.
The numerous access approaches in the existing networks are almost at a standstill and
require immediate improvement when the current 5G network is taken into account. At
least for the next 50 years, current technology like OFDMA will be functional. Further-
more, the wireless confguration that was changed from 1G to 4G does not need to be
changed. As an alternative, the user requirements could be satisfed by simply adding an
application or improving the basic network. The package providers will be prompted by
this to start planning for a 5G network as soon as 4G is put in place commercially [53]. A
signifcant shift in the approach to building the 5G wireless cellular architecture is required
to satisfy user requests and address the issues raised by the 5G system. Researchers’ broad
observations have revealed in [8] that the majority of wireless users spend about 80% of
their time indoors and approximately 20% of the time is spent outside.
In the recent wireless cellular framework, an outside base station (BS) located in the
center of a cell facilitates communication between mobile users whether they are inside or
outside. Signals must therefore pass through the walls of the inside in order for the inside
users to exchange information with the outside base station. This will result in massive pen-
etration loss, which decreases the spectrum efectiveness, data rate, and energy efciency of
wireless communications. To overcome this obstacle, a fresh idea or design approach for the
5G cellular architecture is to distinguish between external and internal confgurations [53].
The signal loss through the building’s walls will be marginally lessened using this method
of designing. Massive MIMO technology will be used to support this concept [44], where
a widely dispersed array of antennas with tens or hundreds of antenna units is deployed.
Massive MIMO systems have the advantage of using the benefts of a large array of antenna
devices in terms of enormous capacity improvements, whereas current MIMO systems only
use two or four antennas.
In order to develop or create a big massive MIMO network, the outer base stations will
frst be outftted with substantial antenna arrays, some of which are spread across the hex-
agonal cell and connected to the base station via optical fber cables, supported by massive
MIMO technology. Outside, mobile users are often equipped with a specifc number of
antenna units, but with collaboration, a sizable virtual antenna array may be built, which,
combined with base station antenna arrays, creates huge virtual MIMO linkages. To com-
municate with outdoor base stations using line-of-sight components, every building will
also have a vast array of external antennas built. For communication with inside users,
the massive antenna arrays are connected to the wireless access points inside the building
through cables. This will result in signifcant improvements to the cellular system’s energy
efciency, cell average throughput, high data rate, and spectrum efciency, albeit at the
expense of higher infrastructure establishment costs. With the implementation of such a
design, users inside buildings will only need to connect to or communicate with internal
wireless access points, while external buildings would continue to have larger antenna ar-
rays built [53]. Certain technologies, such as Wi-Fi, Small-Cell, Ultra-Wideband, and Mil-
limeter Wave Communications, are used for indoor communication [7]. However, higher
frequencies are being used by technologies like visible light communication and millimeter
wave communication frequently for cellular communications. Cloud and fog computing get
the beneft of 5g directly due to high data rate and lower latency time [38].
Toward Fast Reliable Intelligent Industry 5.0 65
However, it is not a good idea to employ these high-frequency waves for outdoor and long-
distance applications since they are quickly scattered by raindrops, gases, and the atmosphere.
They also do not penetrate dense materials well. However, due to their huge bandwidth, visi-
ble light and millimeter wave communications technologies can increase the transmission data
rate for indoor settings. Another strategy to address the issue of spectrum scarcity is the in-
troduction of additional spectrum that is not typically used for wireless communication. This
strategy is known as Cognitive Radio (CR) networks, which increase the spectrum utilization
of existing radio spectra [20]. The heterogeneous 5G cellular architecture necessitates the use
of macrocells, microcells, tiny cells, and relays. The idea of a mobile tiny cell is crucial to 5G
wireless. Mobile relay and tiny cell concepts are used to some extent in cellular networks [16].
It is being adopted to accommodate those with high levels of mobility who are riding in
cars and high-speed trains. While gigantic MIMO units made up of enormous antenna arrays
are deployed outside moving vehicles to interact with the base station, mobile small cells are
placed within moving vehicles to communicate with users inside those vehicles. The idea of
separating indoor and outdoor installations is supported by the fact that a mobile small cell
appears to users as a standard base station and that all of its associated users are seen as a
single unit to the base station. In order to take advantage of data rate services with high-fre-
quency signaling overhead, mobile small-cell users have a high data rate, as illustrated in [53].
The radio network and the network cloud are the only two logical levels in the architecture
of the 5G wireless cellular network. The radio network is made up of various types of parts
with various functions. The User plane entity (UPE) and Control plane entity (CPE) that per-
form higher-layer functions linked to the User and Control planes, respectively, make up the
network function virtualization (NFV) cloud. Resource pooling is one example of the special
network functionality as a service (XaaS) that will ofer services based on demand. The radio
network and network cloud are connected by XaaS. In [53] and [2], the architecture of the 5G
cellular network is described. It is equally crucial for the front-end and backhaul networks.
The general 5G cellular network design is presented in this research according to Figure 3.3. It
discusses the connections between many cutting-edge technologies, including massive MIMO
networks, cognitive radio networks, and mobile and static small-cell networks. The function
of the network function virtualization (NFV) cloud in the proposed architecture for the 5G
cellular network is also explained. This suggested 5G cellular network architecture also takes
into account the ideas of Device to Device (D2D) communication, small cell access points, and
the Internet of Things (IoT). Overall, the suggested 5G cellular network design might ofer a
solid foundation for the next generation of 5G standardized networks.
3.3.1 Advantages of 5G
High speeds: In comparison to 4G and 4G LTE, 5G operates more quickly on mobile phones
and other devices. Instead of taking minutes, it enables customers to download movies,
videos, and music in seconds. Organizations can use the network’s 20 Gbps speed for
services like automation and enhanced web conferencing. According to a recent poll,
customers who used 5G downloaded content in less than 23 hours per day.
Low latency: In comparison to 4G, 5G ofers lower latency, which will efectively enable
emerging applications like AI, IoT, and virtual reality. Additionally, it makes it simple for
mobile phone users to browse the web and open websites. Another beneft is that it pro-
vides a means to access the Internet whenever you need to fnd some crucial information.
66
Secure and Smart Cyber-Physical Systems
Figure 3.3 Architectural framework of 5G.
Toward Fast Reliable Intelligent Industry 5.0 67
Increased capacity: Up to 100 times more capacity than 4G is possible with 5G. It enables
businesses to transition between cellular and Wi-Fi wireless solutions, greatly enhancing
performance. In addition, it ofers highly efective ways to access the Internet.
More bandwidth: One of the key benefts of 5G is that it increases bandwidth, which will
aid in quick data transfer. Additionally, by choosing a 5G network, mobile phone con-
sumers can avail of a faster connection with greater bandwidth.
Powering innovation: Connecting with a wide variety of devices, such as drones and sen-
sors, requires the use of 5G technology. It ofers strategies for accelerating IoT adoption,
enabling businesses to increase productivity and do other things.
Less tower congestion: Accessing critical information may become difcult due to 4G cell-
phone networks’ frequent congestion. However, the improved speed and increased ca-
pacity of 5G networks enable consumers to bypass them.
3.3.2 Disadvantages of 5G
Expensive initial rollout costs: Because network operators would have to both upgrade their
current network infrastructures and construct new ones to fulfll the requirements of the
3GPP standard, developing and implementing 5G capabilities would be costly. In order to
upgrade and construct infrastructures, it is necessary to buy new hardware, obtain new li-
censes, integrate and advance complementary technologies like multiuser MIMO and mas-
sive MIMO as well as beamforming, and lease both public and private areas. Building and
expanding their ffth-generation network capabilities would take some time for developing
and undeveloped nations, as well as for rural areas like provinces because the entrance
barrier for local network operators is still high due to cost, expertise, and resource needs.
Not compatible with older devices: Newer generations of cellular network technologies
have various hardware requirements, just like the older versions did. To connect to a 5G
network, devices must have the required hardware. Fifth-generation networks will not be
supported by the majority of fagship smartphones from 2019 and earlier, as well as mid-
range to entry-level devices from 2020 and entry-level devices from 2021. For users to
beneft from 5G technology, they must purchase equipment that is capable of doing so.
Variations between mmWave and sub-6: The fact that the entire 5G standard is built on two
separate standards is another issue. In contrast to mmWave, sub-6 employs various tech-
nologies and operates on diferent principles. Additionally, while some devices only sup-
port the mmWave specifcation, others only support the sub-6 specifcation. The sub-6
5G standard covers the so-called C-Band 5G. To determine whether the gadgets they
intend to purchase are compliant with both or just one of the criteria, consumers would
need to read and comprehend the tiny print of those devices. There are fundamental dif-
ferences between various 5G networks and 5G gadgets. Given the variations in these two
specifcations, it is preferable to buy a device that supports both.
mmWave specifcation restrictions: In terms of bandwidth, latency, and data transmission speed,
mmWave 5G is superior to sub-6 5G. There is one problem, though. The mmWave specifca-
tion’s range is constrained because it calls for employing higher frequencies. To completely
cover a certain area, network operators would need to construct and place hundreds to
thousands of smaller cells. Users must also be within a block of a mmWave cell site and along
a line of sight in order to join a mmWave network. This specifcation’s restrictions make it
perfect for congested urban regions or specifed target locations like stadiums and airports.
Cybersecurity: One of the issues with 5G is cybersecurity since hacking will happen. The
increase in bandwidth makes it simple for thieves to grab the database. Additionally,
68 Secure and Smart Cyber-Physical Systems
the software it employs makes it subject to attacks. Attacks are quite likely when 5G
connects to more devices. As a result, organizations and corporations should invest in a
security operations center to safeguard their infrastructure.
3.4 6G Technology
6G technology is the next step in mobile communications for the Industry to upgrade its
systems and operations. To develop a fully functional 5G ecosystem, it is important that the
entire industry has a common standard that supports 5G standards, from the core network
to WANs and mobile operators. The frst-generation service node of 6G ensures that all
operators can start deploying 5G in real time. 6G technology will have a disruptive efect on
entire supply chains as it enables high-defnition, real-time, interactive, and virtual experi-
ences in an increasingly digital world through advanced communication technologies such
as Machine-to-Machine (M2M) and Remote Cellular Networks (RCNs).
In conjunction with a secure and automated orchestration architecture, 6G architecture
includes building blocks spanning important architectural domains of a communication
network, starting at the physical layer and moving up to the service layer. As shown in Fig-
ure 3.4, we defne and formulate architectural 6G building blocks. The Nokia Bell Labs 6G
architectural breakdown into building pieces consists of four key interconnected compo-
nents that ofer an open and distributed reference architecture. The “het-cloud” component
of the 6G architectural cloud transition efectively serves as the architecture’s infrastructure
platform and contains features such as an open, scalable, and agnostic run-time environ-
ment; data fow centricity; and hardware acceleration.
3.4.1 Advantages of 6G
6G technology has several advantages, and the advantages are discussed below.
Provides higher data rates: The 6G network’s ability to sustain larger data speeds is an ad-
ditional advantage. Remember that this form of connection will only be accessible in
frequencies utilizing the mmWave spectrum, just like 5G. Such high-frequency waves are
currently incompatible with the available devices. Very fast data rate (Tb/sec) and very
low latency (sub-ms) are features of 6G.
70 Secure and Smart Cyber-Physical Systems
Increases the number of mobile connections supported: The fact that 6G technology is in-
tended to handle more mobile connections than 5G capacity is one of its key advantages.
As a result, there will be less device interference, which will result in an improved service.
It is intended to handle more mobile connections than the approximately 10 × 105 ca-
pacity of 5G per km. Because, most of the indoor trafc is produced by mobile devices.
Furthermore, efective interior coverage has never truly been a goal of cellular networks’
design. By utilizing femtocells or distributed antenna systems (DASs), 6G overcomes
these obstacles.
Transforms the healthcare industry: Through surgeries and simulations in a real-world set-
ting, medical interns and students can learn more efectively. The key beneft of 6G
technology is that it will change the concept of healthcare for patients and medical pro-
fessionals. Imagine living in a time when you could quickly learn about your health
rather than having to wait for weeks. By enabling remote surgery and ensuring health-
care workfow optimization, 6G will transform the healthcare industry and break down
time and geographic limitations.
Separates frequencies: The control channels for the 6G standard are assigned a frequency
range of 8 to 12 GHz. It will feature separate frequencies and a frequency bandwidth of
up to 3.5 kHz. This indicates that the channels do not overlap. This makes it possible to
give room to various transmissions, which increases data speeds.
Utilizes terahertz (THz) frequencies: THz (Terahertz) frequencies are used in 6G. THz
waves are helpful for high-speed, short-range wireless communications because they
can readily absorb moisture from the air. THz provides a narrow-beam, better direc-
tivity, and secure transmission, which is made possible by its potent anti-interference
abilities. From 108 to 1,013 GHz, high wireless bandwidth (a few tens of GHz) can
enable higher Tb/sec transmission rates. THz waves are utilized in space communica-
tion to enable lossless transmission between satellites. In order to meet the needs for
urban coverage, beamforming and massive MIMO multiplexing gain assist in over-
coming rain attenuation and fading propagation. The extremely low photon energy of
THz waves (10−3 eV) allows for greater energy efciency. THz waves can be employed
for various unique communication methods since they can permeate materials with
minimal attenuation.
Visible lights: Visible lights used by 6G wireless take advantage of LED’s lighting and high-
speed data connection capabilities. Electromagnetic radiation (EM) cannot be generated
by visible light communication (VLC). As a result, it is immune to EM interference from
outside sources. VLC aids in enhancing network security as well.
3.4.2 Disadvantages of 6G
wave spectrum between 0.1 and 10 THz with a wavelength of 30 to 3,000 micrometers.
THz waves are well suited for use between satellites and can be employed widely in
space communications. The THz signal’s sensitivity to shadows has a signifcant impact
on coverage. Additionally, THz frequencies with a lower frequency experience have a
higher free space fading. Ultra-large-scale antenna, which demands high bandwidth and
vast quantitative high resolution, is a signifcant problem in THz. Designing 6G devices
with low power and cheap cost involves signifcant processing power challenges.
Health-related consequences: Ongoing discussions surround the usage of 6G technology
and its potential for harm to people. For instance, exposure to high-frequency radiation
has been related to illnesses like autism, ADHD, PTSD, migraines, nausea, and blurred
vision due to OCD. Additionally, RF exposure from using a cell phone may cause cancer,
notwithstanding the fndings of other studies. The usage of cell phones over an extended
period of time, according to numerous scientists, may have an impact on some aspects
of human cells.
Visible light frequencies: Since visible light wavelengths are used in some of 6G’s commu-
nications, its disadvantages are also those of 6G wireless technology. The wavelength
range for visible light is 390–700 nm.
Energy consumption and efciency: A 6G system is required to manage a high number of
terminals and networking devices in an energy-efcient and cost-efective manner. Cir-
cuitry in network and terminal equipment as well as the design of the communication
protocol stack must be optimized to achieve this. To meet this need, energy-harvesting
strategies are employed.
Within the next ten years, it is anticipated to witness the birth of a new 6G technology due
to the quick growth of ffth-generation (5G) applications and rising demand for even faster
communication networks. According to numerous sources, the 6G wireless network stand-
ard might appear around 2030. The severe technological limitations of 5G wireless networks
are therefore examined critically in this research, together with the projected difculties of
Key Points 5G 6G
Operating bandwidth Up to 400 MHz for sub-6 Up to 400 MHz for sub-6 GHz
bands bands
Up to 3.25 GHz for mmWave Up to 3.25 GHz for mmWave band
bands Indicative value: 10–100 GHz for
THz bands
Carrier bandwidth 400 MHz To be defined
Peak data rate 200 Gbps ≥ 1Tbps
(Holographic, VR/AR, and tactile)
User experience rate 100 Mbps 1 Gbps
User plane latency 4 ms (eMBB) and 1 ms 25 µs to 1 ms
(uRLLC)
Mobility 500 km/h 1,000 km/h
Control plane latency 20 ms 20 ms
72 Secure and Smart Cyber-Physical Systems
“CPS are complex systems of computational, physical, and human components integrated
to achieve some function over one or more networks.”
CPSs are intelligent systems with constructed networks of interconnected physical and
computational elements. It is widely acknowledged that CPS and related systems, including
the Industrial Internet and the Internet of Things (IoT), have enormous potential to en-
able novel applications and have an impact on a variety of economic sectors in the global
economy [15].
A cyber-physical system is a combination of physical, computational, and information
technologies to create new and dynamic systems. Industry 5.0 is a new paradigm that recog-
nizes that people, technology, and processes are all intertwined. The scope of CPS has been
explored in two articles: A case study on the city of Redondo Beach, California, where an
obstacle detection system was used as a demonstration for a county-wide (electronic logging
devices) ELD initiative; and a presentation on cooperative control concepts as applied in
Industry 4.0 research for controlling automated machinery.
In order to perform time-sensitive tasks with variable levels of contact with the envi-
ronment, including human involvement, CPSs integrate computation, communication,
sensing, and actuation with physical systems. Figure 3.6 displays a conceptual repre-
sentation of the CPS. This illustration highlights the possible interconnections between
systems and devices in a system of systems (SoS) (such as a CPS infrastructure). A CPS
can be as straightforward as a single device, or it can be an SoS made up of several
systems made up of various devices or one or more cyber-physical devices that create a
plan.
For CPSs to function, the cyber and physical must be combined, and they must be in-
terconnected. Typically, a CPS comprises sensing, processing, and actuation. Traditional
information technology (IT) is used in CPSs to process data as it moves from sensors to
computation. Traditional operational technology (OT) is also used in CPSs for actuation
and control functions. A particularly novel aspect of CPSs is the fusion of these OT and IT
worlds, along with the temporal limitations that go along with it.
An SoS could be a CPS. As a result, it may span several objectives as well as temporal and
data domains, necessitating techniques for translating between or accommodating various
domains. For instance, several time domains may refer to various time scales or have vari-
ous levels of granularity or accuracy.
CPSs can be used for purposes other than that for which they were originally intended.
For instance, a mobile trafc sensor might be created from a cell phone in a car, and equip-
ment failures could be identifed using data on energy use. The smart city is another applica-
tion of CPSs [40, 10].
Due to the open nature of the CPS composition, emergent behaviors are to be expected.
One of the main analysis issues is to comprehend a behavior that cannot be explained by
a single CPS component but rather results from the interplay of potentially numerous CPS
subsystems. For instance, a trafc jam is a negative emergent behavior, whereas the smart
grid’s optimal energy distribution, in which power suppliers and consumers collaborate, is
a desirable positive emergent impact [39].
CPSs’ potential impact on the physical world and its interconnectedness raise questions
regarding its reliability. Stressing security, privacy, safety, reliability, and resilience is more
urgently needed, along with corresponding assurance for widely used networked infrastruc-
tures and devices. For instance, publish and subscribe messages, certifcate authorities, type
and object registries, and other infrastructure-based components and aggregators in CPS
networks may be owned and operated by outside parties. This could lead to possible trust
problems.
To guarantee interoperability, manage evolution, and deal with emergent efects, CPSs
need a methodology. Many of the subsystems, particularly those in large-scale CPSs like
smart grid and smart city, are the responsibility of various manufacturers.
Smart CPSs have a wide range of applications in various domains. Here are some exam-
ples of diferent applications of smart CPSs:
Smart grid: CPSs can be used to optimize the generation, distribution, and consumption of
energy in smart grids. CPSs can monitor and control energy generation and consumption
in real time, helping to balance supply and demand.
74 Secure and Smart Cyber-Physical Systems
Smart transportation: CPSs can be used to optimize trafc fow, improve road safety, and
reduce congestion. CPSs can monitor trafc fow, control trafc signals, and provide real-
time information to drivers to avoid accidents and reduce travel time.
Smart healthcare: CPSs can be used to improve patient care by monitoring patients in real
time and providing timely interventions. CPSs can monitor vital signs, administer medi-
cation, and alert healthcare professionals in case of emergencies.
Smart manufacturing: CPSs can be used to optimize manufacturing processes by monitoring
and controlling production lines in real time. CPSs can track inventory levels, monitor
equipment performance, and predict maintenance needs to reduce downtime and im-
prove efciency.
Smart buildings: CPSs can be used to optimize energy consumption in buildings by
monitoring and controlling heating, cooling, and lighting systems. CPSs can adjust
the temperature and lighting based on occupancy and other factors to reduce energy
waste.
Smart agriculture: CPSs can be used to optimize crop production by monitoring and con-
trolling irrigation, fertilization, and pest control. CPSs can monitor soil moisture, tem-
perature, and nutrient levels to optimize crop growth and yield.
Smart City: CPSs can be used to optimize city services such as waste management, public
transportation, and emergency services. CPSs can monitor and control trafc fow, track
waste disposal, and provide real-time information to emergency services.
providing desired outcomes. It could also be distinguished from a belief based on evidence
or logical reasoning. The concept of trust is thus seen at diferent levels such as individual
(“I trust you”), group (“we all trust each other”), and culture (“everyone trusts their
government”).
Management and consumers have grown to rely on readily available, quick, and se-
cure mobile connectivity as a result of the growing digital delivery of government services.
However, as 5G networks link millions of users, Internet-of-things (IoT) gadgets, driverless
vehicles, and smart city services, the advantages of ubiquitous connectivity must be weighed
against the expanded attack surface that would be made possible. Governments must keep
up with the escalating security concerns if they want to build trust in these digitally deliv-
ered services.
Not simply over smartphones, 5G will enable new use cases, applications, and services.
Large-scale IoT sensor installations are supported, as are connections with extremely low
latency for automated systems, better coverage, and more bandwidth for several latest ap-
plications in transportation, healthcare, and public security, to mention a few.
Cyberattacks are also becoming more complex every day. Government networks are
frequently attacked by criminal gangs, disgruntled citizens, past and present employees,
nation-states, and actors with governmental sponsorship. Thankfully, the foundation of
software-defned networking and virtualization is one of the distinguishing characteristics
of 5G network design. This indicates that 5G networks are very fexible, scalable, and inte-
grated throughout. Most importantly, a lot of their tasks can be automated [52].
These networks are capable of changing to counter extremely sophisticated cyberattacks
against targets in the government. In comparison to earlier generations of mobile standards,
they ofer much higher levels of security, thanks to their greater data encryption and strin-
gent user authentication.
This is signifcant because hacker vulnerabilities usually use automation and dynamic
network response adaptation. Government networks need to be able to respond even more
quickly because ”dwell time,” or how long a hacker or an attack remains unnoticed, must
be reduced. It has been demonstrated that the use of software analytics, machine learning,
orchestration, and automation may cut dwell time by 80%. Figure 3.7 represents frame-
works of digital trust.
Goal of digital trust: The digital trust framework defnes shared goals or values that inform
the concept of digital trust, including:
Dimensions: The framework also defnes dimensions against which the trustworthiness of
digital technologies can be operationalized and evaluated:
• Privacy
• Fairness
• Redressability
• Auditability
• Interoperability
• Transparency
• Safety
• Cybersecurity
3.7 Conclusions
In conclusion, the study provides valuable insights into the current state and future di-
rection of Industry 5.0. The survey results suggest that Industry 5.0 is expected to bring
signifcant benefts in terms of productivity, efciency, and quality, driven by advanced
technologies such as AI, IoT, and cloud computing. The survey highlights the importance
of fast and reliable connectivity, as well as the need for intelligent automation and data
analytics to enable real-time decision-making. The results also indicate that there is a strong
demand for Industry 5.0 solutions in various sectors, including manufacturing, healthcare,
transportation, and energy. However, the chapter also identifes several challenges that need
to be addressed for the successful implementation of Industry 5.0, including cyber-security,
data privacy, and the need for new skill sets and workforce training. The results of the study
suggest that the success of Industry 5.0 will depend on a collaborative efort by industry,
academia, and government.
Industry 5.0 will evolve into a leading industrial revolution in a few years. 5G and
6G technologies recreate a crucial role in Industry 5.0. These technologies accomplish
the communication demands of Industry 5.0. The cyber-physical system was introduced
Toward Fast Reliable Intelligent Industry 5.0 77
in Industrial 4.0, whereas it makes a major impact on Industry 5.0. In this chapter, we
highlight all the aspects of Industry 5.0. Additionally, the 5G and 6G technologies and
the cyber-physical system are conferred in the subsequent sections. This chapter furnishes
a brief idea regarding Industry 5.0 and how 5G and 6G technologies are utilized in CPSs.
Further, this chapter highlights digital trust in brief. This chapter will assist the research-
ers by introducing these emerging topics in the future research direction.
Overall, the chapter provides a comprehensive overview of the current trends and future
outlook for Industry 5.0, highlighting the need for continued research and development to
overcome the challenges and realize the full potential of this emerging paradigm.
Bibliography
[1] Giuseppe Aceto, Valerio Persico, and Antonio Pescapé. Industry 4.0 and health: Internet of
things, big data, and cloud computing for healthcare 4.0. Journal of Industrial Information
Integration, 18:100129, 2020.
[2] Patrick Kwadwo Agyapong, Mikio Iwamura, Dirk Staehle, Wolfgang Kiess, and Anass Benjeb-
bour. Design considerations for a 5g network architecture. IEEE Communications Magazine,
52(11):65–75, 2014.
[3] Hossein Akbaripour, Mahmoud Houshmand, Tom Van Woensel, and Nevin Mutlu. Cloud
manufacturing service selection optimization and scheduling with transportation considerations:
Mixed-integer programming models. The International Journal of Advanced Manufacturing
Technology, 95(1):43–70, 2018.
[4] UN General Assembly. Work of the statistical commission pertaining to the 2030 agenda for
sustainable development. United Nations: New York, NY, 2017.
[5] Sweta Bhattacharya, Praveen Kumar Reddy Maddikunta, Saqib Hakak, Wazir Zada Khan, Ali
Kashif Bashir, Alireza Jolfaei, Usman Tariq, et al. Antlion re-sampling based deep neural net-
work model for classifcation of imbalanced multimodal stroke dataset. Multimedia Tools and
Applications, 1–25, 2020.
[6] Nirmal Kr Biswas, Sourav Banerjee, Utpal Biswas, and Uttam Ghosh. An approach towards
development of new linear regression prediction model for reduced energy consumption and sla
violation in the domain of green cloud computing. Sustainable Energy Technologies and Assess-
ments, 45:101087, 2021.
[7] Ariel Bleicher et al. Millimeter waves may be the future of 5g phones. IEEE Spectrum, 8, 2013.
[8] Vikram Chandrasekhar, Jefrey G. Andrews, and Alan Gatherer. Femtocell networks: A survey.
IEEE Communications Magazine, 46(9):59–67, 2008.
[9] Xiao Chen, Martin A. Eder, and A.S.M. Shihavuddin. A concept for human-cyberphysical systems
of future wind turbines towards industry 5.0. DTU Library, 2020.10.36227/techrxiv.13106108.v1,
[10] Debashis Das, Sourav Banerjee, Kousik Dasgupta, Pushpita Chatterjee, Uttam Ghosh, and Utpal
Biswas. Blockchain enabled sdn framework for security management in 5g applications. In 24th
International Conference on Distributed Computing and Networking, Association for Comput-
ing Machinery, 414–419, 2023.
[11] Ignacio de la Peña Zarzuelo, María Jesús Freire Soeane, and Beatriz López Bermúdez. Industry
4.0 in the port and maritime industry: A literature review. Journal of Industrial Information
Integration, 20:100173, 2020.
[12] Caterine Silva De Oliveira, Cesar Sanin, and Edward Szczerbicki. Visual content representation and
retrieval for cognitive cyber physical systems. Procedia Computer Science, 159:2249–2257, 2019.
[13] Natarajan Deepa, B. Prabadevi, Praveen Kumar Maddikunta, Thippa Reddy Gadekallu, Thar
Baker, M. Ajmal Khan, and Usman Tariq. An ai-based intelligent system for healthcare analy-
sis using ridge-adaline stochastic gradient descent classifer. The Journal of Supercomputing,
77(2):1998–2017, 2021.
[14] Kadir Alpaslan Demir, Goĺzde Doĺven, and Buĺlent Sezen. Industry 5.0 and human-robot co-
working. Procedia Computer Science, 158:688–695, 2019.
78 Secure and Smart Cyber-Physical Systems
[15] Edward R. Grifor, Christopher Greer, David A. Wollman, Martin J. Burns, et al. Framework for
cyber-physical systems: Volume 1, overview. National Institute of Standards and Technology,
U.S. Department of Commerce, 2017.
[16] Fourat Haider, Cheng-Xiang Wang, Harald Haas, Dongfeng Yuan, Haiming Wang, Xiqi Gao, Xiao-
Hu You, and Erol Hepsaydir. Spectral efciency analysis of mobile femtocell based cellular systems.
In 2011 IEEE 13th international conference on communication technology, 347–351. IEEE, 2011.
[17] Abid Haleem and Mohd Javaid. Industry 5.0 and its applications in orthopaedics. Journal of
Clinical Orthopaedics & Trauma, 10(4):807–808, 2019.
[18] Debiao He, Mimi Ma, Sherali Zeadally, Neeraj Kumar, and Kaitai Liang. Certifcateless public
key authenticated encryption with keyword search for industrial internet of things. IEEE Trans-
actions on Industrial Informatics, 14(8):3618–3627, 2017.
[19] Petri Helo, Duy Phuong, and Yuqiuge Hao. Cloud manufacturing—scheduling as a service for
sheet metal manufacturing. Computers & Operations Research, 110:208–219, 2019.
[20] Xuemin Hong, Cheng-xiang Wang, Hsiao-hwa Chen, and Yan Zhang. Secondary spectrum ac-
cess networks. IEEE Vehicular Technology Magazine, 4(2):36–43, 2009.
[21] Miao Hu, Xianzhuo Luo, Jiawen Chen, Young Choon Lee, Yipeng Zhou, and Di Wu. Virtual
reality: A survey of enabling technologies and its applications in IoT. Journal of Network and
Computer Applications, 178:102970, 2021.
[22] Dmitry Ivanov and Alexandre Dolgui. New disruption risk management perspectives in supply
chains: Digital twins, the ripple efect, and resileanness. IFAC-PapersOnLine, 52(13):337–342,
2019.
[23] Mohd Javaid, Ibrahim Haleem Khan, Ravi Pratap Singh, Shanay Rab, and Rajiv Suman. Explor-
ing contributions of drones towards industry 4.0. Industrial Robot: The International Journal of
Robotics Research and Application, 49(3):476-490, 2021.
[24] Ibrahim Haleem Khan and Mohd Javaid. Role of internet of things (IoT) in adoption of industry
4.0. Journal of Industrial Integration and Management, 2150006, 2021.
[25] Jin Ho Kim. A review of cyber-physical system research relevant to the emerging it trends: Indus-
try 4.0, IoT, big data, and cloud computing. Journal of Industrial Integration and Management,
2(3):1750011, 2017.
[26] Bo-Hu Li, Lin Zhang, Shi-Long Wang, Fei Tao, Jun Wei Cao, Xiao Dan Jiang, Xiao Song, and
Xu Dong Chai. Cloud manufacturing: A new service-oriented networked manufacturing model.
Computer Integrated Manufacturing Systems, 16(1):1–7, 2010.
[27] Ling Li. China’s manufacturing locus in 2025: With a comparison of “made-in-China 2025” and
“industry 4.0”. Technological Forecasting and Social Change, 135:66–74, 2018.
[28] Ling Li. Education supply chain in the era of industry 4.0. Systems Research and Behavioral Sci-
ence, 37(4):579–592, 2020.
[29] Yongkui Liu, Xun Xu, Lin Zhang, and Fei Tao. An extensible model for multitask-oriented
service composition and scheduling in cloud manufacturing. Journal of Computing and Informa-
tion Science in Engineering, 16(4), 2016.
[30] Yang Lu. Cyber physical system (cps)-based industry 4.0: A survey. Journal of Industrial Integra-
tion and Management, 2(3):1750014, 2017.
[31] Yang Lu. Industry 4.0: A survey on technologies, applications and open research issues. Journal
of Industrial Information Integration, 6:1–10, 2017.
[32] Praveen Kumar Reddy Maddikunta, Quoc-Viet Pham, B. Prabadevi, Natarajan Deepa, Kapal
Dev, Thippa Reddy Gadekallu, Rukhsana Ruby, and Madhusanka Liyanage. Industry 5.0: A
survey on enabling technologies and potential applications. Journal of Industrial Information
Integration, 26:100257, 2022.
[33] Riman Mandal, Manash Kumar Mondal, Sourav Banerjee, and Utpal Biswas. An approach to-
ward design and development of an energy-aware vm selection policy with improved SLA violation
in the domain of green cloud computing. The Journal of Supercomputing, 76(9):7374–7393, 2020.
[34] Riman Mandal, Manash Kumar Mondal, Sourav Banerjee, Pushpita Chatterjee, Wathiq Man-
soor, and Utpal Biswas. Design and implementation of an sla and energy-aware vm placement
policy in green cloud computing. In 2022 IEEE Globecom Workshops (GC Wkshps), IEEE, Rio
de Janeiro, Brazil, 777–782, 2022.
[35] Riman Mandal, Manash Kumar Mondal, Sourav Banerjee, Pushpita Chatterjee, Wathiq Man-
soor, and Utpal Biswas. PBV MSP: A priority-based vm selection policy for vm consolidation in
Toward Fast Reliable Intelligent Industry 5.0 79
green cloud computing. In 2022 5th International Conference on Signal Processing and Informa-
tion Security (ICSPIS), Dubai, IEEE, United Arab Emirates, 32–37, 2022.
[36] Riman Mandal, Manash Kumar Mondal, Sourav Banerjee, Gautam Srivastava, Waleed Alnu-
may, Uttam Ghosh, and Utpal Biswas. Mecpvms: An SLA aware energy-efcient virtual machine
selection policy for green cloud computing. Cluster Computing, 1–15, 2022.
[37] Jose Antonio Marmolejo-Saucedo, Margarita Hurtado-Hernandez, and Ricardo Suarez-Valdes.
Digital twins in supply chain management: A brief literature review. In International Conference
on Intelligent Computing & Optimization, 653–661. Springer, 2019.
[38] Manash Kumar Mondal and Madhab Bandyopadhyay. A comparative study between cloud
computing and fog computing. Brainwave: A Multidisciplinary Journal, 2(1):36–42, 2021.
[39] Manash Kumar Mondal, Riman Mandal, Sourav Banerjee, Utpal Biswas, Pushpita Chatterjee,
and Waleed Alnumay. A CPS based social distancing measuring model using edge and fog com-
puting. Computer Communications, 194:378–386, 2022.
[40] Manash Kumar Mondal, Riman Mandal, Sourav Banerjee, Utpal Biswas, Jerry Chun-Wei Lin,
Osama Alfarraj, and Amr Tolba. Design and development of a fog-assisted elephant corridor
over a railway track. Sustainability, 15(7):5944, 2023.
[41] Saeid Nahavandi. Industry 5.0—a human-centric solution. Sustainability, 11(16):4371, 2019.
[42] Quoc-Viet Pham, Kapal Dev, Praveen Kumar Reddy Maddikunta, Thippa Reddy Gadekallu,
Thien Huynh-The, et al. Fusion of federated learning and industrial internet of things: A survey.
arXiv preprint arXiv:2101.00798, 2021.
[43] V. Priya, I. Sumaiya Thaseen, Thippa Reddy Gadekallu, Mohamed K. Aboudaif, and Emad
Abouel Nasr. Robust attack detection approach for IIoT using ensemble classifer. arXiv preprint
arXiv:2102.01515, 2021.
[44] Fredrik Rusek, Daniel Persson, Buon Kiong Lau, Erik G. Larsson, Thomas L. Marzetta, Ove
Edfors, and Fredrik Tufvesson. Scaling up mimo: Opportunities and challenges with very large
arrays. IEEE Signal Processing Magazine, 30(1):40–60, 2012.
[45] Manuel Sanchez, Ernesto Exposito, and Jose Aguilar. Autonomic computing in manufacturing
process coordination in industry 4.0 context. Journal of Industrial Information Integration,
19:100159, 2020.
[46] Mahak Sharma, Rajat Sehrawat, Sunil Luthra, Tugrul Daim, and Dana Bakry. Moving towards
industry 5.0 in the pharmaceutical manufacturing sector: Challenges and solutions for Germany.
IEEE Transactions on Engineering Management, pp. 1–18 2022.
[47] Pradip Kumar Sharma, Neeraj Kumar, and Jong Hyuk Park. Blockchain-based distributed
framework for automotive industry in a smart city. IEEE Transactions on Industrial Informat-
ics, 15(7):4197–4205, 2018.
[48] Rahul Sindhwani, Shayan Afridi, Anil Kumar, Audrius Banaitis, Sunil Luthra, and Punj Lata
Singh. Can industry 5.0 revolutionize the wave of resilience and social value creation? A multi-
criteria framework to analyze enablers. Technology in Society, 68:101887, 2022.
[49] Fei Tao, Lin Zhang, V.C. Venkatesh, Y. Luo, and Ying Cheng. Cloud manufacturing: A comput-
ing and service-oriented manufacturing model. Proceedings of the Institution of Mechanical
Engineers, Part B: Journal of Engineering Manufacture, 225(10):1969–1976, 2011.
[50] Fei Tao, Ying Zuo, Li Da Xu, and Lin Zhang. IoT-based intelligent perception and access of
manufacturing resource toward cloud manufacturing. IEEE Transactions on Industrial Infor-
matics, 10(2):1547–1557, 2014.
[51] Ozan Alp Topal, Mehmet Ozgun Demir, Zekai Liang, Ali Emre Pusane, Guido Dartmann, Gerd
Ascheid, and Gunes Karabulut Kur. A physical layer security framework for cognitive cyber-
physical systems. IEEE Wireless Communications, 27(4):32–39, 2020.
[52] Jef Verrant. Building digital trust with 5G, 2020. https://gcn.com/cybersecurity/2020/11/
building-digital-trust-with-5g/315413/.
[53] Cheng-Xiang Wang, Fourat Haider, Xiqi Gao, Xiao-Hu You, Yang Yang, Dongfeng Yuan,
Hadi M. Aggoune, Harald Haas, Simon Fletcher, and Erol Hepsaydir. Cellular architecture and
key technologies for 5g wireless communication networks. IEEE Communications Magazine,
52(2):122–130, 2014.
[54] Shulan Wang, Haiyan Wang, Jianqiang Li, Huihui Wang, Junaid Chaudhry, Mamoun Ala-
zab, and Houbing Song. A fast cp-abe system for cyber-physical security and privacy in mobile
healthcare network. IEEE Transactions on Industry Applications, 56(4):4467–4477, 2020.
80 Secure and Smart Cyber-Physical Systems
[55] Li Da Xu. The contribution of systems science to industry 4.0. Systems Research and Behavioral
Science, 37(4):618–631, 2020.
[56] Li Da Xu. Industry 4.0—frontiers of fourth industrial revolution. Systems Research and Behav-
ioral Science, 37(4):531–534, 2020.
[57] Li Da Xu and Lian Duan. Big data for cyber physical systems in industry 4.0: A survey. Enter-
prise Information Systems, 13(2):148–169, 2019.
[58] Li Da Xu, Eric L Xu, and Ling Li. Industry 4.0: State of the art and future trends. International
Journal of Production Research, 56(8):2941–2962, 2018.
[59] Xun Xu. From cloud computing to cloud manufacturing. Robotics and Computer-Integrated
Manufacturing, 28(1):75–86, 2012.
[60] Xun Xu, Yuqian Lu, Birgit Vogel-Heuser, and Lihui Wang. Industry 4.0 and industry 5.0—incep-
tion, conception and perception. Journal of Manufacturing Systems, 61:530–535, 2021.
[61] Hasan Yetȷfs and Mehmet Karakoĺse. Optimization of mass customization process using quan-
tum-inspired evolutionary algorithm in industry 4.0. In 2020 IEEE International Symposium on
Systems Engineering (ISSE), 1–5. IEEE, 2020.
[62] Caiming Zhang and Yong Chen. A review of research relevant to the emerging industry trends:
Industry 4.0, IoT, blockchain, and business analytics. Journal of Industrial Integration and
Management, 5(1):165–180, 2020.
Chapter 4
Chapter Contents
4.1 Introduction 81
4.1.1 Types of Software for Medical Devices 83
4.1.1.1 Software as a Medical Device (SaMD) 83
4.1.2 Scope of Medical Device Software Development 83
4.1.3 Role and Signifcance of Medical Device Software in Healthcare 84
4.2 Background 86
4.3 Challenges in Software Development for Medical Devices 86
4.3.1 Regulatory Compliance and Approval Processes 86
4.3.2 Ensuring the Safety and Reliability of Software 88
4.3.3 Integration with Hardware and Existing Healthcare Systems 89
4.4 Software Development Life Cycle (SDLC) for Medical Devices 91
4.5 Regulatory Compliance and Standards 93
4.5.1 FDA Regulations for Medical Device Software (e.g., 21 CFR Part 820) 93
4.6 Best Practices in Software Development FOR Medical Devices 94
4.7 Software Verifcation and Validation 96
4.7.1 Validation in Real-World Clinical Settings 97
4.8 Cybersecurity and Data Privacy 97
4.9 Future Trends in Software Development for Medical Devices 99
4.10 Conclusion 99
Bibliography 100
4.1 Introduction
The Internet of Medical Things (IoMT) refers to the network of interconnected medical
devices and systems that collect and exchange health data in real time [9, 46]. The prolifera-
tion of IoMT devices has led to a surge in sensitive health data, including patient electronic
health records, diagnostics, treatment plans, and more. IoMT is evolving rapidly, driven
by emerging technologies that are transforming healthcare and medical practices. Artifcial
Intelligence (AI) and Machine Learning (ML) are revolutionizing IoMT by enabling predic-
tive analytics, disease diagnosis, and treatment optimization [8]. AI/ML algorithms can
analyze large datasets from the medical devices to identify trends, predict patient outcomes,
and personalize treatment plans [4, 39]. Edge computing in medical system can play an
important role for processing the vast amount of critical medical data locally in real time
and reducing the latency. Blockchain technology [25] can be applied to enhance the data
integrity, security, and patient privacy in medical systems. Moreover, 5G networks enable
DOI: 10.1201/9781003376712-4
82 Secure and Smart Cyber-Physical Systems
real-time monitoring, high-quality video consultations, and the rapid exchange of medical
data among devices, physicians, and patients [10].
In contemporary times, the integration of software has emerged as a fundamental compo-
nent within medical devices, ushering in a transformative era for the healthcare sector. This
infuence extends across a spectrum of applications, ranging from diagnostic instruments to
implantable devices, where software assumes a pivotal role in elevating both the functional-
ity and efectiveness of these medical tools.
Software as a Medical Device (SaMD) [17] is a software that performs a medical function
independently, without being an integral part of a physical medical device. SaMD encom-
passes a wide range of applications, including software that aids in the display, processing,
analysis, or evaluation of medical images. Additionally, it includes software that manages the
functionality of a connected medical device, like a pacemaker, and software that provides es-
sential parameters for the operation of diferent medical devices or software. SaMD is versa-
tile and can operate on various platforms, such as smartphones, computers, or cloud servers.
In Figure 4.1, we can observe various examples of medical devices commonly employed
within healthcare settings. These devices play pivotal roles in tasks such as diagnosing,
monitoring, and treating a variety of medical conditions [23].
Software-Driven Medical Devices (SdMDs) include hardware medical devices with sig-
nifcant software components such as Software in Medical Devices (SiMD). SiMD includes
software that helps to run a hardware medical device by powering its mechanics or produc-
ing a graphical interface. Some examples of SiMD [54] include:
This chapter will explore the various aspects of software development in medical devices,
including the challenges, regulations, and best practices involved in this specialized feld.
Before initiating a new project, it is necessary to properly identify the needs for your medical
device software development, as the scope and technology can vary greatly. Embedded cod-
ing and Software as a Medical Device (SaMD) are examples of this. The bulk of real-world
medical equipment startups and initiatives employ a mix of technologies. Let’s look at the
important areas of medical device software development [29].
Embedded Medical Systems and the Development of Embedded Medical Software: This do-
main encompasses the low-level programming of micro-components such as microcontrollers
and microchips that are combined with microprocessors and embedded memory. These com-
ponents are typically found within the inner workings of various healthcare devices [20]. Medi-
cal equipment that use embedded systems driven or confgured by embedded code include
pulse oximeters, electronic defbrillators, smart (bio)sensors, automated infusion pumps, glu-
cometers, electronic thermometers, electronic blood pressure sensors, a wide range of labora-
tory equipment, and medical imaging equipment such as X-ray, ECG, EEG, MRI, and CT.
Embedded programming plays an important role in healthcare equipment and biomedi-
cal applications because it regulates the operation of numerous electronic components and
allows medical devices to be integrated with nonspecifc or general-purpose software and
hardware. This integration may encompass PCs, EHRs, Wi-Fi, and other systems [5].
While some medical devices just require basic programming abilities for embedded sys-
tem development, some projects necessitate considerable knowledge of healthcare device
engineering. Programming and calibrating all of the embedded electronics in a large and
complex machine, such as a modern MRI tomograph, require signifcant skill.
The process of planning, producing, and deploying software solutions specifcally for medi-
cal devices used in healthcare settings is referred to as medical device software development.
84 Secure and Smart Cyber-Physical Systems
These gadgets cover a broad spectrum of technology, such as monitoring tools, treatment
systems, diagnostic equipment, and therapeutic software.
The main goal of developing software for medical devices is to improve patient care by
utilizing software skills to ofer advanced functions, increase accuracy, and facilitate bet-
ter healthcare results. It entails the creation of software programs that interact with the
hardware elements of medical apparatus to form an integrated system that aids medical
practitioners in the diagnostic, observation, and therapeutic processes.
The development of medical device software goes beyond conventional software develop-
ment techniques since it requires a thorough knowledge of the medical industry, regulatory
compliance, and the particular difculties and factors present in healthcare contexts. It cov-
ers the whole process of developing software, from gathering requirements to creating the
software architecture through coding, testing, validation, obtaining regulatory approval,
and continuous maintenance [15].
The scope of medical device software development covers a number of areas, including
the following:
Diagnostic Devices: Software applications that aid in the detection and diagnosis of medical
conditions, such as imaging software for radiology or pathology.
Monitoring Devices: Software solutions are used for continuous monitoring of vital signs,
patient data, and physiological parameters, such as remote patient monitoring systems
or wearable devices.
Treatment Systems: Software integrated with medical devices to deliver specifc treatments or
therapies, such as software-controlled infusion pumps or radiation-therapy-planning software.
Data Analysis and Decision Support: Software applications that analyze and interpret medi-
cal data and support healthcare professionals in making informed decisions and treat-
ment planning.
User Interfaces and Medical Visualization: Software components that provide intuitive and
user-friendly interfaces for healthcare professionals and patients, facilitating efcient in-
teraction with medical devices.
Connectivity and Interoperability: Software solutions that enable seamless integration and
communication among medical devices, hospital information systems, electronic health
records, and other healthcare infrastructure.
Due to the crucial nature of medical device software, it must be developed by regulatory
requirements, quality assurance procedures, and industry-specifc best practices. To ensure
the efcient and secure operation of medical devices and the provision of high-quality pa-
tient care, it is imperative to address the specifc difculties related to safety, dependability,
regulatory compliance, and data security [12].
The signifcance, difculties, life cycle, regulatory requirements, best practices, and data
privacy and security issues related to medical device software development will all be dis-
cussed in the parts that follow. To promote innovation, guarantee patient safety, and op-
timize healthcare results in the quickly developing feld of medical technology, developers,
healthcare practitioners, and regulatory agencies need to comprehend these factors.
Modern healthcare systems depend heavily on medical device software, which has revolutionized
patient care, diagnosis, and treatment outcomes [16]. Its importance can be seen in several ways:
Software Development for Medical Devices 85
Enhanced functionality and accuracy: Software plays a vital role in enhancing the function-
ality and accuracy of medical devices. Through software, medical devices can perform
complex calculations, automate processes, and provide advanced features that were pre-
viously not possible. For example, the software can enable a precise control of medical
devices, allowing for accurate dosage delivery in drug administration or precise surgical
interventions. Software-driven algorithms can also enhance diagnostic device accuracy,
improving test results’ reliability and aiding in early detection and treatment [14].
Remote monitoring and connectivity: The software enables medical devices to establish con-
nectivity and facilitate remote monitoring of patients. This capability is especially valuable in
telemedicine and remote patient-monitoring scenarios. Through software, medical devices
can transmit data in real time to healthcare professionals or centralized systems, enabling
remote monitoring of vital signs, tracking patient progress, and facilitating timely interven-
tions. Remote monitoring and connectivity enhance patient convenience, reduce the need
for hospital visits, and improve access to healthcare in remote or underserved areas [21].
Real-time data analysis and decision support: Software in medical devices allows for real-
time data analysis and decision support. By processing and analyzing data collected
by medical devices, the software can provide valuable insights and support healthcare
professionals in making informed decisions [51]. Real-time data analysis helps detect
patterns, trends, and anomalies, enabling early intervention and personalized treatment
plans. Software algorithms can also provide decision support, such as suggesting optimal
treatment options or alerting healthcare professionals to critical situations, leading to
more efcient and efective healthcare delivery [30].
Improved patient outcomes and safety: The integration of software in medical devices con-
tributes to improved patient outcomes and safety. Software can aid in the prevention,
early detection, and management of medical conditions. For example, software-enabled
monitoring devices can detect irregularities in vital signs and alert healthcare profession-
als, enabling timely intervention and reducing the risk of adverse events. Additionally,
software-driven automation minimizes human errors in tasks like medication adminis-
tration or data recording. By enhancing patient outcomes and safety, software in medical
devices positively impacts healthcare quality and patient satisfaction [19, 22].
Operational efciency and workfow streamlining: Medical device software improves oper-
ational efciency in healthcare environments by automating procedures and streamlining
workfows. Data entry, documentation, and reporting tasks can all be automated, which
eases the administrative burden on medical staf. This increase in productivity enables
them to concentrate more on patient care, spend less time on mundane duties, and reduce
errors associated with manual data management [42].
Reduction of errors and adverse events: By minimizing errors and unfavorable outcomes, med-
ical device software improves patient safety. Automated systems can carry out error checks,
identify potential problems, and notify healthcare practitioners of any issues. The danger of
pharmaceutical errors is reduced by software-integrated devices that assure precise medicine
delivery, dosage computations, and protocol adherence. In addition, it is possible to include
software-driven safety systems to stop injury in dangerous circumstances [6].
Fostering innovation and advancements: Medical device software fosters innovation in
healthcare by enabling the development of new diagnostic and therapeutic techniques. It
allows for the integration of emerging technologies like artifcial intelligence (AI), machine
learning, the Internet of Things (IoT), and cloud computing. These advancements facilitate
the creation of smart devices, personalized medicine approaches, and real-time data analy-
sis, leading to improved patient outcomes and advancements in medical research [18].
86 Secure and Smart Cyber-Physical Systems
4.2 Background
With the introduction of digital technology in recent years, the healthcare sector has un-
dergone substantial development. Medical device software, for example, is critical in aid-
ing diagnoses, therapy, and patient care. Medical device software has become an essential
component of modern healthcare delivery, ranging from embedded software in medical
equipment to mobile applications and cloud-based platforms [34].
The vital role of medical device software resides in its ability to boost clinical results,
increase patient safety, expedite healthcare operations, and enable remote monitoring and
telemedicine. These software solutions help healthcare practitioners to collect, and analyze
patient data, giving them vital insights for accurate diagnosis, personalized therapies, and
continuous monitoring of patient’s health states. Furthermore, medical device software al-
lows for the seamless integration and interoperability of various healthcare systems, ena-
bling efcient information sharing and collaboration among healthcare practitioners [50].
Yet, developing medical device software is not without its difculties. The healthcare
industry’s unique characteristics, tight regulatory standards, the necessity for thorough test-
ing and validation, and the complexity of combining software with hardware components
all provide signifcant challenges. Furthermore, due to the sensitive nature of patient health
information and the increasing possibility of cybersecurity breaches, protecting data privacy
and security become critical.
To solve these issues, healthcare organizations and software developers must navigate a
complicated terrain that includes regulatory regulations, best practices, and data privacy
and security concerns. Compliance with regulatory standards, such as those established
by regulatory agencies such as the United States Food and Drug Administration (FDA)
[38] and international standards such as IEC 62304, guarantees that medical device soft-
ware meets quality and safety requirements. Best practices in software development, such
as adhering to certain processes, documentation, and traceability, aid in ensuring the stabil-
ity and efectiveness of medical device software. Furthermore, to protect against potential
breaches and unauthorized access, rigorous data protection measures and the incorporation
of strong security systems become necessary.
Adhering to regulatory standards and obtaining necessary approvals are critical aspects of
medical device software development. Regulatory bodies, such as the US Food and Drug
Software Development for Medical Devices 87
This classifcation scheme is similar to ISO 14971 [28] Clauses 4.4, 5, and 6.1. In the case
of safety-critical software systems, they can be divided into individual items, with each item
running a diferent software element, each having its own safety classifcation. These items
can be further subdivided into additional software elements. The overall classifcation of the
software system is determined by the highest classifcation among all the software elements
it contains. For instance, if a software system comprises fve software elements, with four
classifed as Class A and one as Class C, the overall device would be classifed as Class C.
This concept is illustrated in Figure 4.2.
However, IEC 62304 [31] allows for the segregation of a specifc software item from the
overall software system. This means that the segregated software item can independently
receive a lower safety classifcation.
The process of regulatory compliance involves several stages throughout the software
development life cycle. From the initial design phase, developers need to consider regulatory
requirements, including risk management, documentation, and quality management sys-
tems. Robust documentation, including design specifcations, hazard analysis, and software
validation plans, is essential to demonstrate compliance.
Testing and validation are crucial steps in the approval process. Developers must conduct
comprehensive testing, including software verifcation and validation, to ensure that the
software meets predefned requirements and functions as intended. Validation involves veri-
fying that the software performs safely and efectively within its intended use.
Post-market surveillance is equally important. Developers must establish processes to
monitor and address any potential risks or issues that may arise after the software is re-
leased to the market. This includes collecting feedback, conducting post-market studies, and
promptly addressing any reported adverse events or complaints [11].
Achieving compliance requires collaboration among cross-functional teams, including
software engineers, regulatory experts, quality assurance personnel, and legal advisors. Es-
tablishing a clear regulatory strategy early in the development process is essential to stream-
line the approval process and avoid unnecessary delays.
Additionally, it is crucial to stay informed about changes in regulatory requirements and
evolving best practices. Regularly monitoring updates from regulatory bodies and partici-
pating in industry conferences, workshops, and forums can help developers stay ahead of
regulatory changes and ensure ongoing compliance.
Overcoming the challenges of regulatory compliance and approval processes requires a
comprehensive understanding of the regulations, meticulous planning, and proactive en-
gagement with regulatory authorities. By investing the necessary time, resources, and exper-
tise, developers can navigate the regulatory landscape and bring safe and compliant medical
device software to market.
Ensuring the safety and reliability of medical device software is of paramount importance in
healthcare. Patient safety heavily relies on the accurate and error-free functioning of software
that drives medical devices. A single software glitch or malfunction could have serious con-
sequences for patient health and well-being. Therefore, developers must take comprehensive
measures to mitigate risks and ensure the safety and reliability of medical device software [2].
One crucial aspect of achieving safety and reliability is implementing robust risk manage-
ment processes throughout the software development life cycle. This involves identifying
and assessing potential risks associated with the software, its interactions with hardware
components, and its impact on patient care. By conducting thorough risk assessments, de-
velopers can identify potential hazards and take necessary steps to mitigate or eliminate
them. Risk management also involves considering factors such as software complexity, po-
tential failure modes, and the severity of potential harm to patients [52].
Rigorous testing and quality assurance play a vital role in validating the safety and reli-
ability of medical device software. Various testing methodologies, including functional
testing, performance testing, and interoperability testing, should be employed to assess
the software’s behavior under diferent scenarios. Rigorous testing helps identify and
rectify software defects, ensures compliance with functional requirements, and verifes
that the software performs as intended. Additionally, conducting validation testing with
simulated or real-world data helps evaluate the accuracy and reliability of the software in
delivering desired outcomes [33].
Quality assurance measures should be implemented throughout the software develop-
ment process to maintain high standards of safety and reliability. This includes adhering
to industry best practices, following established software development methodologies, and
Software Development for Medical Devices 89
conducting comprehensive code reviews. Quality assurance also involves documenting soft-
ware development processes, maintaining traceability between requirements and design,
and establishing robust change control procedures [41].
To address vulnerabilities and potential security risks, medical device software develop-
ment should follow secure design and coding practices. This includes incorporating encryp-
tion techniques, secure authentication mechanisms, and secure communication protocols to
protect patient data and prevent unauthorized access. Ongoing vulnerability management
is essential to identify and address potential security vulnerabilities promptly, including
regular software updates, patch management, and security audits.
Collaboration with healthcare professionals, regulatory experts, and end users is crucial
in ensuring the safety and reliability of medical device software. By involving these stake-
holders throughout the development process, developers can gain valuable insights into the
specifc requirements, use cases, and potential risks associated with the software. Regular
communication, feedback loops, and user testing can help identify and address usability is-
sues, optimize workfows, and improve overall software performance and safety.
Integration with hardware and existing healthcare systems is a critical aspect of medical
device software development. Medical devices often rely on the integration of software
with various hardware components, sensors, and actuators to perform their intended
functions. Additionally, seamless interoperability with existing healthcare systems, such
as EHRs or HIS, is essential for data exchange, communication, and streamlined work-
fows. However, achieving smooth integration poses several challenges that need to be
addressed [53].
One of the main challenges is the heterogeneity of hardware devices and systems used in
healthcare settings. Diferent medical devices may employ diferent communication proto-
cols, data formats, and interfaces. Integrating software with such diverse hardware com-
ponents requires careful consideration and adaptation. The software must be designed to
handle the specifc communication requirements of each device and ensure data compat-
ibility and integrity [43].
Another challenge arises from the complex nature of the existing healthcare systems.
These systems may have their own unique data structures, workfow processes, and security
protocols. Medical device software needs to align with these systems to exchange data accu-
rately and securely. Achieving interoperability often requires collaboration with healthcare
IT professionals who possess the knowledge of the existing infrastructure and can provide
guidance on integrating the software efectively [13].
To overcome integration challenges, collaboration with hardware engineers and sys-
tem integrators is crucial. Hardware engineers can provide insights into the technical
specifcations, interfaces, and communication protocols of the devices. They can assist in
designing software interfaces that facilitate seamless communication with the hardware
components.
System integrators, on the other hand, play a vital role in bridging the gap between the
software and the existing healthcare systems. They possess expertise in integrating diferent
software systems, managing data exchange, and ensuring compatibility across platforms. Col-
laborating with system integrators helps ensure that the medical device software aligns with
the established standards and workfows of the healthcare environment [1].
90 Secure and Smart Cyber-Physical Systems
Risk management: Managing risks associated with medical device software is crucial to
ensure patient safety. Identifying potential hazards, conducting risk assessments, imple-
menting risk mitigation strategies, and documenting the risk management process re-
quire expertise and rigorous analysis. Balancing the need for innovative functionalities
with the need for risk reduction presents an ongoing challenge for developers.
Verifcation and validation: Validating the performance and safety of medical device soft-
ware is a complex task. Rigorous testing, including unit testing, integration testing, and
system testing, must be conducted to verify that the software meets the specifed require-
ments and functions as intended. Validating the software’s efectiveness in real-world
clinical scenarios through clinical evaluations and user acceptance testing adds an ad-
ditional layer of complexity [47].
Interoperability and integration: Medical devices often need to interact and exchange data
with other devices and systems within the healthcare ecosystem. Ensuring seamless inter-
operability and integration is a challenge, as diferent devices may use diferent commu-
nication protocols or data formats. Developers must address compatibility issues, design
standardized interfaces, and ensure secure and reliable data exchange [3, 45].
Software complexity: Medical device software can be highly complex, incorporating ad-
vanced algorithms, machine learning, and artifcial intelligence capabilities. Manag-
ing the complexity of such software, while ensuring its reliability, maintainability, and
usability, requires specialized skills and expertise. Developers must implement robust
software engineering practices, maintain clean and modular code, and ensure efective
documentation to handle the complexity efectively [6].
Usability and user-centered design: Medical device software must be designed with the
end users in mind, including healthcare professionals, patients, and caregivers. Ensuring
usability and user-centered design is a challenge due to the diverse user base, varying
levels of technical expertise, and specifc user requirements. Incorporating user feedback,
conducting usability testing, and iteratively improving the software’s usability present
ongoing challenges throughout the development process.
Data security and privacy: With the increasing connectivity of medical devices, data secu-
rity and privacy are critical concerns. Protecting patient data from unauthorized access,
ensuring secure data transmission, and complying with data privacy regulations require
robust cybersecurity measures. Developers must implement encryption, authentication
mechanisms, vulnerability management, and secure coding practices to safeguard patient
information.
Software Development for Medical Devices 91
Software maintenance and updates: Medical device software requires ongoing maintenance
and periodic updates to address bugs, vulnerabilities, and evolving regulatory require-
ments. Ensuring seamless software updates without disrupting device functionality, man-
aging software confguration, and maintaining version control present challenges for
developers. Balancing the need for updates with minimizing disruption to healthcare
workfows and patient care is a continuous challenge.
Requirements gathering: In this initial phase, the requirements for the software are iden-
tifed and documented. This involves understanding the intended use of the device,
Figure 4.3 IEC 62304: Summary of medical device software development life cycle.
92 Secure and Smart Cyber-Physical Systems
user needs, functional requirements, and any regulatory or quality requirements that
must be met. Requirements gathering may involve interactions with stakeholders,
including healthcare professionals, patients, regulatory bodies, and quality assurance
teams.
Design and architecture: Once the requirements are established, the software design and
architecture are developed. This phase involves defning the overall system architecture,
including hardware–software interfaces, data fows, and module interactions. Design de-
cisions are made to ensure that the software meets the intended use, is scalable, maintain-
able, and compliant with relevant standards and regulations.
Implementation: In this phase, the software is developed on the basis of the design specif-
cations. It involves coding, unit testing, and integration of software modules. Best prac-
tices for coding, such as following coding standards, using appropriate programming
languages, and applying secure coding practices, are crucial to ensure the quality and
reliability of the software.
Verifcation and validation: The verifcation and validation phase aims to ensure that the
developed software meets the specifed requirements and performs reliably. Verifcation
involves activities such as unit testing, integration testing, and system testing to identify
and fx defects. Validation involves evaluating the software’s performance in real-world
scenarios, often through clinical evaluations and user acceptance testing, to ensure that
it functions safely and efectively.
Risk management: Throughout the SDLC, risk management is a critical component. Risk
assessment and analysis are performed to identify potential hazards associated with the
software and to develop risk mitigation strategies. Manufacturers must conduct a thor-
ough risk analysis, implement risk control measures, and document the risk management
process to demonstrate the safe operation of the software.
Documentation and traceability: Comprehensive documentation is essential at each stage
of the SDLC. This includes documenting the software requirements, design specifca-
tions, test plans, verifcation and validation activities, and risk management processes.
Traceability matrices are used to establish and maintain traceability among requirements,
design elements, test cases, and risk controls.
Release and maintenance: Once the software is deemed ready for deployment, it undergoes
a release process that includes confguration management, version control, and docu-
mentation of the software release. After deployment, ongoing maintenance is crucial to
address any software updates, bug fxes, or enhancements. Post-market surveillance and
vigilance processes ensure a continuous monitoring of the software’s performance and
safety.
Figure 4.4 A simple breakdown of ISO and IEC Standards for SaMD.
4.5.1 FDA Regulations for Medical Device Software (e.g., 21 CFR Part 820)
The U.S. Food and Drug Administration (FDA) provides regulatory oversight for medical
devices including software. Compliance with FDA regulations is crucial for the develop-
ment, testing, and marketing of medical device software in the United States. One important
regulation is 21 CFR Part 820, which outlines the Quality System Regulation (QSR) for
medical devices.
21 CFR Part 820 specifes requirements for the establishment and maintenance of a qual-
ity management system (QMS) by medical device manufacturers as shown in Figure 4.4.
It covers various aspects of the development process, including design controls, document
controls, device history records, complaint handling, and corrective and preventive actions.
Compliance with these regulations ensures that medical device software is developed and
manufactured in a controlled and quality-oriented manner.
The FDA also provides guidance documents specifc to medical device software such as
the “General Principles of Software Validation” and the “Content of Premarket Submis-
sions for Software Contained in Medical Devices.” These guidance documents provide rec-
ommendations and expectations for the validation, documentation, and risk management
of medical device software [44].
International Standards (e.g., IEC 62304, ISO 13485): International standards play a sig-
nifcant role in guiding the development of medical device software and ensuring global regu-
latory compliance. Two notable standards in this context are IEC 62304 and ISO 13485 [48].
94 Secure and Smart Cyber-Physical Systems
IEC 62304: This standard provides guidance on the software life cycle processes for
medical device software. It defnes activities and tasks at each stage of the software develop-
ment life cycle, including requirements specifcation, architectural design, implementation,
verifcation, and validation. Adhering to IEC 62304 ensures that medical device software is
developed following a systematic and controlled process, with a specifc emphasis on risk
management and documentation [35].
ISO 13485: This standard specifes the requirements for a comprehensive quality manage-
ment system for medical devices. It provides guidance on establishing, implementing, and
maintaining the QMS throughout the entire product life cycle. Compliance with ISO 13485
demonstrates the manufacturer’s commitment to quality and regulatory compliance in the
development, production, installation, and servicing of medical device software. These in-
ternational standards help harmonize practices and ensure consistency in the development
of medical device software across diferent regions. Adhering to these standards enhances
the safety, quality, and performance of the software and facilitates regulatory compliance
in various markets [55].
Risk Management Frameworks (e.g., ISO 14971): Risk management is a crucial aspect of
medical device software development, and ISO 14971 is a widely recognized standard for
managing risks associated with medical devices.
ISO 14971 provides guidance on establishing a risk management process throughout the
entire life cycle of a medical device, including its software components. The standard out-
lines a systematic approach to identify, analyze, evaluate, and control risks associated with
the device and its software. It emphasizes the importance of risk mitigation and ongoing
risk assessment to ensure the safety and efectiveness of the software.
Complying with ISO 14971 involves conducting a comprehensive risk analysis, assessing
the probability and severity of potential hazards, implementing risk control measures, and
monitoring the efectiveness of these measures. The standard also emphasizes the impor-
tance of maintaining a risk management fle that documents the risk management activities
and decisions throughout the development process.
By adopting risk management frameworks like ISO 14971, medical device software de-
velopers can systematically identify and address potential risks, enhance the safety and
reliability of the software, and meet regulatory requirements related to risk management.
These frameworks help ensure that potential risks are proactively managed, reducing the
likelihood of adverse events and promoting patient safety [55].
Software testing and validation: Robust testing and validation processes are essential to
ensure the reliability and safety of medical device software. This includes comprehen-
sive unit testing, integration testing, system testing, and validation in real-world clinical
settings. Rigorous testing helps identify and fx defects, ensure the software meets the
specifed requirements, and validate its performance and accuracy. The use of automated
testing frameworks and tools can expedite the testing process and improve efciency [40,
49].
Documentation and traceability: Comprehensive documentation is crucial throughout the
software development life cycle. This includes documenting software requirements, de-
sign specifcations, test plans, risk management processes, and any changes made during
the development process. Documentation facilitates transparency, reproducibility, and
compliance with regulatory requirements. Additionally, maintaining traceability matri-
ces helps establish and maintain traceability between requirements, design elements, test
cases, and risk controls [24].
Collaboration and cross-functional teams: Promoting collaboration among cross-functional
teams is essential for successful software development in medical devices. This includes
close collaboration between software developers, regulatory experts, clinical profession-
als, quality assurance personnel, and other stakeholders. Collaborative environments fos-
ter efective communication, knowledge sharing, and problem-solving. By involving all
relevant stakeholders throughout the development process, the resulting software aligns
with regulatory requirements, user needs, and quality standards [56].
Risk management: Risk management is a critical aspect of software development for medi-
cal devices. Manufacturers must conduct a thorough risk analysis, identify potential haz-
ards associated with the software, and implement risk control measures. It is important
to document the risk management process and maintain traceability between identifed
risks and implemented risk controls. Regularly reviewing and updating the risk manage-
ment documentation ensure that potential risks are addressed throughout the device’s
life cycle [26].
Usability and user-centered design: Considering usability and adopting a user-centered de-
sign approach are essential for medical device software. Understanding the needs, ca-
pabilities, and workfows of the end users, including healthcare professionals, patients,
and caregivers, helps design intuitive and user-friendly interfaces. Conducting usability
studies, gathering user feedback, and incorporating user-centered design principles con-
tribute to the development of software that is efcient, and efective, and enhances user
satisfaction [27].
Cybersecurity and data privacy: With the increasing connectivity of medical devices, ro-
bust cybersecurity measures and data privacy practices are crucial. Implementing secu-
rity controls, encryption mechanisms, access controls, and vulnerability management
processes helps protect against unauthorized access, data breaches, and cyber threats.
Adhering to data privacy regulations, such as the General Data Protection Regulation
(GDPR), ensures the proper handling and protection of patient data throughout the soft-
ware development process [32].
Post-market surveillance and maintenance: Post-market surveillance and ongoing mainte-
nance are important aspects of software development for medical devices. Establishing
processes for monitoring the performance, safety, and efectiveness of the software in
real-world settings allows for the timely identifcation and mitigation of any issues that
96 Secure and Smart Cyber-Physical Systems
may arise. Regular software updates, bug fxes, and enhancements should be carried out
to address potential vulnerabilities and ensure the software remains up-to-date [7].
By following these best practices, manufacturers can enhance the quality, reliability, and
safety of medical device software. Incorporating agile methodologies, rigorous testing, efective
documentation, and ongoing validation processes are essential steps in achieving these goals.
Unit testing: Unit testing involves testing individual components or units of the software
to ensure they function correctly. Developers write test cases to verify the behavior of
specifc functions, modules, or classes. By isolating and testing individual units, defects
and errors can be identifed early in the development process. Unit testing ensures that
the building blocks of the software are reliable, enhancing the overall quality of the
fnal product.
Integration testing: Integration testing verifes the interaction and interoperability between
diferent components or modules of the software. It ensures that the integrated system
functions as expected and that data fows correctly between various modules. Integration
testing helps detect issues related to communication, data integrity, and dependencies
between diferent software components. By validating the integration, the overall perfor-
mance and functionality of the software can be ensured.
Figure 4.5 Software Verification and Validation (V&V) for medical devices.
Software Development for Medical Devices 97
System testing: System testing evaluates the entire medical device software system as a whole.
It focuses on validating the system’s compliance with functional and non-functional re-
quirements, including user interfaces, system behavior, and performance. System testing
involves executing test scenarios that simulate real-world usage conditions, ensuring that
the software operates as intended in diferent scenarios. By testing the system in a compre-
hensive manner, potential defects or shortcomings can be identifed and addressed.
Verifcation and validation testing: Verifcation and validation (V&V) testing is a comprehensive
testing process that ensures that the software meets the intended purpose and satisfes regula-
tory requirements, as shown in Figure 5.4. Verifcation testing involves assessing whether the
software has been developed according to the specifed requirements and design. Validation
testing, on the other hand, evaluates the software’s performance in real-world clinical settings
and verifes that it achieves the desired clinical outcomes. V&V testing provides evidence that
the software is ft for its intended purpose and meets the necessary quality standards.
Usability testing: Usability testing focuses on evaluating the user experience and the ease of
use of medical device software. It involves gathering feedback from users, such as health-
care professionals and patients, to assess the software’s intuitiveness, navigation, and
overall user satisfaction. Usability testing helps identify areas for improvement in terms
of user interface design, workfow efciency, and user satisfaction. Incorporating user
feedback through usability testing ensures that the software is user-friendly and meets
the needs of its intended users.
Validating the software in real-world clinical settings is a crucial step in ensuring its safety
and efectiveness. This involves testing the software with actual users, such as healthcare
professionals, in realistic healthcare environments. Real-world validation helps identify any
issues or challenges that may arise during actual usages, such as interoperability issues,
performance limitations, or usability concerns. By validating the software in real-world
scenarios, developers can refne and optimize its performance for practical clinical use.
By employing comprehensive software testing and validation processes, medical device
software developers can identify and address defects; ensure compliance with regulatory
requirements; and validate the software’s safety, reliability, and efectiveness. These test-
ing and validation eforts contribute to the overall quality and trustworthiness of medical
device software, ultimately enhancing patient safety and improving healthcare outcomes.
Security by design: Security should be an integral part of the software development pro-
cess, starting from the initial design phase. Adopting a security-by-design approach
involves identifying potential vulnerabilities, threat modeling, and incorporating secu-
rity controls into the software architecture. Developers need to follow industry best
98 Secure and Smart Cyber-Physical Systems
practices and coding standards that prioritize security. This includes using secure coding
frameworks; adhering to secure coding guidelines; and avoiding common vulnerabilities
such as bufer overfows, injection attacks, or insecure authentication mechanisms. By
adopting secure coding practices, developers can minimize the likelihood of software
vulnerabilities that could be exploited by malicious actors. This proactive approach
helps minimize security risks and ensures that security measures are implemented
throughout the development life cycle.
Threat modeling and risk assessment: Threat modeling involves identifying potential threats
and vulnerabilities that could compromise the security of medical device software. This
process helps prioritize security measures and allocate resources efectively. Conducting
a comprehensive risk assessment assists in identifying and assessing potential risks, their
impact, and the likelihood of occurrence. By understanding the specifc threats and risks
associated with the software, developers can implement targeted security measures to
mitigate vulnerabilities.
Secure communication and encryption: Medical device software often involves the transfer
of sensitive patient data, such as health records and diagnostic information. Ensuring
secure communication channels and encryption of data during transit is crucial. Imple-
menting robust encryption protocols, such as Transport Layer Security (TLS), helps pro-
tect data from unauthorized access or interception. Additionally, mechanisms like Public
Key Infrastructure (PKI) and digital signatures can enhance the integrity and authenticity
of transmitted data.
Access controls and user authentication: Implementing appropriate access controls and
user authentication mechanisms is vital to prevent unauthorized access to medical device
software. Strong authentication methods, such as two-factor authentication or biometric
authentication, can enhance user verifcation and limit access to authorized personnel.
Role-based access control (RBAC) can be employed to assign specifc privileges to difer-
ent user roles, ensuring that only authorized individuals can perform certain actions or
access sensitive data.
Vulnerability management and patching: Regular vulnerability assessments and patch
management are crucial to address security vulnerabilities and protect against emerg-
ing threats. Medical device software developers should actively monitor security vulner-
abilities, stay updated on security patches released by software and hardware vendors,
and promptly apply patches to address known vulnerabilities. Establishing a process for
ongoing vulnerability management and timely patch deployment helps mitigate the risk
of potential exploits.
Incident response and recovery: Developing an incident response plan is essential to ad-
dress security incidents efectively. This plan outlines the steps to be taken in the event
of a security breach, including containment, investigation, notifcation, and recovery.
Timely response and recovery measures help minimize the impact of security incidents
and facilitate the restoration of normal operations. Regular testing of the incident re-
sponse plan ensures its efectiveness and enables continuous improvement.
Compliance with regulatory requirements: Medical device software must comply with ap-
plicable regulatory requirements and standards, such as the FDA’s guidance on cyberse-
curity in medical devices or the European Union’s Medical Device Regulation (MDR).
Adhering to these regulations ensures that the software meets the necessary security and
privacy standards. Compliance with standards like ISO 27001 for information secu-
rity management systems and ISO 27799 for healthcare information security further
enhances the security posture of medical device software.
Software Development for Medical Devices 99
By incorporating robust cybersecurity and data privacy measures, medical device soft-
ware developers can protect sensitive patient data, prevent unauthorized access, and ensure
the safe and secure operation of medical devices. These measures not only safeguard patient
privacy but also contribute to maintaining the trust of healthcare providers and patients in
the digital healthcare ecosystem.
Artifcial intelligence and machine learning: Artifcial intelligence (AI) and machine learn-
ing (ML) have the potential to revolutionize medical device software development. These
technologies can enable devices to analyze complex data, identify patterns, and make
intelligent decisions in real time. AI and ML algorithms can be used for tasks such as im-
age recognition, diagnostics, predictive analytics, and personalized medicine. Integrating
AI and ML into medical device software can enhance accuracy, efciency, and patient
outcomes.
Internet of Medical Things (IoMT): The Internet of Medical Things (IoMT) refers to the
network of medical devices, sensors, and healthcare systems connected through the In-
ternet. IoMT enables real-time monitoring, data collection, and remote healthcare man-
agement. In the future, medical device software will need to support seamless integration
with IoMT ecosystems, ensuring secure and reliable data transfer, interoperability, and
remote device management capabilities.
User experience and human-centered design: User experience (UX) and human-centered
design (HCD) will play an increasingly signifcant role in the development of medical de-
vice software. Emphasizing the ease of use, intuitive interfaces, and workfows tailored to
healthcare professionals and patients will enhance adoption and usability. Incorporating
user feedback through iterative design processes and usability testing will be crucial for
creating software that meets the needs of end users.
Cloud computing and Big data analytics: Cloud computing and Big data analytics ofer op-
portunities for scalable storage, processing power, and advanced analytics capabilities.
Medical device software developers can leverage the cloud for data storage, data analy-
sis, and remote access to software and updates. Big data analytics can help derive mean-
ingful insights from large datasets, enabling personalized medicine, population health
management, and real-time monitoring.
These future trends will shape the landscape of software development for medical de-
vices, infuencing the design, functionality, and regulatory requirements of medical device
software. By embracing these trends, developers can create innovative solutions that im-
prove patient outcomes, enhance healthcare delivery, and drive advancements in the feld.
4.10 Conclusion
Throughout this chapter, we have explored various aspects of software development in
medical devices, including the importance of software in enhancing functionality, remote
100 Secure and Smart Cyber-Physical Systems
monitoring, real-time data analysis, and improving patient outcomes and safety. We have
also discussed the critical considerations such as regulatory compliance, risk management,
cybersecurity, and data privacy. Software development in the context of medical devices
demands adherence to stringent regulatory requirements and international standards such
as FDA regulations, IEC 62304, ISO 13485, and ISO 14971. Compliance with these stand-
ards ensures that the software is developed following systematic and controlled processes,
with a focus on risk management, quality assurance, and patient safety. We have also delved
into the challenges faced in software development for medical devices, including the com-
plexities of regulatory compliance, interoperability, usability, and cybersecurity. Address-
ing these challenges requires a multidisciplinary approach, involving collaboration between
software engineers, healthcare professionals, regulatory experts, and cybersecurity special-
ists. Furthermore, we discussed best practices in software development for medical devices,
emphasizing the importance of software testing and validation, regulatory compliance, risk
management, and cybersecurity. These best practices help ensure the development of high-
quality, safe, and reliable software that meets regulatory requirements, mitigates risks, and
maintains the privacy and security of patient data. Looking toward the future, we explored
the emerging trends in software development for medical devices, including advancements
in artifcial intelligence, machine learning, telemedicine, and interoperability. These trends
have the potential to revolutionize healthcare delivery, enabling more personalized and ef-
fcient patient care.
In conclusion, software development in medical devices continues to drive innovation
and improvement in the healthcare industry. With careful considerations of regulatory com-
pliance, risk management, cybersecurity, and data privacy, developers can create software
solutions that enhance patient care, improve outcomes, and contribute to the advancement
of healthcare technology. As technology continues to evolve, it is crucial to stay abreast of
new developments, standards, and regulations to ensure the continued success of software
development in the feld of medical devices.
Bibliography
[1] Amelie Abadie, Melanie Roux, Soumyadeb Chowdhury, and Prasanta Dey. Inter-linking or-
ganisational resources, AI adoption and omnichannel integration quality in Ghana’s healthcare
supply chain. Journal of Business Research, 162:113866, 2023.
[2] Noorul Husna Abd Rahman, Ayman Khallel Ibrahim, Khairunnisa Hasikin, Nasrul Anuar Abd
Razak, et al. Critical device reliability assessment in healthcare services. Journal of Healthcare
Engineering, 2023, 2023.
[3] David Arney, Yi Zhang, Lauren R. Kennedy-Metz, Roger D. Dias, Julian M. Goldman, and
Marco A. Zenati. An open-source, interoperable architecture for generating real-time surgical
team cognitive alerts from heart-rate variability monitoring. Sensors, 23(8):3890, 2023.
[4] M. Aruna, S. Ananda Kumar, B. Arthi, and Uttam Ghosh. Smart security for industrial and
healthcare IoT applications. In Intelligent Internet of Things for Healthcare and Industry, pages
353–371. Springer, 2022.
[5] Katie L. Ayers, Stefanie Eggers, Ben N. Rollo, Katherine R. Smith, Nadia M. Davidson, Nicole
A. Siddall, Liang Zhao, Josephine Bowles, Karin Weiss, Ginevra Zanni, et al. Variants in sart3
cause a spliceosomopathy characterised by failure of testis development and neuronal defects.
Nature Communications, 14(1):3403, 2023.
[6] Almir Badnjevic. Evidence-based maintenance of medical devices: Current shortage and pathway
towards solution. Technology and Health Care, 31:293–305, 2023.
[7] Almir Badnjevic, Amar Deumic, Zijad Dzıemic, and Lejla Gurbeta Pokvic. A novel method for
conformity assessment testing of anaesthesia machines for post-market surveillance purposes.
Technology and Health Care (Preprint):1–11, 2023.
Software Development for Medical Devices 101
[8] Sourav Banerjee, Sudip Barik, Debashis Das, Uttam Ghosh, and Narayan C. Debnath. Federated
learning assisted Covid-19 detection model. In AboulElla Hassanien, Rawya Y. Rizk, Dragan
Pamucar, Ashraf Darwish, and Kuo-Chi Chang, editors, Proceedings of the 9th International
Conference on Advanced Intelligent Systems and Informatics 2023, pages 392–399. Springer
Nature Switzerland, 2023.
[9] Siddharth Banyal, Deepanjali Mehra, Amartya, Siddhant Banyal, Deepak Kumar Sharma, and
Uttam Ghosh. Computational intelligence in healthcare with special emphasis on bioinformat-
ics and internet of medical things. In Intelligent Internet of Things for Healthcare and Industry,
pages 145–170. Springer, 2022.
[10] Deborsi Basu, Vikram Krishnakumar, Uttam Ghosh, and Raja Datta. Deep-care: Deep learning-
based smart healthcare framework using 5g assisted network slicing. In 2022 IEEE International
Conference on Advanced Networks and Telecommunications Systems (ANTS), Gandhinagar,
Gujarat, India, 2022, pp. 201-206, doi: 10.1109/ANTS56424.2022.10227802.
[11] R. Beckers, Z. Kwade, and F. Zanca. The EU medical device regulation: Implications for artifcial
intelligence-based medical device software in medical physics. Physica Medica, 83:1–8, 2021.
[12] Shaurya Bhatt, Deepak Joshi, Pawan Kumar Rakesh, and Anoop Kant Godiyal. Advances in ad-
ditive manufacturing processes and their use for the fabrication of lower limb prosthetic devices.
Expert Review of Medical Devices, 20(1):17–27, 2023.
[13] Bharat Bhushan, Avinash Kumar, Ambuj Kumar Agarwal, Amit Kumar, Pronaya Bhattacharya,
and Arun Kumar. Towards a secure and sustainable internet of medical things (IoMT): Re-
quirements, design challenges, security techniques, and future trends. Sustainability, 15(7):6177,
2023.
[14] Adam Bohr and Kaveh Memarzadeh. The rise of artifcial intelligence in healthcare applications.
Artifcial Intelligence in Healthcare, 25–60, 2020.
[15] Michael Bretthauer, Sara Gerke, Cesare Hassan, Omer F. Ahmad, and Yuichi Mori. The New
European medical device regulation: Balancing innovation and patient safety. Annals of Internal
Medicine, 176(6):844–848, 2023
[16] Steven Brown and Apurva Desai. Legal and regulatory issues related to the use of clinical soft-
ware in healthcare delivery. In Clinical Decision Support and Beyond, pages 651–692. Elsevier,
2023.
[17] Richard J. Chen, Judy J. Wang, Drew F.K. Williamson, Tifany Y. Chen, Jana Lipkova, Ming Y.
Lu, Sharifa Sahai, and Faisal Mahmood. Algorithmic fairness in artifcial intelligence for medi-
cine and healthcare. Nature Biomedical Engineering, 7(6):719–742, 2023.
[18] Oriana Ciani, Patrizio Armeni, Paola Roberta Boscolo, Marianna Cavazza, Claudio Jommi, and
Rosanna Tarricone. De innovatione: The concept of innovation for medical technologies and its
implications for healthcare policy-making. Health Policy and Technology, 5(1):47–64, 2016.
[19] Linda Connor, Jennifer Dean, Molly McNett, Donna M. Tydings, Amanda Shrout, Penelope F.
Gorsuch, Ashley Hole, Laura Moore, Roy Brown, Bernadette Mazurek Melnyk, et al. Evidence-
based practice improves patient outcomes and healthcare system return on investment: Findings
from a scoping review. Worldviews on Evidence-Based Nursing, 20(1):6–15, 2023.
[20] Genevieve Dammery, Louise A. Ellis, Kate Churruca, Janani Mahadeva, Francisco Lopez, Ann
Carrigan, Nicole Halim, Simon Willcock, and Jefrey Braithwaite. The journey to a learning
health system in primary care: A qualitative case study utilising an embedded research approach.
BMC Primary Care, 24(1):22, 2023.
[21] Delshi Howsalya Devi, Kumutha Duraisamy, Ammar Armghan, Meshari Alsharari, Khaled Al-
iqab, Vishal Sorathiya, Sudipta Das, and Nasr Rashid. 5g technology in healthcare and wearable
devices: A review. Sensors, 23(5):2519, 2023.
[22] Margaret Hardt DiCuccio. The relationship between patient safety culture and patient out-
comes. Journal of Patient Safety, 11(3):135–142, 2015.
[23] Jean Feng, Scott Emerson, and Noah Simon. Approval policies for modifcations to machine
learning-based software as a medical device: A study of bio-creep. Biometrics, 77(1):31–44,
2021.
[24] Senay A. Gebreab, Khaled Salah, Raja Jayaraman, and Jamal Zemerly. Trusted traceability and
certifcation of refurbished medical devices using dynamic composable NFTs. IEEE Access,
11:30373–30389, 2023.
[25] Uttam Ghosh, Debashis Das, Pushpita Chatterjee and Sachin Shetty, “Quantum-Enabled Block-
chain for Data Processing and Management in Smart Cities,” 2023 IEEE 24th International
102 Secure and Smart Cyber-Physical Systems
Automatic Data Collection System for Infants in Neonatal Intensive Care Units,” in IEEE Jour-
nal of Biomedical and Health Informatics, 28(2):678–689, 2024.
[44] Vernessa T. Pollard. FDA issues draft predetermined change control plan for machine-learning-
enabled device software functions. Mondaq Business Briefing, 2023. https://www.duanemor-
ris.com/alerts/fda_issues_draft_guidance_predetermined_change_control_plans_artificial_
intelligence_0623.html
[45] Andreas Puder, Jacqueline Henle, and Eric Sax. Threat assessment and risk analysis (TARA)
for interoperable medical devices in the operating room inspired by the automotive industry. In
Healthcare, volume 11, page 872. MDPI, 2023.
[46] Dukka Karun Kumar Reddy, H.S. Behera, Janmenjoy Nayak, Ashanta Ranjan Routray, Pem-
mada Suresh Kumar, and Uttam Ghosh. A fog-based intelligent secured iomt framework for
early diabetes prediction. In Intelligent Internet of Things for Healthcare and Industry, pages
199–218. Springer, 2022.
[47] Matthias Seibold, José Miguel Spirig, Hooman Esfandiari, Mazda Farshad, and Philipp Fürn-
stahl. Translation of medical AR research into clinical practice. Journal of Imaging, 9(2):44,
2023.
[48] Kaapo Seppaĺlaĺ. New business creation in health technology. In Design Thinking in Healthcare:
From Problem to Innovative Solutions, pages 101–111. Springer, 2023.
[49] Veenu Singh, Vijay Kumar, and V.B. Singh. A hybrid novel fuzzy AHP-topsis technique for
selecting parameter-influencing testing in software development. Decision Analytics Journal,
6:100159, 2023.
[50] M. Srivani, Abirami Murugappan, and T. Mala. Cognitive computing technological trends and
future research directions in healthcare—a systematic literature review. Artificial Intelligence in
Medicine, 102513, 2023.
[51] Muhammad Turab and Sonain Jamil. A comprehensive survey of digital twins in healthcare in
the era of Metaverse. BioMedInformatics, 3(3):563–584, 2023.
[52] Tomaso Vairo, Margherita Pettinato, Andrea P. Reverberi, Maria Francesca Milazzo, and Bruno
Fabiano. An approach towards the implementation of a reliable resilience model based on ma-
chine learning. Process Safety and Environmental Protection, 172:632–641, 2023.
[53] Sai Srinivas Vellela, B. Venkateswara Reddy, Kancharla K. Chaitanya, and M. Venkateswara
Rao. An integrated approach to improve e-healthcare system using dynamic cloud computing
platform. In 2023 5th International Conference on Smart Systems and Inventive Technology
(ICSSIT), pages 776–782. IEEE, 2023.
[54] Chunhu Xie, Huachun Wu, and Jian Zhou. Vectorization programming based on HR DSP using
SIMD. Electronics, 12(13):2922, 2023.
[55] Nataliya Yakymets, Mihai Adrian Ionescu, and David Atienza Alonso . Metamodel for safety risk
management of medical devices based on ISO 14971. In The ACM/IEEE 26th International Con-
ference on Model-Driven Engineering Languages and Systems, EPFL Scientific Publications, 2023.
[56] Zhe Yin, Carlos Caldas, Daniel de Oliveira, Sharareh Kermanshachi, and Apurva Pamidimuk-
kala. Cross-functional collaboration in the early phases of capital projects: Barriers and contrib-
uting factors. Project Leadership and Society, 100092, 2023.
[57] Youshan Yu, Nicolette Lakemond, and Gunnar Holmberg, “AI in the Context of Complex Intel-
ligent Systems: Engineering Management Consequences,” in IEEE Transactions on Engineering
Management, vol. 71, pp. 6512-6525, 2024.
Chapter 5
Chapter Contents
5.1 Introduction 104
5.1.1 Evolution of IIoT 104
5.2 State-of-the-Art of IIoT 105
5.2.1 Feasible Developments of Industry 5.0 106
5.3 Transition From 1G to 6G for IIoT 108
5.3.1 Key Areas of 6G Communication 110
5.3.2 Key Technologies of 6G Communication 111
5.3.3 Case Studies Showing Advantages of 6G Communication 112
5.3.4 Amalgamation of 6G Communication with Industry 5.0 113
5.4 Conclusion 115
Acknowledgment 115
References 116
5.1 Introduction
Industry Internet of Things (IIoT) is a forethoughtful perception of the futuristic industrial
paradigm that focuses on systems’ resiliency and agility with the deployment of adaptable
and fexible technologies. IIoT is expected to support various industrial verticals such as
smart farming, healthcare, smart grids, and supply chain production ecosystems to leverage
huge production with customer-centric customization [1].
IIoT eventually has a huge economic impact that brings entirely new infrastructures to
our most vital and impactful societal systems. It puts emphasis on the communication be-
tween machines (M2M), the use of machine learning, and the handling of Big data, which
leads to improved reliability and efciency in industrial operations [2].
IIoT applications are a simple evolution of Internet of Things (IoT). Thus, IIoT shares some
security weaknesses with the IoT, including the integrity of CPS, the protection of data, the es-
tablishment of keys for system pairing, and the management of systems.
Before the evolution era of IIoT, agriculture and simple handicrafts were the signifcant
factors of the global economy and later as said “necessity is the mother of disruption,” the
transformation in the IIoT ecosystem took pace.
Industry 1.0 revolution started around 17th century from the period between 1760 to
1840 in which the industrial machines were powered by water, steam, etc. This stage was
DOI: 10.1201/9781003376712-5
6G Communication Technology for Industry 5.0 105
referred to as mechanization [3]. Henry Ford invented the assembly line with electricity in
1870, which led to the evolution of Industry 2.0 termed electrifcation. The fundamental con-
cept of Industry 2.0 was mass production [4]. Industry 3.0 marked a shift from traditional
mechanical methods to modern digital production processes along with partial automation.
In this generation, huge-sized computers with memory-programmable controllers were used
to make industrial plans, which resulted in a reduction of the need of human eforts. In the
year 2011, the world witnessed a drastic shift from Industry 3.0 toward Industry 4.0 termed
as digitization. The digital era encompasses the use of information and communication tech-
nologies to support remote production processes that are managed through a network of
connected devices [5, 6]. One of the major concerns of Industry 4.0 is IoT-driven CPS. The
entire evolution of IIoT is well depicted in Figure 5.1.
The revolution of Industry 5.0 involves the blending of artifcial intelligence with human
knowledge which is the driving force behind the development of this era. Industry 5.0 is
visualized as a way to improve the quality of production which allows the robot to handle
boring and repetitive tasks while human handles intelligent and critical thinking tasks [11].
The key defnitions of Industry 5.0 given by diferent authors are shown in Table 5.1.
Authors Definition
[7] The very first human-initiated industrial evolution is Industry 5.0, based on
6R principles which are Recognize, Reconsider, Reuse, Realize, Reduce, and
Recycle. It is a technique that aims to eliminate waste in a systematic manner
and manufactures good-quality custom items.
[8] Industry 5.0 is an amalgamation of human intelligence and the potentiality of
CPSs aimed at resolving the problem of labor shortage faced in Industry 4.0.
[9] Industry 5.0 is an amalgamation of human-intelligence and the potentiality of
CPSs to build cooperate factories.
[10] Industry 5.0 refers to a network of smaller factories where robots and humans
have a direct, seamless interaction.
C. IIoT Standardization
Standardization is a crucial step for a technology to be widespread. The process of
standardization faces numerous challenges. The standardization of 5G toward IIoT
has a crucial signifcance in Industry 5.0 but has various shortcomings with the trans-
formation of the industrial era. This comes under the umbrella of Ultra Reliable Low
Latency Communications (URLLC) that aims to provide 1 ms latency to grant a valid
transmission time interval (TTI) operation [13]. With the evolution of Industry 5.0,
6G communication came into the scenario which plays a crucial role to connect a va-
riety of IoT devices. 6G, an upgradation of 5G, emphasizes its ample amount of ben-
efts, for example—higher data transmission rate, high bandwidth and low latency.
The feasible development of IIoT has enabled new efciencies and capabilities within indus-
trial settings, leading to improved productivity, quality, and safety. Today, the IIoT system
is being used in a wide range of industrial applications which help organizations to improve
operational efciency, reduce costs, enhance product quality, etc. A few of the aspects that
are infuenced by the evolution of Industry 5.0 are discussed below:
6G Communication Technology for Industry 5.0 107
and learning experiences, improve student outcomes, and prepare students for careers
in the feld of industrial automation and digital transformation. Some potential ap-
plications of Industry 5.0 in the education system include smart classrooms, virtual
laboratories, personalized learning experiences, and real-time monitoring of student
progress and performance.
• IoMT
Internet of Medical Things (IoMT) is a vital component of Industry 5.0, which fo-
cuses on combining the strengths of humans and machines to improve productivity
and create new value for the healthcare system. The benefts of IoMT in Industry 5.0
include improved patient outcomes, personalized treatment plans, etc.
• Financial Industry
Industry 5.0 has the potential to transform the fnancial industry with innovation,
improving efciency, and enhancing customer experiences. A signifcant aspect of In-
dustry 5.0 in the fnancial industry is the need for a greater emphasis on sustainability
and social responsibility. Further, Industry 5.0 can be applied in several ways in the
fnancial industry. For example, fnancial institutions can use advanced technologies
such as artifcial intelligence and machine learning to improve decision-making pro-
cesses and risk management [14].
Specifications 1G 2G 3G 4G 5G 6G
of information between two devices which were supported only with poor-quality
voice call features. One of the key challenges of 1G communication technology was
its fxed geographical area since it lacked roaming support by the network.
• 2G: Text
2G communication technology facilitated better quality of voice calls as compared
to 1G. The analog system based on 1G of wireless transmission was substituted by a
more sophisticated digital technology known as Global System for Mobile Communi-
cation (GSM). In addition, it also supported new services such as—Short/Multimedia
Message Service which is abbreviated as (SMS) and (MMS), respectively.
• 3G: Era of Applications
The 3G communication technology was introduced with high-speed Internet services,
laying the foundation for the development of smartphones equipped with a diverse
range of applications. It also fabricated the concept of online radio services, mobile
television, emails on phones, etc.
• 4G: Internet Calling
The incorporation of the LTE (Long-Term Evolution) system signifcantly improved
the data rate allowing synchronous transmission of both data and voice. VoLTE
(Voice over LTE) or Internet calling is one of the fundamental improvements of
the 4G communication network. It also facilitates Voice over Wi-Fi (VoWi-Fi) fea-
ture which allowed one to make voice calls in either low-network areas or even in
no-network-coverage area [15].
• 5G: IoT
5G technology is still in the process of being fully rolled out globally, and it will likely
take a few years for it to be widely available and adopted. As compared to all the
existing communication technologies, the advantage of recently launched 5G technol-
ogy is low latency with higher throughput features, which makes the network ideal
with automation features and connected ecosystem.
• 6G: IoE
The transition from 5G to 6G is not an immediate concern. It is expected that by the
year 2030, 6G will bring a drastic evolution in communication mediums as it will en-
able the newly introduced intelligent Internet of Everything (IoE) concept. Future 6G
is forecasted to bring high and sophisticated Quality of Service (QoS), for example,
holographic communication and virtual reality [16]. The concept of the IoE is mak-
ing progress in enhancing people’s lives by enhancing the IoT by creating connections
among individuals, processes, information, and devices. The advent of 6G technology
will make communication instantaneous with low latency, thereby creating a seamless
connection between the digital and physical world.
The key areas in which 6G communication technology plays a vital role are described
below.
• Real-Time Intelligent Edge
The existing 5G communication technology supports autonomous driving, but ser-
vices such as self-awareness and self-adaption are not supported yet. To overcome
these shortcomings of 5G, 6G communication technology is introduced which ena-
bles AI-assisted services.
• Distributed Artifcial Intelligence
The futuristic 6G network is expected to support the revolutionary Internet of Eve-
rything (IoE), which will make the 6G communication technology capable enough to
take smart decisions of its own [17].
• 3D Intercoms
6G is predicted to be with an optimized network, and the design will make a smooth
shift from two dimension (2D) to three dimension (3D). 6G is expected to support
3D communication which will enable communication in heterogeneous scenarios such
as—Unmanned Aerial Vehicles (UAVs), satellites, and undersea communication. A 3D
intercom could facilitate these features with the exact time as well as location. Addition-
ally, resource management and characteristics such as mobility and routing also need
network optimization in 3D intercom [18].
• Intelligent Radio
The transceiver system could be separated in futuristic 6G while it was designed to-
gether in existing generations. Thus, it has the ability to self-update. Figure 5.4 illus-
trates the new logical state of 6G communication technology [19].
6G Communication Technology for Industry 5.0 111
In this subsection, the key technologies of 6G communication are discussed in detail and
depicted in Figure 5.5 for clear understanding.
A. Artifical Intelligence (AI)
Even though AI is incorporated in existing 5G network, it is regarded as the prime
feature of futuristic 6G communication technology. AI technologies are fragmented
into a physical layer which consists of network structure, architecture, and comput-
ing layer consisting of software-defned network, network function virtualization,
and edge/cloud computing [20].
B. Quantum Communication
Quantum communication is an aspiring technology in 6G technology. Quantum
communication provides security with crucial developments. It ofers explanations
and elevates communication which is unachievable through conventional commu-
nication techniques. However, it isn’t the only panacea for each security peril.
C. Blockchain
Blockchain is another prominent technology in 6G communication. Network de-
centralization, spectrum sharing, and distributed ledger technology are several uses
of Blockchain technology. Blockchain technology could overcome spectrum mo-
nopoly and low-spectrum utilization. Privacy issues of Blockchain are related to
authentication, communication, and access control [21].
112 Secure and Smart Cyber-Physical Systems
data rates may limit the potential of these applications. Overall, a smart environment
is a critical goal of modern networks, and the 6G network is expected to provide even
greater optimization and efciency in daily life.
• Automation in Industry 5.0
The development of Industry 5.0 is a recent trend and with the arrival of the 6G
network, it is expected to reach new heights of automation and optimization. The
aim of Industry 5.0 is to reduce the dependency on human intervention in traditional
manufacturing and industrial processes, replacing it with automatic control systems,
communication networks, and CPSs. To achieve this goal, the 6G network must meet
strict key performance indicators (KPIs) such as high reliability levels, low latency,
and multiple connected links.
5.4 Conclusion
In this chapter, the prospects, opportunities, and future aspects upraised by the amalgama-
tion of 6G communication with Industry 5.0 are presented. 6G communication technology
has the potential to revolutionize Industry 5.0, enabling more advanced automation, data
analytics, and communication. However, it will still take time and signifcant investment
before 6G is widely adopted and implemented in the industry. According to the study, based
on current trends in 6G technology, in the future, 6G could have a great impact on Industry
5.0 with enhanced speed and precision of industrial robots, leading to more advanced auto-
mation. The combination of Industry 5.0 and 6G could bring about a new era of productiv-
ity, efciency, and innovation. However, there are several limitations that are needed to be
overcome before this can become a reality. A few of the prime limitations of 5G are: Security,
integration with existing technologies, investment and adoption, etc., which shall be taken
care of in 6G. Further, the proposed study put forward a few potential fndings of evolv-
ing concepts which include ultra-fast data transmission, massive connectivity, etc. Inversely,
there’s a downside to every upside, therefore, the proposed study sums up with a peculiar
view that the realization of amalgamation of 6G communication with Industry 5.0 may lead
to increased energy consumption, higher carbon emissions, etc., which are unfavorable for
humankind, and minimizing these can be considered as a future scope of the study.
Acknowledgment
The research work is supported by the Ministry of Education, the Government of India.
116 Secure and Smart Cyber-Physical Systems
References
[1] Verma, A., Bhattacharya, P., Madhani, N., Trivedi, C., Bhushan, B., Tanwar, S. and Sharma, R.,
Blockchain for Industry 5.0: Vision, Opportunities, Key Enablers, and Future Directions, IEEE
Access, 10, 69160, 2022.
[2] Sisinni, E., Saifullah, A., Han, S., Jennehag, U. and Gidlund, M., Industrial Internet of Things:
Challenges, Opportunities, and Directions. IEEE Transactions on Industrial Informatics, 14,
4724, 2018.
[3] Yu, X. and Guo, H., A Survey on IIoT Security. IEEE VTS Asia Pacifc Wireless Communica-
tions Symposium (APWCS), 1, 2019.
[4] Nahavandi, S., Industry 5.0—A Human-Centric Solution. Sustainability, 11, 4371, 2019.
[5] Akbar, M. S., Hussain, Z., Sheng, Q. Z. and Mukhopadhyay, S., 6G Survey on Challenges,
Requirements, Applications, Key Enabling Technologies, Use Cases, AI Integration Issues and
Security Aspects. arXiv preprint arXiv:2206.00868, 2022.
[6] Upadhyaya, P., Dutt, S. and Upadhyaya, S. "6G Communication: Next Generation Technology
for IoT Applications," 2021 First International Conference on Advances in Computing and Fu-
ture Communication Technologies (ICACFCT), Meerut, India, 2021, pp. 23-26, doi: 10.1109/
ICACFCT53978.2021.9837375.
[7] Rada, M., INDUSTRY 5.0 Defnition, 2018. Retrieved from https://michaelrada.medium.com/
industry-5-0-de?nition.
[8] Longo, F., Padovano, A. and Umbrello, S., Value-Oriented and Ethical Technology Engineering
in Industry 5.0: A Human-Centric Perspective for the Design of the Factory of the Future. Ap-
plied Sciences, 10, 4182, 2020.
[9] Friedman, B. and Hendry, D. G., Value Sensitive Design: Shaping Technology with Moral Imagi-
nation. MIT Press, 2019.
[10] Koch, P. J., van Amstel, M. K., Debska, P., Thormann, M. A., Tetzlaf, A. J., Bøgh, S. and
Chrysostomou, D., A Skill-Based Robot Co-Worker for Industrial Maintenance Tasks. Procedia
Manufacturing, 11, 83, 2017.
[11] Chi, H. R., Wu, C. K., Huang, N. F., Tsang, K. F. and Radwan, A., "A Survey of Network
Automation for Industrial Internet-of-Things Toward Industry 5.0," in IEEE Transactions on
Industrial Informatics, 19(2):2065-2077, Feb. 2023, doi: 10.1109/TII.2022.3215231.
[12] Schneider, S., The Industrial Internet of Things (IIOT) Applications and Taxonomy. Internet of
Things and Data Analytics Handbook, 41, 2017.
[13] Mohsan, S. A. H., Mazinani, A., Malik, W., Younas, I., Othman, N. Q. H., Amjad, H. and
Mahmood, A., 6G: Envisioning the Key Technologies, Applications and Challenges. Interna-
tional Journal of Advanced Computer Science and Applications, 11, 9, 2020.
[14] Maiti, M., Vuković, D., Mukherjee, A., Paikarao, P.D. and Yadav, J.K. Advanced Data Integra-
tion in Banking, Financial, and Insurance Software in the Age of COVID-19. Software: Practice
and Experience, 52, 887, 2021.
[15] Yang, P., Xiao, Y., Xiao, M. and Li, S., 6G Wireless Communications: Vision and Potential Tech-
niques. IEEE Network, 33, 70, 2020.
[16] Sheth, K., Patel, K., Shah, H., Tanwar, S., Gupta, R. and Kumar, N., A Taxonomy of AI Tech-
niques for 6G Communication Networks. Computer Communications, 161, 279, 2020.
[17] De Alwis, C., Kalla, A., Pham, Q. V., Kumar, P., Dev, K., Hwang, W. J. and Liyanage, M., Survey
on 6G Frontiers: Trends, Applications, Requirements, Technologies and Future Research. IEEE
Open Journal of the Communications Society, 2, 836, 2021.
[18] Mahmoud, H. H. H., Amer, A. A. and Ismail, T., 6G: A Comprehensive Survey on Technologies,
Applications, Challenges, and Research Problems. Transactions on Emerging Telecommunica-
tions Technologies, 32, e4233, 2021.
[19] Majumder, S., Ray, S., Sadhukhan, D., Khan, M. K. and Dasgupta, M, ESOTP: ECC-Based
Secure Object Tracking Protocol for IoT Communication. International Journal of Communica-
tion Systems, 35, e5026, 2021.
[20] Tataria, H., Shaf, M., Molisch, A. F., Dohler, M., Sjöland, H. and Tufvesson, F., 6G Wire-
less Systems: Vision, Requirements, Challenges, Insights, and Opportunities. Proceedings of the
IEEE, 109, 1166, 2021.
[21] Dong, W., Xu, Z. H., Li, X. X. and Xiao, S. P., Low-Cost Subarrayed Sensor Array Design Strat-
egy for IoT and Future 6G Applications. IEEE Internet of Things Journal, 7, 4816, 2020.
6G Communication Technology for Industry 5.0 117
[22] Chatterjee, U. and Ray, S., Security Issues on IoT Communication and Evolving Solutions. Soft
Computing in Interdisciplinary Sciences, 183, 2022.
[23] Mukherjee, A., Goswami, P., Khan, M. A., Manman, L., Yang, L. and Pillai, P., Energy-Efcient
Resource Allocation Strategy in Massive IoT for Industrial 6G Applications. IEEE Internet of
Things Journal, 8, 5194, 2020.
[24] Ji, B., Wang, Y., Song, K., Li, C., Wen, H., Menon, V. G. and Mumtaz, S., A Survey of Compu-
tational Intelligence for 6G: Key Technologies, Applications and Trends. IEEE Transactions on
Industrial Informatics, 17, 7145, 2021.
[25] Adhikari, S., Ray, S. (2019). A Lightweight and Secure IoT Communication Framework in Con-
tent-Centric Network Using Elliptic Curve Cryptography. In: Khare, A., Tiwary, U., Sethi, I., Singh,
N. (eds) Recent Trends in Communication, Computing, and Electronics. Lecture Notes in Electri-
cal Engineering, vol. 524. Springer, Singapore. https://doi.org/10.1007/978-981-13-2685-1_21
[26] Letaief, K. B., Shi, Y., Lu, J. and Lu, J., Edge Artifcial Intelligence for 6G: Vision, Enabling Tech-
nologies, and Applications. IEEE Journal on Selected Areas in Communications, 40, 5, 2021.
[27] Ray, S. and Biswas, G. P., Design of Mobile Public Key Infrastructure (M-PKI) Using Elliptic
Curve Cryptography. International Journal on Cryptography and Information Security (IJCIS),
3, 25, 2013.
Chapter 6
Chapter Contents
6.1 Introduction 118
6.2 CPS in AI enabled Smart Healthcare 120
6.2.1 Characteristics of CPS in AI Enabled SHS 120
6.2.2 Architectures of CPS in Smart Healthcare 122
6.2.3 Monitoring Medical Status Using CPS in Smart Healthcare 124
6.2.4 Cyber-Physical Systems Technologies in Smart Healthcare System 125
6.3 Big Data Analytics in CPS for Smart Healthcare System 126
6.4 Digital Security in CPS for Smart Healthcare System 128
6.5 Application of SHS in Real-Time Scenario 130
6.6 CPS in Smart Healthcare Challenges 130
6.7 Conclusion 131
References 132
6.1 Introduction
The last few years of the pandemic demanded a very strong as well as Smart Healthcare
System being able to monitor each and every patient efciently in order to handle the out-
break of rapidly increasing diseases [1]. Smart healthcare system enables patients as well
as doctors to monitor and access healthcare data from a remote location without physi-
cally visiting the hospital. This automation in healthcare can be provided using Artifcial-
Intelligence-based IoMT framework [2]. These wide developments and automation in
healthcare use CPSs to enhance the functionality of various physical and cyber medical
components. Cyber-Physical System acts as a developing technology that is exponentially
gaining demand every day in the research domain. Cyber-Physical System in SHS acts as
an interface between the cyber and physical world in order to enhance medical treatments
as shown in Figure 6.1. CPS is required to interconnect medical equipment (physical
world) for patient monitoring and medical data (cyber world) analysis which is stored in
the cloud [3].
CPS is an engineered system that is made up of continuously integrated computational
algorithms and physical components. Besides healthcare, CPS is having wide applications in
diferent domains like aerospace, civil infrastructure, energy, entertainment, manufacturing,
and transportation [4] as shown in Figure 6.2. Collaborating the concept of IoT (Internet
of Things) and IoS (Internet of Service) together with Cyber-Physical System brings the idea
of “Industrial Internet” that is evolved in the United States and the Germany innovation
DOI: 10.1201/9781003376712-6
AI-Enabled Smart Healthcare System 119
“Industry 4.0” [5]. CPS also plays an important role in transportation to enhance control-
lability, competency, and consistency of physical equipment involved in the maintainability
of transportation systems, e.g., vehicle accident prevention techniques and zero-net power
creation systems [6].
Industry Foundation Classes (IFCs) is the traditional schema for monitoring and control-
ling the structural health in civil infrastructure, and CPS here brings a further extension of
IFC with enhanced automation facilities [7]. Aerospace cyber-physical systems are made-
up of various intelligent equipment to collect, process, and communicate data with better
reliability, security, and efciency in order to accomplish advanced tasks and innovations
[8]. In order to store and process huge amounts of data generating everyday, cloud-based
120 Secure and Smart Cyber-Physical Systems
CPS can be used for incorporating Virtual Machines (VMs) for more energy conservation
and thereby better QoS [9]. Automotive Engineering also uses CPS to secure advanced au-
tomobile inventions like cyber cars with intelligent automotive control units like Electronic
Control Units (ECUs) [10].
Sighting the wide applications of CPS in diferent domains, we are motivated to incorporate
CPS in AI-enabled Smart Healthcare Systems to enhance the functionality of diferent physical
and cyber medical components that will help the society to be updated about their health pa-
rameters and also consult doctors remotely whenever required. It will also help to control the
spreading of harmful viruses due to regular hospital visits for each and every small problem.
The major contributions of this research work are as follows:
The rest of the chapter is organized as follows: Section 6.2 represents an overview of CPS
in Smart Healthcare Systems including diferent characteristics of CPS in SHS, mostly used
architectures of CPS in Smart Healthcare Systems, monitoring medical status using CPS in
Smart Healthcare, and discusses various technologies that can be used for CPS in SHS. Sec-
tion 6.3 explains various Big data analysis techniques in CPS for SHS. Section 6.4 shows
digital security techniques in CPS for SHS. Section 6.5 explains various research challenges
that can be encountered during the design of CPS in SHS.
Besides the cyber world, CPS is also composed of diferent physical components rang-
ing from minor smart equipment like sensors or actuators to large equipment that can be
controlled by smart devices (like smartphones). Depending on the working situations of
AI-Enabled Smart Healthcare System 121
diferent equipment involved within CPS, the overall health of CPS can be defned, which
is divided into four states, namely, critical, healthy, unhealthy, and nonworking [11]. The
healthy state shows that the task is completed on time, the unhealthy state shows that
the parameters are within the threshold value, the critical state represents failures within the
system beyond a critical limit, and nonworking state shows faults and failures. Input and
output to these physical devices can be of diferent formats, and they can be structured or
unstructured; hence interfaces are required to convert these data into a fxed format that
will be widely accepted [12]. CPS in AI-enabled Smart Healthcare Systems can be catego-
rized among various levels depending on the requirement and utilization of these medical
data representing diferent characteristics of CPS in Smart Healthcare.
• Unit-level CPS: This is the basic level of CPS in Smart Healthcare and used to monitor and
control the health parameters of various patients admitted in diferent sections of the hos-
pital. Continuous monitoring of the patient’s physiological condition (like heart rate, blood
pressure, body temperature) is required at the unit level, and then these healthcare data
are transmitted to diferent smart systems for analysis and managing diferent sensors and
actuators linked with the patient. Here, the healthcare staf also plays an important role to
support and inform the experts about immediate patient treatment when required [1].
• Integration-level CPS: In this stage, various hospitals collaborate with smart homes for
delivering healthcare services to various patients remotely. It can later integrate with
smart ambulances for continuous monitoring and making necessary emergency arrange-
ments at hospitals for transferring risky patients to hospitals whenever required [1].
• System-level CPS: At this stage, diferent autonomous systems support CPS in Smart
healthcare thereby forming Healthcare Cyber-Physical System in Smart City. Smart hos-
pitals, smart homes, smart ambulances, etc., will form a healthcare ecosystem providing
rich, professional, and personalized healthcare services to patients [1].
• Acceptance-level CPS: At this stage, diferent researchers, engineers, academicians, scien-
tists, and health experts collaborate to make an efective SHS based on diferent policies
and standards [1].
• Evolutionary-level CPS: This stage is the ideal future CPS in Smart Healthcare having
advanced properties like self-adaptability and self-manageability [1].
122 Secure and Smart Cyber-Physical Systems
In the Smart Healthcare System, CPS works as an embedded system of healthcare equip-
ment and autonomous network systems to detect and prevent various highly sensitive dis-
eases such as COVID-19 as explained in Figure 6.4.
Figure 6.5 shows another three-layered architecture for CPS in the healthcare sector that
is proposed by Bordel et al. [14]. In this architecture, the physical layer is composed of vari-
ous physical sensing equipment whose working performances are to be measured, the mid-
dle layer is formed of diferent controlling hardware components, and the software layer is
composed of all analysis techniques.
Fatima et al. [15] explained a general architecture that elaborates various architectural
practices for IoT and CPS as shown in Figure 6.6; the interoperability among these two
felds indicating similar processes like data preprocessing, element analysis, etc.; and the
transformation that can be performed from IoT to CPS and vice versa.
Zhan et al. [16] again proposed a three-layered architecture where the bottommost layer
is the data collection layer which is composed of diferent nodes and adapters that can be
used to provide a combined interface for collecting diverse data from diferent hospitals,
individual users, or from the Internet. Adapters here can be used to preprocess the col-
lected raw data having diferent structures and formats before transmitting it to the data
management layer. The next layer is the data management layer which is mainly composed
of two modules: The DFS module (Distributed File Storage module) and the DPC module
(Distributed Parallel Computing module) supported through various Big data techniques
for enhancing data storage and processing capabilities of the system. Now, the topmost
Figure 6.6 Architectural dataflow indicating same and different processes between CPS and IoT [15].
124 Secure and Smart Cyber-Physical Systems
layer is the Application Service layer which enables various user-centric APIs to show the
basic data analysis results. It will help to provide general user-adaptable and specialized
healthcare services.
Time is the most important factor to check the reliability and performance of Cyber-
Physical System in Smart healthcare. Minor delays of milliseconds in the treatment of a
patient can result in a risky or critical situation; hence, it will thereby reduce the efciency
and reliability of the system. CPS is used for continuous monitoring and control capabili-
ties and thereby introduces a new term known as Health Monitoring Status (HMS). HMS
can be used for a double purpose: To monitor the condition of each physical component of
CPS and to perform a proactive approach regarding the feasibility of CPS components [1].
Monitoring the medical status of patients is very important mainly after a surgery or even
for the routine activity of risky patients. Amin et al. [17] discusses various CPS solutions
designed for e-diagnostics and monitoring high-risk pregnancy, elderly people, and edema
patients as shown in Table 6.1.
In Smart Healthcare Systems, Digital Twin is basically a simulation model that provides
virtual resources in cyberspace to plan, control, and coordinate according to the digital
information received from the resources [25]. IoT can be helpful for machine-to-machine
(M2M) communication using wireless communication, Bluetooth, radio communication
etc., that is forwarded to cloud or remote servers for further controlling and analysis via AI
and ML prediction algorithms [1]. In CPS for Smart healthcare diferent medical devices,
M2M communication within diverse sensors continuously collects huge data that can be
in diferent formats so it needs to be processed, stored, and analyzed for receiving medical
information, and this is the situation where Big Data Analytics comes into its role [33].
CPS for Smart Healthcare can use cloud computing to digitally store the Electronic Health
Records (EHR) at the cloud server in an encrypted format to enable easy sharing and ac-
cess among various entities like patients, doctors, hospital staf, and insurance companies
[9]. Besides storing encrypted data, Industry 4.0 standards introduce various advance ser-
vice models for cloud manufacturing as explained in Table 6.2 [31]. Robots are basically
autonomous machines that can perform assigned tasks with proper accuracy [27]. In CPS
for Smart Healthcare Systems, medical robots can be used for assisting in patient care and
surgery. Industrial robots can be used for manufacturing tasks and surveillance [28]. Block-
chain technology helps in providing a decentralized and distributed database platform for
secured and authenticated access to EHR maintained by cloud servers [31].
105
100
95
90
85
Precision %
80 Recall %
75
Figure 6.7 Classifier performance evaluation for various physical activities using precision and
recall evaluation [36].
128 Secure and Smart Cyber-Physical Systems
10
6
RMSE
5
MAPE
4 MSD
3
0
MR SGD-LR SVM RF
Figure 6.8 Performance comparison of stochastic gradient descent algorithm with Logistic Re-
gression (SGD-LR), Multiple Regression (MR), Support Vector Machine (SVM), and
Random Forest (RF) [38].
comparison of the proposed algorithm with various other Big data techniques, namely
Multiple Regression (MR), Support Vector Machine (SVM), and Random Forest (RF).
The proposed architecture is basically composed of two main subsystems, first Meta-Fog
redirection that uses Big data techniques like Apache Pig and Apache HBase for collection
and storage of the collected sensor data, and second Grouping and Choosing architecture
for providing category-wise management and security services [44, 45].
Sr. No Model Techniques and Features Model Techniques and Features Functionality
algorithm to achieve high accuracy and precision in identifying the disease within mini-
mum time and disease prediction algorithm for fall prediction of elderly patients. Challa
et al. [42] proposed Burrows–Abadi–Needham logic (BAN logic) for providing authentica-
tion between a cloud server and a user followed by Automated Validation of Internet Secu-
rity Protocols and Applications (AVISPA) tool to ensure authentication between the cloud
server and smart meter. Figure 6.9 compares the total computation overhead of proposed
algorithm with various other schemes like Remote User Authentication (RUA), Mutual
Authentication Scheme (MAS), Ad-hoc Authentication Scheme (AAS), and Lightweight
Authentication Protocol for IoT (LAP-IoT). For providing efcient and scalable sharing
of encrypted data, Yang et al. [43] proposed a LiST (lightweight Sharable and Traceable)
highly secured mobile health system that ensures end-to-end encryption of patient data for
a mobile device to. the end user. This system also provides on-demand user abrogation,
supports traitors’ tracing and fne-grained control in data access, and enables efcient
keyword search.
130 Secure and Smart Cyber-Physical Systems
0.8
0.7
0.6
0.5 Smart equipment overhead(s)
0.4
Cloud Server Overhead(s)
0.3
Total Overhead(s)
0.2
0.1
0
AKAS RUA MAS AAS LAP-IoT
Figure 6.9 Performance comparison in terms of total computation overhead for Authenticate
KeyAgreement Scheme (AKAS), Remote User Authentication (RUA), Mutual Authen-
tication Scheme (MAS), Ad-hoc Authentication Scheme (AAS), and Lightweight Au-
thentication Protocol for IoT (LAP-IoT) [42].
designers of cyber-physical systems still face during the implementation of a precise and
accurate CPS in the healthcare sector, and a few of them are discussed below.
6.7 Conclusion
CPS includes the physical as well as the cyber components of a system where physical
components include various equipment with inbuilt sensors for data collection, and cyber
components include various data-handling schemes that enhance the overall performance
of the system with various automation techniques. CPS works within diferent domains like
132 Secure and Smart Cyber-Physical Systems
manufacturing, civil engineering, and aerospace. CPS plays an important role in the Smart
Healthcare System in terms of enhanced security, efciency, and accuracy from the system.
CPS utilizes various high-performance technologies like cloud computing, Big data, and
robotics for the betterment of the system performance. Big data analytics enables the pro-
cessing and handling of the rapidly increasing healthcare dataset generated from diferent
components of CPS having heterogeneous formats and environments, ensuring a personal-
ized experience with reduced medical costs. This work will help an individual to discover
diferent CPS characteristics and applications in various domains, technologies working
with CPS, Big data analytics with CPS, digital security in CPS, and the research challenges
in real-time implementation of CPS in Smart Healthcare Systems.
References
[1] Verma, Rupali. “Smart city healthcare cyber physical system: Characteristics, technologies and
challenges.” Wireless Personal Communications 122, no. 2 (2022): 1413–1433.
[2] Srivastava, Jyoti, Sidheswar Routray, Sultan Ahmad, and Mohammad Maqbool Waris. “Inter-
net of Medical Things (IoMT)-based smart healthcare system: Trends and progress.” Computa-
tional Intelligence and Neuroscience 2022 (2022).
[3] Balakrishnan, Amutha, Ramana Kadiyala, Gaurav Dhiman, Gokul Ashok, Sandeep Kautish,
Kusum Yadav, and J. Maruthi Nagendra Prasad. “A personalized eccentric cyber-physical system
Architecture for smart healthcare.” Security and Communication Networks 2021 (2021): 1–36.
[4] Wang, Lihui, Xi Vincent Wang, Lihui Wang, and Xi Vincent Wang. “Latest advancement in CPS
and IoT applications.” Cloud-Based Cyber-Physical Systems in Manufacturing (2018): 33–61.
[5] Dafon, Baudouin, Nejib Moalla, and Yacine Ouzrout. “The challenges, approaches, and used
techniques of CPS for manufacturing in Industry 4.0: A literature review.” The International
Journal of Advanced Manufacturing Technology 113 (2021): 2395–2412.
[6] Xiong, Gang, Fenghua Zhu, Xiwei Liu, Xisong Dong, Wuling Huang, Songhang Chen, and Kai
Zhao. “Cyber-physical-social system in intelligent transportation.” IEEE/CAA Journal of Auto-
maticaSinica 2, no. 3 (2015): 320–333.
[7] Smarsly, Kay, Michael Theiler, and Kosmas Dragos. “IFC-based modeling of cyberphysical sys-
tems in civil engineering.” In Proceedings of the 24th International Workshop on Intelligent
Computing in Engineering (EG-ICE). Nottingham, UK, vol. 7, no. 10, 2017.
[8] Maleh, Yassine. “Machine learning techniques for IoT intrusions detection in aerospace cy-
ber-physical systems.” Machine Learning and Data Mining in Aerospace Technology (2020):
205–232.
[9] Qi, Lianyong, Yi Chen, Yuan Yuan, Shucun Fu, Xuyun Zhang, and Xiaolong Xu. “A QoSaware
virtual machine scheduling method for energy conservation in cloud-based cyberphysical sys-
tems.” World Wide Web 23 (2020): 1275–1297.
[10] Munir, Arslan, and Farinaz Koushanfar. “Design and analysis of secure and dependable automo-
tive CPS: A steer-by-wire case study.” IEEE Transactions on Dependable and Secure Computing
17, no. 4 (2018): 813–827.
[11] Shangguan, Lantian, and Swaminathan Gopalswamy. “Health monitoring for cyber physical
systems.” IEEE Systems Journal 14, no. 1 (2019): 1457–1467.
[12] Napoleone, Alessia, Marco Macchi, and Alessandro Pozzetti. “A review on the characteristics
of cyber-physical systems for the future smart factories.” Journal of Manufacturing Systems 54
(2020): 305–335.
[13] Chen, Fulong, Yuqing Tang, Canlin Wang, Jing Huang, Cheng Huang, Dong Xie, Taochun Wang,
and Chuanxin Zhao. “Medical cyber—physical systems: A solution to smart health and the state
of the art.” IEEE Transactions on Computational Social Systems 9, no. 5 (2021): 1359–1386.
[14] Bordel, Borja, Ramón Alcarria, Tomás Robles, and Diego Martín. “Cyber—physical systems:
Extending pervasive sensing from control theory to the Internet of Things.” Pervasive and Mo-
bile Computing 40 (2017): 156–184.
[15] Fatima, Iqra, Saif U. R. Malik, Adeel Anjum, and Naveed Ahmad. “Cyber physical systems and
IoT: Architectural practices, interoperability, and transformation.” IT Professional 22, no. 3
(2020): 46–54.
AI-Enabled Smart Healthcare System 133
[16] Zhang, Yin, Meikang Qiu, Chun-Wei Tsai, Mohammad Mehedi Hassan, and Atif Alamri.
“Health-CPS: Healthcare cyber-physical system assisted by cloud and big data.” IEEE Systems
Journal 11, no. 1 (2015): 88–95.
[17] Amin, Sara, Tooba Salahuddin, and Abdelaziz Bouras. “Cyber physical systems and smart
homes in healthcare: Current state and challenges.” In 2020 IEEE International Conference on
Informatics, IoT, and Enabling Technologies (ICIoT), pp. 302–309. IEEE, 2020.
[18] Wu, Qiong, Zhiwei Zeng, Jun Lin, and Yiqiang Chen. “AI empowered context-aware smart
system for medication adherence.” International Journal of Crowd Science, vol. 1, no. 2, pp.
102-109, June 2017.
[19] Varshney, Upkar. “Smart medication management system and multiple interventions for medica-
tion adherence.” Decision Support Systems 55, no. 2 (2013): 538–551.
[20] Suzuki, Takuo, and Yasushi Nakauchi. “Intelligent medicine case for dosing monitoring: Design
and implementation.” SICE Journal of Control, Measurement, and System Integration 4, no. 2
(2011): 163–171.
[21] S. Ishak, H. Z. Abidin, and M. Muhamad, “Improving medical adherenceusing smart medicine
cabinet monitoring system.” The Indonesian Journal of Electrical Engineering and Computer
Science 9, no. 1 (2018).
[22] Chen, Chen, Nasser Kehtarnavaz, and Roozbeh Jafari. “A medication adherence monitoring sys-
tem for pill bottles based on a wearable inertial sensor.” In 2014 36th Annual International Con-
ference of the IEEE Engineering in Medicine and Biology Society, pp. 4983–4986. IEEE, 2014.
[23] Kalantarian, Haik, Nabil Alshurafa, Ebrahim Nemati, Tuan Le, and Majid Sarrafzadeh. “A
smartwatch-based medication adherence system.” In 2015 IEEE 12th International Conference
on Wearable and Implantable Body Sensor Networks (BSN), pp. 1–6. IEEE, 2015.
[24] Kalantarian, Haik, Babak Motamed, Nabil Alshurafa, and Majid Sarrafzadeh. “A wearable sensor
system for medication adherence prediction.” Artificial Intelligence in Medicine 69 (2016): 43–52.
[25] Khan, Sagheer, Tughrul Arslan, and Tharmalingam Ratnarajah. “Digital twin perspective of
fourth industrial and healthcare revolution.” IEEE Access 10 (2022): 25732–25754.
[26] Liu, Ying, Lin Zhang, Yuan Yang, Longfei Zhou, Lei Ren, Fei Wang, Rong Liu, Zhibo Pang, and
M. Jamal Deen. “A novel cloud-based framework for the elderly healthcare services using digital
twin.” IEEE Access 7 (2019): 49088–49101.
[27] Terashima, Kazuhiko, Kazuhiro Funato, and Takuyuki Komoda. “Healthcare robots and smart
hospital based on human-robot interaction.” In Human-Robot Interaction Perspectives and Ap-
plications. IntechOpen, 2022.
[28] Khan, Zeashan Hameed, Afifa Siddique, and Chang Won Lee. “Robotics utilization for health-
care digitization in global COVID-19 management.” International Journal of Environmental
Research and Public Health 17, no. 11 (2020): 3819.
[29] D’Auria, Daniela, and Fabio Persia. “A collaborative robotic cyber physical system for surgery
applications.” In 2017 IEEE International Conference on Information Reuse and Integration
(IRI), pp. 79–83. IEEE, 2017.
[30] Nguyen, Gia Nhu, Nin Ho Le Viet, Mohamed Elhoseny, K. Shankar, B. B. Gupta, and Ahmed A.
Abd El-Latif. “Secure blockchain enabled Cyber—physical systems in healthcare using deep belief
network with ResNet model.” Journal of Parallel and Distributed Computing 153 (2021): 150–160.
[31] Gupta, Brij B., Kuan-Ching Li, Victor C. M. Leung, Kostas E. Psannis, and Shingo Yamagu-
chi. “Blockchain-assisted secure fine-grained searchable encryption for a cloudbased healthcare
cyber-physical system.” IEEE/CAA Journal of Automatica Sinica 8, no. 12 (2021): 1877–1890.
[32] Dedeoglu, Volkan, Ali Dorri, Raja Jurdak, Regio A. Michelin, Roben C. Lunardi, Salil S.
Kanhere, and Avelino F. Zorzo. “A journey in applying blockchain for cyberphysical systems.”
In 2020 International Conference on COMmunication Systems & NETworkS (COMSNETS),
pp. 383–390. IEEE, 2020.
[33] Wang, Lidong, and Cheryl Ann Alexander. “Big data analytics in medical engineering and
healthcare: Methods, advances and challenges.” Journal of Medical Engineering & Technology
44, no. 6 (2020): 267–283.
[34] Shah, Tejal, Ali Yavari, Karan Mitra, Saguna Saguna, Prem Prakash Jayaraman, Fethi Rabhi, and
Rajiv Ranjan. “Remote health care cyber-physical system: Quality of service (QoS) challenges and
opportunities.” IET Cyber-Physical Systems: Theory & Applications 1, no. 1 (2016): 40–48.
[35] Sarosh, Parsa, Shabir A. Parah, G. Mohiuddin Bhat, and Khan Muhammad. “A security man-
agement framework for big data in smart healthcare.” Big Data Research 25 (2021): 100225.
134 Secure and Smart Cyber-Physical Systems
[36] Syed, Liyakathunisa, Saima Jabeen, S. Manimala, and Abdullah Alsaeedi. “Smart healthcare
framework for ambient assisted living using IoMT and big data analytics techniques.” Future
Generation Computer Systems 101 (2019): 136–151.
[37] Bansal, Malti, and Bani Gandhi. “IoT & big data in smart healthcare (ECG monitoring).” In
2019 International Conference on Machine Learning, Big Data, Cloud and Parallel Computing
(COMITCon), pp. 390–396. IEEE, 2019.
[38] Manogaran, Gunasekaran, Ramachandran Varatharajan, Daphne Lopez, Priyan Malarvizhi Ku-
mar, Revathi Sundarasekar, and Chandu Thota. “A new architect7ure of Internet of Things and
big data ecosystem for secured smart healthcare monitoring and alerting system.” Future Gen-
eration Computer Systems 82 (2018): 375–387.
[39] Adil, Muhammad, Muhammad Khurram Khan, Muhammad Mohsin Jadoon, Muhammad At-
tique, Houbing Song, and Ahmed Farouk, “An AI-Enabled Hybrid Lightweight Authentication
Scheme for Intelligent IoMT Based Cyber-Physical Systems,” in IEEE Transactions on Network
Science and Engineering, vol. 10, no. 5, pp. 2719-2730, 1 Sept.-Oct. 2023.
[40] Kumar, Mahender, and Satish Chand. “A provable secure and lightweight smart healthcare cyber-
physical system with public verifability.” IEEE Systems Journal 16, no. 4 (2021): 5501–5508.
[41] Ramasamy, Lakshmana Kumar, Firoz Khan, Mohammad Shah, Balusupati Veera Venkata Siva
Prasad, Celestine Iwendi, and Cresantus Biamba. “Secure smart wearable computing through
artifcial intelligence-enabled internet of things and cyber-physical systems for health monitor-
ing.” Sensors 22, no. 3 (2022): 1076.
[42] Challa, Sravani, Ashok Kumar Das, Prosanta Gope, Neeraj Kumar, Fan Wu, and Athanasios
V. Vasilakos. “Design and analysis of authenticated key agreement scheme in cloud-assisted
cyber—physical systems.” Future Generation Computer Systems 108 (2020): 1267–1286.
[43] Yang, Yang, Ximeng Liu, Robert H. Deng, and Yingjiu Li. “Lightweight sharable and traceable
secure mobile health system.” IEEE Transactions on Dependable and Secure Computing 17, no.
1 (2017): 78–91.
[44] Srivastava, Jyoti, and Sidheswar Routray. “AI enabled internet of medical things framework
for smart healthcare.” In Innovations in Intelligent Computing and Communication: First In-
ternational Conference, ICIICC 2022, Bhubaneswar, Odisha, India, December 16–17, 2022,
Proceedings, pp. 30–46. Springer International Publishing, 2023.
[45] Rajasoundaran, S., A. V. Prabu, Sidheswar Routray, S. V. N. Santhosh Kumar, Prince Priya
Malla, Suman Maloji, Amrit Mukherjee, and Uttam Ghosh. “Machine learning based deep job
exploration and secure transactions in virtual private cloud systems.” Computers & Security 109
(2021): 102379.
[46] Joshi, Amit M., Urvashi P. Shukla, and Saraju P. Mohanty. “Smart healthcare for diabetes during
COVID-19.” IEEE Consumer Electronics Magazine 10, no. 1 (2020): 66–71.
[47] Tiwari, Anurag, Viney Dhiman, Mohamed A. M. Iesa, Haider Alsarhan, Abolfazl Mehbodniya,
and Mohammad Shabaz. “Patient behavioral analysis with smart healthcare and IoT.” Behav-
ioural Neurology 2021 (2021).
[48] Uddin, Md Zia. “A wearable sensor-based activity prediction system to facilitate edge computing
in smart healthcare system.” Journal of Parallel and Distributed Computing 123 (2019): 46–53.
[49] Malla, Prince Priya, Sudhakar Sahu, and Sidheswar Routray. “Investigation of breast tumor
detection using microwave imaging technique.” In 2020 International Conference on Computer
Communication and Informatics (ICCCI), pp. 1–4. IEEE, 2020.
[50] Soundararajan, Rajasoundaran, A. V. Prabu, Sidheswar Routray, Prince Priya Malla, Arun Kumar
Ray, Gopinath Palai, Osama S. Faragallah et al. “Deeply trained real-time body sensor networks
for analyzing the symptoms of Parkinson’s disease.” IEEE Access 10 (2022): 63403–63421.
[51] Balasundaram, A., Sidheswar Routray, A. V. Prabu, Prabhakar Krishnan, Prince Priya Malla,
and Moinak Maiti, Internet of Things (IoT)-Based Smart Healthcare System for Efcient Diag-
nostics of Health Parameters of Patients in Emergency Care,” in IEEE Internet of Things Jour-
nal, vol. 10, no. 21, pp. 18563-18570, 1 Nov.1, 2023.
[52] Sathish Kumar, L., A. V. Prabu, V. Pandimurugan, S. Rajasoundaran, Prince Priya Malla, and
Sidheswar Routray. “A comparative experimental analysis and deep evaluation practices on hu-
man bone fracture detection using x-ray images.” Concurrency and Computation: Practice and
Experience 34, no. 26 (2022): e7307.
Chapter 7
Service-Oriented Distributed
Architecture for Sustainable Secure
Smart City
Sourav Banerjee, Sudip Barik, Arijit Sil, and Jerry Chun-Wei Lin
Chapter Contents
7.1 Introduction 135
7.2 Background 140
7.3 Related Work 141
7.4 Key Challenges 144
7.5 Proposed Architecture 145
7.5.1 Preliminaries 147
7.5.2 Data Management 147
7.6 Proposed Model and Challenges 148
7.7 Conclusion and Future Direction 149
Bibliography 150
7.1 Introduction
Smart cities and urban computing are exciting research areas full of new challenges and op-
portunities. A large urban area can be called a smart city if various services and operations
such as governance, healthcare, education, fuel, and energy distribution are supported by an
ICT infrastructure that ensures greater efciency and simpler operations. Prominent exam-
ples of such services include intelligent trafc monitoring, efcient and sustainable distribu-
tion of various energy needs (electricity, gas, fuel, etc.), ICT-enabled public transportation,
sensor-based pollution monitoring and control systems, online services for individual citi-
zens (e.g. buying a new car or property, applying for a passport or driver’s license, reporting
a crime, and seeking health services), etc. All of these services need to be integrated into an
architectural model to facilitate the daily lives of individuals. The design should also ensure
that everyone benefts from the system regardless of their ICT capabilities. With the launch
of the iPhone and Android handsets, substantial changes were made to both the business
models and the technological infrastructures on online platforms, serving as precursors to
this progression. Additionally, ICT industry-specifc equipment and solutions now need to
communicate with telecommunications networks. Meanwhile, telecom companies want to
provide more cutting-edge business solutions than they provide at the moment. Thus, it
seems sensible that as new business models are put forth, existing system architectures will
change to match those models. The business models proposed for smart cities are no excep-
tion: By defnition, they imply an evolution of the value chain as well as the related system
architecture that underpins both of these businesses. Table 7.1 demonstrates the impact of
Smart City Business Models [41]. The vast majority of Smart City Business Models fall into
one of several types, as shown Below [41].
• Public–Private Partnerships (PPPs): This model involves collaboration between local gov-
ernments and private companies to develop and implement smart city solutions. The
public sector provides the regulatory framework, while the private sector invests in the
technology and infrastructure needed to make the city “smart.”
• Software as a Service (SaaS): Here, smart city solutions are provided to customers on a
subscription basis. The SaaS provider is responsible for developing and maintaining the
software, while the customer pays a fee to use it.
• Infrastructure as a Service (IaaS): In this model, the smart city infrastructure is provided
as a service, similar to cloud computing. The IaaS provider is responsible for building
and maintaining the infrastructure, while the city pays a fee to use it.
• Build–Operate–Transfer: In this model, a private company builds and operates the smart
city infrastructure for a set period, typically 20–30 years. After this time, ownership is
transferred to the government.
• Joint Ventures: A joint venture involves a partnership between the government and pri-
vate companies, with both parties sharing risks and rewards. This model is often used for
large-scale projects that require signifcant investment.
• Service Contracts: In this model, the government contracts with private companies to
provide specifc smart city services, such as waste management, transportation, or energy
management.
• User Pays: The user pays model involves charging users for the use of smart city services,
such as toll roads, parking, or public transportation. This model can help to generate
revenue and encourage more sustainable use of resources.
Service-Oriented Distributed Architecture 137
The main motivation for building a smart city is to use the innovations of the digital and
information technology revolution to support the daily operations of a metropolis. This
also facilitates the adoption of an information society that continuously gathers informa-
tion from various sources (sensors, citizens, government agencies, social media, etc.) to bet-
ter understand and serve various stakeholders, paving the way for sustainable development
in the long run. Most importantly, smart city progress leads to a citizen-centric approach to
public administration that can eliminate corruption and free citizens from the stranglehold
of bureaucracy [1,6,13,14,17].
Over the years, various aspects of building smart cities have been extensively studied by
researchers, and many have developed various defnitions, frameworks, and solutions for
smart cities [12,18,23,25,42]. The goal is to identify and solve problems that arise in an
urban space with the increasing complexity of urban operations and the growing popula-
tion by taking advantage of recent advances in information and communication technology
(Figure 7.1). Waste management, smart distribution of scarce and limited resources, envi-
ronmental degradation, healthcare system, trafc congestion, and reconstruction and reuse
of obsolete infrastructure are some of the fundamental problems faced by cities around the
world [10,15,30].
Therefore, smart city today can be visualised as a massive information system consist-
ing of multiple subsystems that efectively cooperate in collecting, storing, retrieving, and
visualising data and enable citizens to access relevant information on demand using modern
network and communication mediums as depicted in Figure 7.2. There are some challenges
along the way to achieving these goals. Establishing adequate physical infrastructure and
secure and intelligent data processing and fnally creating appropriate interfaces for citizens
to adopt smart city services are some of the obstacles that need to be overcome. For example
implementing a smart transportation and trafc management system holds tremendous po-
tential for improving trafc conditions and road safety in a city, but the system may require
new types of networks to enable communication between vehicles. The implementation of
intelligent trafc management requires extensive infrastructure throughout the city, and
special care must be taken to ensure the security and privacy of the data collected and used.
Banerjee et al. [11] survey the possibilities of how automated vehicles can be embedded into
the trafc management system to bring about the next range of revolution in the transport
system. In [29] to determine an efective way, the images captured as sequence from a cam-
era are analysed using edge detection algorithm, object counting tool, and queue length
determination. Following that, the number of vehicles at the intersection is assessed, and
the fow of trafc is efectively controlled. Radio Frequency Identifcation (RFID), a brand-
new technology that can be combined with the current signalling system to provide intel-
ligent real-time trafc control, is introduced in [38]. In [53], the suggested method fnds the
vehicle candidates from the foreground image during vehicle detection, solving issues like
headlight efects. Vehicles are tracked using the tracking technique over a series of frames.
Finally, the tracking capabilities are improved by using a mechanism that makes up for er-
ror cases in busy environments.
Similarly, Ghosh et al. in [44] analyse security, privacy, and efcient information man-
agement in a healthcare system backed by IOT as the sector is vulnerable to cybersecurity
threats. Finally, event-driven architecture (EDA) is mentioned in [10], although it has yet
to be implemented. Table 7.2 demonstrates that architecture is independent of the smart
city organisation [public organisation, state-owned enterprise (SOE), project coalition, or
private company], as multi-tier architecture is observed in a variety of situations that follow
alternative organisational forms [7]. Layer selection in multi-tier architectures, on the other
hand, is unafected by ICT smart city selection (e.g. Trikala is a digital city and Kyoto is an
online city).
In order to efectively solve the difculties of an information management system specif-
cally created for smart cities, this chapter suggests a new paradigm. The following are the
prerequisites for creating a smart city:
• Establishing a strong network and sensor systems to enable continuous monitoring and
thorough real-world data collection.
• Efective methods for processing, retrieving, and storing data.
• Making it possible for data to be used by a variety of applications.
This will eventually convert the theory of a smart city to a reality. The system must also
meet additional criteria for scalability and security, which are all important cosiderations.
Case Findings
Architecture Organisation
Given the size of a modern metropolis and the rate of urbanization, these difculties are
exacerbated in real life.
In light of these difculties, our study suggests a high-end architecture based on the efec-
tive distribution and storage of urban data to ease the operation of smart cities. The model
is based on hierarchical and service-oriented storage of data that facilitates data visualiza-
tion and decision-making. While the hierarchical model introduces data redundancy, it also
efectively reduces network latency. Service-oriented distribution of data also enables im-
proved data security and privacy. Third-party applications can access appropriate service-
related datasets to provide services with enriched functionality and useful information to
end users. The main contributions of this chapter are as follows:
7.2 Background
In recent years, the concept of a smart city has grown in popularity as a means of addressing
the issues of urbanisation and the need for sustainable development. A smart city is one that
uses new technologies to optimise its functioning, increase its people’ quality of life, and
lessen its environmental efect. A smart city accomplishes this by utilising a variety of sys-
tems and devices that collect and analyse data to provide insights into urban activities [50].
So, as the number of devices and systems in a smart city grows, so does the complexity of
managing them. Moreover, ensuring the security of these systems and protecting the privacy
of citizens’ data have become a major concern. Therefore, designing efective and sustain-
able architecture for a smart city is critical to its success.
Service-Oriented Architecture (SOA) [19,35,54] is a well-established architectural style
that has been widely used in the design of large-scale distributed systems. SOA promotes
the creation of modular and reusable software components that can be combined to create
complex systems. By adopting an SOA-based approach, a smart city can create a fexible
and adaptable architecture style that can evolve over time as new technologies emerge.
In addition to being service-oriented, smart city architecture should also be distributed. A
distributed architecture allows for the decentralisation of data processing and reduces the
risk of system failure or downtime. Furthermore, a distributed architecture enables the use
of edge computing and the deployment of sensors and devices closer to the source of data,
thus reducing latency and improving the accuracy of data analysis.
architecture reduces the impact of security breaches. In addition, the architecture uses secure
communication protocols such as SSL/TLS to ensure the confdentiality and integrity of data.
management systems for smart cities. Above it is the standard user interface layer, which
contains the user interaction tools. The smart city layer is on top, and it unifes and stream-
lines interaction with the previous four layers.
Anthopoulos and Fitsilis have presented [4] a fve-layer smart city architecture that seeks
to integrate the physical and conceptual parts of such a system. The stakeholder layer iden-
tifes the various system users. The service layer explains how data and information are
distributed to stakeholders. The business layer focuses on the rules and procedures that will
control how a smart city operates. The infrastructure layer consists of the basic network
and communication devices required for the system, while the data layer is responsible
for defning the means and ways to manage data. According to research in [22], cities and
face-to-face contacts may be supplemented by telecommunications or at the very least, they
aren’t a powerful alternative for them.
The authors of [5] describe the development process for Trikala, Greece’s digital city
(e-Trikala), as well as the digital city’s contribution to e-Government. The methodology
shows the methods used to develop an e-Government environment in the digital city
that ofers more than just service administration. The approach incorporates difculties
related to participatory design, although other related factors are also examined. The
authors of [8] ofer a development model of municipal Enterprise Architecture using data
from a number of signifcant e-Government strategies and their enterprise architectures
(Figure 7.5). The confguration and appropriation of new socio-technical constituencies
are examined and afterwards interpreted in terms of social learning, according to the
authors of [50]. According to Filipponi et al., smart cities are divided into two categories:
Knowledge Processors (KPs) and Semantic Information Brokers (SIBs) [20]. SIB is where
information is saved. Once the KP is linked to the SIB, operations are initiated via the
Service-Oriented Distributed Architecture 143
Smart Space Access Protocol (SSAP). Through SSAP, KP manages all of the diferent user
sessions. Harrison et al. [27], on the other hand, proposed a framework using infrastruc-
ture and stakeholders to collect the necessary information about the evolving behaviour
of a smart city. In addition, Lugaric et al. [37] proposed a smart city architecture that
consists of three parts: the physical network, the communication devices, and the data
fow. To improve the reliability of smart city IoT devices, Ghosh et al. [39] build a dy-
namic correlation between nodes in a single cluster based on their statistical behaviour
when performing smart communication in Cognitive Radio Sensor Networks. Chourabi
et al. [17] proposed a framework that attempts to understand a smart city by identifying
external and internal categories of factors that act as infuencers. External factors include
governments, people, various other communities, natural resources, physical infrastruc-
ture, and the economy. Internal factors include technologies, rules, and related policies.
In [38], Banerjee et al. propose an energy-efcient cloud computing mechanism through
VM selection that is specifcally designed for an environment where large-scale virtualized
data centres need to communicate via the cloud and facilitate service-oriented computing.
From the above discussion, it is clear that recent advances in Big data management and
information technology will play a critical role in the development of future smart cities.
Taking these factors into account, this chapter proposes a distributed, service-oriented
smart city architecture that (i) allows a free yet secure fow of usable data and information
between diferent modules, (ii) is highly fexible to adapt to rapidly evolving technologies,
and (iii) follows an open data model that enables an interface for data sharing with third-
party developers and agencies.
144 Secure and Smart Cyber-Physical Systems
ICT Infrastructure: Developing and deploying the necessary ICT infrastructure in all des-
ignated locations in a city remain a major obstacle. The lack of a fast and stable Internet
connection throughout the city is one of the biggest challenges. The infrastructures already
in place are not scalable, which is another challenge. Before a smart city initiative can be
implemented, a reliable, scalable, and high-quality infrastructure must be installed [40].
Security and Privacy: As we move towards a smart city, citizens carrying sophisticated
handheld devices must provide personal data to smart city services [43]. For example
to know trafc conditions, a person must share his or her current location with a trafc
management system. Meeting the necessary security requirements for processing a huge
amount of private and sensitive data is a fundamental challenge in any smart city archi-
tecture. Sensitive data is always vulnerable to attacks by hackers, viruses, worms, and
Trojans, and if compromised, it can lead to a total disruption of the system, resulting in
large losses. The system must be carefully protected at every step of the collection, stor-
age, and retrieval of private, confdential data, not only to make data available but also
to build stakeholder confdence in the use of the services.
Big Data Management: A huge amount of data will always be generated by all smart city
systems [3]. The data can be generated in both structured and unstructured formats.
In order to handle this huge amount of data, efcient data management is an essential
requirement. Continuously collecting, storing, and retrieving data generated by a huge
number of smart city sensors are indeed formidable challenges. For example, the sensor
data from all vehicles operating in a city at GPS can be used to predict trafc fow, but it
requires an efcient handling of the enormous amount of data [31,32,51].
Financial Cost: Since a smart city requires enormous IT infrastructure, the fnancial cost of
setting things up is enormous [26]. To run this system efciently, millions of sensors, net-
work devices, and computers will be needed. There will also be a high cost to employing
IT professionals and maintenance staf. Maintaining the fow of operations and regularly
updating the systems will be necessary, for which separate budgetary resources will need
to be allocated. Maintaining the required level of efciency and ensuring security/privacy
will incur additional overhead costs.
Interoperability: Smart city architecture provides a heterogeneous environment where diferent
categories of applications, devices, and platforms must communicate seamlessly. The network
devices and connectivity required for smart trafc management are diferent from the type of
networking used for short-range wireless communications. Integrating the existing applica-
tions and network infrastructures into smart city architecture is a major challenge [16].
Efciency, Availability, and Scalability: Smart city systems are mission-critical and require
a high availability rate. As a system grows in size and complexity, its availability becomes
critical. A smart city, which is currently a massive and complicated system, will ex-
pand by leaps and bounds as it is deployed. With vast volumes of data fowing in all
Service-Oriented Distributed Architecture 145
the time, assuring data availability, scalability, and efciency remains a vital concern.
A smart city provides benefts such as performance optimisation, interoperability, efec-
tive planning, and fast response to service demands. In times of crisis, for example, all
civilian agencies should be able to collaborate to respond to an emergency.
A smart city appears to be the appropriate solution to the majority of the difculties caused
by rapid urbanisation and population increase. However, research has identifed challenges
due to inequity, the digital divide, and residents’ diverse cultural habits. The proposed ar-
chitecture addresses the technological aspects of smart city deployment.
the fow of data and service requests that come in as needed. The service layer facilitates the
development of strategic links between diferent departments of public and private organi-
sations responsible for the operation of various services related to urban life. Typically, all
of these departments operate in isolation with little or no coordination between them. This
is problematic because it hinders efective response and service in diferent circumstances.
The departments responsible for a particular service essentially use all their resources (ICT
or otherwise) to gather information relevant to their work. This leads to many problems
and delays in processing service requests. It is very tedious for citizens to get a response to
a service request that involves diferent departments. Even in disaster management, where
rapid response is an absolute priority, a lack of coordination between diferent units can
severely hamper the efectiveness of the response.
The architecture focuses on data sharing to enable mutual coordination between diferent
sectors. It also ofers open data services to third parties who wish to use the information
required to provide a service. This approach even allows cross-platform applications to
use real-time collected data from diferent sectors for decision-making, which can lead to
shorter response times and efectively increase the overall efciency of city services. By con-
tinuously sharing information from diferent domains, service providers can gain insights
into existing problems or even predict impending problems to take countermeasures before
the problem escalates or occurs.
Similarly, the availability of real-time data across diferent domains enables efcient re-
source management, allowing efective coordination and sharing of information, and the
response to an event or service request is efective and almost instantaneous.
Figure 7.7 shows a holistic view of our proposed architecture. The architecture is designed
as a system of subsystems, with each subsystem fully integrated and connected to other sub-
systems through the CDMS&KP layer. The CDMS&KP enables data sharing between dif-
ferent services operating at the service level. A subsystem can share information and insights
through CDMS&KP while benefting from cross-domain knowledge and services accessible
through the architecture. CDMS&KP acts as an integration point for information fow in
diferent directions. In addition, CDMS&KP can also use the data and information fowing
through it to make decisions in real-time.
7.5.1 Preliminaries
The traditional city is divided into diferent zones of administration. Each zone admin-
istration is responsible for providing services in that area through a local ofce that
manages the records for that area. Therefore, the proposed architecture is also based
on such a scenario. Each subsystem is responsible for a specifc service and collects data
from the zone sites, where the data is managed in the cloud of the local data centre. For
electricity management, the system maintains a number of cloud data centres through-
out the city, each of which stores its local data. Similar facilities can be implemented
for water management, waste management, gas supply management, etc. Given the
complexity and challenges at the technical and social levels, a smart city can only be
developed in a phase-wise manner. By facilitating zone-level services, this architecture
enables the gradual and ever-expanding deployment of smart city services. Each zone is
considered an autonomous system consisting of a local data centre, network facilities,
and any other related infrastructure capable of collecting, storing, retrieving, and pro-
cessing data. Zonal systems can also interoperate via web services to provide cross-zone
services.
Figure 7.8 depicts a city’s electricity management system. Zone A stores data collected by
sensors and other devices in a local relational database. Zone A data centres provide ser-
vices to zone A clients. Because of its established ACID property and query optimisation
capability, a relational database is selected. A fast and reliable network connects all zonal
data centres to the central data centre. Data from all zonal data centres is consolidated in
a centralised data management facility. The volume of data created across all zones will be
enormous. To deal with the enormity and complexity of the acquired data, sophisticated Big
data management solutions must be in place.
Service-Oriented Architecture: The smart city architecture described in this study is es-
sentially a large-scale distributed system that adheres to the decentralisation principle.
To enable interoperability, modularity, software reuse, and application integration, the
system must leverage open standards like XML, WSDL, SOAP, and UDDI across multi-
ple platforms, heterogeneous networks, and a range of service requirements. Water and
waste management services provided by another application can thus be used by the
disaster management application via smooth interoperability.
Open Data Model: Since any data centre will generate a huge amount of data, it is only pru-
dent to make that data available to anyone who is interested. Therefore, the architecture
follows an open data model that allows researchers, app developers, and private agencies
148 Secure and Smart Cyber-Physical Systems
to access the central repository through a revenue-based system in a selective manner after
ensuring privacy and data security. This allows researchers and app developers not only to
gain new insights into city operations but also to develop new apps to better serve citizens.
time by enabling instant collaboration between diferent departments. This approach improves
the processing and sharing of real-time data for planning the efcient distribution of resources.
Following is a discussion of how the proposed model addresses key challenges:
ICT Infrastructure: A zone-by-zone implementation means that not all infrastructure needs
to be brought online at the same time. The model supports a phased rollout of smart city
services. Nevertheless, the model still requires adequate infrastructure on the way to a
smart city.
Security and Privacy: The model provides data as part of various web services it ofers.
To ensure the security of the data, it uses the standard of end-to-end encryption at the
message level. The model also collects private and sensitive data from its users. It shares
private information only after obtaining the necessary consent from the user. Data is
shared only with authenticated agencies in accordance with the rules and regulations set
by the relevant authority.
Big Data Management: Zone-wise distribution of data helps with efective collection, stor-
age, and analysis. Each public service department stores data collected in a given area in
a zonal data centre. As a result, decisions and services that afect a particular zone do not
have to be routed through central data storage. If a service needs to be provided at the
city level, the zonal data centres can always share the information with the central data
repository, where it can be further processed to fnd a solution.
Cost: The initial cost of installing all the ICT infrastructure and setting up zonal data cen-
tres along with a centralised data repository may seem very expensive, but in the long
run, the efciency and ease of use built into a smart city architecture will tilt the balance
in its favour by increasing the speed and efciency of public services and reducing costs
for users.
Interoperability: The model provides a service-oriented architecture in which data and in-
formation are available through web services. This approach makes data available to
diferent clients. Web services seamlessly integrate diferent applications, regardless of
the underlying platform.
Efciency, availability, and scalability: The smart city architecture proposed here eliminates
the need for many manual operations in city administration. The division of the city into
self-sufcient operational zones results in the separation of daily activities. Automation
also provides greater efciency and shorter response times.
Because the system is divided into separate operational zones, the unavailability of services
in a particular zone for any reason does not afect the entire system. Since most data is also
replicated in a central repository, a failed data service can be quickly restored using the
central data centre.
The system supports the easy introduction and integration of new services. It also ena-
bles the replacement of old services with new ones. Even trusted third parties can use data
through web services to fnd solutions to the city’s problems. This horizontal growth cycle
is one of the unique features of the architecture. In addition, each zonal entity can improve
its services and expand its resources as needed, which also enables vertical growth.
Bibliography
[1] Mahmoud Al-Hader and Ahmad Rodzi. The smart city infrastructure development & monitor-
ing. Theoretical and Empirical Researches in Urban Management, 4(2 (11):87–94, 2009.
[2] Mahmoud Al-Hader, Ahmad Rodzi, Abdul Rashid Sharif, and Noordin Ahmad. Smart city com-
ponents architicture. In 2009 International Conference on Computational Intelligence, Model-
ling and Simulation, pages 93–97. IEEE, 2009.
[3] E. Al Nuaimi, H. Al Neyadi, N. Mohamed and J. Al-Jaroodi, Applications of big data to smart
cities. Journal of Internet Services and Applications, 6, pp. 1-15, 2015.
[4] L. Anthopoulos, and P. Fitsilis, “From Digital to Ubiquitous Cities: Defning a Common Archi-
tecture for Urban Development,” 2010 Sixth International Conference on Intelligent Environ-
ments, Kuala Lumpur, Malaysia, pp. 301-306, 2010.
[5] Leo G. Anthopoulos and Ioannis A. Tsoukalas. The implementation model of a digital city. The case
study of the digital city of trikala, greece: E-trikala. Journal of e-Government, 2(2):91–109, 2006.
[6] Leonidas Anthopoulos and Panos Fitsilis. From online to ubiquitous cities: The technical trans-
formation of virtual communities. In Next Generation Society. Technological and Legal Issues:
Third International Conference, e-Democracy 2009, Athens, Greece, September 23–25, 2009,
Revised Selected Papers 3, pages 360–372. Springer, 2010.
[7] Leonidas Anthopoulos and Panos Fitsilis. Exploring architectural and organizational features in
smart cities. In 16th International Conference on Advanced Communication Technology, pages
190–195. IEEE, 2014.
[8] Leonidas G. Anthopoulos. Collaborative enterprise architecture for municipal environments. In
Advances in Government Enterprise Architecture, pages 392–408. IGI Global, 2009.
[9] B. Azvine, N. Azarmi, and K. C. Tsui. Soft computing: A tool for building intelligent systems. BT
Technology Journal, 14(4):37–45, 1996.
[10] Tuba Bakici, Esteve Almirall, and Jonathan Wareham. A smart city initiative: The case of barce-
lona. Journal of the Knowledge Economy, 4(6), 2012.
[11] Sourav Banerjee, Chinmay Chakraborty, and Sumit Chatterjee , A Survey on IoT Based Traf-
fc Control and Prediction Mechanism. In: Balas, V., Solanki, V., Kumar, R., Khari, M. (eds)
Internet of Things and Big Data Analytics for Smart Generation. Intelligent Systems Reference
Library, vol. 154. Springer, Cham. https://doi.org/10.1007/978-3-030-04203-5_4
[12] Iain Begg. Cities and competitiveness. Urban Studies, 36(5–6):795–809, 1999.
[13] Jennifer Belissent. The core of a smart city must be smart governance. Forrester Research Inc.
Cambridge Google Scholar, 2011.
[14] Christine Bellamy and G. D. Garson. The politics of public information systems. Public Admin-
istration and Public Policy, 77:85–98, 2000.
[15] Zhang, Abraham, V. G. Venkatesh, Jason X. Wang, Venkatesh Mani, Ming Wan, and Ting Qu.
“Drivers of industry 4.0-enabled smart waste management in supply chain operations: a circular
economy perspective in china.” Production Planning & Control 34, no. 10, pp. 870-886, 2023.
[16] Arianna Brutti, Piero De Sabbata, Angelo Frascella, Nicola Gessa, Rafaele Ianniello, Cristiano
Novelli, Stefano Pizzuti, and Giovanni Ponti. Smart city platform specifcation: A modular ap-
proach to achieve interoperability in smart cities. In The Internet of Things for Smart Urban
Ecosystems, Springer, Cham. pages 25–50, 2019.
Service-Oriented Distributed Architecture 151
[17] H. Chourabi, T. Nam, S. Walker, J. R. Gil-Garcia, S. Mellouli, and K. Nahon, T. A. Pardo, and
H. J. Scholl “Understanding smart cities: An integrative framework.” In 2012 45th Hawaii in-
ternational conference on system sciences, IEEE, pp. 2289-2297, 2012.
[18] Stefanie Duĺhr. Potentials for Polycentric Development in Europe: The Espon 1.1. 1 Project Re-
port. Planning, Practice & Research, 20(2):235–239, 2005.
[19] Hisham Elhoseny, Mohamed Elhoseny, Samir Abdelrazek, Hazem Bakry, and Alaa Riad. Utiliz-
ing service oriented architecture (SOA) in smart cities. International Journal of Advanced Com-
puter Technology (IJACT), 8(3):77–84, 2016.
[20] Luca Filipponi, Andrea Vitaletti, Giada Landi, Vincenzo Memeo, Giorgio Laura, and Paolo
Pucci. Smart city: An event driven architecture for monitoring public spaces with heterogeneous
sensors. In 2010 Fourth International Conference on Sensor Technologies and Applications,
pages 281–286. IEEE, 2010.
[21] Margaret Fleck, Marcos Frid, Tim Kindberg, Eamonn O’Brien-Strain, Rakhi Rajani, and Mir-
jana Spasojevic. From informing to remembering: Ubiquitous systems in interactive museums.
IEEE Pervasive Computing, 1(2):13–21, 2002.
[22] Jess Gaspar and Edward L. Glaeser. Information Technology and the Future of Cities. Journal of
Urban Economics, 43(1):136–156, 1998.
[23] Rudolf Gif nger, Christian Fertner, Hans Kramar, Robert Kalasek, and Natasıa Pichler
Milanovic. Meijers, evert-smart cities. Ranking of European Medium-Sized Cities, Vi-
enna University of Technology, Final Report, 2007, Online: https://www.researchgate.net/
publication/261367640_Smart_cities_-_Ranking_of_European_medium-sized_cities
[24] Pierpaolo Girardi and Andrea Temporelli. Smartainability: A methodology for assessing the sus-
tainability of the smart city. Energy Procedia, 111:810–816, 2017. https://www.researchgate.
net/publication/241977644_The_vision_of_a_smart_city#fullTextFileContent
[25] R. Hall, B. Bowerman, Joseph Braverman, J. Taylor, Helen Todosow, and U. Wimmersperg. The
vision of a smart city. 2nd International Life Extension Technology Workshop Paris, France Sep-
tember 28, 2000, 2000.
[26] Steve Hamilton and Ximon Zhu. Funding and fnancing smart cities. The Journal of Govern-
ment Financial Management, 66(1):26–33, 2017.
[27] Colin Harrison, Barbara Eckman, Rick Hamilton, Perry Hartswick, Jayant Kalagnanam, Jurij
Paraszczak, and Peter Williams. Foundations for smarter cities. IBM Journal of Research and
Development, 54(4):1–16, 2010.
[28] Ishida T, Isbister K, editors. Digital cities: technologies, experiences, and future perspectives.
Springer Science & Business Media; 2000 Mar 2.
[29] Supriya Kamoji, Aswathi Nambiar, Karishma Khot, and Ravi Bajpai. Dynamic vehicle trafc man-
agement system. IJRET International Journal of Research in Engineering and Technology, vol. 4. pp.
352-356. 10.15623/ijret.2015.0404063. 2015.
[30] Yin, C., Xiong, Z., Chen, H., Wang, J., Cooper, D. and David, B., “A literature survey on smart
cities,” Science China. Information Sciences, 58(10):1-18, 2015.
[31] Zaheer Khan, Ashiq Anjum, and Saad Liaquat Kiani. Cloud based big data analytics for smart
future cities. In 2013 IEEE/ACM 6th International Conference on Utility and Cloud Comput-
ing, pages 381–386. IEEE, 2013.
[32] Zaheer Khan, Ashiq Anjum, and Saad Liaquat Kiani. Cloud based big data analytics for smart
future cities. In 2013 IEEE/ACM 6th International Conference on Utility and Cloud Comput-
ing, pages 381–386. IEEE, 2013.
[33] Nicos Komninos. The architecture of intelligent cities: Integrating human, collective and artif-
cial intelligence to enhance knowledge and innovation. In 2006 2nd IET International Confer-
ence on Intelligent Environments-IE 06, volume 1, pages 13–20. IET, 2006.
[34] Victor V. Kryssanov, Masayuki Okabe, Koh Kakusho, and Michihiko Minoh. Communication
of social agents and the digital city—a semiotic perspective. In Digital Cities II: Computational
and Sociological Approaches: Second Kyoto Workshop on Digital Cities Kyoto, Japan, October
18–20, 2001 Revised Papers 2, pages 56–70. Springer, 2002.
[35] Dilshodbek Kuryazov, Bekmurod Khujamuratov, and Khursand Sherkhanov, “Sustainable Ser-
vice-Oriented Architecture for Smart City Development,” 2019 International Conference on
Information Science and Communications Technologies (ICISCT), Tashkent, Uzbekistan, pp.
1-5, 2019. doi: 10.1109/ICISCT47635.2019.9011877.
152 Secure and Smart Cyber-Physical Systems
[36] Ninad Lanke and Sheetal Koul. Smart trafc management system. International Journal of
Computer Applications, 75(7), 2013.
[37] Luka Lugaric, Slavko Krajcar, and Zdenko Simic. Smart city—platform for emergent phenom-
ena power system testbed simulator. In 2010 IEEE PES Innovative Smart Grid Technologies
Conference Europe (ISGT Europe), pages 1–7. IEEE, 2010.
[38] Riman Mandal, Manash Kumar Mondal, Sourav Banerjee, and Utpal Biswas. An approach to-
ward design and development of an energy-aware vm selection policy with improved sla viola-
tion in the domain of green cloud computing. The Journal of Supercomputing, 76:7374–7393,
2020.
[39] Li Manman, Pratik Goswami, Proshikshya Mukherjee, Amrit Mukherjee, Lixia Yang, Uttam
Ghosh, Varun G. Menon, Yinan Qi, and Lewis Nkenyereye. Distributed artifcial intelligence
empowered sustainable cognitive radio sensor networks: A smart city on-demand perspective.
Sustainable Cities and Society, 75:103265, 2021.
[40] Catherine A. Middleton, Andrew Clement, and Graham Longford. ICT Infrastructure as Public
Infrastructure: Exploring the Benefts of Public Wireless Networks. TPRC, 2006.
[41] Catherine E. A. Mulligan and Magnus Olsson. Architectural implications of smart city business
models: An evolutionary perspective. IEEE Communications Magazine, 51(6):80–85, 2013.
[42] Michael Parkinson, Greg Clark, Mary Hutchins, James Simmie, and Hans Verdonk. Competitive
European Cities: Where Do the Core Cities Stand? Ofce of the Deputy Prime Minister London,
2004.
[43] Daniela Popescul and Laura-Diana Genete. Data security in smart cities: Challenges and solu-
tions. Informatica Economicfa, 20(1), 2016.
[44] Pradip Kumar Sharma, Uttam Ghosh, Lin Cai, and Jianping He. Guest editorial: Security, pri-
vacy, and trust analysis and service management for intelligent internet of things healthcare.
IEEE Transactions on Industrial Informatics, 18(3):1968–1970, 2021.
[45] A. Steventon and S. Wright. Intelligent spaces—the vision, the opportunities, and the barriers. In
Intelligent Spaces: The Application of Pervasive ICT, pages 1–17. Springer-Verlag, 2006.
[46] Kehua Su, Jie Li, and Hongbo Fu. Smart city and the applications. In 2011 International Confer-
ence on Electronics, Communications and Control (ICECC), pages 1028–1031. IEEE, 2011.
[47] Chai K. Toh. Security for smart cities. IET Smart Cities, 2(2):95–104, 2020.
[48] Angeliki Maria Toli and Niamh Murtagh. The concept of sustainability in smart city defnitions.
Frontiers in Built Environment, 6:77, 2020.
[49] Zhao Tong, Feng Ye, Ming Yan, Hong Liu, and Sunitha Basodi. A survey on algorithms for in-
telligent computing and smart city applications. Big Data Mining and Analytics, 4(3):155–172,
2021.
[50] M. J. Van Lieshout. Confguring the digital city of amsterdam: Social learning in experimenta-
tion. New Media & Society, 3(2):131–156, 2001.
[51] Ignasi Vilajosana, Jordi Llosa, Borja Martinez, Marc Domingo-Prieto, Albert Angles, and Xavier
Vilajosana. Bootstrapping smart cities through a selfsustainable model based on big data fows.
IEEE Communications Magazine, 51(6):128–134, 2013.
[52] Mark Weiser. The computing for the twenty-frst century. Scientifc American, 94–104, 1991.
[53] Bing-Fei Wu, Chih-Chung Kao, Jhy-Hong Juang, and Yi-Shiun Huang. A new approach to video-
based trafc surveillance using fuzzy hybrid information inference mechanism. IEEE Transac-
tions on Intelligent Transportation Systems, 14(1):485–491, 2012.
[54] Zhang Xiong, Yanwei Zheng, and Chao Li. Data vitalization’s perspective towards smart city:
A reference model for data service oriented architecture. In 2014 14th IEEE/ACM International
Symposium on Cluster, Cloud and Grid Computing, pages 865–874. IEEE, 2014.
[55] Tan Yigitcanlar and Md Kamruzzaman. Does smart city policy lead to sustainability of cities?
Land Use Policy, 73:49–58, 2018.
[56] Lotf A. Zadeh. The roles of fuzzy logic and soft computing in the conception, design and deploy-
ment of intelligent systems. BT Technology Journal, 14(4):32–36, 1996.
[57] Kuan Zhang, Jianbing Ni, Kan Yang, Xiaohui Liang, Ju Ren, and Xuemin Sherman Shen. Se-
curity and privacy in smart city applications: Challenges and solutions. IEEE Communications
Magazine, 55(1):122–129, 2017.
Chapter 8
Chapter Contents
8.1 Introduction 153
8.2 Background of CPS 154
8.2.1 CPS Layers and Components 154
8.2.1.1 CPS Layers 155
8.2.1.2 CPS Components 156
8.2.2 CPS Model Types 158
8.3 Cyber-Physical System Attacks and Vulnerabilities 159
8.3.1 Cyber-Physical System Attacks 159
8.3.1.1 Physical Attacks 159
8.3.1.2 Cyberattacks 161
8.3.2 Cyber-Physical System Vulnerabilities 164
8.3.2.1 Cyber Vulnerabilities 165
8.3.2.2 Physical Vulnerabilities 166
8.4 Characteristics of Adversaries 166
8.5 Failure of CPS 167
8.6 Recommendation for CPS 168
8.7 Present Work and Future Research Direction 172
8.8 Conclusion 173
References 173
8.1 Introduction
To create the physical world function appropriately and more straightforwardly, the Cyber-
Physical System (CPS) attempts to track physical systems’ activity and enable actions to
alter their behavior. A cyber-physical arrangement (CPS) normally consists of a pair of fun-
damental parts, a physical mechanism, and cyber conformity. The motive state is usually
tracked or managed via a specifc cyber device, a networked arrangement of many small
devices with (often wireless) capability for sensing, computation, and communication. A
spontaneous occurrence (e.g., an inoperative volcano) and a human-made dynamic struc-
ture (e.g., an operational room), rather a more confused mixture of those two may be the
dynamic mechanism involved. As the physical and virtual systems’ link grows, the physical
systems become more and more vulnerable to computer system security vulnerabilities. For
instance, several hackers have hacked into the U.S. Federal Aviation Agency’s air trafc con-
trol expedition networks in many incidents in contemporary ages, according to an Inspector
DOI: 10.1201/9781003376712-8
154 Secure and Smart Cyber-Physical Systems
General’s research proposed to the FAA in 2009 (Mills, 2009). Any hacker can now even
hack specifc medical devices with wireless communications embedded in the human body.
A CIA report (O’Connell, 2008) shows that hackers have breached energy grids in many
neighborhoods just outside of the United States and triggered a power failure that involved
several towns in at least one instance. Within 2010, the antagonists exhibited a software
intermediary summoned CarShark (Koscher et al., 2010) that could remotely disable a car
engine, switch of individual brakes so that the car does not stop, and create tools by track-
ing messages among the electronic control units (ECUs) and injecting fake datagrams to
send out strikes and provide false readings. Hackers have formulated a virus 2023 that can
efectively target the Siemens plant-control arrangement.
The bulk of cybersecurity event datasets are confdential, usually combined with the addi-
tional caveat that they are either kept hidden or just exchanged within acutely technological
circles as bugs are identifed. Consequently, there is an incentive provided before and after
the vulnerable discovery stage for presumably silent zero-day penetration by ofenders who
may be highly competent. Therefore, it can be argued that the emphasis is not directly on the
existence and substance of an exploit but on how it is capable of weaving between computer
security systems to accomplish the ultimate purpose of exploitation. In reality, redemption
vulnerabilities are located in even deeper cyber-physical regularities, such as electrical energy
systems, conveyance infrastructure, and healthcare regularities. Researchers are beginning to
think about CPS stability. If we have more intelligent and highly knowledgeable cyber-physical
networks, these systems’ potential faws should be carefully considered. In reality, security is
a relatively recent environment for CPSs and more research needs to be done within this feld.
Similar to any other emerging area, the greatest initiative appears to concentrate on map-
ping clarifcations from subsisting contexts, previously mentioned as sensor networks that be-
stow networked activities and low-ability features among CPS (Roy et al., 2018a). Typically,
though, these resolutions have yet to be established to address CPSc. As an illustration, the
gas department’s cyber-physical machine would communicate with the one that controls the
wounded individual’s well-being to accomplish the rescue operation, imagining an example of
gas leakage in a bright house. These applications are, under normal circumstances, separate.
Nevertheless, all these applications need to collaborate and exchange resources to achieve the
same purpose if there is an incident. For interoperation between heterogeneous systems, con-
ventional safe communication solutions are not planned. Cyber-physical networks guarantee
that the device is always protected when communicating with another system is a fundamental
challenge. Some modern CPS security challenges need to be discussed as well.
In this chapter, we frst discuss the background of CPS, which consists of CPS layers and
components and CPS model type; second, the faws, attacking models, and forms of adver-
saries are identifed. After that, we also discuss some recommendations and failures in CPS.
The CPS device design consists of various courses and modules that depend on diverse com-
munication etiquette and technology to interact across multiple courses.
Cliff Edge on Cyber-Physical Systems 155
Each design of the CPS consists of three fundamental courses—a specifc course of vision,
the course of transmission, furthermore the course of operation, as manifested and defned
in Figure 8.1. A specifc study (Ashibani and Mahmoud, 2017) is a foundation for review-
ing the diferent CPS course protection problems.
• Perception Layer: It is often referred to since unless every layer of identifcation or the
course of sense. This involves cameras, actuators, aggregators, tags for Radio Frequency
Identifcation (RFID), Global Positioning System (GPS), and many other devices. To
track, monitor, and analyze the physical environment, these instruments capture real-
time data. Examples of such collected data include vibrational and visual signals, as
well as data related to electrical usage, heat, position, chemistry, and biology, depending
on the sensor type. Once collected, this data is then processed through treatment pan-
els, allowing sensors to analyze real-time data within large regional interface specialties.
Besides, actuator securing relies on ofcial authorizations to assure that all input plus
command groups remain error-free and safeguarded. In general, increasing the degree
of protection includes applying a framework of end-to-end encryption on each course.
Heavyweight reckonings and high-retention specifcations will then be set in place. There
is a need for reliable and lightweight protection protocols to be built in this context, tak-
ing into account the capacities of the equipment and safety specifcations.
• Transmission Layer: This is the second layer of CPS, which is additionally assigned
as the course of transport or the network layer. Layer as mentioned earlier, reciproca-
tions furthermore prepare knowledge among the levels of interpretation and imple-
mentation. Managing Local Area Networks’ (LANs’) further networking standards,
including Bluetooth, 4G, 5G, InfraRed (IR), ZigBee, Wi-Fi, LTE, diferent innova-
tions onward, data transfer, and interaction are accomplished across the Internet.
Notwithstanding the reason mentioned above, separate protocols, such as Internet
Protocol version 6 (IPv6)(Wu and Lu, 2010), imply profciency to manage the growth
during the particular number of machines connecting to the Internet. The course, as
mentioned above, guarantees information routing and communication via fog foun-
dation services, networking modules, swapping and Internet gateways, frewalls, and
Intrusion Detection/Prevention Mechanisms (IDS/IPS) (Sommestad et al., 2010). To
bypass interruptions and vicious muggings, including ransomware, spiteful crypto-
gram injection, Denial of Service/Distributed Denial of Service (DoS/DDoS), eaves-
dropping, and furthermore, unlawful admittance initiatives, it is important to ensure
their delivery until outsourcing data content (Weiss, 2010). This poses a provocation,
principally concerning resource-constrained machines, owing to the overhead com-
manded in phases of the processor and energy sources demanded. Overhead includes
both computational demands on the processor and the energy resources required.
• Application Layer: This signifes a single layer that is threefold, moreover, and social.
This layer devises some transmission layer information and furthermore carries out the
physical device’s instructions, including those of the sensors and actuators. This is ac-
complished by the application of complicated decision-making algorithms concentrated
on aggregated information (Saqib et al., 2015). Besides, before evaluating the correctly
invoked automatic behavior, this layer receives and processes knowledge from the per-
ception layer (Khan et al., 2012). Algorithms for cloud storage, middleware, and infor-
mation tunneling are utilized to handle this layer’s data. Protecting and retaining privacy
involve protecting the leakage of sensitive knowledge. Anonymization, information
masking (camoufage) (Roy et al., 2019a), and isolation protection, including hidden
distribution, are among the most well-known protective methods. Besides, this layer of-
ten includes a substantial multifactor authentication classifcation to avoid unauthorized
admittance and privilege intensifcation. The scale of the data produced has become a
big concern because of the rise in Internet-connected devices (Kumar and Patel, 2014).
Thus, securing large data calls for appropriate encryption strategies to handle vast data
volumes in a timely and reliable manner.
For sensing erudition (Gries et al., 2017) concerning monitoring signals, CPS compo-
nents are used (Figure 8.2). CPS components are divided in this respect into a couple
of infuential classes: Sensing Components (SC), which handle and sense erudition, and
Controlling Components (CC), which track and regulate beacons.
• Sensing Components: The sensors remain essentially positioned in the perception layer
and furthermore serve the purpose concerning sensors to collect and transmit informa-
tion upon aggregators. This information is then assigned for further analysis to some
actuators to obtain a reliable strategic thinking. These main protective-service-detecting
components are listed below.
○ Sensors: To determine the quality of the data gathered, meaningful data is collected
and reported following a correlation method called “calibration.” Sensing knowledge
is important since the options can focus on the interpretation of this information.
○ Aggregators: The statistics obtained from sensors is mainly analyzed at the transmis-
sion layer (i.e., routers, sockets, and access points) until the subsequent decision is
issued (s). In reality, the aggregation of data is analyzed, and the results are gathered
for a given goal, where this information is collected and presented after a statistical
Cliff Edge on Cyber-Physical Systems 157
review. Online Analytical Processing (OLAP) is a main cluster formation method used
as an online knowledge production reporting method.
○ Actuators: To render the details available to the external world based on the judg-
ments taken by the aggregators, the implementation layer is located. Because actua-
tors are highly dependent on certain network devices, any operation executed by the
CPS is focused on a previous data aggregation sequence (Roy et al., 2019b). Following
the defnitions, actuators often process electrical signals as an input, generating physi-
cal behavior as an output.
• Controlling Components: To attain greater precision and security degrees from disruptive
attacks or collisions, primarily signal blasting, noise, and intrusion, they imply managing
beacons and operating an absolute position in beacon administration, tracking, and su-
perintendence. As a consequence, it has become indispensable to focus on Programmable
Logic Controllers (PLCs) and Distributed Control System (DCSs) onward including their
elements [i.e., Programmable Automation Controller (PAC) (Mazur et al., 2012), Opera-
tional Technology/Information Technology (OT/IT) (Morelli et al., 2019), Control Loop/
Server (Vogel and Zack, 2006), and Human Machine Interface (HMI)/Graphical User
Interface (GUI) (Ardanza et al., 2019)]. First, we mention the numerous forms of control
systems in use inside CPS structures.
• Programmable Logic Controllers (PLCs): Primarily conceived to substitute wired DPDT
and SPDT relays, they are called the research-automated computers that monitor the
158 Secure and Smart Cyber-Physical Systems
production processes, including the output of robotic systems and/or the handling of
fault diagnosis, thereby achieving greater fexibility and resilience.
• Distributed Control Systems (DCSs): Computer-controlled management systems are vir-
tual instrumentation systems that enable the deployment of decentralized controllers
within the system utilizing formal authority from a central operator. There is improve-
ment in DCSs’ reliability due to the item and management phase, while its implemen-
tation cost has decreased. DCS may be equivalent to Supervisory Control and Data
Acquisition (SCADA) schemes in certain situations.
• Remote Terminal Units (RTUs): These are electronic devices which are powered by a
microprocessor, such as that of the Master Terminal Unit (MTU) (Stoufer et al., 2011)
or “Remote Telemetry Uni.”(Roy et al., 2019c). They do not endorse any feedback loop
and control algorithm, unlike the PLC(s). Therefore, they are more suited for wireless
interactions in larger regional telemetry regions. The key role of the RTUs is to use a
supervisory messaging framework to communicate SCADA to the specifc object(s) that
govern(s) these artifacts via the transmission of sensor information by the system.
In fact, a tiny computer-controlled “artifcial brain” [Central Processing Unit (CPU)] is used
by both RTUs and PLCs to process diferent components from smart sensors and pumping
devices; thus, the usage of IEDs (Intelligent Electronic Devices) to relay streams of data or,
in the event of an attack, causes an alarm. Concerning the interaction between instruments
and levels, it must be said that sensing instruments are implemented predominantly at the
layers of interpretation and propagation. In contrast, the regulating modules are installed
at the level of operation.
may be used to describe any event’s spatiotemporal property while additionally defning
all those elements that a particular conclusion has identifed.
• Hybrid-Based CPS Model: Hybrid CPS schemes remain complex structures consisting of
two diferent types of interactive processes—a persistent state (physical functional networks)
and a discrete state (discrete computer systems). The reaction of isolated transient events
defned by neural networks and the complex action represented by the equation(s) of dif-
ferential/diference depend on growth and evolution. Unlike diferent CPS variants, hybrid
CPS is integrated through an interface, rendering it susceptible to procrastination. Also, no
hierarchical simulation is supported by hybrid CPS frameworks, and they are not appropri-
ate for the modeling of linear models. The simulation problems of hybrid systems caused
by CPS have been addressed (Roy et al., 2016). In reality, Kumar et al. (2012) discussed
and solved CPS device network latency problems using real-time hybrid authentication. In
contrast, Tidwell et al. introduced a customizable actual hybrid structural test for it. Finally,
Jianhui (2011) proposed an event-driven control of CPS focused on hybrid automatons.
The numerous types of threats that threaten the various facets of CPS networks, particularly
cyber and physical ones, are presented in subsequent subsections.
In previous years, direct attacks have been more successful, in particular toward industrial-
ized CPSs. Most of these assaults have already been responded to. Nonetheless, this essay
presents a wider variety of forms of material intervention:
• Infected Items: Aforementioned group covers infected CDs, USBs, computers, also
drives, and before-mentioned while individual Stuxnet worm, which, when embedded
within a cyber-physical computer, piles up on clandestine malware comprising malicious
programs.
• Abuse of Privilege: If rogue or dissatisfed staf obtain access to the CPS domain’s server
rooms and implementation zones, they are committing abuse of privilege attack. This
can help them implant a rogue USB for exploitation or catch sensitive details by running
harmful security software or as a keystroke.
• Wire Cuts/Taps/Dialing: Since the contact lines of certain cyber-physical headquarters
(HQs), including telephony and Wi-Fi, are already physically observable, attackers may
break the cables or wiretap them to decrypt the individual transmitted data.
• False Identity: As perpetrators try to portray themselves as legitimate workers, this as-
sault happens with ample expertise to deceive others. To achieve easy access and greater
160 Secure and Smart Cyber-Physical Systems
contact with other staf, they mostly serve as cleaners. The Maroochy Water Leak in
Australia in 2000 (Slay and Miller, 2007) is an outstanding illustration of this.
• Stalkers: These would be typically legitimate workers who behave curiously (with sinis-
ter intent) by peering over the heads of CPS supervisors and designers to gain their trust
to coerce or ofer them positions in additional CPS organizations.
• Surveillance of CCTV Camera Images: This involves intercepting videos from closed-circuit
news cameras that are used to protect access and important aspects within CPS zones. For
carrying out a physical attack to be undetected, the aforementioned can conspire by collaps-
ing camera beacons, condensing transmission cables, removing the video, obtaining admit-
tance over some cloud handle and surveillance division, and so on.
• Key-Card Hijacking: This entails copying valid cards taken from workers or generating
authentic lookalike counterparts to achieve full/partial admittance and breach specifc
feld of the CPS.
• Physical Breach: this assault involves the procurement of unauthorized physical entry to
the infrastructure, specifcally by a physical breach, such as the 2011 Springfeld Pumping
Station case (Fillatre et al., 2017); a loophole, such as the 2013 Georgia Water Treatment
Plant case (Credeur, 2013); or a security breach exploited, such as the 2012 Canadian
Telvent Company case. This enables an intruder to disrupt and shut down CPS equip-
ment and network-connected production networks, resulting in a lack of accessibility and
efciency.
• Malicious Third-Party Information Provider: A particular primary aim of the aforemen-
tioned assault transpires to threaten the organization’s CPS by breaching specifc legal
software “Industrial Control Systems,” a before-mentioned essentially individual 2008
shutdown concerning a particular Georgia Nuclear Power Plant. This involved swapping
legal fles in their libraries with software intended to include remote access capability to
monitor or exploit a device.
• Misuse of Privilege: Acts usually accompanied by insiders, practically “whistle-blowers,”
to carry out or aid in the implementation of a (cyber)-attack from inside. These high
privileges ofer them the power to carry out these threats by disclosing useful information
regarding the faws and shortcomings in CPS programs. This exploitation of authority
will come in several shapes and sizes.
○ Physical Tampering: This includes obtaining unauthorized or spoofng-approved en-
try through confned felds to disrupt CPS arrangements and equipment, alter their
operating convention, insert malicious information, or appropriate sensitive reports.
○ Unauthorized Actions: These are focused on conducting suspicious functions, such
as opening/closing pumping stations, increasing/decreasing power voltage, opening
closed ports, interfering with an external agency, redirecting network trafc, or leak-
ing information.
• Social Engineering: It may demand several manipulative manners as before-mentioned
essentially invert architecture (impersonating the tech-savvy), baiting (selling disrup-
tive USBs or software), tailgating (following approved staf), or arranging quid pro quo
(impersonating technical support teams) and, furthermore, remains focused upon the
science of exploiting individuals (psychologically rather than emotionally) to disclose
sensitive erudition through infuencing their emotions.
Hackers have lately shifted their focus to CPS networks for espionage, infltration, warfare,
terrorism, and service stealing (Mahato et al., 2021), especially cyber-warfare (Ray, 2020),
Cliff Edge on Cyber-Physical Systems 161
cybercrimes (Choraś et al., 2016), and (cyber)-terrorism (Haimes, 2002) in, countries like Leb-
anon (Barakat, 2019). (cyber)-sabotage (Alenius and Warren, 2012) (for example, cyber intru-
sions toward Estonia in 2007 (Kaeo, 2007) moreover Georgia in 2008 (Donovan Jr, 2009)),
about (cyber)-espionage (Yeboah-Ofori et al., 2019). The lack of (cyber)-security exposed a
major problem among potentially catastrophic implications, especially in the United States.
8.3.1.2 Cyberattacks
There has been a spike in the specifc number of cyber intrusions against CPS and IoCPT
in recent years, with rather signifcant implications. CPS is particularly vulnerable to mali-
cious SQL injection attacks (Francillon and Castelluccia, 2008) and script attacks (Roemer
et al., 2012), simultaneously including false declaration intrusion ofenses (Alemzadeh et
al., 2016), zero-control info strikes (Hu et al., 2016b), and furthermore ultimately Control-
Flow Attestation (C-FLAT) interventions, as per existing research carried out by Abera et al.
(2016). As seen in Table 8.1, such assaults might lead to a complete blackout striking CPS
industrial equipment and systems.
The USA Ohio Nuke Plant Slammer Worm Malware-DoS January 25, Criminal
Network 2003
The USA Georgia Nuclear Installed Undefined March 7, 2008 Unclear
Power Plant Software Software
Shutdown Update
The USA Springfield Pumping Backdoor Unauthorized November 8, Criminal
Station Access 2011
Iran Iranian nuclear Stuxnet Worm November, Political
facilities 2007
Iran Power plant and Stuxnet-2 Worm December 25, Political
other industrie 2012
Saudi Saudi infrastructure Shamoon-1 Malware August 15–17, Religion-
Arabia in the energy 2012 Political
industry
Qatar Qatar’s RasGas Shamoon Malware August 30, Political
2012
Australia Maroochy Water Remote Access Unauthorized March, 2000 Criminal
Breach Access
Canada Telvent Company Security Breach Exploited September 10, Criminal
Vulnerability 2012
162 Secure and Smart Cyber-Physical Systems
run in the intended suferer mesh browser (typically a targeted CPS programmer, con-
structor, or worker). XSS will hijack a victim’s session and, in certain situations, register
keystrokes and obtain remote access to their computer.
• SQL Injection: SQLi is a weakness that enables hackers to read and/or change sensitive
data on CPS database-driven websites, as well as to conduct administrative tasks like
database shutdown, particularly while CPS policies remain nevertheless utilizing SQL
concerning information management.
• Password Cracking: This includes attempt to break the passwords of CPS users (primar-
ily designers and administrators) utilizing brute force, dictionary (Narayanan and Shma-
tikov, 2005) (mitigated through key shift), rainbow table (Papantonakis et al., 2013),
birthdays (mitigated via hashing), or online/ofine password presuming interventions to
obtain entry into individual identifcation database, or the incoming/outgoing transac-
tions. As a consequence, it’s necessary to stop more intensifcation.
• Phishing: This is accomplished in several ways, as before-mentioned in the forms of email
phishing, vishing, spear-phishing or whaling, targeted at any complete CPS customer[such
as programmers, experts, executives, Chief Executive Ofcers (CEOs), Chief Operating
Ofcers (COOs), furthermore Chief Financial Ofcers (CFOs)], by imitating company
peers or service providers.
• Replay: This involves impersonating ICSs, RTUs, and PLCs to intercept transmitted/re-
ceived packets between them to trigger impediments that can impact CPSs’ present-time
regulations plus availability. These intercepted packets might, in certain circumstances,
be changed, which would signifcantly disrupt regular processes.
• DoS/DDoS: DoS attacks exploit the infrastructure of the cyber-physical framework and
moreover are initiated by a great range concerning computers that are locally compro-
mised. DDoS attacks are normally carried out by Botnets, which use many infected com-
puters to initiate a DDoS assault simultaneously from multiple geological positions. DoS
interventions can gain various modes [i.e., blackhole (Al-Shurman et al., 2004), tear-
drop], whereas DDoS can reap signifcant subsequent patterns, both of which threaten
CPS structures [i.e., ping-of-death, smurf (Kumar, 2007), including Black Energy se-
quence (BE-1, BE-2, and BE-3 (Khan et al., 2016)].
○ TCP SYN Flood: This takes advantage of the TCP handshake mechanism by sub-
mitting requests to the server continuously without answering, forcing the server to
reserve a room in expectation of an answer (Roy et al., 2018b). This results in an
overload of the bufer, which creates the cyber-physical machine to fail.
• Malicious Third-Party: This involves malware that remotely attacks information-
gathering networks and breaches them, specifcally through utilizing botnets, Trojans,
or worms to penetrate erudition via a CPS-encrypted tunnel of a constitutional device
(i.e., PLC, ICS, or RTU) to a botnet Command-and-Control server through the use of a
trustworthy third party within the mask. As a consequence, CPSs (Antonioli et al., 2018)
and AMIs (Sgouras et al., 2017) are being attacked.
• Watering-Hole Attack: The intruder looks for some faws in cyber-physical protection.
Once a loophole has been found, a “watering leak” will be set up on the selected CPS
website, where ransomware will be distributed by abusing the intended CPS framework,
primarily via backdoors, rootkits, or zero-day exploits.
• Malware: Malware denotes ways to hack CPS machines to capture or drip data, dam-
age appliances, or circumvent admittance command arrangements. This malware may
Cliff Edge on Cyber-Physical Systems 163
necessitate several diferent types of assault, but the most popular ones that threaten CPS
are concisely described and conferred below.
○ Botnets: Aforementioned entails manipulating the faws of CPS machines to trans-
form them into bots or zombies, specifcally to carry out DDoS assaults that are barely
traceable [i.e., Ramnit (2015) (De Carli et al., 2017), Mirai (2016)(Kolias et al., 2017),
Smominru botnet (2017) (De Carli et al., 2017), Mootbot (2020) (Seering et al.,
2018), Wild-Pressure furthermore VictoryGate (2020)].
○ Trojan: Trojan implies a malicious mask that looks genuine but fools users into install-
ing that. The Trojan infects the computer when it is downloaded and provides indirect
admittance to withdraw data credentials including track user actions. Turla (2008),
MiniPanzer/MegaPanzer (2009) (Scott and Chen, 2013), Ghost RAT (2009)(Boina-
pally et al., 2017), Shylock (2011)(Murdoch and Leaver, 2015), Corefood (2011)(Hen-
draningrat et al., 2013), DarkCornet (2012) (Farinholt et al., 2017), MEMZ (2016),
Tiny-Banker (2016) (Gostev et al., 2016), Banking.BR Android, and Botnet (2020) are
examples of Remote Access Trojans that can transform a computer into a bot.
○ Virus: It may reproduce and propagate to other machines with the aid of humans or
nonhumans. Viruses infect CPS computers and steal knowledge by linking themselves
to other executable codes and programs.
○ Worms: These propagate by leveraging OS vulnerabilities to damage owner webs by
bringing payloads to withdraw, alter, or erase info or overwhelm web-servers [aside
from Stuxnet, Flame, and Duqu, e.g., Code Red/Code Red II (2001) (Cowie et al.,
2001), Nimda (2001) (Machie et al., 2001), Triton (2017) (Di Pinto et al., 2018)].
○ Rootkit: Rootkit means to enter or manipulate a device remotely and covertly to
achieve records, strip data by altering machine settings (i.e., Moonlight Maze (1999),
and introduce Blackhole exploit kit (2012).
○ Polymorphic Malware: the identifable entity shifts repeatedly and regularly to prevent
getting identifed and enhances indistinctness toward every pattern-matching identif-
cation method.
○ Spyware: Spyware is a harmful program remotely mounted on a computer for surveil-
lance purposes having an outwardly exceptional understanding of the consumer or
consent (e.g., surveillance, reconnaissance, or scanning). In reality, they [(ProjectSau-
ron (2011) (Adams et al., 2020), Dark Caracal (2012), Red October (2013) (Chavez
et al., 2015), Warrior Pride (2014)(Marquis-Boire et al., 2015), Fin-Fisher (2014),
furthermoreCOVID-19 spyware) may be used for potential cyberattacks.
○ Ransomware: Ransomware signifes a spiteful malware that utilizes CPS vulnerabili-
ties to retain and encrypt CPS data as a hostage, targeting oil refneries, power grids,
industrial plants, and medicinal stations, also encrypting complete data reinforce-
ments before a ransom is charged. Siskey (2016), SamSam (2016), Locky (2016), Jig-
saw (2016), Hitler-Ransomware (2016), WannaCry (2017), Petya (2017), Bad-Rabbit
(2017), Maze (2019), and Ekans (2020) ransomware are only a few cases.
• Side-Channel: This is focused on data gathered of individual CPS devices, as before-
mentionedfor measuring information and energy usage, including electromagnetic losses
that can be manipulated.
In fact, as early as the 1980s, Do et al. provided a far more thorough explanation of the
attack (Fillatre et al., 2017). On the other hand, this chapter attempts to characterize these
164 Secure and Smart Cyber-Physical Systems
attacks’ frequency as early as 2000, focusing on several reasons including, though not lim-
ited to, national, social, and criminal intentions.
A weakness is a software weakness that can be used for the intent of manufacturing re-
connaissance (reconnaissance preferentially into efective interventions). Each vulnerability
evaluation thus entails defning and assessing the available vulnerabilities of the CPS while
at the same time identifying efective improvement plus precautionary steps to minimize,
alleviate, and instead likewise remove the unspecifed vulnerability. There exist three major
categories of CPS vulnerabilities:
Vulnerabilities exist regardless of several causes. There are, however, three primary triggers
of vulnerability as explained here:
• Assumption and Isolation: In most CPS designs, they are focused on the trend of “defense
through anonymity.” Consequently, the emphasis here is on developing a dependable
and stable framework but still considering the deployment of required security facilities
without implying that networks are entirely disconnected from the outside world.
• Increasing Connectivity: As the network grows more connected, the attack surface be-
comes greater. Manufacturers have developed CPSs by introducing open networks and
open wireless applications, as CPS devices have become more linked in recent years. Up
until 2001, the bulk of ICS assaults were focused on internal attacks. This was before the
Internet, which changed the concept of threats from the outer world.
• Heterogeneity: CPS solutions contain heterogeneous modules from third parties com-
bined to construct CPS implementations. Consequently, CPS has developed into a multi-
vendor scheme, with separate protection weaknesses for each product.
• USB Usage: Aforementioned stands a big trigger concerning vulnerabilities in CPS, be-
fore-mentioned since the particular matter concerning this Stuxnet strike against Iranian
energy plants, as unique USB is within specifc malware. The malware spread through
many computers after it was plugged in due to manipulation and duplication.
• Poor Practice: This is mainly due to bad coding/weak abilities, which allow the code to
perform endless loops or becoming too simple to be changed by an intruder.
• Spying: CPS networks are often susceptible to spying/surveillance assaults, which are car-
ried out mostly by the use of spyware (malware) forms that obtain enigmatic admittance
and furthermore stay undetected for extended periods, among the particular primary
purposes of eavesdropping, stealing, and collecting sensitive data including knowledge.
• Homogeneity: Related forms of cyber-physical networks enduring specifc similar
faws that can impact any of the equipment in their proximity until activated, a prime
Cliff Edge on Cyber-Physical Systems 165
illustration being the Stuxnet worm assault upon Iranian nuclear energy plants (Iasiello,
2013).
• Suspicious Employees: Through undermining moreover changing specifc code writing,
or through allowing distant entrance to hackers via specifc availability regarding secured
ports or obstructing an infected USB device, suspicious employees may deliberately or
unintentionally damage or hurt CPS computers.
CPS weaknesses may also be of three kinds, namely electronic, human, furthermore mean-
while fused, all occur in any physical, cyber hazard.
ICS implementations are vulnerable to security breaches considering that ICS depends mas-
sively upon public criterion etiquettes, including the Inter-Control Center Communications Pro-
tocol (ICCP) (Gungor et al., 2011) and also the Transmission Control Protocol/Internet
Protocol (TCP/IP). In reality, ICCP experiences some crucial vulnerability to bufer surplus-
age (Zhu et al., 2011) and lacks fundamental protection measures. In reality, the Remote
Procedure Call (RPC) protocol and ICSs are susceptible to diferent types of attack, including
Stuxnet (1 and 2) (Karnouskos, 2011) and Duqu malware (1.0, 1.5, and 2.0) (Bencs´ath et al.,
2012), Gauss malware (Bencs´ath et al., 2012), plus RED October malware (Chavez
et al., 2015), as well as Shamoon malware (1, 2, and 3) (Dehlawi and Abokhodair, 2013).
Interception, snifng, eavesdropping, wiretapping, wardialing also wardriving attacks (Fran-
cia III et al., 2012) and furthermore, meet-in-the-middle attacks are all feasible with
open/non-secure wired/wireless communications like Ethernet. Wireless short-range com-
munications are often sensitive, as insiders may intercept, evaluate, harm, erase, or even
exploit them. Besides, if not safe, employees’ linked tools to the ICS transpacifc interface
are susceptible to the botnet, indirect admittance Trojan, and furthermore rootkit interven-
tions. Their devices are managed remotely by an attacker. Eavesdropping, replay assaults,
and unintended connection attacks are all feasible for long-range wireless communications.
However, SQL injection endures greatest signifcant web-related weakness. By inserting a
malicious code that proceeds to operate indefnitely until executed without the user’s aware-
ness, attackers may enter any application database without authorization.
Since certain medicinal tools rely tediously upon radio transmissions, all are susceptible
to a range of radio interventions such as jamming, alteration, and furthermore, replay due
to a defciency concerning encryption. Furthermore, GPS moreover particular machine mi-
crophones are already being used as a monitoring mechanism, enabling the target’s position
to be calculated or in-car conversations to be overheard by eavesdropping.
In contrast, ICS relies upon the Modbus plus DNP3 protocols to track sensors and actuators
and command them. According to Humayed et al. (2017), the Modbus protocol lacks simple
protection mechanisms before-mentioned such as encryption, authentication, including author-
ization. The aforementioned becomes rendered it vulnerable to eavesdropping, wiretapping,
and port-scan, with the possibility of spoofng the controller by fake insertion of information.
The DNP3 protocol is often vulnerable to the same bugs and threats, with the Cyclic Redun-
dancy Review (CRC) integration essentially a probity measure being one of the key distinctions.
Besides, Windows Server is susceptible to remote code execution, with further assaults being
achieved in every running operating device by manipulating bufer overfow vulnerabilities (OS).
Furthermore, since smart grid power system architecture is built on the same protocols as
ICS, Modbus, and DNP3, it is subject to the same bugs as ICS, Modbus, and DNP3. Con-
sequently, the IEC 61850 etiquette was adopted in substation interfaces, which historically
166 Secure and Smart Cyber-Physical Systems
• Dissatisfed insiders having spiteful intention do not necessarily have a great under-
standing of cyber intrusion expertise, and their information of the game operation
additionally empowers them to acquire unrestricted admittance to overthrow the con-
formity or to appropriate system data, which are known to be the key source of cyber-
crime and sabotage; workers, contractors, or business associates may be the types of
insiders.
• The ransom will be the prime motive for a criminal organization conducting an assault
on a cyber-physical infrastructure (O’Connell, 2008).
• Many terrorists want higher-impact objectives in a single nation, before-mentioned es-
sentially aero orderliness or energy network systems, and all could acquire the particular
capability to pull these vital cyber-physical installations down. Also, by employing highly
trained coders, hiring control device developers, and bribing insiders, they can presum-
ably attempt to accomplish the target (Wan et al., 2010).
The CPS defenders should follow the necessary policies or tactics to react to the threat
based on adversaries’ types. Furthermore, to develop hazard models, researchers may ob-
tain a deeper comprehension of foe features and the potential to predict an adversary.
• Content Loss: This indicates that each content concerning specifc information transmit-
ted is unreliable, occurring in the failure of the functional structure. The lack of content
may imply both numerical or non numerical mode (i.e., alphabets, graphics, sounds, or
colors).
• Timing Failure: This indicates that specifc timing (transmission/receipt) of the process-
ing of information is postponed or disrupted (collected/transmitted too short-stemmed or
exceedingly belated). The aforementioned will change the specifc methods of decision-
making and could create difculties with data administration.
• Sensors Failure: This suggests that specifc sensors imply no long-drawn working cor-
rectly, presenting a signifcant challenge to decision-making owing to incorrect input or
forcing the CPS device to a standstill. In 2005, at the Taum Sauk Hydroelectric Power
Station, a related event occurred.
• Silent Failure: This happens in a distributed device where there is no communication sent
or received.
• Babbling Failure: This happens as the data is provided, allowing the device to crash and
work in a babbling fashion.
• Budget Failure: This happens where the signifcant expense of installing a cyber-physical
device reaches the resources allocated ere the system is checked. This is largely attributed
to a lack of preparation.
• Schedule failure: This happens when due to more upgrades, further tests, or insufciency
for customer requirements, the schedule provided for preparing, testing, and reviewing a
specifed CPS is not met.
168 Secure and Smart Cyber-Physical Systems
• Application Failure: This happens where the service interface propagates an error and
impacts its decision-making capacity or/and usual output quality. This failure will result
in a partial or total failure of the CPS device, which can be temporary or permanent.
• Consistent/Inconsistent Failures: A consistent failure arises when all CPS customers view
a specifed service identically. If all CPS customers interpret an erroneous service difer-
ently (i.e., Bohrbugs, Mandelbugs, Heisenbugs, and Byzantine defeats), this is referred to
as an incomplete failure.
tracking channels plus device actions, efectively restricting multiple reconnoitering en-
deavors. Nevertheless, those fresh advanced forensic instruments remain compatible with
the software/hardware of numerous CPSs, particularly resource-constrained machines,
and moreover, necessity likewise remains immune to anti-forensic trials.
• Enhanced Approach to Incidents: This requires the capacity to recognize, warn, and react
to a specifc event. To minimize threats, proposals for event response and investigation
can be enforced. This ofers defense against accidental technological and organizational
failures (power loss, blackout) through contingency arrangements, and against malicious
failures (cyber initiatives), by teams of CERT (Computer Emergency Response) and
CSIRT (Computer Security Incident Response), including IRCF (Incident Response and
Computer Forensics). Essentially to maintain an improved and productive cyber, physi-
cal, and device ecosystem with safe computing and communications, CPS experts plus
designers undertake additional training and practice.
• Real-Time Monitoring: Utilizing advanced forensics or non-forensic software and tech-
niques to operate real-time applications is vital to avoiding any cyber-physical device
malfunction, whether unintentional or not. This helps CPSs' actions to be continuously
tested and tracked and, thus, identify unspecifed cyber threat endeavors under their im-
mature platforms.
• Security Check: Staf monitoring necessity imply carried out ere including throughout
specifc work for each employee to remove moreover accommodate unspecifed potential
efort by a whistle-blower. Accordingly, it is strongly advisable to sign agreements such
as the Non-Disclosure Agreement (NDA), the Confdentiality Agreement (CA), the Con-
fdential Disclosure Agreement (CDA), the Proprietary Knowledge Agreement (PIA), or
the Privacy Agreement (SA). These security checks are particularly relevant in vulnerable
areas like nuclear power plants.
• Periodic Employee Training: This requires periodic ICS and PLC employee sensitivity
training about the best practices of data protection depending on their degree and experi-
ence and the potential to spot any unusual action or operation. Employees must also be
educated on a range of technology risks and poor behaviors, such as stopping download-
ing any app upgrades, avoiding social engineering and phishing attempts, and preserving
transparency in the event of misconduct.
• Daily Pen Monitoring and Vulnerability Assessment: This must be conducted on a rou-
tine basis to implement device auditing, identify intimidations, including resolving them
in real-time until all are detected furthermore misused via an intruder beneath zero-days
misuse statuses.
• Periodic Risk Evaluation: The potential and efect regarding a profered danger upon a
critical/noncritical cyber-physical framework based upon a qualitative/quantitative dan-
ger assessment and a Cost–Beneft Analysis (CBA) must both be enforced to study and
identify the danger based upon an adequate/non-adequate mode, including minimizing
this soon while practicable.
• Up-to-Date Devices: Cyber-physical policies necessarily remain up-to-date in the areas
of applications, frmware, including hardware by implementing checks and upgrades
daily. Furthermore, such structures must be safe at various stages of deployment (lay-
ered protection), including the signifcant potential to alleviate and furthermore react to
an intervention to minimize its efect including avoiding additional intensifcation and
furthermore harm. Also, to avoid any payload injection, USB ports obligation signify
corporally including inevitably disabled. The actions and behavior of PLC devices must
Cliff Edge on Cyber-Physical Systems 171
○ Step 6: The implemented CPS device will undergo a trial phase after satisfactory tests
to ascertain its operating state, thus tracking its actions and efciency before being
completely operational.
CPS is rapidly emerging because of increased levels of automation and intelligence, espe-
cially data analytics. These qualities Increased levels of automation, Intelligence, and data
analytics are determined through artifcial intelligence approaches such as machine learn-
ing. According to a report from the National Science and Technology Council in the United
States (Cowie et al., 2001), AI and data analytics potential are viewed as game changers.
Context awareness is critical for new sorts of AI-based CPSs, particularly the capacity to
identify which entities are now present in the relatively close and deduce their intentions.
The advancement of AI technology across a variety of application sectors is expected to
generate higher degrees of automation. Because of their potential to address social concerns
and create cash, future CPSs will be assigned more complex jobs in open environments. To
counteract conventional manufacturing uses, extremely sophisticated technologies are being
applied and disseminated across the society—for example, self-driving automobiles on pub-
lic highways with no human involvement and robot–human collaboration systems.
Smart CPS is in charge of dynamic changes in the environment (e.g., highly change-
able trafc situations that alter fast in response to changing human behaviors and CPS
infrastructures). It typically indicates that not all operational circumstances are known a
priori (at the time of system creation), as shown in the example by Branquinho (2018).
The broader implications include that open CPS faces a variety of current and new types
of uncertainty, including largely unknown surroundings, weaknesses in safety and assaults
(predict attack by establishing “attacker models”), and altering CPS itself (due to partial
failures). Uncertainty can apply to features of a CPS as well as to all stages of the life cycle.
Cliff Edge on Cyber-Physical Systems 173
It is obvious that the potential qualities of future CPSs would necessitate new methods of
thinking about system-level attributes and composability.
8.8 Conclusion
CPS technologies are essential parts of Enterprise v4.0, and by combining the real and cyber
environments, they are now explaining how people communicate with the either external sur-
roundings. The aim of introducing CPS programs, whether inside or outside of IoT (IoCPT),
is to increase the standard of goods and systems’ availability and functionality. On the other
hand, CPSs are plagued by a bunch of protection and data issues that jeopardize their depend-
ability, protection, and performance, as well as obstructing their widespread adoption.
This chapter looks at the past of the CPSs and the security risks and vulnerabilities in
cyber-physical structures and the guidelines for current CPS security models. We hope that
these problems and concerns can provide ample impetus for potential discussions and study
interests in CPS protection aspects.
In this chapter, we discussed the protection threats including concerns in a cyber-physical
system. We divided this book chapter into three parts; in the first part, we discussed the
background of the CPSs. After that, we recognized the reasonable vulnerabilities, attack
arguments, opponent features, and an assemblage of provocations that necessitate being
inscribed. We furthermore discussed some recommendations and failures in CPSs.
References
Tigist Abera, Tigist, N. Asokan, Lucas Davi, Jan-Erik Ekberg, Thomas Nyman, Andrew Paverd, Ah-
mad-Reza Sadeghi, and Gene Tsudik. C-flat: Control-flow attestation for embedded systems soft-
ware. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications
Security, pages 743–754, 2016. https://www.witpress.com/Secure/ejournals/papers/TDI040103f.pdf
Adams, N.P.H., Chisnall, R.J., Pickering, C., and Schauer, S. How port security has to evolve to ad-
dress the cyber-physical security threat: Lessons from the sauron project. International Journal of
Transport Development and Integration, 4(1):29–41, 2020.
Homa Alemzadeh, Homa, Daniel Chen, Xiao Li, Thenkurussi Kesavadas, Zbigniew T. Kalbarczyk,
and Ravishankar K. Iyer. Targeted attacks on teleoperated surgical robots: Dynamic model-based
detection and mitigation. In 2016 46th Annual IEEE/IFIP International Conference on Depend-
able Systems and Networks (DSN), pages 395–406. IEEE, 2016.
Kari Alenius, Kari, and M. Warren. An exceptional war that ended in victory for estonia, or an ordinary
e-disturbance? Estonian narratives of the cyber attacks in 2007. The Institute Ecole Supérieure en
Informatique Electronique et Automatique, Laval, France 5–6 July 2012 Edited by, page 18, 2012.
https://www.researchgate.net/publication/290231968_An_exceptional_war_that_ended_in_victory_
for_estonia_or_an_ordinary_e-disturbance_Estonian_narratives_of_the_cyber-_Attacks_in_2007
Mohammad Al-Shurman, Mohammad, Seong-Moo Yoo, and Seungjin Park. Black hole attack in
mobile ad hoc networks. In Proceedings of the 42nd Annual Southeast Regional Conference, pages
96–97, 2004. https://doi.org/10.1145/986537.986560
Saurabh Amin, Saurabh, Xavier Litrico, Shankar Sastry, and Alexandre M. Bayen. Cyber security
of water scada systems—part i: Analysis and experimentation of stealthy deception attacks. IEEE
Transactions on Control Systems Technology, 21(5):1963–1970, 2013.
Daniele Antonioli, Daniele, Giuseppe Bernieri, and Nils Ole Tippenhauer. Taking control: De-
sign and implementation of botnets for cyber-physical attacks with cpsbot. arXiv preprint
arXiv:1802.00152, 2018.
Aitor Ardanza, Aitor, Aitor Moreno, Álvaro Segura, Mikel de la Cruz, and Daniel Aguinaga. Sus-
tainable and flexible industrial human machine interfaces to support adaptable applications in the
industry 4.0 paradigm. International Journal of Production Research, 57(12):4045–4059, 2019.
174 Secure and Smart Cyber-Physical Systems
Yosef Ashibani, Yosef and Qusay H. Mahmoud. Cyber physical systems security: Analysis, challenges
and solutions. Computers & Security, 68:81–97, 2017.
Algirdas Avizienis, Algirdas, J.-C. Laprie, Brian Randell, and Carl Landwehr. Basic concepts and
taxonomy of dependable and secure computing. IEEE Transactions on Dependable and Secure
Computing, 1(1):11–33, 2004.
Kristofas Barakat, Kristofas. Does Lebanon Possess the Capabilities to Defend Itself from Cyber-
Theats? Learning from Estonia’s Experience.(c2019). PhD thesis, Lebanese American University,
2019.
Boldizsár Bencsáth, Boldizsár, Gábor Pék, Levente Buttyán, and Mark Felegyhazi. The cousins of
stuxnet: Duqu, fame, and gauss. Future Internet, 4(4):971–1003, 2012.
Vamshika Boinapally, Vamshika, George Hsieh, and Kevin S. Nauer. Building a gh0st malware experi-
mentation environment. In Proceedings of the International Conference on Security and Manage-
ment (SAM), pages 89–95. The Steering Committee of The World Congress in Computer Science,
Computer …, 2017.
Marcelo Ayres Branquinho, Marcelo Ayres. Ransomware in industrial control systems. What comes
after wannacry and petya global attacks? WIT Transactions on the Built Environment, 174:329–
334, 2018.
Lorenzo De Carli, Lorenzo De, Ruben Torres, Gaspar Modelo-Howard, Alok Tongaonkar, and So-
mesh Jha. Botnet protocol inference in the presence of encrypted trafc. In IEEE INFOCOM 2017-
IEEE Conference on Computer Communications, pages 1–9. IEEE, 2017.
Raymond Chavez, Raymond, William Kranich, and Alex Casella. Red october and its reincarna-
tion. Boston University—CS558 Network Security, 2015. https://www.cs.bu.edu/~goldbe/teaching/
HW55815/presos/redoct.pdf
Michal Choraś, Michal, Rafaƚ Kozik, Adam Flizikowski, Witold Hoƚubowicz, and Rafaƚ Renk. Cyber
threats impacting critical infrastructures. In Managing the Complexity of Critical Infrastructures,
pages 139–161. Springer, 2016.
James Cowie, James, A. Ogielski, B.J. Premore, and Yougu Yuan. Global routing instabilities
triggered by code red ii and nimda worm attacks. Technical Report, Renesys Corporation,
2001.
Mary Jane Credeur, Mary Jane. FBI probes georgia water plant break-in on terror concern, 2013. AuQ1
Zakariya Dehlawi, Zakariya and Norah Abokhodair. Saudi arabia’s response to cyber confict: A case
study of the shamoon malware incident. In 2013 IEEE International Conference on Intelligence
and Security Informatics, pages 73–75. IEEE, 2013.
Alessandro Di Pinto, Alessandro, Younes Dragoni, and Andrea Carcano. Triton: The frst ICS cyber
attack on safety instrument systems. In Proceedings of the Black Hat USA, 2018:1–26, 2018.
George T Donovan Jr, George T. Russian operational art in the russo-georgian war of 2008. Technical
Report, Army War Coll Carlisle Barracks PA, 2009.
Brown Farinholt, Brown, Mohammad Rezaeirad, Paul Pearce, Hitesh Dharmdasani, Haikuo Yin,
Stevens Le Blond, Damon McCoy, and Kirill Levchenko. To catch a ratter: Monitoring the behavior
of amateur darkcomet rat operators in the wild. In 2017 IEEE Symposium on Security and Privacy
(SP), pages 770–787. IEEE, 2017.
Lionel Fillatre, Lionel, Igor Nikiforov, Peter Willett, et al. Security of scada systems against cyber–
physical attacks. IEEE Aerospace and Electronic Systems Magazine, 32(5):28–45, 2017.
Guillermo Francia III, Guillermo, David Thornton, and Thomas Brookshire. "Cyberattacks on
SCADA systems." In Proc. 16th Colloquium Inf. Syst. Security Educ., pp. 9-14. 2012.
Aurélien Francillon, Aurélien and Claude Castelluccia. Code injection attacks on harvard-architecture
devices. In Proceedings of the 15th ACM Conference on Computer and Communications Security,
pages 15–26, 2008. https://doi.org/10.1145/1455770.1455775
Marc Geilen, Marc, Stavros Tripakis, and Maarten Wiggers. The earlier the better: A theory of timed
actor interfaces. In Proceedings of the 14th International Conference on Hybrid Systems: Computa-
tion and Control, pages 23–32, 2011. https://doi.org/10.1145/1967701.1967707
Shyamnath Gollakota, Shyamnath, Haitham Hassanieh, Benjamin Ransford, Dina Katabi, and
Kevin Fu. They can hear your heartbeats: non-invasive security for implantable medical de-
vices. In Proceedings of the ACM SIGCOMM 2011 Conference, pages 2–13, 2011. https://doi.
org/10.1145/2018436.2018438
Alexander Gostev, Alexander, Roman Unuchek, Maria Garnaeva, Denis Makrushin, and Anton
Ivanov. It threat evolution in q1 2016. Kapersky 2015 Report, Kapersky L, 2016.
Cliff Edge on Cyber-Physical Systems 175
Stefan Gries, Stefan, Marc Hesenius, and Volker Gruhn. Cascading data corruption: About dependencies
in cyber-physical systems: Poster. In Proceedings of the 11th ACM International Conference on Dis-
tributed and Event-based Systems, pages 345–346, 2017. https://doi.org/10.1145/3093742.3095092
Vehbi C Gungor, Vehbi C., Dilan Sahin, Taskin Kocak, Salih Ergut, Concettina Buccella, Carlo Ce-
cati, and Gerhard P. Hancke. Smart grid technologies: Communication technologies and standards.
IEEE Transactions on Industrial Informatics, 7(4):529–539, 2011.
Yacov Y Haimes, Yacov Y. Risk of terrorism to cyber-physical and organizational-societal infrastruc-
tures. Public Works Management & Policy, 6(4):231–240, 2002.
Daniel Halperin, Daniel, Thomas S. Heydt-Benjamin, Benjamin Ransford, Shane S. Clark, Benessa
Defend, Will Morgan, Kevin Fu, Tadayoshi Kohno, and William H. Maisel. Pacemakers and im-
plantable cardiac defbrillators: Software radio attacks and zero-power defenses. In 2008 IEEE
Symposium on Security and Privacy (sp 2008), pages 129–142. IEEE, 2008.
Luky Hendraningrat, Luky, Shidong Li, and Ole Torsæter. A corefood investigation of nanofuid
enhanced oil recovery. Journal of Petroleum Science and Engineering, 111:128–138, 2013.
Fei Hu, Fei, Yu Lu, Athanasios V. Vasilakos, Qi Hao, Rui Ma, Yogendra Patil, Ting Zhang, Jiang Lu,
Xin Li, and Neal N. Xiong. Robust cyber—physical systems: Concept, models, and implementa-
tion. Future Generation Computer Systems, 56:449–475, 2016a.
Hong Hu, Hong, Shweta Shinde, Sendroiu Adrian, Zheng Leong Chua, Prateek Saxena, and Zhenkai
Liang. Data-oriented programming: On the expressiveness of non-control data attacks. In 2016
IEEE Symposium on Security and Privacy (SP), pages 969–986. IEEE, 2016b.
Abdulmalik Humayed, Abdulmalik, Jingqiang Lin, Fengjun Li, and Bo Luo. Cyber-physical systems
security—a survey. IEEE Internet of Things Journal, 4(6):1802–1831, 2017.
Emilio Iasiello, Emilio. Cyber attack: A dull tool to shape foreign policy. In 2013 5th International
Conference on Cyber Confict (CYCON 2013), pages 1–18. IEEE, 2013.
Mao Jianhui, Mao. Event driven monitoring of cyber-physical systems based on hybrid automata. Na-
tional University of Defense Technology Changsha, 2011. https://doi.org/10.3390/app131910603
Merike Kaeo, Merike. Cyber attacks on estonia: Short synopsis. Double Shot Security, 2007. www.
doubleshotsecurity.com/pdf/NANOG eesti.pdf (accessed 18 July 2009).
Stamatis Karnouskos, Stamatis. Stuxnet worm impact on industrial cyber-physical system security.
In IECON 2011-37th Annual Conference of the IEEE Industrial Electronics Society, pages 4490–
4494. IEEE, 2011.
Rafullah Khan, Rafullah, Sarmad Ullah Khan, Rifaqat Zaheer, and Shahid Khan. Future internet:
The internet of things architecture, possible applications and key challenges. In 2012 10th Interna-
tional Conference on Frontiers of Information Technology, pages 257–260. IEEE, 2012.
Rafullah Khan, Rafullah, Peter Maynard, Kieran McLaughlin, David Laverty, and Sakir Sezer.
Threat analysis of blackenergy malware for synchrophasor based real-time control and monitoring
in smart grid. In 4th International Symposium for ICS & SCADA Cyber Security Research 2016 4,
pages 53–63, 2016. https://doi.org/10.14236/ewic/ICS2016.7
Constantinos Kolias, Constantinos, Georgios Kambourakis, Angelos Stavrou, and Jefrey Voas. DDoS
in the IoT: Mirai and other botnets. Computer, 50(7):80–84, 2017.
Karl Koscher, Karl, Stefan Savage, Franziska Roesner, Shwetak Patel, Tadayoshi Kohno, Alexei Cz-
eskis, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham, et al. Experimental secu-
rity analysis of a modern automobile. In 2010 IEEE Symposium on Security and Privacy, pages
447–462. IEEE Computer Society, 2010.
J Sathish Kumar, J. Sathish, and Dhiren R. Patel. A survey on internet of things: Security and privacy
issues. International Journal of Computer Applications, 90(11), 2014.
Pratyush Kumar, Pratyush, Dip Goswami, Samarjit Chakraborty, Anuradha Annaswamy, Kai
Lampka, and Lothar Thiele. A hybrid approach to cyber-physical systems verifcation. In DAC
Design Automation Conference 2012, pages 688–696. IEEE, 2012.
Sanjeev Kumar, Sanjeev. Smurf-based distributed denial of service (DDoS) attack amplifcation in in-
ternet. In Second International Conference on Internet Monitoring and Protection (ICIMP 2007),
pages 25–25. IEEE, 2007.
A Machie, A., Jenssen Roculan, Ryan Russell, and M.V. Velzen. Nimda worm analysis. Technical
Report, Incident Analysis, SecurityFocus, 2001.
Bipasha Mahato, Bipasha, Deepsubhra Guha Roy, and Debashis De. Distributed bandwidth selection
approach for cooperative peer to peer multi-cloud platform. Peer-to-Peer Networking and Applica-
tions, 14(1):177–201, 2021.
176 Secure and Smart Cyber-Physical Systems
Morgan Marquis-Boire, Morgan, Marion Marschalek, and Claudio Guarnieri. Big game hunting: The
peculiarities in nation-state malware research. Black Hat, Las Vegas, NV, 2015.
David C Mazur, David C., Ryan D. Quint, and Virgilio A. Centeno. Time synchronization of automa-
tion controllers for power applications. In 2012 IEEE Industry Applications Society Annual Meet-
ing, pages 1–8. IEEE, 2012.
Reem Melki, Reem, Hassan N. Noura, and Ali Chehab. Lightweight multi-factor mutual authentica-
tion protocol for IoT devices. International Journal of Information Security, 1–16, 2019.
Elinor Mills, Elinor. Report: Hackers broke into FAA air trafc control systems, 2009. https://www.
cnet.com/news/privacy/report-hackers-broke-into-faa-air-trafc-control-systems/
Umberto Morelli, Umberto, Lorenzo Nicolodi, and Silvio Ranise. An open and fexible cybersecurity
training laboratory in it/ot infrastructures. In Computer Security, pages 140–155. Springer, 2019.
Stuart Murdoch, Stuart and Nick Leaver. Anonymity vs. trust in cyber-security collaboration. In Pro-
ceedings of the 2nd ACM Workshop on Information Sharing and Collaborative Security, pages
27–29, 2015. https://doi.org/10.1145/2808128.2808134
Arvind Narayanan, Arvind, and Vitaly Shmatikov. Fast dictionary attacks on passwords using time-
space tradeof. In Proceedings of the 12th ACM Conference on Computer and Communications
Security, pages 364–372, 2005. https://doi.org/10.1145/1102120.1102168
Troy Nash, Troy. Backdoors and holes in network perimeters, 2005 [Online]. http://ics-cert.us-cert.
gov/controlsystems.
Hassan N Noura, Hassan N., Ola Salman, Ali Chehab, and Raphaël Couturier. Distlog: A distributed
logging scheme for IoT forensics. Ad Hoc Networks, 98:102061, 2020.
Hassan Noura, Hassan N., Ola Salman, Ali Chehab, and Raphael Couturier. Preserving data security
in distributed fog computing. Ad Hoc Networks, 94:101937, 2019.
Kelly O’Connell, Kelly. CIA report: Cyber extortionists attacked foreign power grid, disrupting deliv-
ery. Internet Business Law Services, 2008. https://www.scmagazine.com/news/cia-analyst-reports-
hacker-attack-on-foreign-power-grid
Panagiotis Papantonakis, Panagiotis, Dionisios Pnevmatikatos, Ioannis Papaefstathiou, and
Charalampos Manifavas. Fast, FPGA-based rainbow table creation for attacking encrypted mobile
communications. In 2013 23rd International Conference on Field Programmable Logic and Ap-
plications, pages 1–6. IEEE, 2013.
Lydia Ray, Cyber-physical systems: an overview of design process, applications, and security. Cyber
Warfare and Terrorism: Concepts, Methodologies, Tools, and Applications, pp. 128-150, 2020.
Ryan Roemer, Ryan, Erik Buchanan, Hovav Shacham, and Stefan Savage. Return-oriented program-
ming: Systems, languages, and applications. ACM Transactions on Information and System Secu-
rity (TISSEC), 15(1):1–34, 2012.
Deepsubhra Guha Roy, Deepsubhra Guha, Debashis De, Md Mozammil Alam, and Samiran Chat-
topadhyay. Multi-cloud scenario based qos enhancing virtual resource brokering. In 2016 3rd In-
ternational Conference on Recent Advances in Information Technology (RAIT), pages 576–581.
IEEE, 2016.
Deepsubhra Guha Roy, Deepsubhra Guha, Madhurima Das, and Debashis De. Cohort assembly: A
load balancing grouping approach for traditional wi-f infrastructure using edge cloud. In Method-
ologies and Application Issues of Contemporary Computing Framework, pages 93–108. Springer,
2018a.
Deepsubhra Guha Roy, Deepsubhra Guha, Puja Das, Debashis De, and Rajkumar Buyya. Qos-aware
secure transaction framework for internet of things using blockchain mechanism. Journal of Net-
work and Computer Applications, 144:59–78, 2019c.
Deepsubhra Guha Roy, Deepsubhra Guha, Ahona Ghosh, Bipasha Mahato, and Debashis De. Qos-
aware task ofoading using self-organized distributed cloudlet for mobile cloud computing. In In-
ternational Conference on Computational Intelligence, Communications, and Business Analytics,
pages 410–424. Springer, 2018b.
Deepsubhra Guha Roy, Deepsubhra Guha, Bipasha Mahato, and Debashis De. A competitive hedonic
consumption estimation for iot service distribution. In 2019 URSI Asia-Pacifc Radio Science Con-
ference (AP-RASC), pages 1–4. IEEE, 2019a.
Deepsubhra Guha Roy, Deepsubhra Guha, Bipasha Mahato, Debashis De, and Rajkumar Buyya.
Application-aware end-to-end delay and message loss estimation in internet of things (IoT)—mqtt-
sn protocols. Future Generation Computer Systems, 89:300–316, 2018c.
Cliff Edge on Cyber-Physical Systems 177
Deepsubhra Guha Roy, Deepsubhra Guha, Bipasha Mahato, Ahona Ghosh, and Debashis De. Service
aware resource management into cloudlets for data ofoading towards IoT. Microsystem Technolo-
gies, 1–15, 2019b.
Michael Rushanan, Michael, Aviel D. Rubin, Denis Foo Kune, and Colleen M. Swanson. Sok: Secu-
rity and privacy in implantable medical devices and body area networks. In 2014 IEEE Symposium
on Security and Privacy, pages 524–539. IEEE, 2014.
A Saqib, A., Raja Waseem Anwar, Omar Khadeer Hussain, Mudassar Ahmad, Md Asri Ngadi, Mohd
Murtadha Mohamad, Zohair Malki, C. Noraini, Bokolo Anthony Jnr, R.N.H. Nor, et al. Cyber
security for cyber physcial systems: A trust-based approach. Journal of Theoretical and Applied
Information Technology, 71(2):144–152, 2015.
Norman Scott, Norman and Hongda Chen. Nanoscale science and engineering for agriculture and
food systems. Industrial Biotechnology, 9(1):17–18, 2013.
Joseph Seering, Joseph, Juan Pablo Flores, Saiph Savage, and Jessica Hammer. The social roles of
bots: evaluating impact of bots on discussions in online communities. Proceedings of the ACM on
Human-Computer Interaction, 2(CSCW):1–29, 2018.
Abraham Serhane, Abraham, Mohamad Raad, Raad Raad, and Willy Susilo. Plc code-level vulner-
abilities. In 2018 International Conference on Computer and Applications (ICCA), pages 348–352.
IEEE, 2018.
Kallisthenis I Sgouras, Kallisthenis I., Avraam N. Kyriakidis, and Dimitris P. Labridis. Short-term risk
assessment of botnet attacks on advanced metering infrastructure. IET Cyber-Physical Systems:
Theory & Applications, 2(3):143–151, 2017.
Jill Slay, Jill, and Michael Miller. Lessons learned from the maroochy water breach. In International
Conference on Critical Infrastructure Protection, pages 73–82. Springer, 2007.
Teodor Sommestad, Teodor, Göran N. Ericsson, and Jakob Nordlander. Scada system cyber
security—a comparison of standards. In IEEE PES General Meeting, pages 1–8. IEEE, 2010.
Keith A Stoufer, Keith A., Joseph A. Falco, and Karen A. Scarfone. Sp 800–82. guide to industrial
control systems (ICS) security: Supervisory control and data acquisition (SCADA) systems, distrib-
uted control systems (DCS), and other control system confgurations such as programmable logic
controllers (PLC), 2011. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf
YingTan, Ying, Mehmet C. Vuran, Steve Goddard, Yue Yu, Miao Song, and Shangping Ren. A concept
lattice-based event model for cyber-physical systems. In Proceedings of the 1st ACM/IEEE International
Conference on Cyber-physical Systems, pages 50–60, 2010. https://doi.org/10.1145/1795194.1795202
Stephen R Vogel, Stephen R., and Steven Jefrey Zack. Method and apparatus providing remote re-
programming of programmable logic devices using embedded JTAG physical layer and protocol.
US Patent 7,155,711, December 26 2006.
Kaiyu Wan, Kaiyu, K.L. Man, and D. Hughes. Specifcation, analyzing challenges and approaches for
cyber-physical systems (CPS). Engineering Letters, 18(3), 2010.
Wenye Wang, Wenye and Zhuo Lu. Cyber security in the smart grid: Survey and challenges. Computer
Networks, 57(5):1344–1371, 2013.
Joseph Weiss, Joseph. Protecting Industrial Control Systems from Electronic Threats. Momentum
Press, 2010.
Miao Wu, Miao, Ting-Lie Lu, Jing Sun, Hui-Ying Du. Research on the architecture of Internet of
things. In Advanced Computer Theory and Engineering (ICACTE), pages 484–487, 2010. doi:
10.1109/ICACTE.2010.5579493.
Abel Yeboah-Ofori, Abel, J. Abdulai, and Ferdinand Katsriku. Cybercrime and risks for cyber physi-
cal systems. International Journal of Cyber-Security and Digital Forensics (IJCSDF), 8(1):43–57,
2019.
Bonnie Zhu, Bonnie, Anthony Joseph, and Shankar Sastry. A taxonomy of cyber attacks on scada
systems. In 2011 International Conference on Internet of Things and 4th International Conference
on Cyber, Physical and Social Computing, pages 380–388. IEEE, 2011.
Chapter 9
Chapter Contents
9.1 Introduction 178
9.1.1 Motivation 180
9.2 Financial Services Use Cases 181
9.3 Vulnerabilities, Threats, and Risks in Financial Services 185
9.3.1 Vulnerabilities 185
9.3.2 Threats 188
9.3.3 Risks 190
9.4 Blockchain for Financial Services and Banking Industries 191
9.4.1 Addressable Challenges in Financial Services 192
9.4.2 Blockchain in Financial Services 195
9.4.3 Benefts of Blockchain in Finance 196
9.5 Blockchain-Enabled Federated Learning for Financial Services 197
9.5.1 Federated Learning 197
9.5.2 Blockchain-Enabled FL for Financial Services 197
9.6 Future Scopes 201
9.7 Conclusion 203
Bibliography 203
9.1 Introduction
Financial services are crucial for economic growth as they facilitate economic activities by
providing individuals, businesses, and governments with the necessary tools and resources
to manage money. These services mobilize savings and investments, enabling the fow of
funds between borrowers and lenders and supporting businesses to invest, expand, and
create jobs. Financial services promote fnancial inclusion by providing access to credit and
banking services, empowering individuals to manage their fnances efectively. In the digital
world, fnancial services play a vital role in driving economic development and ensuring the
efcient allocation of resources.
Financial institutions handle sensitive customer information, such as bank account de-
tails, social security numbers, and transaction histories. Ensuring the security of this infor-
mation is crucial to protect customers from identity theft, fraud, and unauthorized access to
their funds [71]. Robust security measures, including encryption, frewalls, and access con-
trols, are essential to safeguard customer data. The fnancial industry is a prime target for
fraudsters and cybercriminals due to the potential fnancial gains involved. Cybercriminals
DOI: 10.1201/9781003376712-9
Federated Learning and Blockchain 179
have the ability to target a wide range of businesses, and their selection process depends on
the potential fnancial gain or the magnitude of impact that a particular target may ofer
[63]. Hackers may attempt to breach systems, steal sensitive information, or launch cyber-
attacks to disrupt services or gain unauthorized access to accounts.
Security is crucial for fnancial services to protect customer information, prevent fraud
and cyberattacks, maintain trust and reputation, and comply with regulatory requirements.
Robust security measures are necessary to ensure the integrity, confdentiality, and avail-
ability of fnancial systems and data. Security breaches in the fnancial services sector can
have severe consequences for both the institution and its customers. A security breach can
damage the reputation of a fnancial institution, erode customer trust, and lead to fnancial
losses [13]. Implementing strong security measures, such as multi factor authentication, in-
trusion detection systems, and regular security audits, can prevent such threats and protect
fnancial systems.
Blockchain technology [27], known for its decentralized and immutable nature, can pro-
vide secure and transparent transactions in fnancial services [78]. It enables the creation
of tamper-proof, distributed ledgers that record and validate transactions, eliminating the
need for intermediaries and reducing the risk of fraud. Figure 9.1 shows that the use of
Blockchain in fnancial sectors is greater than in other sectors [60]. By the end of the year
2028, it is anticipated that the value of the fnancial Blockchain industry will have increased
to 36.04 billion dollars [20]. Blockchain can facilitate faster and more efcient cross-border
payments, streamline trade fnance processes, and improve the transparency and traceability
Figure 9.1 Usage of Blockchain in financial sectors rather than other sectors [60].
180 Secure and Smart Cyber-Physical Systems
of supply chain fnancing. Federated learning, on the other hand, is a privacy-preserving ap-
proach to machine learning that allows multiple entities to collaboratively train a shared
model without sharing their raw data. In the context of fnancial services, federated learning
can enable banks and fnancial institutions to collectively improve their risk models, fraud
detection algorithms, and customer analytics without compromising the privacy of sensitive
customer data [14].
The combination of Blockchain and federated learning can further enhance fnancial ser-
vices by providing secure and privacy-preserving data sharing and collaboration. For example,
Blockchain can be used to create a decentralized marketplace where fnancial institutions can
securely exchange data or model updates for collaborative analysis. Federated learning can en-
sure that the actual data remains local to the participating institutions while sharing aggregated
model updates for mutual beneft. Combining these has the potential to improve federated
learning’s transparency, trustworthiness, and, most importantly, decentralization [7].
9.1.1 Motivation
The fnancial sector has benefted from several technological improvements and integra-
tions. It still works in a centralized way, with fnancial institutions and governments at the
center of the model. It has caused a lot of changes in how companies are set up and how
they do business, which have given the fnancial technology sector a huge chance. Because
of this, both new businesses and companies that have been around for a while and focus on
making fnancial applications are interested in fnding out if Blockchain is necessary for f-
nancial services or not. According to Figure 9.2, the use of Blockchain in fnancial services
is greater than in other sectors. A common factor that contributes to the complexity of
risk is the fact that it is impossible to completely remove or guard against all risks, regard-
less of how sophisticated your systems are. This is where the process of risk management
comes in. Risk management is a regular, ongoing process in which the right professionals
look at risks from time to time to reduce the chances that certain threats will come true.
Companies that provide fnancial services in today’s market not only have a hard time lur-
ing in new clients, but they also have a hard time doing the same with prospective work-
ers. It may be hard to fnd the right people to fll new positions in information technology
(IT) because of several factors, the most important of which is that millennials don’t like
long-term jobs. The provision of essential fnancial services is essential to the operation of
any economy. Without them, those who have money to save may have difculty locating
others who need to borrow money, and vice versa. Without fnancial services, people might
not buy as many goods or services because they would be so worried about saving money
to protect themselves from possible losses.
Contribution of the Work: This chapter gives an overview of how Blockchain and feder-
ated learning are used in the fnancial services industry. The goal of this research is to
look at the benefts of Blockchain and FL to get useful information that can be used to
improve external statistics and make policy decisions in the fnancial sector. This chapter
talks about and analyzes how fnancial activities face weaknesses and problems. Besides,
it is discussed how fnancial services can be used and organized using decentralized tech-
nology. However, the main contribution of this chapter is presented as follows:
• We give an overview of fnancial services by talking about how important they are and
showing how they can be used in diferent situations.
• We provide recent fnancial services vulnerabilities and related threats that have oc-
curred. Possible risks in fnancial services are also discussed in this chapter.
• We demonstrate a few problems that exist in fnancial services and how Blockchain can be
used to solve them. The benefts of Blockchain in this sector are also discussed in detail.
• We present several Blockchains and federated learning applications in diferent felds.
Parallelly, we give some ideas for how Blockchain and FL can be used in fnancial ser-
vices and explain what these technologies signify.
The remainder of this chapter is organized as follows. Figure 9.3 shows the overall road-
map of this chapter. Section 9.2 gives the existing use cases of fnancial services. In Sec-
tion 9.3, existing vulnerabilities, threats, and risks in fnancial services are provided in
detail. Section 9.4 depicts the usage of Blockchain in fnancial services. Applications of
Blockchain and federated learning in fnancial services are stated in Section 9.5. Section
9.6 introduces some future research aspects in fnancial services. Finally, the chapter is
concluded in Section 9.7.
used by the most important institutions in this feld to change the rules of the game. They
are gathering additional information from sources such as telecom providers, merchants,
and social media to improve the knowledge that they already have about their custom-
ers. Because they have such a comprehensive perspective on their consumers, they are in
Federated Learning and Blockchain 183
a position to increase revenue, reduce risk, cut opportunity costs, and improve opera-
tional efciency.
Sales and Revenue Analysis: Examining the operating procedures assists fnancial institu-
tions in lowering their continuing expenses. If you know the sales trends for a certain
consumer, you may be able to make things easier to repeat. Sales is a key activity, and
having Business Intelligence (BI) tools may aid in defning benchmarks like the number
of net new customers and the lucrative sector among current customers. These are just
two examples of how having these tools can be benefcial.
Sales Performance Analysis: The report is all-encompassing and includes data on employee
productivity. Any employee who works with customers, like salespeople, account man-
agers, and tellers, can beneft from the information it can give because it can help them
fnd ways to improve and, in the end, give better service to their customers. This evalua-
tion could be used to check the viability of new fnancial products or services and make
strategic changes that are in line with the institution’s long-term goals.
Branch/Online Sales Analysis: It may assist fnancial institutions in formulating the most
efective channel strategy. Multiple channels are now available for customers to use
when communicating with their banks. Their trips through these channels are very com-
plicated. They often start in one channel, go through diferent stages of the process in
another channel, and then end up in a diferent channel. By collecting real-time data and
using analytics to learn more about the buyer’s journey, fnancial institutions may be able
to use this to give customers a truly seamless multichannel experience. In addition to this,
it assists them in maintaining an awareness of their rivals.
Lending, Payment, and Transaction Analysis: Banks can use their customers’ transac-
tion history to recommend products and services that are relevant to those customers.
It leads to improved conversion rates as well as increased levels of client satisfaction.
The following information about customers may be analyzed more efectively with
the use of banking analytics: Existing clients of a bank can ask to look at their trans-
action history, which could include information about deposits, withdrawals, or pay-
ments. Bankers can help their customers take advantage of good deals on their credit
or debit cards or other new fnancial products by getting to know how they spend
their money and encouraging them to do so. Using this information to send timely
spending alerts and payment reminders can improve the customer experience. It can
be done to improve the customer experience. By looking at their clients’ transaction
histories and looking for patterns, banks can fnd transactions that might be fraudu-
lent and take steps to stop them. Analytics for banking include data-driven methods
like digital credit evaluation, improved early-warning systems, next-generation stress
testing, and analytics for collecting debt. These techniques are used to protect clients
against fraud at fnancial institutions.
Credit Risk and Exposure Analysis: An analysis of a client’s credit risk and exposure might
shed light on whether or not a customer has a history of defaulting on their payments in
the past. These consumers’ credit profles highlight their assets and customer behavioral
data, such as past-due bills, loans or borrowings, and earnings, that may be used to cal-
culate each customer’s credit score.
Market and Portfolio Analysis: It is highly important to do market and portfolio research
to recruit new clients and keep the ones you already have. An analytics system could look
at a client’s current portfolio to suggest new investment options to the client and help the
client’s portfolio managers keep a steady return. Again, doing a market study is of the
184 Secure and Smart Cyber-Physical Systems
utmost importance when it comes to building a portfolio that will be successful regard-
less of the state of the economy.
Liquidity Risk Management: Every single banking procedure has the potential to be-
come more efcient and streamlined. Using advanced analytics, fnancial institutions
may be able to do things like answer questions from regulators faster and more ac-
curately and give teams more information. It helps with decision-making that is aug-
mented by analytics. The compliance and regulatory standards that banks must meet
are quite severe. This has a big efect on how poor the impairment risk they face is.
Know-your-customer (KYC) analysis is vital, not only to achieve compliance with the
legal requirements but also as a method of mitigating risk. Anti-money laundering
(AML) analysts can more efectively detect and monitor problematic account holders
with the use of these BI technologies.
Analyzing and Planning Finances: Finance is the core of every company, just as it is with
every other kind of organization. In the case of banks, this issue is even more important
because bank employees are responsible not only for running the day-to-day business
of the bank but also for meeting the diferent fnancial needs of customers. An analyti-
cal system may fnd the following use cases when it comes to a bank’s fnances: Banks
need to have their cash on hand to handle payments well and follow all of the rules set
by regulators. By looking at how much they spent in the past, they can make a budget
that works for them. They also take into account certain factors that could make their
fnancial needs go up or down. This could lead to fnding a clear set of important success
criteria that turn short-term savings into long-term, sustainable improvements and the
best way to manage costs. Business intelligence (BI) tools could make fnancial planning
and analysis (FP&A) easier and make it easier to report to key stakeholders in a useful
way. By making the necessary reports automatically and regularly, these systems could
cut the amount of work needed for fnancial reporting by a large amount. In addition to
this, they help speed up the transmission of information and ensure that decision-makers
are kept up-to-date on the state of the bank’s fnances.
Management, Marketing, and Production: There are instances when a new strategy for
approaching an established consumer is necessary. Banks need to give their current cus-
tomers suggestions for new and better products, and this information should be given to
these customers at the right time. When you look at the company’s current customers,
you can see which marketing methods have worked best in the past. You can then use
these methods to bring in new customers. Business intelligence systems can be used with
transactional and trade analytics to make more complete and richer profles of custom-
ers. This, in turn, can increase the acquisition and retention of consumers as well as
cross- and upselling opportunities.
Customer Portfolio and Segmentation: It is another signifcant use of analytics systems
in fnancial services. It is necessary to correctly segment clients to successfully market
to them. Consumers who are searching for a house loan or a vehicle loan are an ex-
ample of one kind of customer segmentation used by fnancial services organizations.
Another example would be customers who are specifcally interested in a checking
account or a money market account. Conversion can happen when the customer rela-
tionship manager makes an ofer or calls the customer about something important to
them. In the same way, a new ofer may be aimed at a smaller group of people based
on their credit scores.
Federated Learning and Blockchain 185
Churn Prediction and Value Modeling: Predicting a client’s likelihood to churn and es-
timating their lifetime worth as a client are two areas that have gained major signif-
cance for fnancial institutions like banks and insurance companies in recent years.
It takes a massive expenditure to compete with the thousands of businesses that are
fghting for consumers’ attention and physical space. It is of the utmost importance to
make sure that you are not leaving any value on the table after you have successfully
onboarded the consumer. The process of mapping the customer journey to observe
their behavior helps in understanding any requirements that the customer may have
and also assists in up-selling.
Analysis of a Marketing Campaign: An analysis of a marketing campaign gives a summary
of the diferent channels that work for a bank and fnds the best way to spend money
on all of them. The leading banks use the information from the transaction data of
credit cards (from both their terminals and those of other banks) to develop ofers that
provide customers with an incentive to make regular purchases from one of the bank’s
merchants. These ofers can be found on the websites of the leading banks.
9.3.1 Vulnerabilities
Organizations in the fnancial industry confront security risks from both internal and ex-
ternal sources regularly because they are high-value targets for hackers [28]. Threat actors
use banking websites or virtual private networks (VPNs) to get into online banking systems
to steal account information, cause trouble, or test how far they can get into a network. In-
ternal threats often come from unhappy employees, weak third-party vendors, and human
mistakes caused by phishing emails or other forms of social engineering. Weaknesses in ex-
ternal and internal security let sensitive fnancial information, client data, account balances
and transactions get out. It hurts customer confdence and causes business problems [31].
Today’s fnancial services frms need sophisticated cybersecurity solutions that can manage
the growing demands of keeping customer and fnancial data safe, limiting attack risk, and
complying with regulatory regulations.
interruptions and eroded client trust. Instead, fnancial service companies should take a
proactive approach. Financial service organizations may conduct an initial evaluation of
current vulnerabilities to discuss with a managed service provider (MSP).
Ransomware Attacks: There is an exponential increase in the number of potential targets
for ransomware assaults as the globe continues to become more digitally linked. The
term “ransomware” refers to an attack in which the perpetrators employ malware to get
Federated Learning and Blockchain 187
access to your business’s systems or data and then keep that data hostage until the frm
pays a ransom. The aftermath of these assaults has been utterly catastrophic. In addition
to the cost of the ransom, there may be additional expenditures related to damage man-
agement, such as legal fees and other expenses. There is also the possibility of losing data.
Access Vulnerability: Sensitive data can be left exposed and subject to attack if there are
faws in the diferent levels of information access. Integration of cybersecurity measures
is essential throughout all departments of a business and at each level of access. Crimi-
nals online will attempt to take advantage of whatever vulnerabilities they may fnd,
regardless of the organizational hierarchy of the company they are targeting.
Managing Compliance: The advancement of information technology has made the fnan-
cial services industry’s job more difcult in terms of complying with regulations. The
fnancial services industry in the United States is one of the most heavily regulated corpo-
rate sectors in the world. On the other hand, merely complying with the rules may not be
enough anymore. Instead, aggressively managing compliance risk and increasing compli-
ance overall are essential for gaining the trust of customers and avoiding expensive fnes.
Operational Stability: A backup and disaster recovery solution that is proactive and dy-
namic is necessary for avoiding disruptions to corporate operations and the loss of
crucial data, either of which might result in a compliance violation. It is common for
of-the-shelf onsite backup systems to be unable to provide the degree of performance
necessary to satisfy the requirements of fnance and investment businesses. It is essential
to come up with a solution in advance of an outage to guarantee a speedy recovery and
reduce the amount of time customers are without service.
Insider Weaknesses: Insider vulnerabilities are a source of concern in the banking and f-
nancial industries when it comes to cybersecurity. It occurs when people who work in-
side a bank or other fnancial institution do something that puts the company at risk
of being attacked. The 2019 IBM X-Force Intelligence Index [72] found that phishing
emails were used in almost two-thirds (29%) of the attacks that were looked at. Whal-
ing attacks, often called “corporate email compromise scams,” were to blame for 45%
of these problems. In these incidents, hackers try to break into the email accounts of
important organization members, like the CEO, to get the company to reveal private
information. Another common thing that might happen is that systems and servers are
set up incorrectly.
Technological Bottlenecks: Websites and apps about banking and money make the archi-
tecture of the network as a whole more vulnerable. Researchers discovered that they
were more likely to be hacked into banking and fnance systems. Cross-site scripting
(XSS) attacks [72], which allow attackers to run malicious code on a website or app,
could happen to 80% of the people who were tested. Then, the bad script could change
the site’s content by getting to the user’s cookies and other sensitive information. Users
are more likely to mistrust websites and programs that have vulnerabilities like these. So,
if the businesses want to stay competitive, they should look into what steps they can take
to protect their websites and apps.
Responsibility Gap: Even though the global fnancial system is becoming more dependent
on digital infrastructure, it is not clear who is responsible for protecting it from cyberat-
tacks. It is due, in part, to the rapid pace at which the environment is changing. If people
don’t work together, the global fnancial system will continue to get worse as more inno-
vation, more competition, and the pandemics speed up the pace of the digital revolution
and make it more dangerous. Although many threat actors are motivated by a desire to
188 Secure and Smart Cyber-Physical Systems
make money, the number of attacks that are solely disruptive and destructive has been
increasing; additionally, those who learn how to steal learn about the fnancial system’s
networks and operations, allowing them to release more obstructive or dangerous future
attacks [61]. Even though the system is generally well-developed and well-regulated, this
sudden change, like the risks it poses, puts a strain on its ability to respond.
9.3.2 Threats
The worst catastrophes have harmed fnancial information, particularly accounts, calcula-
tions, and transactions. Such assaults, which may undermine trust, now have some tech-
nological solutions. VMware reported 238% more fnancial institution cyberattacks in the
frst half of 2020 [49]. IBM and the Ponemon Institute estimate a fnancial data breach
would cost $5.72 million in 2021 [49]. It’s global. The increased frequency of assaults on
targets of opportunity in low- and lower-middle-income countries is less reported than cy-
berattacks in high-income countries. Financial inclusion has been the biggest driver of digi-
tal banking services like mobile payment systems. Digital banking services expand fnancial
inclusiveness but provide hackers with more targets.
Phishing: Phishing is social engineering that deceives individuals into sharing their login
credentials to enter a private network. Email phishing, when victims get ofcial-looking
emails, is the most common. Visiting a phishing email’s dangerous links or attachments
might install malware or launch a bogus website that steals login credentials. In the frst
half of 2021, bank phishing attacks rose by 22%. Financial app assaults increased by
38% at the same time. Akamai’s 2019 State of the Internet report found that over 50%
of phishing attempts targeted fnancial services [49]. Phishing tactics are evolving to ex-
ploit modern worries. These troubling trends rank phishing among the banking sector’s
top cybersecurity dangers.
Ransomware: Ransomware also threatens fnancial institutions. Ransomware encrypts
computers, locking victims out [49]. Only a ransom can fx the harm. Due to strict rules
requiring fnancial institutions to be resilient to cyberattacks and data breaches, these
extortion methods work efectively against them. Ransomware attacks are now data
breaches, which might afect regulatory compliance requirements. Ransomware gangs
target fnancial businesses because of their customer data. Due to the danger of data
exposure on the dark web and reputational damage, many fnancial services companies
accept extortion demands.
DDoS Attacks: The year 2020 witnessed the highest DDoS attacks on fnancial institutions.
DDoS attacks are a prevalent cyber threat to fnancial services since they may target
consumer accounts, payment gateways, and banks’ IT systems. Due to this, the impact
of DDoS attacks on fnancial frms is amplifed. Cybercriminals may use the ensuing con-
fusion in one of two ways. Password login attacks and DoS attacks were the two main
online dangers to payment systems in 2020. In comparison to the same period in 2020,
multi-vector DDoS attacks had increased by 80% in 2021 [49]. These DDoS attacks
combine several campaigns to swamp security personnel.
SQL Injections: A vulnerability in a WordPress plugin that enabled Time-Based Blind SQL
injections (SQLi) was found in March of 2021 [37]. This vulnerability was detected.
There was a possibility that 600,000 customers were afected by this issue. Through the
use of a technique known as Time-Based Blind SQLi, the vulnerability made it possible
Federated Learning and Blockchain 189
for any site visitor to access sensitive data stored in a website’s database. Because the
SQL query was executed inside the function object for the pages”, this meant that any
site visitor, even those who did not have a login, may trigger the execution of this SQL
query. It would thus be possible for a hostile actor to give harmful values for either the
ID or type parameters.
Local File Inclusion: A vulnerability known as Local File Inclusion (LFI) was discovered
in August 2021 for a version of BIQS [49] software used by driving schools for billing
customers. When a certain payload is sent to download/index.php in older versions of
BIQS IT Biqs-drive than v1.83, a local fle inclusion (LFI) vulnerability is present. This
vulnerability may be exploited to take control of the afected system. Because of this,
the attacker can access arbitrary fles stored on the server using the permissions of the
web–user confguration.
Cross-Site Scripting: Trend Micro revealed the details of e-commerce website cross-site
scripting (XSS) attacks on April 28, 2021. EC-CUBE-built websites have also had XSS
instances confrmed by JPCERT/CC (an open-source CMS for e-commerce websites).
Any e-commerce website having an XSS vulnerability on its administrator page is tar-
geted by this attack. This attack campaign continued on July 1, 2021. In order forms on
targeted e-commerce websites, attackers insert malicious scripts to make purchases. XSS
attacks on the administrator’s page steal credentials and install Simple WebShell on the
website. Attackers then utilize WebShell and JavaScript on the website to harvest and
save user data. Monitoring the WebShell may allow the attackers to obtain the stolen
data. During the attack, the attackers embed Adminer [2] on the e-commerce website.
This is a GUI-based database content analysis tool. It supports MySQL, PostgreSQL,
SQLite, MS SQL, Oracle, SimpleDB, Elasticsearch, and MongoDB. Attackers presum-
ably accessed database information using this approach.
OGNL Java Injections: In August 2021, OGNL faws allowed hostile actors to inject code
into Atlassian Confuence servers [25]. OGNL injection vulnerabilities allow unauthen-
ticated users to execute arbitrary codes on Confuence Server or Data Center instances.
Previous versions of the Confuence Server and Data Center were afected by this prob-
lem. The vulnerability is actively abused in nature. Unauthenticated users may exploit it
regardless of settings.
Unencrypted Data: When data is left unencrypted [45], fraudsters or hackers may immedi-
ately change it, causing major problems for banks. Online and fnancial institution data
must be jumbled. It prevents attackers from using stolen data.
Spoofng: It is one of the most recent instances of a cyber threat that businesses in the f-
nancial sector need to be prepared for. The URL of a bank’s website will be impersonated
by hackers, who will replace it with a website that is connected to the actual one and
operates in the same manner (cite 17). When a customer uses a fraudulent website and
inputs his login information, the hackers will grab the customer’s credentials and utilize
them in the future.
Data Manipulation: One of the most common misunderstandings about cyber assaults is
the belief that people are only concerned about the theft of data. It isn’t always the case,
though, because hackers are using data manipulation attacks more and more. Cyber-
criminals are always developing new methods of attack. Attacks involving data manipu-
lation happen when a bad actor gains access to a trusted system and then makes changes
to the data without being caught to help themselves [45]. One example of this would
be if an employee changed information about customers. Likely, it won’t be found out
190 Secure and Smart Cyber-Physical Systems
because the transactions will look like they were done legally. It will cause future data to
be stored incorrectly. The more time that goes by before the manipulation is discovered,
the more damage it will do.
9.3.3 Risks
The fnancial sector is getting more and more exposed to “cyber risk,” which is the risk
of losing money because of how much they depend on computers and digital technology.
Cyber-related events, especially cyberattacks, are always at the top of polls that measure
the fnancial stability of the United States and the rest of the world. Cyber risk, like other
fnancial vulnerabilities, raises macroprudential issues. Similar to other fnancial problems,
a lot of technological attention has been paid to cyber resilience, but it is still very early to
measure the efects that cyber risk might have on the fnancial system. If you want to be
strong against cyberattacks, you need to know about the problems that make the cyber risks
the fnancial sector faces even higher. It is important to fnd a way to solve them all at once,
as these problems are linked to each other.
Digital Innovation In fnancial institutions (FIs), new technologies are being used, such as
cloud computing, artifcial intelligence, and digital service delivery. Most FIs are improv-
ing their data processing, fraud detection, and fnancial analytics by using software that
is hosted in the cloud [50]. Meanwhile, the COVID-19 epidemic furthered the process
of transferring the industry’s IT infrastructure (digital transformation), which resulted in
the proliferation of virtual banks and fnancial services. Because of digital transforma-
tion, businesses today run an increasing number of brand-new apps, devices, and infra-
structure components, all of which expand the attack surface. A surge in cybersecurity
threats for fnancial institutions is caused by all of the issues together. Even if the rise of
new technologies in the fnancial sector has a major impact on industrial risk manage-
ment, these technologies could help risk management by improving cybersecurity and
compliance controls.
Complicated Statutes and Rules: As fnancial institutions use more technology and data
to help their customers, regulations must change to keep up. State, federal, and interna-
tional authorities have established several new restrictions for their industries in reaction
to the growth in cyberattacks on fnancial services organizations. Data protection, pri-
vacy, and cybersecurity legislation for fnancial institutions (FIs) are tightening in various
nations. Compliance may be time-consuming and expensive, but it’s in everyone’s best in-
terest. According to BITS’ technology division, chief information security ofcers spend
40% of their time addressing regulatory agency criteria [35]. Because of the regulatory
environment’s complexity, enforcement is tighter, raising regulatory costs and penalties.
In August 2020, the US government fned Capital One $80 million for failing to fnd
and deal with cyber risk, which led to a massive data breach in 2019 [69]. Capital One
resolved a class-action lawsuit in late December 2021 over a 2019 Amazon Web Services
cloud network intrusion that stole 100 million customers’ data [8]. The settlement was
for 190 million dollars.
Complex Supply Chain Ecosystem: Most fnancial frms outsource their digital duties. Third-
party service providers may be vulnerable even if the FI’s internal security is strong. Threat
actors are targeting software businesses and sending malware to supply chain customers
through legitimate downloads and upgrades. Threat actors gain backdoor access to client
networks via these attacks on software distribution platforms. Recent assaults include the
Federated Learning and Blockchain 191
SolarWinds breach for supply-chain assault [81]. Attackers infltrated SolarWinds’ network
and planted malware in their management software to target thousands of banks and gov-
ernment entities. The SolarWinds breach shows how susceptible the fnancial services sector
is to cyberattacks and disruptions since it depends on third-party suppliers and service pro-
viders with little or no cybersecurity oversight. Third-party cybersecurity vulnerabilities will
grow as the government prioritizes business continuity and operational resilience.
Hybrid Workplace: COVID-19 has sped up recent changes in the way people work, like the
hybrid workspace, which combines people who work in the ofce and those who work
from home. It will increase the risk that businesses face. As we move into the fve year
of the pandemic, more and more people are using technologies like remote work, hybrid
workforces, and software that is hosted in the cloud. Businesses had no choice but to
quickly adopt the new technologies that gave them remote access, better communica-
tion, and more ways to work together. Because of this, hybrid working settings make IT
systems more complicated, increase the number of ways to attack them, and create new
cyber risks and threats.
Enabling Technologies: According to some estimates, the pandemic sped up the transition
to digital technology by as much as three years. Enabling technologies, such as applica-
tion programming interfaces, Big data analytics, artifcial intelligence, biometrics, cloud
computing (particularly outsourcing to the cloud), and distributed ledger (Blockchain)
technology, makes it feasible for digital transformation to occur. Companies and their
boards of directors need to be able to make sure that new technologies are adopted safely
so that the benefts can be gained and the risks that come with trying new things can be
managed proactively. This will help businesses get the most out of their innovative activi-
ties and reduce the risks that come with them.
Data Governance; The importance of having a solid strategy for data governance is only
going to grow in the coming years. Companies need to realize that data is a key strategic
asset before they can come up with a company-wide plan for collecting, managing, stor-
ing, protecting, retrieving, and destroying data. To put it another way, develop a strategy
for data governance that is tailored to your organization. If data governance works, it
will have many benefts, such as making it easier to see risks in a hybrid work environ-
ment, being able to meet the recently agreed-upon requirements for reporting climate
risk, and making it easier to keep track of records.
Operational Resilience; Cybersecurity is a major problem for businesses operating in the
fnancial industry. In a September 2021 Conference of State Bank Supervisors (CSBS)
study, more than 80% of bankers regarded cybersecurity risk as “very signifcant” as the
top internal risk [1]. This number is more than twice any other operational risk category
and greater than the 60% recorded in the year 2020. This risk aversion may be attributed
to a great number of diferent factors. For example, worries about cybersecurity can hurt
both the way a company works and its reputation. If a fnancial institution is hit by a
cyberattack, its ability to do business could be hurt or completely stopped. It is called
operational risk. In addition, as a result of the hack, consumers can lose faith in the com-
pany and want to conduct their business elsewhere (reputational risk).
a bank or fnancial services provider, a Blockchain lets people transmit money securely [24,
34]. Blockchain technology is known as “distributed ledger technology” in the fnancial
services business [38]. Table 9.1 shows the existing methods of using Blockchain in fnan-
cial services. Since all transactions on a Blockchain are saved in a shared database, it could
make banking more open. Because of this openness, problems like fraud might be found
and fxed, which could make the risk for fnancial institutions lower [9]. Figure 9.5 shows
the usage of Blockchain in several cases in fnancial sectors.
Financial services often have problems, like not reaching their goals, taking a long time to
raise money, and losing more and more money. These problems are often caused by inad-
equate management. The following is a list of challenges that Blockchain technology has the
potential to solve in the fnancial technology industry [39,73]:
Centralized System: Even though fnancial services solutions make things seem easier, the
real power is still in the hands of third parties [6,41]. Higher-ups are still the only ones
who can approve transactions, so users are still waiting for confrmation that they can
move forward with their transactions. Because of the introduction of Blockchain tech-
nology, this is the frst problem in the fnancial services industry that could be addressed.
Trust Issues: When consumers take any action inside fnancial services apps, they are not
aware of what is occurring on the other side of the transaction [3]. This leads to a great
deal of uncertainty as well as an increase in the fear of having one’s identity stolen, which
eventually results in a decrease in faith in the process. Because the Blockchain is open
and can’t be changed, these Blockchain application development services can solve this
problem in the feld of fnancial technology.
Liu et al. [54] Hybrid chain model Hybrid chain model may handle High performance. Performance
combining PANDA each account’s transaction in Lower protection cost. accuracy is low.
and X-alliance parallel, asynchronized from Increased sample
other adjacent accounts in the data.
network. It provides efficient Smart contract
data storage and authorization adoption issue.
control and ownership of
change-tracking data.
Lorenz et al., Money-laundering Active learning approach that Detects money laundering. Lack of proper Anti-
[55] detection matches a fully supervised Simulates a real-world Money Laundering
baseline with 5% of labels. situation with few analysts for (AML) processing in
manual labeling. all financial services.
Chen et al. [17] Blockchain-enabled Research on Blockchain credit Safeguarding financial and user User identity
Financial Surveillance information preservation data. verification.
Systems and supervision, post-loan Cost reduction in auditing. Unauthorized
management, and time-based Provides repayment ability persons can read
financial supervision chain. function. financial data.
Chen et al. [15] Online P2P lending Used machine learning and Improves the efficiency of Time consuming.
(Continued)
193
Table 9.1 (Continued)
194
Du et al. [32] Blockchain-enabled The suggested supply chain Increase capital flow and data Inadequate for
supply chain financing finance platform overcomes flow efficiency. massive data.
Less Efcient Methods : One further reason why the fnancial technology industry requires
Blockchain is that the presence of many diferent third parties often causes the proce-
dures to be delayed. This, in the end, leads to poorer rates of customer satisfaction and
increased levels of volatility in the commercial sector as it generates a lot of data [42].
Higher Operational Cost: In the fnancial technology industry, time is money. As a result,
Blockchain technology has once again shown itself to be one of the fnancial services inno-
vations that have the potential to lower costs by almost half. This is because it reduces the
dependence on many individuals, makes the process public, and shortens the required time.
When talking about how the Blockchain technology has changed the fnancial technology in-
dustry, it’s best to focus on the most important parts of the economy to better understand and
analyze the changes. The following is a list of Blockchain use cases for fnancial services [33].
P2P Payments : Bank clearing and settlement regions have concerns about costly bureau-
cracy and unclear expertise. These concerns are present in most fnancial arrangements
and cause concern. Old and hierarchical fnancial systems produce these gaps. Decen-
tralized consensus methods can close them quickly. Blockchain technology helps f-
nancial services. Decentralized ledger technology will enable mobile banking for those
without bank accounts. A Blockchain mobile app development business may simplify
cross-checking data between companies engaged in international payment transactions.
Blockchain technology allows several checks at once.
Financial Trading: Documents are still being sent or faxed to confrm information that is
necessary for trade fnancing, which means that paperwork is being sent across the world
to verify the information. To buy stocks or shares, you still have to go through the com-
plicated and time-consuming steps of brokerage, exchanges, clearing, and settlement.
The settlement process takes three days on average, but it may take longer if it occurs
over the weekend. This is because every trader is required to keep databases for all of
the transaction-based documents, and they must routinely check these databases against
each other to ensure that they are accurate. The application of Blockchain technology to
the provision of fnancial services in this sector has the potential to free traders from the
need to do time-consuming checks on counter-parties while also improving the efciency
of the whole life cycle [30,42]. This not only speeds up the settlement process but also
makes transactions more accurate and reduces the risks involved [44].
Crypto Lending: Thanks to crypto lending, the fnancial world now has a new, easy, and
transparent way to lend money. The lenders will give the borrowers the assets they need
for the loan at a rate of interest that was agreed upon ahead of time. Borrowers will be
able to keep their crypto assets as collateral for a loan based on fat currency or stable-
coins. It is also true when read backward. When borrowers need to borrow crypto assets,
they will occasionally use their stable coins or traditional cash as collateral.
Regulatory Compliance: For the second time, this is one of the most consequential uses
of Blockchain in the fnancial sector. Since it is expected that the global need for regu-
latory services will expand in the next few years, fnancial services businesses are inte-
grating Blockchain technology to improve regulatory compliance [65]. They expect this
technology to record the actions of all parties involved in every verifed transaction,
eliminating the need for regulators to verify the records’ veracity. Technology is also
196 Secure and Smart Cyber-Physical Systems
allowing scholars to return to the original documents rather than relying on the many
copies that have been produced. Errors are less likely to occur, the integrity of records
for fnancial reporting and audits is being preserved, and the time and resources spent
on auditing and accounting are being drastically reduced thanks to the Blockchain’s
promise of immutability [4,62].
Digital Identity: The number of accounts that have been made with fake information keeps
going up. Even though banks do have stringent Know Your Customer and Anti-Money
Laundering inspections, these measures are not failsafe. A digital identifcation system may
beneft from using Blockchain technology. The customers only need to go through the vali-
dation process once, and then they may use their credentials to conduct transactions in any
part of the world. On this front, Blockchain may also aid fnancial users in the following
ways: 1) Managing personal information; 2) communicating personal information to other
parties while minimizing security concerns; and 3) digitally signing legal documents, such
as claims and transactions [75, 77].
Auditing: It is a procedure that checks the fnances and brings to light any discrepancies
that may exist. The procedure is not only difcult to understand, but it also moves quite
slowly. Blockchain technology, on the other hand, makes the procedure simpler. Because
of this technology, you can ask the Blockchain application development frm with whom
you are paired to add the record straight to the ledger, making it possible to see and up-
date data in a time-efcient manner [43].
New Crowdfunding Models: The concept of “crowdfunding” refers to a method of sup-
porting a project by soliciting contributions from a large number of individuals, often
via the Internet. ICOs, IEOs, and other mechanisms may make the fundraising process
using Blockchain technology more open and efcient, as opposed to more traditional
methods of fnancing. However, it is highly recommended to have a clear understanding
of what all fnancial services organizations that use Blockchain technology are doing
with it.
Blockchain technology has made it possible to create inclusive, open, and safe corporate
networks. These networks make it possible to issue digital security credentials in a shorter
amount of time, at lower unit prices, and with a higher degree of customization [11, 67].
Over the past few years, the use of Blockchain technology in the fnancial sector has grown,
which has shown the following benefts [23, 29, 80].
Transparency: Protocols, standards that everyone agrees on, and common procedures
are all used in Blockchain technology. Together, these things serve as a single source of
growth for all members of the network. It makes the data more reliable and improves the
customer experience by making processing faster.
Security: In the fnancial sector, Blockchain technology has made it possible to use secure
application code that is designed to be impossible to change by hostile or third-party ac-
tors [18]. It makes it practically impossible to modify or hack the system.
Trust: The immutable and clear ledger makes it easier for the diferent people in a busi-
ness network to work together on data management and get along. The Blockchain is a
distributed ledger technology that enables the safe recording, management, storage, and
transmission of transactions across a wide variety of industries.
Privacy: When Blockchain technology is used in the fnancial industry, it protects data pri-
vacy at all levels of software stacks in a way that is unmatched in the industry. This makes
Federated Learning and Blockchain 197
it possible for businesses to share data selectively within their networks. This increases
confdence and openness while preserving anonymity and privacy at the same time.
Programmability: It makes it possible to design and run smart contracts, which are pieces
of software that automate business logic and can’t be changed. This makes them easier
to program, more efcient, and more trustworthy.
Scalability and High Performance: In the fnancial sector, Blockchain technology is used
through hybrid and private networks that were built to handle hundreds of transactions
per second. It provides enterprises with signifcant resilience and worldwide reach by
completely supporting interoperability across the public and private sectors.
Federated learning (FL) is an exciting new decentralized DL technique that lets users update
their models together without having to share their data. FL is changing how mathemati-
cal modeling and analysis are done in the business world. This makes it possible for more
and more industries to build distributed machine learning models that protect privacy and
are safe. Nonetheless, the properties that are intrinsic to FL have resulted in several issues,
including those about the security of personal information, the expense of communication,
the heterogeneity of the systems, and the unreliability of model upload during real-world
operation. It’s interesting to think about how adding Blockchain technology could improve
FL’s security and performance and increase the number of things that can be done with it.
FL is a strategy for training artifcial intelligence systems using data that is kept confdential.
It lets centralized AI systems learn from data, which is often personal, without the data’s
actual content being shared or made public. Instead, only the lessons that can be gleaned
from the data’s structure are used.
198
Ref Proposed Method Description Pros Cons
Kim et al. [48] BlockFL Architecture for distributed Incentive-based method. Uncontrolled data
learning that allows for Federates additional devices quality.
the secure and transparent with more training samples.
sharing and verification of
localized modifications to
learning models.
Ramanan et al. [68] BAFFLE Decomposing the global Updates many sections No method for data
parameter space into discrete simultaneously. quality control.
pieces and then using a score A low cost for the
and bid technique is how computation.
BAFFLE increases computing
efficiency.
Shayan et al. [70] Biscotti A completely decentralized The PoF consensus algorithm Scalability issues for
peer-to-peer (P2P) method was introduced. the large model.
for multi party machine Scalable, resistant to errors, Privacy issues.
learning, as well as a client- and able to withstand Stake limitations.
to-client machine learning recognized forms of assault.
procedure that protects
users’ privacy.
Chen et al. [16] Learning chain Decentralized privacy- A decentralized framework. Prone to being
preserving and secure machine Protection against attacks influenced by biases.
learning system using a broad performed by Byzantine.
(linear or nonlinear) deep-
learning approach with no
centralized trusted servers.
Lyu et al. [57] FPPDL A local credibility mutual Privacy-preserved. Many encryption
assessment method for Fairness. methods may
fairness and a three-layer Accuracy. impede node
onion-style encryption processing.
199
200 Secure and Smart Cyber-Physical Systems
provide controllable data traceability. For federated learning, both making data visible and
making it available are possible. the FL functions are somewhat complementary with each
other If they can be connected, it will not only be possible to improve the way data is shared,
but it will also be possible to keep data modeling private [26].
will be in charge of making backups in case of a disaster and ofering services for storing
fles in diferent places.
Safeguarding Payment Networks: One of the best things about Blockchain technology is that it
can be used as a payment network that is not limited by national borders. As a decentralized
answer to the problem of making payments without friction and with low transaction costs,
many diferent Blockchain protocols have been made. Centralized fnancial institutions are
known for their high fees and painfully slow processing times, which led to the creation of
these alternatives. Even though this use of Blockchain technology has a lot of potential, it is
still hard to use it widely because of security concerns [74]. Theft and fraud are all too fre-
quent in Blockchain transactions since all that is required to complete them is a set of public
and private keys. On the other hand, advanced machine learning can easily fnd unusual
account activity, which then calls for human help. Both the companies that supply fnancial
services and the people who use them are protected by this extra security measure [64].
Efective Financial Services: Financial institutions that use FL and Blockchain technologies
often have the goal of increasing both the speed at which they provide their services and
the quality of those services. In the same way that any other company would, these estab-
lishments have the incentive to fnd ways to save expenses and, as a result, generate greater
value. In a survey that shows this trend, A survey in [19] found that 57% of frms see cost
savings as the main beneft of joining consortium Blockchain networks. Those that sup-
ply fnancial services may deliver more value to their consumers while also optimizing the
returns on their investments if they use these two technologies to drive business operations.
Controlled Finance Automation: The trend toward more automation cannot be denied, but if
it is allowed to continue unchecked, it may result in undesirable consequences. Businesses
will always lose control of their operations over time if there are no limits on how they can
use automated processes. As a result of this, the tasks of automation need to be carried
out in conjunction with built-in checks and balances. Using FL and smart contracts backed
by Blockchain technology could help make this dynamic happen. Smart contacts make it
possible to automate procedures, while machine learning can look for problems and only
call for human help when it’s necessary. Because of this very important infrastructure, all
fnancial transactions would be completely safe, open, and efcient.
but also the bandwidth on the network. Therefore, the best way to lessen the amount
of transmission that is needed while still preserving the reliability of model training is a
subject deserving of further investigation.
The Scene in Public: The authentication processes are handled by the alliance Blockchain
system, although this does have the side efect of making it more difcult to join the train-
ing community. How to create a public community by using a Proof-of-Work (PoW)
mechanism is another interesting problem, which is fnding a way to work together while
protecting yourself from attacks from hostile nodes in fnancial services.
Lightweight Training: A lot of the Internet of Things (IoT) devices that fnancial clients
use don’t have enough hardware features to train a deep neural network well. Because
of this, the question of how to make training models easier (e.g., by using edge servers)
while still protecting users’ privacy is an important one that deserves more research.
Security Control Validation: Even though it’s good to see fnancial institutions work toward
high levels of cyber maturity, we strongly suggest doing an objective evaluation of these
assumptions and maturity levels and fxing any gaps between what was expected and
what was found in an assessment. Banks and other fnancial institutions, as well as other
businesses, must constantly test the efcacy of their security policies against real-world
attacks to stay one step ahead of threat actors. The term “security control validation”
refers to an approach that is centered on potential threats and that enables businesses
to evaluate and analyze their cybersecurity posture and their overall cyber resilience. It
also checks to see if the security controls are working well enough to stop cyberattacks.
Automation: As long as AI keeps getting good investments, FL seems to be in a great posi-
tion to grow a lot. Because of the adaptability of the technology, it is expected that it
will make its way into a rising number of diferent businesses across a wide variety of
use cases. The fnancial services industry, in particular, is in a great position to get a lot
of value out of the combination of Blockchain and FL technologies. These technologies
work together to make big changes in the fnancial sector by making it safer, making it
run better, and giving people more control over automation. Figure 9.6 shows the poten-
tial outcomes of using Blockchain technology in the fnancial sector.
Figure 9.6 The potential outcomes of using Blockchain technology in the financial sector [21].
Federated Learning and Blockchain 203
However, it’s important to note that both Blockchain and FL face challenges and limita-
tions. Blockchain’s scalability, energy consumption, and regulatory considerations are areas
that require further investigation. FL may face issues related to model synchronization,
privacy leakage, and communication overhead. Overcoming these challenges and ensuring
appropriate governance frameworks will be essential for the successful implementation of
Blockchain and federated learning in future fnancial services.
9.7 Conclusion
FL is attracting attention for its privacy-enhancing and scalable fnancial services and applica-
tions. We conducted a state-of-the-art assessment and comprehensive survey based on recent
research to examine how Blockchain and FL may improve fnancial services. This study was
motivated by the lack of a comprehensive FL and Blockchain survey in fnancial services. We
frst discussed FL and Blockchain technologies and their combination to bridge this gap. Then,
we extended our study by providing measures of how FL and Blockchain can be used in fnan-
cial services to protect fnancial data, make decentralized storage more efcient, keep payment
networks safe, automate tasks, protect privacy, and keep things safe. Lastly, we talked about
some of the problems with research and gave notions for future initiatives that will bring more
attention to this new feld and encourage more research to realize FL and Blockchain.
Bibliography
[1] CSBS 2022 national survey of community banks, fndings from the 2022 CSBS national survey
of community banks presented at the 10th annual community banking research conference,
2022. https://www.picussecurity.com/resource/blog/six-stages-of-dealing-with-a-global-security-
incident [Online; Accessed on Oct. 24, 2022].
[2] Adminer. Database Management in a Single PHP File, 2021. https://www.adminer.org/en/ [On-
line; Accessed on Nov. 17, 2022].
[3] David Andolfatto. Assessing the impact of central bank digital currency on private banks. The
Economic Journal, 131(634):525–540, 2021.
[4] Raphael Auer. Embedded Supervision: How to Build Regulation into Blockchain Finance, 2019.
https://ssrn.com/abstract=3486246
[5] Eranga Bandara, Sachin Shetty, Abdul Rahman, Ravi Mukkamala, Juan Zhao, and Xueping Li-
ang. Bassa-ml—a blockchain and model card integrated federated learning provenance platform.
In 2022 IEEE 19th Annual Consumer Communications & Networking Conference (CCNC),
pages 753–759, 2022. doi: 10.1109/CCNC49033.2022.9700513.
[6] Christian Barontini and Henry Holden. Proceeding with caution-a survey on central bank digi-
tal currency. Proceeding with Caution-A Survey on Central Bank Digital Currency (January 8,
2019). BIS Paper, (101), 2019.
[7] Laveen Bhatia and Saeed Samet. Decentralized federated learning: A comprehensive survey
and a new blockchain-based data evaluation scheme. In 2022 Fourth International Confer-
ence on Blockchain Computing and Applications (BCCA), pages 289–296, 2022. doi: 10.1109/
BCCA55292.2022.9922390.
204 Secure and Smart Cyber-Physical Systems
[8] Amanda Bronstad. Capital One Reaches $190m Settlement Over 2019 Data Breach, 2021.
https://www.law.com/2021/12/21/capital-one-settles-lawsuits-over-2019-data-breach/ [Online;
Accessed on May 19, 2022].
[9] Volker Brulhl. Virtual currencies, distributed ledgers and the future of fnancial services. Inter-
economics, 52(6):370–378, 2017.
[10] Ramiro Daniel Camino, Radu State, Leandro Montero, and Petko Valtchev. Finding suspicious
activities in fnancial transactions and distributed ledgers. In 2017 IEEE International Conference
on Data Mining Workshops (ICDMW), pages 787–796, 2017. doi: 10.1109/ICDMW.2017.109.
[11] Caytas, Joanna, Developing Blockchain Real-Time Clearing and Settlement in the EU, U.S., and
Globally (June 22, 2016). Columbia Journal of European Law: Preliminary Reference (June 22,
2016), Available at SSRN: https://ssrn.com/abstract=2807675
[12] Sarathiel Chaipa, Ernest Ketcha Ngassam, and Singh Shawren. Towards a new taxonomy of
insider threats. In 2022 IST-Africa Conference (IST-Africa), pages 1–10, 2022. doi: 10.23919/
IST-Africa56635.2022.9845581.
[13] Pushpita Chatterjee, Debashis Das, and Danda Rawat. Securing Financial Transactions: Explor-
ing the Role of Federated Learning and Blockchain in Credit Card Fraud Detection, 2023. ISSN
0167-739X, https://doi.org/10.1016/j.future.2024.04.057.
[14] Pushpita Chatterjee, Debashis Das, and Danda Rawat. Use of Federated Learning and Block-
chain Towards Securing Financial Services, 2023. doi: 10.1109/TCE.2023.3339702.
[15] Chen, Shuhui, Qing Wang and Shu-an Liu. “Credit Risk Prediction in Peer-to-Peer Lending
with Ensemble Learning Framework.” 2019 Chinese Control And Decision Conference (CCDC)
(2019): 4373-4377.
[16] Xuhui Chen, Jinlong Ji, Changqing Luo, Weixian Liao, and Pan Li. When machine learning meets
blockchain: A decentralized, privacy-preserving and secure design. In 2018 IEEE International
Conference on Big Data (Big Data), pages 1178–1187, 2018. doi: 10.1109/BigData.2018.8622598.
[17] Yi-Hui Chen, Li-Chin Huang, Iuon-Chang Lin, and Min-Shiang Hwang. Research on the secure
fnancial surveillance blockchain systems. International Journal of Network Security, 22(4):708–
716, 2020.
[18] Yi-Hui Chen, Li-Chin Huang, Iuon-Chang Lin, and Min-Shiang Hwang. Research on the secure
fnancial surveillance blockchain systems. International Journal of Network Security, 22(4):708–
716, 2020.
[19] Z. Chen. What the Convergence of Blockchain and Machine Learning Means for the Future of
Finance, 2023. https://www.nasdaq.com/news-and-insights [Online; Accessed on Jan. 15, 2023].
[20] Chirag. Blockchain in Financial Services: A Catalyst for Disruption in Finance World, 2022.
https://appinventiv.com/blog/blockchain-and-fntech/ [Online; Accessed on Jan. 13, 2023].
[21] Chirag. Why Are Banks Adopting Blockchain Technology?, 2023 https://appinventiv.com/blog/
blockchain-in-banking/ [Online; Accessed on Jan. 18, 2023].
[22] Jiri Chod, Nikolaos Trichakis, Gerry Tsoukalas, Henry Aspegren, and Mark Weber. On the
fnancing benefts of supply chain transparency and blockchain adoption. Management Science,
66(10):4378–4396, 2020.
[23] Tsan-Ming Choi. Financing product development projects in the blockchain era: Initial coin
oferings versus traditional bank loans. IEEE Transactions on Engineering Management,
69(6):3184–3196, 2022.
[24] Luisanna Cocco, Andrea Pinna, and Michele Marchesi. Banking on blockchain: Costs savings
thanks to the blockchain technology. Future Internet, 9(3):25, 2017.
[25] Atlassian Community. Confuence Server and Data Center—CVE-2021–26084, Confuence
Server Webwork Ognl Injection, 2021. https://confuence.atlassian.com/doc/confuence-security-
advisory-2021-08-25-1077906215.html [Online; Accessed on Dec. 17, 2022].
[26] Debashis Das, Sourav Banerjee, and Utpal Biswas. A secure vehicle theft detection framework us-
ing blockchain and smart contract. Peer-to-Peer Networking and Applications, 14:672–686, 2021.
[27] Debashis Das, Sourav Banerjee, Pushpita Chatterjee, Uttam Ghosh, and Utpal Biswas. A secure
blockchain enabled v2v communication system using smart contracts. IEEE Transactions on
Intelligent Transportation Systems, pages 1–10, 2022. doi: 10.1109/TITS.2022.3226626.
[28] Debashis Das, Sourav Banerjee, Kousik Dasgupta, Pushpita Chatterjee, Uttam Ghosh, and Ut-
pal Biswas. Blockchain enabled sdn framework for security management in 5g applications. In
Proceedings of the 24th International Conference on Distributed Computing and Networking,
pages 414–419, 2023. https://doi.org/10.1145/3571306.3571445
Federated Learning and Blockchain 205
[29] Debashis Das, Sourav Banerjee, Uttam Ghosh, Utpal Biswas, and Ali Kashif Bashir. A decentral-
ized vehicle anti-theft system using blockchain and smart contracts. Peer-to-Peer Networking
and Applications, 14:2775–2788, 2021.
[30] Natalia Dashkevich, Steve Counsell, and Giuseppe Destefanis. Blockchain application for central
banks: A systematic mapping study. IEEE Access, 8:139918–139952, 2020.
[31] D. Donaldson. Vulnerability of Financial Institutions to Cyber Crime, 2022. https://
www.iap-association.org/getattachment/Conferences/Regional-Conferences/North-
America-and-Caribbean/4th-North-American-and-Caribbean-Conference/Conference-
Documentation/4NACC_Jamaica_WS2B_PPT_Damien_Donaldson.pdf.aspx [Online; Accessed
on Dec. 18, 2022].
[32] Mingxiao Du, Qijun Chen, Jie Xiao, Houhao Yang, and Xiaofeng Ma. Supply chain fnance in-
novation using blockchain. IEEE Transactions on Engineering Management, 67(4):1045–1058,
2020.
[33] Mingxiao Du, Qijun Chen, Jie Xiao, Houhao Yang, and Xiaofeng Ma. Supply chain fnance innova-
tion using blockchain. IEEE Transactions on Engineering Management, 67(4):1045–1058, 2020.
[34] Olaniyi Evan s. Blockchain Technology and the Financial Market: An Empirical Analysis, 2018.
https://mpra.ub.uni-muenchen.de/99212/2/MPRA_paper_99212.pdf
[35] F. Christopher Feeney. Cybersecurity Regulation Harmonization: The Financial Services Round-
table—Bits, 2017. https://www.hsgac.senate.gov/imo/media/doc/Testimony-Feeney-2017-06-21.
pdf [Online; Accessed on Nov. 25, 2022].
[36] Xiaoqing Feng and Lei Chen. Data privacy protection sharing strategy based on consortium block-
chain and federated learning. In 2022 International Conference on Artifcial Intelligence and Com-
puter Information Technology (AICIT), pages 1–4, 2022. doi: 10.1109/AICIT55386.2022.9930188.
[37] Ram Gall. Over 600,000 Sites Impacted by WP Statistics Patch. https://www.wordfence.com/
blog/2021/05/over-600000-sites-impacted-by-wp-statistics-patch/ [Online; Accessed on Aug. 22,
2022].
[38] Teja Goud Allam, A. B. M. Mehedi Hasan, Angelika Maag, and P. W. C. Prasad. Ledger technol-
ogy of blockchain and its impact on operational performance of banks: A review. In 2021 6th
International Conference on Innovative Technology in Intelligent System and Industrial Appli-
cations (CITISIA), pages 1–10, 2021. doi: 10.1109/CITISIA53721.2021.9719886.
[39] Meriem Guerar, Alessio Merlo, Mauro Migliardi, Francesco Palmieri, and Luca Verderame. A
fraud-resilient blockchain-based solution for invoice fnancing. IEEE Transactions on Engineer-
ing Management, 67(4):1086–1098, 2020.
[40] Ye Guo and Chen Liang. Blockchain application and outlook in the banking industry. Financial
Innovation, 2(1):1–12, 2016.
[41] Xuan Han, Yong Yuan, and Fei-Yue Wang. A blockchain-based framework for central bank
digital currency. In 2019 IEEE International Conference on Service Operations and Logistics,
and Informatics (SOLI), pages 263–268. IEEE, 2019.
[42] Hossein Hassani, Xu Huang, Emmanuel Sirimal Silva, Hossein Hassani, Xu Huang, and Em-
manuel Sirimal Silva. Fusing Big Data, Blockchain, and Cryptocurrency. Springer, 2019.
[43] Adam Hayes. Decentralized banking: Monetary technocracy in the digital age. In Banking Be-
yond Banks and Money, pages 121–131. Springer, 2016.
[44] Friedrich Holotiuk, Francesco Pisani, and Jĺrrgen Moormann. The Impact of Blockchain Tech-
nology on Business Models in the Payments Industry, in Leimeister, J.M., Brenner, W. (Hrsg.):
Proceedings der 13. Internationalen Tagung Wirtschaftsinformatik (WI 2017), St. Gallen, S.
912-926.
[45] Intellipaat. The Importance of Cyber Security in Banking Sector: Cyber Security in Banking,
2022. https://intellipaat.com/blog/cyber-security-in-banking/ [Online; Accessed on Sep. 05, 2022].
[46] Cliford Kemp, Chad Calvert, and Taghi M. Khoshgoftaar. Detecting slow application-layer
dos attacks with PCA. In 2021 IEEE 22nd International Conference on Information Reuse and
Integration for Data Science (IRI), pages 176–183, 2021.doi: 10.1109/IRI51335.2021.00030.
[47] Meriem Kherbouche, Galena Pisoni, and Bálint Molnár. Model to program and blockchain ap-
proaches for business processes and workfows in fnance. Applied System Innovation, 5(1), 2022.
[48] Hyesung Kim, Jihong Park, Mehdi Bennis, and Seong-Lyun Kim. Blockchained on-device feder-
ated learning. IEEE Communications Letters, 24(6):1279–1283, 2020.
[49] Edward Kost. The 6 Biggest Cyber Threats for Financial Services in 2023, 2023. https://www.up-
guard.com/blog/biggest-cyber-threats-for-fnancial-services [Online; Accessed on Jan. 15, 2023].
206 Secure and Smart Cyber-Physical Systems
[50] Pralay Kumar Lahiri, Debashis Das, Wathiq Mansoor, Sourav Banerjee, and Pushpita Chatterjee.
A trustworthy blockchain based framework for impregnable iov in edge computing. In 2020
IEEE 17th International Conference on Mobile Ad Hoc and Sensor Systems (MASS), pages
26–31. IEEE, 2020.
[51] Dun Li, Dezhi Han, Noel Crespi, Roberto Minerva, and Kuan-Ching Li. A blockchain-based
secure storage and access control scheme for supply chain fnance. The Journal of Supercomput-
ing, 1–30, 2022.
[52] Dun Li, Dezhi Han, and Han Liu. Fabric-chain & chain: A blockchain-based electronic docu-
ment system for supply chain fnance. In International Conference on Blockchain and Trustwor-
thy Systems, pages 601–608. Springer, 2020.
[53] Yuzheng Li, Chuan Chen, Nan Liu, Huawei Huang, Zibin Zheng, and Qiang Yan. A blockchain-
based decentralized federated learning framework with committee consensus. IEEE Network,
35(1):234–241, 2021.
[54] Jingkuang Liu, Lemei Yan, and Dong Wang. A hybrid blockchain model for trusted data of sup-
ply chain fnance. Wireless Personal Communications, 127:919–943, 2021.
[55] Joana Lorenz, Maria Inês Silva, David Oliveira Aparício, João Tiago Ascensão, and P. Bizarro.
Machine learning methods to detect money laundering in the bitcoin blockchain in the presence
of label scarcity. Proceedings of the First ACM International Conference on AI in Finance, 2020.
https://doi.org/10.1145/3383455.3422549
[56] Yunlong Lu, Xiaohong Huang, Yueyue Dai, Sabita Maharjan, and Yan Zhang. Blockchain and
federated learning for privacy-preserved data sharing in industrial IoT. IEEE Transactions on
Industrial Informatics, 16(6):4177–4186, 2020.
[57] L. Lyu, Jiangshan Yu, Karthik Nandakumar, Yitong Li, Xingjun Ma, and Jiong Jin. Towards fair
and decentralized privacy-preserving deep learning with blockchain. ArXiv, abs/1906.01167,
2019.
[58] Chaoqun Ma, Xiaolin Kong, Qiujun Lan, and Zhongding Zhou. The privacy protection mechanism
of hyperledger fabric and its application in supply chain fnance. Cybersecurity, 2(1):1–9, 2019.
[59] Chuan Ma, Jun Li, Long Shi, Ming Ding, Taotao Wang, Zhu Han, and H. Vincent Poor. When
federated learning meets blockchain: A new distributed learning paradigm. IEEE Computational
Intelligence Magazine, 17(3):26–33, 2022.
[60] Konstantinos Mantzaris. How Can We Beneft from Blockchain Technologies?, 2018 https://
economistmk.blogspot.com/2018/03/how-can-we-beneft-from-blockchain.html [Online; Ac-
cessed on Jan. 18, 2023].
[61] Tim Maurer and Arthur Nelson. The Global Cyber Threat, Finance & Development, 2021.
https://www.imf.org/external/pubs/ft/fandd/2021/03/pdf/global-cyber-threat-to-fnancial-sys-
tems-maurer.pdf [Online; Accessed on Sep. 11, 2022].
[62] Quoc Khanh Nguyen. Blockchain-a fnancial technology for future sustainable development.
In 2016 3rd International Conference on Green Technology and Sustainable Development
(GTSD), pages 51–54. IEEE, 2016.
[63] Jack Nicholls, Aditya Kuppa, and Nhien-An Le-Khac. Financial cybercrime: A comprehensive
survey of deep learning approaches to tackle the evolving fnancial crime landscape. IEEE Ac-
cess, 9:163965–163986, 2021.
[64] Mildred Chidinma Okoye and Jeremy Clark. Toward cryptocurrency lending. In Financial Cryp-
tography and Data Security: FC 2018 International Workshops, BITCOIN, VOTING, and
WTSC, Nieuwpoort, Curaçao, March 2, 2018, Revised Selected Papers 22, pages 367–380.
Springer, 2019.
[65] Peterson K. Ozili. Blockchain fnance: Questions regulators ask. In Disruptive Innovation in
Business and Finance in the Digital World. Emerald Publishing Limited, 2019.
[66] Polestar. Top Financial Services Banking Analytics Use Cases, 2022. https://www.polestarllp.
com/ top-fnancial-services-banking-analytics-use-cases [Online; Accessed on Jan. 10, 2023].
[67] Randy Priem. Distributed ledger technology for securities clearing and settlement: Benefts, risks,
and regulatory implications. Financial Innovation, 6(1):1–25, 2020.
[68] Paritosh Ramanan and Kiyoshi Nakayama. Bafe: Blockchain based aggregator free federated
learning. In 2020 IEEE International Conference on Blockchain (Blockchain), Rhodes Island,
2020 pp. 72-81. doi: 10.1109/Blockchain50366.2020.00017
[69] Pete Schroeder. Capital One to Pay $80 Million Fine After Data Breach, 2020. https://www.reu-
ters.com/article/us-usa-banks-capital-one-fn-idUSKCN2522DA [Online; Accessed on Sep. 06,
2022].
Federated Learning and Blockchain 207
[70] Muhammad Shayan, Clement Fung, Chris J. M. Yoon, and Ivan Beschastnikh. Biscotti: A block-
chain system for private and secure federated learning. IEEE Transactions on Parallel and Dis-
tributed Systems, 32(7):1513–1525, 2021.
[71] Rajani Singh, Ashutosh Dhar Dwivedi, Gautam Srivastava, Pushpita Chatterjee, and Jerry Chun-
Wei Lin. A privacy preserving internet of things smart healthcare fnancial system. IEEE Internet
of Things Journal, 1–1, 2022.
[72] Swivelsecure. 5 Cybersecurity Weaknesses in Banking and Finance, 2022. https://swivelsecure.
com/solutions/banking-fnance/5-cybersecurity-weaknesses-threats-in-banking-and-fnance-in-
dustry/. [Online; Accessed on Dec. 12, 2022].
[73] Wei-Tek Tsai, Robert Blower, Yan Zhu, and Lian Yu. A system view of fnancial blockchains. In
2016 IEEE Symposium on Service-Oriented System Engineering (SOSE), pages 450–457. IEEE,
2016.
[74] Wei-Tek Tsai, Enyan Deng, Xiaoqiang Ding, and Jie Li. Application of blockchain to trade
clearing. In 2018 IEEE International Conference on Software Quality, Reliability and Security
Companion (QRS-C), pages 154–163. IEEE, 2018.
[75] Xin Wang, Xiaomin Xu, Lance Feagan, Sheng Huang, Limei Jiao, and Wei Zhao. Inter-bank
payment system on enterprise blockchain platform. In 2018 IEEE 11th International Confer-
ence on Cloud Computing (CLOUD), pages 614–621. IEEE, 2018.
[76] Binghui Wu and Tingting Duan. Application blockchain in supply chain fnance: A study on
small and micro enterprises in xi’an. In 2021 2nd International Conference on Big Data Econ-
omy and Information Management (BDEIM), Sanya, China, 2021, pp. 479-482, doi: 10.1109/
BDEIM55082.2021.00104.
[77] Tong Wu and Xiubo Liang. Exploration and practice of inter-bank application based on block-
chain. In 2017 12th International Conference on Computer Science and Education (ICCSE),
pages 219–224. IEEE, 2017.
[78] Yuanxin Zhang, Zeyu Wang, Jiaying Deng, Zaijing Gong, Ian Flood, and Yueren Wang. Frame-
work for a blockchain-based infrastructure project fnancing system. IEEE Access, 9:141555–
141570, 2021.
[79] Yang Zhao, Jun Zhao, Linshan Jiang, Rui Tan, Dusit Niyato, Zengxiang Li, Lingjuan Lyu, and
Yingbo Liu. Privacy-preserving blockchain-based federated learning for IoT devices. IEEE Inter-
net of Things Journal, 8(3):1817–1829, 2021.
[80] Weilin Zheng, Zibin Zheng, Xiangping Chen, Kemian Dai, Peishan Li, and Renfei Chen. Nut-
baas: A blockchain-as-a-service platform. IEEE Access, 7:134422–134433, 2019.
[81] Sĺlleyman Ozarslan. Six Stages of Dealing with a Global Security Incident, 2021. https://www.
picussecurity.com/resource/blog/six-stages-of-dealing-with-a-global-security-incident [Online;
Accessed on May 27, 2022].
Chapter 10
A Comprehensive Survey on
Blockchain-Integrated Smart Grids
Uttam Ghosh, Laurent L. Njilla, Danda B. Rawat, and
Charles A. Kamhoua
Chapter Contents
10.1 Introduction 208
10.1.1 Motivation and Contribution 211
10.2 Preliminaries 213
10.2.1 Types of Blockchain 213
10.2.2 Digital Ledger Technology 214
10.2.3 Structure 214
10.2.4 Working Principle 216
10.2.5 Characteristics of Blockchain 216
10.2.6 Applications of Blockchain 217
10.3 Literature Review 218
10.4 Contributions of Blockchain to Smart Grid 218
10.4.1 Blockchain for Advanced Metering Infrastructure 220
10.4.2 Blockchain in Decentralized Energy Trading and Market 221
10.4.3 Use of Blockchain to Monitor, Measure, and Control 224
10.4.4 Use of Blockchain in Microgrid 225
10.4.5 Blockchain Applications in Electric Vehicles 228
10.4.6 Blockchain Applications in Cyber-Physical Security 231
10.5 Limitations of Blockchain and Future Research Directions 232
10.6 Conclusion 234
Acknowledgment 234
Bibliography 234
10.1 Introduction
A smart grid network refers to a complex cyber-physical system (CPS) that provides efcient
and cost-efective management of the electric energy grid by allowing real-time monitor-
ing, coordinating, and controlling of the system [1]. Unlike power grid, the smart grid can
generate the energy seamlessly from distributed energy resources (DERs) (including nuclear,
hydro, solar, wind, solar, and thermal) and transmit the energy using transmission lines to
distribution center, and then distribute to the individual customers based on their usage
and requirements. It can store the excessive energy in a battery for future use. By leverag-
ing real-time data, advanced analytics and technologies, and automated control systems,
the smart grid can meet the evolving demands of diferent customers (including residential,
commercial, and industrial customers) and transform the traditional power grid into a more
resilient, efcient, and reliable energy infrastructure. It incorporates self-healing capabilities
DOI: 10.1201/9781003376712-10
Comprehensive Survey on Blockchain-Integrated Smart Grids 209
to quickly detect the issues, reroute power fows, and restore service to afected areas, mini-
mizing downtime, and improving grid reliability. It utilizes automation to monitor, control,
manage, and make informed decisions to optimize the grid’s operation and ensuring ef-
cient energy delivery. Overall, the smart grid is an automated, self-healing, and distributed
advanced energy delivery network that provides the following features to enhance the func-
tionality and efciency of the power grid [2]:
• The smart grid supports two-way communication of electricity and information. In tra-
ditional power grid, the electricity fows in a one-way direction from the utility provider
to the consumers. Whereas the smart grid supports bidirectional fow of the electricity. It
allows for the installation of DERs (solar panels, wind turbines) at the consumer prem-
ises. These DERs can generate excess electricity and feed back into the smart grid for
contributing to the overall electricity supply.
• The smart grid facilitates interaction between users and the electricity market. As men-
tioned above, users can generate renewable energy using DERs, store excess energy,
and sell it back to the grid or participate in local energy markets. Smart meters allow
bidirectional communication between users and utilities where users can access detailed
information on their energy usage, receive real-time billing data, and even provide feed-
back about their energy preferences or concerns.
In the smart, interconnected grid, as envisaged in the U.S. Department of Energy’s 2030
roadmap [3], increased renewable energy generation with a decrease in battery storage
costs has led to a stronger global focus on energy storage solutions and services. The future
grid, as depicted in Figure 10.1, relies upon the uninterrupted fow of information between
consumers and power generation, transmission, and distribution companies. The exchange
of this real-time information is susceptible to cyber tampering from hackers and malicious
actors that propagate throughout the smart grid system due to the interdependencies be-
tween the cyber, physical, and communication components. The smart grid features are
designed to improve the reliability, performance, and security of traditional power grids
[4]. The heterogeneous nature of the smart grid makes it difcult to standardize procedures
and communication paradigms. Lately, the smart grid has seen extensive attention, and the
global smart grid market size was valued at USD 30.6 billion in 2020 and is expected to
reach USD 162.4 billion by 2030 as shown in Figure 10.2. The rising demand for reliable
and regular power supply owing to the increasing shift toward sustainable energy sources is
boosting the growth of the smart grid market [5].
The smart grid network also sufers from a lot of security problems for its resource restric-
tions. Blockchain applications like Bitcoin and Ethereum have attained excellent achieve-
ments that are beyond anticipation. The technologies behind the Blockchain are distributed
ledger, cryptography, and digital signature to ensure the security and tamper-proof archi-
tecture [6]. It is also a decentralized system where every server carries an identical copy of
the entire ledger. Meanwhile, sustainable Blockchain can be utilized to enhance smart grid
security and safety. It can also provide data security and confdentiality for all informa-
tion stored in it. Sustainable Blockchain can be viewed as an efective method of the smart
grid safety scaling by reducing energy consumption and communication cost. However,
the efectiveness of the sustainable Blockchain for the smart grid safety is still uncertain.
Thus, it is chosen to improve the smart grid security. Figure 10.3 presents the overview of
Blockchain-enabled smart grid networks.
210 Secure and Smart Cyber-Physical Systems
Figure 10.2 The global smart grid market size from 2020 to 2030 (USD billion).
Comprehensive Survey on Blockchain-Integrated Smart Grids 211
Security and privacy are key considerations in the design and operation of a smart grid
system. We need to consider the following key measures related to security and privacy for
the smart grid system [7, 8]: (a) Utilizing appropriate encryption techniques to protect data
transmission and storage to ensure that unauthorized nodes neither can access nor can mod-
ify any information, (b) implementing access control mechanisms to restrict data and sys-
tem access based on user roles and privileges, (c) implementing robust monitoring system,
(d) utilizing advanced privacy-preservation techniques to protect information disclosure, (e)
implementing a fault-tolerant network to protect against availability attacks, (f) providing
non-repudiation to ensure that a node cannot deny or dispute actions it has performed in
the past, and (g) promoting transparency and democracy among all the participating nodes.
As mentioned earlier, the smart grid combines advanced technologies, data analytics,
smart devices, and communication systems to provide efective electricity distribution, sup-
ply security, minimum losses, and services including billing, bidding, and energy trading.
Moreover, it needs to integrate a several number of electric vehicles, DERs, and prosumers
(can produce and consume electricity). However, the traditional centralized grid system
faces several challenges to efectively manage the smart devices, maintaining security and
stability of the grid system. As a result, the smart grid is leading to a shift from a central-
ized topology to a more decentralized, distributed, and fully automated model for allowing
greater interaction among all the grid devices [7].
On the other hand, Blockchain is a decentralized and distributed ledger technology that
provides transparency and security while multiple participants maintain a shared and im-
mutable tamper-proof record of transactions or data. It can be a promising alternative to
the conventional centralized security systems to improve security and privacy. Blockchain
can provide confdentiality, integrity, authentication, access control, transparency, and
212 Secure and Smart Cyber-Physical Systems
automaticity which are necessary for the smart grid system also. Table 10.1 summarizes the
objectives of security and privacy in Blockchain paradigm.
Confidentiality Public Blockchain is an open network to anyone for accessing the data
stored on-chain. Thus, we should either avoid sharing sensitive/private
data on public chain or use cryptography to encrypt the data before
sharing on public chain. We need to make sure that the trusted and
authorized nodes join the network.
Integrity The immutable nature of Blockchain protects the integrity of data by
design. Blockchain uses cryptographic hash function, Merkle tree,
nonce, and timestamps for providing data integrity. We can detect if
the data stored on-chain is modified by the attacker and also prevent
decentralized access.
Authentication Blockchain uses digital signature for the authentication where the
participating nodes sign the transaction using their private key and
verify the signature using the corresponding public key.
Privacy Blockchain typically uses pseudonyms or cryptographic addresses to
represent identities of the participants instead of real-world identities
and provides a certain level of privacy. Zero-knowledge proofs can be
employed in Blockchain to validate the correctness of a transaction or
claim without disclosing the underlying data.
Availability Blockchain operates on a distributed network nodes and does not rely
on single point of failure. Further, it incorporates redundancy and
data replication mechanisms to enhance the availability of data and
maintain the continuity of the Blockchain network.
Transparency Blockchain maintains an immutable distributed ledger that includes
all records, transactions, events, and logs. In public Blockchain,
participants can access, audit, and verify the transactions and records
independently.
Access Control Access control logic can be embedded with smart contract to define who
can perform specific actions and ensure only that authorized entities
can interact with the Blockchain and execute predefined operations.
Blockchain can implement user authentication mechanisms including
username–password combinations, multifactor authentication, digital
certificates, and biometric authentication for the identity verification.
Automaticity Blockchain can automate various actions and streamline operations
within decentralized networks by leveraging smart contracts,
predefined rules, event-driven triggers, and consensus mechanisms.
Comprehensive Survey on Blockchain-Integrated Smart Grids 213
applications. The literature survey on Blockchain-assisted smart grids has been presented
in Section 10.3. Section 10.4 presents the contribution of Blockchain into smart grids for
energy management, energy trading, security and privacy, microgrid management, and
electric vehicle management. The limitations of Blockchain and future research direction
have been presented in Section 10.5. Finally, Section 10.6 concludes the chapter.
10.2 Preliminaries
Blockchain is a decentralized and distributed digital ledger that is used to record and
store information securely and transparently. It consists of a chain of blocks, where
each block contains information and a reference to the previous block [9, 10]. One of
the key features of Blockchain technology is its immutability. This means that once
data is recorded and confrmed in a block, it becomes very hard to alter or tamper
with. Further, it does not need a third-party middleman entity, such as governments or
banks, as Blockchain technology makes it especially safe to transfer money, properties,
and contracts [11]. Blockchain is often considered a type of software protocol that re-
lies on the Internet to function. It comprises various components, including a data-
base, software applications, and a network of interconnected computers. Figure 10.4
presents the timeline for Blockchain use and deployment with coordination of the power
system. In the following section, we provide the overview of Blockchain technology.
Blockchain technology can be classifed into public, private, and consortium types based on
the underlying architecture, consensus mechanisms, and permission levels. Table 10.2 sum-
marizes the classifcation of Blockchain [9, 12].
Figure 10.4 Timeline for Blockchain use and development with coordination of the power system.
214 Secure and Smart Cyber-Physical Systems
Therefore, only authorized participants have the ability to read and access the transac-
tion data. It ofers more control, privacy, and scalability compared to public Blockchain.
However, it does not support decentralization.
• Consortium Blockchain: Consortium Blockchain is governed and operated by a consor-
tium or group of organizations that work together and collectively validate transactions.
It has control over who can join the network and who can participate in the consensus
process of the Blockchain. It provides a balance between public and private Blockchains.
Consortium Blockchain maintains a certain level of decentralization.
Distributed Ledger Technology (DLT) encompasses various types of digital ledgers that ena-
ble the recording, sharing, and verifcation of transactions or data in a decentralized manner,
without the need for a central authority. Whereas Blockchain is a specifc implementation of
DLT that uses a chain of blocks to store and validate transactions. While Blockchain is a spe-
cifc type of DLT, there are other DLT systems, including hashgraph, directed acyclic graph
(DAG), holochain, and radix that have diferent architectural approaches and consensus
mechanisms as shown in Figure 10.5. DLT systems can have diferent characteristics, such as
scalability, privacy, and permissioning, depending on their design and use case.
10.2.3 Structure
The structure of a Blockchain refers to the way the data is organized and stored within the
Blockchain system. The core components of a Blockchain structure include blocks, transac-
tions, and the linking process between the Blockchain blocks as shown in Figure 10.6 [12, 13].
timestamp, a nonce, a unique block identifer (hash), and a reference to the previous
block. The timestamp is used to identify the document or event uniquely and indicate
when the document was created. A nonce is a number that can only be used once. It is a
32-bit feld that miners change as they work on new blocks in the Blockchain to ensure
that each block has a unique hash. The body of the block holds a list of transactions,
data, or other information that is being recorded.
216 Secure and Smart Cyber-Physical Systems
• Transactions: In a Blockchain, transactions are the essential units of data. They repre-
sent actions or exchanges of information, which are recorded on the Blockchain. Each
transaction typically includes details of the sender, receiver, amount, and additional data
specifc to the application or use case. Transactions are grouped together within a block
and are recorded in a defned format based on the Blockchain’s protocol.
• Linking Mechanism: Blockchain uses cryptographic hashing to ensure the integrity and
continuity of the Blockchain structure. Each block includes a reference (hash) to the pre-
vious block and creates a structure like the chain. Blockchain creates a permanent and
tamper-resistant record by this linking mechanism. It is computationally impractical to
alter historical data as any change to a block would require modifying the subsequent
blocks in the chain.
Blockchain technology ofers several potential applications and benefts across various in-
dustries including government, healthcare, energy sectors, education, travel, and fnancial.
Figure 10.9 summarizes the applications of Blockchain technology [13–20].
218 Secure and Smart Cyber-Physical Systems
energy efciency and the safety of the grid. Several numbers of smart devices are deployed
throughout the smart grid to efciently control and manage energy generation, transmis-
sion, distribution, and consumption. However, traditional centralized approaches face criti-
cal challenges to efectively manage these smart devices and maintain security and stability
of the smart grid. Blockchain technology can bring several benefts to the smart grids as
shown in Figure 10.10. Especially, Blockchain can be integrated into smart grid systems for
energy management, energy trading, security, privacy, microgrid management, and electric
vehicle management [33].
We have discussed numerous Blockchain application categories and how Blockchain tech-
nology advances the smart grid in this chapter. According to several academics and business
leaders, the emergence of Blockchain technology will potentially adopt advanced develop-
ment and streamline the switch to the smart grid. Some smart grid systems have historically
been built on decentralized technologies [34]. The electrical grid’s integration of electric vehi-
cles, energy storage technologies, and renewable energy sources has sparked extensive study
of new control techniques to handle these problems [35]. Researchers from academics and
industries are interested in investigating and applying Blockchain technology in smart grids
because of its many compelling advantages [36]. The following categories could be used to
categorize blockchain applications in the smart grid’s various components [21]:
• Power Generation: The dispatching agencies now have complete real-time understanding
of the total functioning state of the power system thanks to Blockchain technology. They
can then create dispatching plans that would optimize their revenues thanks to this.
• Power Transmission and Distribution: By using Blockchain technology and automation,
the control centers can have systemic decentralization that does away with the major
drawbacks of conventional centralized systems.
• Power Consumptions: Like the management of the generating and transmitting sides,
this area could beneft from the management of energy trading between prosumers, vari-
ous energy storage technologies, and electric vehicles.
The advancement of Advanced Metering Infrastructure (AMI) and the widespread deploy-
ment of smart meters have revolutionized the way utility companies, customers, and manu-
facturers interact within the smart grid network. The two-way communication enabled
by smart meters allows for a more connected and dynamic energy ecosystem. Since smart
meters can collect comprehensive data on energy production, use, status, and diagnostics,
they are more advanced than conventional meters. Billing, user appliance control, tracking,
and debugging are all common uses for these data. These frequent data transfers yet occur
across a wide area network and are kept either in a customary centralized storage system or
in the cloud. The existence of the centralized system could be problematic in and of itself,
with prospective alterations posing hazards, privacy issues, and single points of failure.
Furthermore, more connections to a central system may result in scalability, availability,
and reaction time problems. The smart grid system’s electric vehicles and smart meters also
generate a signifcant amount of payment records and data about energy use, which are
often shared with other entities for billing, trading, and monitoring. However, in such a
complicated system, widespread data sharing poses serious privacy risks because middle-
men, brokers, and trusted partners may use the data to reveal personal information about
people’s identities, whereabouts, patterns of energy generation and use, energy profles, and
amounts charged or discharged. Another problem is the question of trust between produc-
ers, consumers, and centralized parties. As a result, it could be challenging for producers
and consumers to accept fairness and openness from centralized parties. Understanding
how to build a trustworthy, secure, and decentralized AMI system is essential.
Here, we review some pertinent Blockchain studies on AMI. The authors in [37] explore
and apply Blockchain technology and smart contracts for the security and robustness of the
smart grid. To reduce costs, enhance transaction rates, and improve transaction security,
the contracts will act as a middleman between energy providers and consumers. After a
transaction has taken place, a smart meter linked to a Blockchain network will send the
record to create a new block in the distributed ledger and attach a timestamp for potential
later verifcation.
The authors in [38] propose a permissioned Blockchain and edge-computing-based
model for providing privacy protection and energy security. They utilize the permissioned
Blockchain to provide the privacy of all participants and decentralized data storage and
protect against malicious activities within the communication channels and central clouds.
Figure 10.11 illustrates the layered activities in their proposed Blockchain system, where
three entities such as edge devices, super nodes, and smart contract servers are introduced
for ensuring the correctness and trustworthiness within the Blockchain system. Here, the
super node is a special type of node which is authorized to choose nodes from the list of
edge nodes to participate in consensus and voting process. An edge node is considered as
either a regular user or a voter, which is like a node in a classic Blockchain system. Prior
to joining the voting process, the super nodes need to validate the identities of edge nodes
through identity authorization and covert channel authorization methods to ensure that the
voting nodes are non-malicious and less likely to be compromised by the 51% attack. Smart
Comprehensive Survey on Blockchain-Integrated Smart Grids 221
Figure 10.11 Layered activities in the proposed [38] permissioned Blockchain system.
contract is implemented in a Blockchain server, called smart contract server. This smart
contract contains the optimal solution to energy resource allocation for the electricity users
by considering three elements, including energy consumption, latency, and communication
security. However, there will be a point of integrity concern due to compromisation of the
super node [7].
In [26], the authors introduce a demand-side management paradigm for the autonomous
and decentralized operation of smart energy networks. In this method, a decentralized, safe,
and automated energy network is built using the Blockchain so that each of its nodes can
function independently of DSO control or centralized supervision. It is also used to tamper-
proof the blocks of data on energy usage that can be obtained from smart meters. The smart
contract, on the other hand, is made to provide decentralized control, set up incentives or
sanctions, validate demand response contracts, and implement rules for achieving a balance
across demand of energy and production on the power network side. Using information
from the energy generation and consumption records of UK buildings, a prototype devel-
oped on the Ethereum Blockchain platform is utilized to validate and test this concept. The
fndings show that this model is able to create energy fexibility levels that allow for rapid
demand adjustments in close to real time and to validate all demand response contracts.
But it is not made apparent how the anonymity of the energy profle was preserved on this
public Blockchain. The user can be identifed by looking at the publicly accessible transac-
tions. Table 10.3 presents the survey on AMI security.
Because energy and information may be sent in both directions, consumers can also gener-
ate. It is anticipated that the smart grid would support an increasing number of producers,
consumers, and prosumers (producer + consumer) in distributed energy-trading situations.
222 Secure and Smart Cyber-Physical Systems
To achieve benefts including lowering load peaks, reducing power loss in transmission, eas-
ing the strain on the power grid to support green systems, and balancing energy supply and
demand, they should be capable of trading their localized generation or more power from
distributed sources with one another. The processes required for organizing bids, negotiat-
ing contracts, and carrying them out between parties must therefore be included in energy
trading. Energy can also be exchanged directly and easily between consumers and produc-
ers. Without the involvement of middlemen, this direct energy trading can boost the benefts
for all parties and is advantageous for the adoption of renewable energy sources. With cur-
rent methods, however, customers and producers can only communicate with one another
informally through a huge number of middlemen and retailers, which may provide several
issues and challenges. Due to the additional operational and regulatory costs, consumers,
manufacturers, and prosumers eventually pay for them. Inefective, dishonest, or malicious
intermediaries also produce a market that is not competitive, has little transparency and
justice, and has monopoly incentives. A Blockchain is a valuable tool for building a more
transparent and decentralized energy market and trading system due to its salient features.
Figure 10.12 shows how Blockchain technology can be used to optimize P2P energy [46].
Li et al. [47] ofer a peer-to-peer (P2P) energy trading system and an energy token to as-
sure the security and decentralization of energy trade in a variety of situations, including
energy harvesting, microgrids, and vehicle-to-grid networks [48]. They achieve this by com-
bining Stackelberg game theory, credit-based payment systems, and consortium Blockchain
technology. The credit-based payment mechanism is used to address the problem of trans-
action confrmation latency, which is very likely with PoW-based Bitcoin. Peer nodes in this
system can send payments more rapidly and efciently than Bitcoin by requesting energy
coin loans from credit banks depending on their credit scores. A loan pricing approach that
maximized profts for the credit banks was developed for this scheme using the Stackelberg
game theory. The planned energy Blockchain prototype is not employed in this work, nor
is there formal proof of the double-spending attack.
The developers of [49] introduce PriWatt, a decentralized token-based system that is
based on Bitcoin and built on top of it. The purpose of PriWatt is to address the issues that
arise in the smart grid energy trading system while safeguarding user identity privacy and
transaction security. Multi-signature functionality, anonymous encrypted message streams,
and smart contracts with Blockchain support are all part of this system. PriWatt helps buy-
ers and sellers to conduct complex energy price bids and discussions while preventing mali-
cious activity with the use of the contracts defned in the smart contract. For bidding and
negotiating, the anonymous communications stream technique is used. The use of multiple
signatures helps prevent theft, and at least two other participants must sign a transaction
for it to be valid. Additionally, they use PoW for consensus like bitcoin to protect against
[51] ✓ ✓ ✗ ✗ ✗ ✗
[48] ✓ ✓ ✗ ✗ ✓ ✗
[52] ✗ ✗ ✓ ✗ ✓ ✓
[53] ✓ ✓ ✗ ✗ ✓ ✓
224 Secure and Smart Cyber-Physical Systems
Byzantine failures and the risks of double spending. There isn’t a thorough explanation of
which nodes implement Proof of Work (PoW), how miners will do so, or what the rewards
are for mining correctly [50].
The current smart grid cyber-physical system (CPS) is built on a central SCADA system that
is hierarchically coupled with various components like MTUs, RTUs, PMUs, and a variety
of sensors. Power grids are regularly managed and monitored using the SCADA system.
Once it is connected to the Internet, the SCADA system will improve large-scale distributed
monitoring, measuring, and control. IoT smart devices, sensors, and PMUs regularly gather
and share status information on power equipment with MTUs through RTUs, which are
thought of as central repositories and control centers. The smart grid system enables intel-
ligent control, wide-area monitoring, and governance to better manage grid safety, stabil-
ity, and reliability as well as monitoring power theft and loss, making it feasible for CPS
components, various grid operators, suppliers, and consumers to exchange fne-grained
measurements. However, malevolent attackers or insiders can conduct cyberattacks in a
variety of ways, including by modifying data in central controllers, launching an availability
assault, and injecting phoney data through sensors and PMUs. As a result, the attacker can
hijack control channels and issue nefarious orders. Blockchain has opened new possibilities
for tracking, measuring, and managing the decentralized smart grid system [7].
Figure 10.13 shows how diferent Blockchains can be applied in diferent smart grid lay-
ers for the data protection [54]. Here, each layer of the smart grid is managed by separate
Blockchain aggregator. The Blockchain ofers a secure and reliable data-storing platform for
protecting the smart grids. Further, it reduces the possibilities of certain types of malicious
attacks by providing a higher level of anonymity and privacy to users (including producers,
The control of microgrids is turning into a critical challenge with the integration of many
distributed energy supplies (DERs). Experts are focusing on the need for demand-based
microgrid control and optimal operation these days [58]. Similarly to this, Blockchain tech-
nology has been used in the industry because of its prospective advantages. A DER schedul-
ing technique relying on Blockchain technology is described in [59]. Here, DERs can all be
trusted because of the secure environment created by the usage of Blockchain technology.
Although Blockchains are getting a lot of attention as a platform for distributed computation
and data supervision, Münsing et al. [60] propose a Blockchain and smart-contract-assisted
226 Secure and Smart Cyber-Physical Systems
and consumers in the microgrids. The proposed system ofers secure energy trading between
the peers within the microgrids and the peers from diferent microgrids using smart contracts.
The authors also present the pricing mechanism that ensures the increase in utility of the partic-
ipants by considering the total available energy, the usage, and the distance between consumer
and prosumer for cost calculation. As depicted in Figure 10.15, the main components of the
proposed model are: (i) Prosumers/consumers:—responsible for selling/buying the energy;
(ii) microgrids:—responsible for fulflling the local energy demands; (iii) utility grids:—the
main grids that facilitate energy transfer; (iv) blockchain:—responsible for decentralization.
The authors in [62] propose a distributed proportional-fairness control scheme for
DERs in microgrids using Blockchain and smart contracts. The proposed scheme consid-
ers a group of DERs acting as voltage regulators and reduces the penetration and sacrifces
their revenue over control periods for balancing the voltage regulations. The authors also
introduce a principle based on the exchange of credits for providing incentive to the DERs
for fair participation in voltage regulation. However, they do not include any punishment
mechanism for the fraudulent transactions [7]. The authors in [63] also address the volt-
age regulation problem where they present a Blockchain-based transactive energy system
(TES) and pay the attention to punish for the fraudulent activities or provide incentives
for voltage regulation services. However, they do not pay any attention to the consensus
mechanism [7].
In [64], the authors address the traditional microgrid transaction management problems
due to centralized trading system such as (i) trust issues between transaction center and trad-
ers (ii) fairness, transparency, and efectiveness of information for transaction centers; and
(iii) threats to transaction security and the interests of traders. Therefore, they propose
a decentralized electricity transaction mode based on Blockchain and continuous double
auction (CDA) mechanism to support independent and direct P2P transactions between
distributed generations and consumers in the microgrid energy market as illustrated in
Figure 10.16. In this technique, initially, buyers and sellers can present quotes to the CDA
Figure 10.16 The overall structure of microgrid electricity transactions proposed in [64].
market according to an adaptive aggressiveness (AA) strategy and adjust quotes dynami-
cally according to the market information. Afterward, the buyers and sellers accomplish the
digital proof of energy trading by using multi-signature and Blockchain. Here, Blockchain
provides security of the transactions whereas the multi-signature ensures protection against
any manipulation of a contract between the buyer and seller. However, the authors do not
consider how rich-rule problem of Proof of Stake (PoS) can be addressed [7]. We reach the
stage where diferent Blockchain applications are available depending on the type of mi-
crogrid that is being used, such as an AC microgrid, DC microgrid, or hybrid AC-DC MG
[25, 65–76] as presented in Table 10.6.
The integration of electric vehicles (EVs) into the smart grid ofers numerous benefts that
contribute to a more sustainable, resilient, and efcient energy future. An EV can store and
exchange energy with the charging stations, home, and other neighboring EVs in P2P manner.
This leads to four scenarios, i.e., Vehicle-to-Vehicle (V2V), Vehicle-to-Home (V2H), Vehicle-
to-Grid (V2G), and Grid-to-Vehicle (G2V). Due to short range communications and mobility
of EVs, it introduces new security and privacy issues. Figure 10.17 illustrates an overview how
smart contract can be used for secure purchasing and selling the energy between them.
In [77], the authors propose a secure EV-charging framework based on smart contract that
is, integrated renewable energy sources and smart grids. They utilize permissioned Block-
chain system and the contract theory to design and implement optimal smart contracts and
Table 10.6 Blockchain for Sustainable Microgrids: A Summary
[65] Local market for Converting all Flow of money and Public Blockchain Authenticating Governmental
energy banking-based energy based on funds and policies,
transactions to Blockchain automating commercial
cryptocurrenc transaction concerns, and
y-based control technological
transactions limitations
[25] Microgrid, smart Maximizing energy Decreased electricity A private Blockchain Optimal electricity Implementing
(Continued)
229
Table 10.6 (Continued)
230
Ref. Subdomain Objectives Solutions/Results Technologies Advantages/ Challenges
Opportunities
a novel energy allocation algorithm. They also utilize delegated Byzantine fault tolerance
(DBFT) for achieving an efcient and fast consensus. Here, the framework allows only the
preselected EVs to participate in auditing and creating a new block. However, the authors do
not present any discussion on who is responsible for validating the transactions issues [7]. The
authors in [78] propose a Blockchain-assisted charging coordination mechanism for charg-
ing the energy storage units (ESUs) including EVs in a realizable, transparent, and decentral-
ized manner from the utility providers. The utility providers and energy storage units are
connected with the Blockchain network. The charging request containing its demand, state
of charge, and time to complete the charge, needs to be sent by each ESU to the Blockchain
network. However, the authors do not present any consensus mechanism [7].
The authors in [79] propose a transparent, autonomous, and privacy-preserving tech-
nique to search the cheapest and viable charging stations for EVs based on energy prices
and the distance. The bid request needs to be sent to the Blockchain network. The Block-
chain protects the EVs’ identity privacy and hides their geographical location, makes veri-
fable, and increases the transparency of bidding requests. In [80], the authors present a
security model for decentralized EV-charging management to provide the security of EVs.
This model introduces the lightning network and Blockchain network. Initially, the light-
ning network is set up for the registration of the EVs, charging piles, and operator. This
network is responsible for helping the Blockchain network by creating trust among the
participants and ensuring the security of payments.
The development of the smart grid led to several faws that make it possible to manipulate
or attack several of the cyber-physical smart grid’s components. A thorough analysis of
the results of various attacks in [81] suggests that cyber and physical attacks are closely
232 Secure and Smart Cyber-Physical Systems
related and should be treated as a single entity. A further explanation of the many features
and historical context of the numerous cyber-physical security problems in the smart grid
is provided by Gupta et al. [82]. There are many diferent types, efects, and impacts of
cyber-physical attacks, including time synchronization [83], GPS spoofng [84], and denial-
of-service (DOS) [85] attacks.
To strengthen the grid’s defense against cyber-physical threats, many Blockchain solu-
tions have been thoroughly studied. A general summary of the various Blockchain security
mechanisms is provided in [86]. The authors in [87] discuss on the use of Blockchain tech-
nology to enhance the security, dependability, and safety of the electricity grid using the me-
ters as nodes in a distributed network that records the readings of the meters as individual
blocks in the chain. In [24], the authors utilize a network built on the Blockchain so that
the customers can monitor electricity use without being concerned about outside infuence.
The work in [37] makes use of smart contracts to improve the cyber resilience of secure
transactive energy applications and smart grids. This is also highly helpful for applications
that involve trading in energy. The importance of utilizing Blockchain technology to cre-
ate a trustworthy network for the usage of intelligent electric car operations was examined
by Kim [88]. Many cyberattacks can be avoided by his plan before they have an adverse
impact. Every home has a smart meter installed as part of the smart grid, which collects
real-time data on electricity consumption for use by the utilities.
In [89], the authors examine how Blockchain technology can improve smart grid security
and privacy. It suggests using Blockchain technology in smart grids for peer-to-peer energy
trading, data aggregation, energy distribution systems, and equipment diagnostics and main-
tenance. The authors review commercial Blockchain smart grid projects and explore the
challenges of integrating these technologies. They also highlight the benefts of incorporating
these technologies. The report analyzes Blockchain technology’s smart grid and other uses.
The authors in [7] note smart grid’s decentralization and ability to integrate green and
renewable energy technology. A smart grid integrates green and renewable energy technol-
ogy efciently. This chapter examines how Blockchain technology may address smart grid
security issues and summarizes existing Blockchain-based research in this area. The authors
also summarize the key practical projects, experiments, and products; discuss major re-
search challenges; and suggest future options for using Blockchain technology to address
smart grid security issues. This work uses cutting-edge technology to help create an ecologi-
cally conscious society.
• Costlier: The nodes in Blockchain receive rewards for their eforts in processing trans-
actions and maintaining the network in the form of transaction fees or newly minted
cryptocurrency tokens. However, the nodes can claim bigger rewards for completing
transactions in a business that follows the law of supply and demand.
• Scalability: Blockchain can face scalability issues, with an increased number of nodes
and transactions. As each transaction needs to be validated and included in the chain by
consensus among the nodes, the process becomes slower as the network grows.
Comprehensive Survey on Blockchain-Integrated Smart Grids 233
Blockchain technology has the potential to reshape the energy industry and contribute
signifcantly to global energy sustainability if we can address the following challenges in
future:
• Incentive Mechanisms and Market Design: We need to design efective incentive mecha-
nisms for energy producers and consumers to participate actively and contribute to the
stability and efciency of the grid.
• Real-World Implementations and Case Studies: We need to focus on pilot projects to
evaluate the efectiveness, scalability, and impact of Blockchains on energy systems while
integrating Blockchains to real-world applications of smart grids.
• Regulatory Compliance and Policy Implications: We need to focus on how Blockchains
in smart grids can adopt existing and evolving energy policies, regulations, and environ-
mental goals. In future, the policymakers need to address the issues related to energy
market regulations, data privacy, and environmental impacts.
10.6 Conclusion
The application of Blockchain technology to smart grids is an emerging and rapidly evolving
area of research that is gaining signifcant attention from researchers, industry stakeholders,
and policymakers. The integration of Blockchains with smart grid systems holds the potential
to revolutionize the energy sector by addressing various challenges and unlocking new op-
portunities. In this chapter, a comprehensive study of Blockchain applications to smart grids
has been presented. First, we have presented a background of Blockchain and its classifca-
tion, working principle, characteristics, and applications. Then, a number of recent research
works proposed in diferent literatures on Blockchain integration into smart grid systems
for energy management, energy trading, security and privacy, microgrid management, and
electric vehicle management have been presented. Finally, we have presented the limitations
of Blockchain and future research direction of applying Blockchain in smart grids.
Acknowledgment
This work is supported by the Visiting Faculty Research Program (VFRP) with the Infor-
mation Assurance Branch of the AFRL, Rome, NY, United States, and the Information
Institute (II). Any opinions, fndings, and conclusions or recommendations expressed in this
material are those of the authors and do not necessarily refect the views of the Air Force
Research Laboratory.
Bibliography
[1] U. Ghosh, P. Chatterjee, S. Shetty, C. Kamhoua and L. Y. Njilla , “Towards Secure Software-
Defned Networking Integrated Cyber-Physical Systems: Attacks and Countermeasures,” in Cy-
bersecurity and Privacy in Cyber-Physical Systems, CRC Press, May, 2019.
[2] U. Ghosh, P. Chatterjee and S. Shetty, “Securing SDN-enabled Smart Power Grids: SDN-enabled
Smart Grid Security,” in Research Anthology on Smart Grid and Microgrid Development, IGI
Global, 2022, pp. 1028–1046.
[3] E. S. G. Challenge, “Energy Storage Grand Challenge Roadmap,” [Online]. Available: www.
energy.gov/energy-storage-grand-challenge/articles/energy-storage-grand-challenge-roadmap
[Accessed 11 July 2023].
[4] S. Aggarwal, N. Kumar, S. Tanwar and M. Alazab, “ Survey on Energy Trading in the Smart Grid:
Taxonomy, Research Challenges and Solutions,” IEEE Access, vol. 9, pp. 116231–116253, 2021.
[5] P. Research, “Smart Grid Market Size to Worth Around us$ 162.8 bn by 2030,” [Online]. Avail-
able: www.globenewswire.com/Ne/news-release/2021/12/15/2352520/0/en/Smart-Grid-Market-
Size-to-Worth-Around-US-162-8-Bn-by-2030.html [Accessed 11 July 2023].
Comprehensive Survey on Blockchain-Integrated Smart Grids 235
[6] X. Liang, S. Shetty, D. Tosh, C. Kamhoua, K. Kwiat and L. Njilla, “ProvChain: A Blockchain-
Based Data Provenance Architecture in Cloud Environment with Enhanced Privacy and Avail-
ability,” in 17th IEEE/ACM International Symposium on Cluster, Cloud and Grid Computing
(CCGRID), Madrid, Spain, 2017.
[7] M. B. Mollah, J. Zhao, D. Niyato, K.-Y. Lam, X. Zhang, A. M. Y. M. Ghias, L. H. Koh and L.
Yang, “Blockchain for Future Smart Grid: A Comprehensive Survey,” IEEE Internet of Things
Journal, vol. 8, no. 1, pp. 18–43, 2021.
[8] D. Das, S. Banerjee, P. Chatterjee, U. Ghosh and U. Biswas, “Blockchain for Intelligent Trans-
portation Systems: Applications, Challenges, and Opportunities,” IEEE Internet of Things Jour-
nal, vol. 10, no. 21, pp. 18961-18970, 1 Nov.1, 2023, doi: 10.1109/JIOT.2023.3277923.
[9] K. K. R. Choo, U. Ghosh, D. Tosh, R. M. Parizi and A. Dehghantanha, “Introduction to the Special
Issue on Decentralized Blockchain Applications and Infrastructures for Next Generation Cyber-
Physical Systems,” ACM Transactions on Internet Technology, vol. 21, no. 2, pp. 1–3, 2021.
[10] S. Nakamoto, “Bitcoin: A Peer-to-Peer Electronic Cash System,” 2008. Available: https://bitcoin.
org/bitcoin.pdf.
[11] B. A. Tama, B. J. Kweka, Y. Park and K.-H. Rhee, “A Critical Review of Blockchain and Its Current
Applications,” in 2017 International Conference on Electrical Engineering and Computer Science
(ICECOS), Palembang, Indonesia, 2017, pp. 109-113, doi: 10.1109/ICECOS.2017.8167115.
[12] Y. Guo, Z. Wan and X. Cheng, “When Blockchain Meets Smart Grids: A Comprehensive Sur-
vey,” High-Confdence Computing, vol. 2, no. 2, 2022.
[13] D. Das, S. Banerjee, U. Ghosh and U. Biswas, “A Decentralized Vehicle Anti-Theft System us-
ing Blockchain and Smart Contracts,” Peer-to-Peer Networking and Applications, vol. 14, pp.
2775–2788, 2021.
[14] D. Das, S. Banerjee, P. Chatterjee, U. Ghosh and U. Biswas, “A Secure Blockchain Enabled V2V
Communication System Using Smart Contracts,” IEEE Transactions on Intelligent Transporta-
tion Systems, vol. 24, no. 4, pp. 4651–4660, 2023.
[15] A. P. Singh, R. N. Pradhan, A. K. Luhach, S. Agnihotri, N. Z. Jhanjhi, S. Verma, Kavita, U.
Ghosh and D. S. Roy, “A Novel Patient-Centric Architectural Framework for Blockchain-Ena-
bled Healthcare Applications,” IEEE Transactions on Industrial Informatics, vol. 17, no. 8, pp.
5779–5789, 2021.
[16] Y. Ren, F. Zhu, J. Wang, P. Sharma and U. Ghosh, “Novel Vote Scheme for Decision-Making
Feedback Based on Blockchain in Internet of Vehicles,” IEEE Transactions on Intelligent Trans-
portation Systems, vol. 23, no. 2, pp. 1639–1648, 2022.
[17] D. Das, S. Banerjee, P. Chatterjee, U. Ghosh, U. Biswas and W. Mansoor, “Security, Trust, and
Privacy Management Framework in Cyber-Physical Systems using Blockchain,” in IEEE 20th
Consumer Communications & Networking Conference (CCNC), Las Vegas, NV, 2023.
[18] A. A. Malik, D. Tosh and U. Ghosh, “Non-Intrusive Deployment of Blockchain in Establishing
Cyber-Infrastructure for Smart City,” in 16th Annual IEEE International Conference on Sens-
ing, Communication, and Networking (SECON), Boston, MA, 2019.
[19] A. Gomez Rivera, D. K. Tosh and U. Ghosh, “Resilient Sensor Authentication in SCADA by
Integrating Physical Unclonable Function and Blockchain,” Cluster Computing, vol. 25, pp.
1869–1883, 2022.
[20] D. Das, S. Banerjee, K. Dasgupta, P. Chatterjee, U. Ghosh and U. Biswas, “Blockchain Enabled
SDN Framework for Security Management in 5G Applications,” in ACM 24th International
Conference on Distributed Computing and Networking (ICDCN), Kharagpur, India, 2023.
[21] Y. Yoldaş, A. Önen, S. Muyeen, A. V. Vasilakos and I. Alan, “Enhancing Smart Grid with Mi-
crogrids: Challenges and Opportunities,” Renewable and Sustainable Energy Reviews, vol. 72,
pp. 205–214, 2017.
[22] J. Lukić, M. Radenković, M. Despotović-Zrakić, A. Labus and Z. Bogdanović, “Supply Chain
Intelligence for Electricity Markets: A Smart Grid Perspective,” Information Systems Frontiers,
vol. 19, no. 1, pp. 91–107, 2017.
[23] J. Xie, H. Tang, T. Huang, F. R. Yu, R. Xie, J. Liu and Y. Liu, “A Survey of Blockchain Technol-
ogy Applied to Smart Cities: Research Issues and Challenges,” IEEE Communications Surveys
& Tutorials, vol. 21, no. 3, pp. 2794–2830, 2019.
[24] J. Gao, K. O. Asamoah, E. B. Sifah, A. Smahi, Q. Xia, H. Xia, X. Zhang and G. Dong, “Grid-
Monitoring: Secured Sovereign Blockchain Based Monitoring on Smart Grid,” IEEE Access, vol.
6, pp. 9917–9925, 2018.
236 Secure and Smart Cyber-Physical Systems
[48] J. Guerrero, A. C. Chapman and G. Verbič, “Decentralized P2P Energy Trading Under Network
Constraints in a Low-Voltage Network,” IEEE Transactions on Smart Grid, vol. 10, no. 5, pp.
5163–5173, 2019.
[49] N. Z. Aitzhan and D. Svetinovic, “Security and Privacy in Decentralized Energy Trading Through
Multi-Signatures, Blockchain and Anonymous Messaging Streams,” IEEE Transactions on De-
pendable and Secure Computing, vol. 15, no. 5, pp. 840–852, 2018.
[50] J. Wu and N. K. Tran, “Application of Blockchain Technology in Sustainable Energy Systems:
An Overview,” Sustainability, vol. 10, no. 9, p. 3067, 2018.
[51] C. Dang, J. Zhang, C.-P. Kwong and L. Li, “Demand Side Load Management for Big Industrial
Energy Users Under Blockchain-Based Peer-to-Peer Electricity Market,” IEEE Transactions on
Smart Grid, vol. 10, no. 6, pp. 6426–6435, 2019.
[52] M. A. Ferrag and L. Maglaras, “DeepCoin: A Novel Deep Learning and Blockchain-Based En-
ergy Exchange Framework for Smart Grids,” IEEE Transactions on Engineering Management,
vol. 67, no. 4, pp. 1285–1297, 2020.
[53] S. Wang, A. F. Taha, J. Wang, K. Kvaternik and A. Hahn, “Energy Crowdsourcing and Peer-to-
Peer Energy Trading in Blockchain-Enabled Smart Grids,” IEEE Transactions on Systems, Man,
and Cybernetics: Systems, vol. 49, no. 8, pp. 1612–1623, 2019.
[54] A. S. Musleh, G. Yao and S. M. Muyeen, “Blockchain Applications in Smart Grid–Review and
Frameworks,” IEEE Access, vol. 7, pp. 86746–86757, 2019.
[55] A. Maw, S. Adepu and A. Mathur, “ICS-BlockOpS: Blockchain for Operational Data Security in
Industrial Control System,” Pervasive and Mobile Computing, vol. 59, p. 101048, 2019.
[56] J. Gao, K. O. Asamoah, E. B. Sifah, A. Smahi, Q. Xia, H. Xia, X. Zhang and G. Dong, “Grid-
Monitoring: Secured Sovereign Blockchain Based Monitoring on Smart Grid,” IEEE Access, vol.
6, pp. 9917–9925, 2018.
[57] J. Wan, J. Li, M. Imran and D. Li, “A Blockchain-Based Solution for Enhancing Security and
Privacy in Smart Factory,” IEEE Transactions on Industrial Informatics, vol. 15, no. 6, pp.
3652–3660, 2019.
[58] X. Zhang and M. Fan, “Blockchain-Based Secure Equipment Diagnosis Mechanism of Smart
Grid,” IEEE Access, vol. 6, pp. 66165–66177, 2018.
[59] V. Gunes, S. Peter, T. Givargis and F. Vahid, “A Survey on Concepts Applications Challenges in
Cyber-Physical Systems,” KSII Transactions on Internet and Information Systems, vol. 8, no. 12,
pp. 4242–4268, 2014.
[60] E. Münsing, J. Mather and S. Moura, “Blockchains for Decentralized Optimization of Energy
Resources in Microgrid Networks,” in IEEE Conference on Control Technology and Applica-
tions (CCTA), Maui, HI, 2017.
[61] M. Aloqaily, O. Bouachir, Ö. Özkasap and F. S. Ali, “SynergyGrids: Blockchain-Supported Dis-
tributed Microgrid Energy Trading,” Peer-to-Peer Networking Applications, vol. 15, pp. 884–
900, 2022.
[62] P. Danzi, M. Angjelichinoski, C. Stefanović and P. Popovski, “Distributed Proportional-Fairness
Control in Microgrids via BLOCKCHAIN Smart Contracts,” in IEEE International Conference
on Smart Grid Communications (SmartGridComm), Dresden, Germany, 2017.
[63] S. Saxena, H. Farag, H. Turesson and H. M. Kim, “Blockchain Based Grid Operation Services
for Transactive Energy Systems,” arXiv preprint arXiv:1907.08725, 2019.
[64] J. Wang, Q. Wang, N. Zhou and Y. Chi, “A Novel Electricity Transaction Mode of Microgrids
Based on Blockchain and Continuous Double Auction,” Energies, vol. 10, no. 12, p. 1971,
2017.
[65] A. S. Yahaya, N. Javaid, F. A. Alzahrani, A. Rehman, I. Ullah, A. Shahid and M. Shafq, “Block-
chain Based Sustainable Local Energy Trading Considering Home Energy Management and De-
murrage Mechanism,” Sustainability, vol. 12, p. 3385, 2020.
[66] C. Antal, T. Cioara, M. Antal, V. Mihailescu, D. Mitrea, I. Anghel, I. Salomie, G. Raveduto, M.
Bertoncini, V. Croce, T. Bragatto, F. Carere and F. Bellesini, “Blockchain Based Decentralized
Local Energy Flexibility Market,” Energy Reports, vol. 7, pp. 5269–5288, 2021.
[67] G. Vieira and J. Zhang, “Peer-to-Peer Energy Trading in a Microgrid Leveraged by Smart Con-
tracts,” Renewable and Sustainable Energy Reviews, vol. 143, 2021.
[68] A. Kavousi-Fard, A. Almutairi, A. Al-Sumaiti, A. Farughian and S. Alyami, “An Efective Se-
cured Peer-to-Peer Energy Market Based on Blockchain Architecture for the Interconnected
238 Secure and Smart Cyber-Physical Systems
Microgrid and Smart Grid,” International Journal of Electrical Power & Energy Systems, vol.
132, 2021.
[69] G. V. Leeuwen, T. AlSkaif, M. Gibescu and W. V. Sark, “An Integrated Blockchain-Based Energy
Management Platform with Bilateral Trading for Microgrid Communities,” Applied Energy,
vol. 2020, 263.
[70] A. Yildizbasi, “Blockchain and Renewable Energy: Integration Challenges in Circular Economy
Era,” Renewable Energy, vol. 176, 2021.
[71] Y. Tsao and V. Thanh, “Toward Sustainable Microgrids with Blockchain Technology-Based
Peer-to-Peer Energy Trading Mechanism: A Fuzzy Meta-Heuristic Approach,” Renewable and
Sustainable Energy Reviews, vol. 2021, no. 110452, 136.
[72] X. Wang, P. Liu and Z. Ji, “Trading Platform for Cooperation and Sharing Based on Block-
chain Within Multi-Agent Energy Internet,” Global Energy Interconnection, vol. 4, no. 4, pp.
384–393, 2021.
[73] Q. Li, A. Li, T. Wang and Y. Cai, “Interconnected Hybrid AC-DC Microgrids Security Enhance-
ment Using Blockchain Technology Considering Uncertainty,” International Journal of Electri-
cal Power & Energy Systems, vol. 133, no. 107324, 2021.
[74] G. S. Mahesh, G. D. Babu and V. Rakesh, “Energy Management with Blockchain Technology in
DC Microgrids,” Materials Today: Proceedings, vol. 47, no. 10, pp. 2232–2236, 2021.
[75] S. Wang, Z. Xu and J. Ha, “Secure and Decentralized Framework for Energy Management of
Hybrid AC/DC Microgrids Using Blockchain for Randomized Data,” Sustainable Cities and
Society, vol. 76, no. 103419, 2022.
[76] M. Yilmaz and P. T. Krein, “Review of the Impact of Vehicle-to-Grid Technologies on Distribu-
tion Systems and Utility Interfaces,” IEEE Transactions on Power Electronics, vol. 28, no. 12,
pp. 5673–5689, 2013.
[77] Z. Su, Y. Wang, Q. Xu, M. Fei, Y. -C. Tian and N. Zhang, “A Secure Charging Scheme for Elec-
tric Vehicles with Smart Communities in Energy Blockchain,” IEEE Internet of Things Journal,
vol. 6, no. 3, pp. 4601–4613, 2019.
[78] M. Baza, M. Nabil, M. Ismail, M. Mahmoud, E. Serpe and M. A. Rahman, “Blockchain-Based
Charging Coordination Mech- Anism for Smart Grid Energy Storage Units,” in IEEE Interna-
tional Conference on Blockchain (Blockchain), Atlanta, GA, 2019.
[79] F. Knirsch, A. Unterweger and D. Engel, “Privacy-Preserving Blockchain-Based Electric Vehicle
Charging with Dynamic Tarif Decisions,” Computer Science – Research and Development, vol.
33, pp. 71–79, 2018.
[80] X. Huang, C. Xu, P. Wang and H. Liu, “LNSC: A Security Model for Electric Vehicle and Charg-
ing Pile Management Based on Blockchain Ecosystem,” IEEE Access, vol. 6, pp. 13565–13574,
2018.
[81] Y. Mo et al., “Cyber–Physical Security of a Smart Grid Infrastructure,” Proceedings of the IEEE,
vol. 100, no. 1, pp. 195–209, 2012.
[82] A. Gupta, A. Anpalagan, G. H. S. Carvalho, A. S. Khwaja and L. Guan, “Retracted: Prevailing
and Emerging Cyber Threats and Security Practices in IoT-Enabled Smart Grids: A Survey,”
Journal of Network and Computer Applications, vol. 132, pp. 118–148, 2019.
[83] Z. Zhang, S. Gong, A. D. Dimitrovski and H. Li, “Time Synchronization Attack in Smart Grid:
Impact and Analysis,” IEEE Transactions on Smart Grid, vol. 4, no. 1, pp. 87–98, 2013.
[84] C. Konstantinou, M. Sazos, A. S. Musleh, A. Keliris, A. Al-Durra and M. Maniatakos, “GPS
Spoofng Efect on Phase Angle Monitoring and Control in a Real-Time Digital Simulator-Based
Hardware-in-the-Loop Environment,” ET Cyber-Physical Systems: Theory & Applications, vol.
2, pp. 180–187, 2017.
[85] S. Liu, X. P. Liu and A. E. Saddik, “Denial-of-Service (DoS) Attacks on Load Frequency Control
in Smart Grids,” in IEEE PES Innovative Smart Grid Technologies Conference (ISGT), Wash-
ington, DC, 2013.
[86] D. Minoli and B. Occhiogrosso, “Blockchain Mechanisms for IoT Security,” Internet of Things,
vols. 1–2, pp. 1–13, 2018.
[87] G. Liang, S. R. Weller, F. Luo, J. Zhao and Z. Y. Dong, “Distributed Blockchain-Based Data
Protection Framework for Modern Power Systems Against Cyber Attacks,” IEEE Transactions
on Smart Grid, vol. 10, no. 3, pp. 3162–3173, 2019.
Comprehensive Survey on Blockchain-Integrated Smart Grids 239
[88] S. Kim, “Chapter Two—Blockchain for a Trust Network Among Intelligent Vehicles,” Advances
in Computers, vol. 111, pp. 43–68, 2018.
[89] T. Alladi, V. Chamola, J. J. P. C. Rodrigues and S. A. Kozlov, “Blockchain in Smart Grids: A
Review on Diferent Use Cases,” Sensors, vol. 19, no. 22, p. 4862, 2019.
[90] V. Gunes, S. Peter, T. Givargis and F. Vahid, “A Survey on Concepts, Applications, and Chal-
lenges in Cyber-Physical Systems,” KSII Transactions on Internet and Information Systems, vol.
8, no. 12, pp. 4242–4268, 2014.
[91] R. Rajkumar, I. Lee, L. Sha and J. Stankovic, “Cyber-physical Systems: The Next Computing
Revolution,” in Design Automation Conference, Anaheim, Anaheim, CA, 2010.
[92] R. Baheti and H. Gill, “Cyber-Physical Systems,” The Impact of Control Technology, pp. 161–
166, 2011.
[93] “Cyber-Physical Systems—A Concept Map,” [Online]. Available: https://ptolemy.berkeley.edu/
projects/cps/ [Accessed 24 July 2023].
[94] Q. Yang, J. Yang, W. Yu, D. An, N. Zhang and W. Zhao, “On False Data-Injection Attacks
against Power System State Estimation: Modeling and Countermeasures,” IEEE Transactions
on Parallel and Distributed Systems, vol. 25, no. 3, pp. 717–729, 2014.