Digital Twins for the Intelligent Detection of Malicious Activities in Urban Spaces

The S4AllCities project has progressed rapidly during the last twelve months since it began in 2020 for the development of three distinct digital twins that collectively augment intelligence concerning cyber and physical security monitoring in smart urban spaces. These respectively specialize on; a) Distributed Edge Computing IoT (DEC-IoT); b) Malicious Actions Information Detection System (MAIDS); and c) Augmented Context Management System (ACMS) (S4AllCities, 2020). These three twins are built under a distributed System of Systems (SoS) architecture. Further, they each acquire real-time observations of both cyber and physical spaces while processing data for the critical extraction of knowledge at their levels. The extracted knowledge, represented as “events” at each of the respective twins levels, is communicated across the S4AllCities SoS Apache Kafka communication client/ server protocols. These respectively specialize in advancement of situation awareness at their levels. Namely, for the intelligent edge processing of observations in the urban space under the DEC-IoT; the detection of unusualness and understanding of cyber and human behavior under the MAIDS; while augmenting all awareness for the final release of threat alerts and proposed regulated responses (ACMS). In this paper, we will introduce the S4AllCities SoS overall architecture and the three twins high level functions. Then we will focus on describing our development of the MAIDS sub-modules and their functions under the De-Facto Joint Director of Laboratory (JDL) data fusion framework. The JDL framework efficiently enables the intelligent monitoring, detection and interpretation of the potential presence of threats and/or attacks in urban spaces. These attacks are either of cyber, physical, or both malicious nature. The well-known Endsley model for the cognitive advancement of situational awareness is mapped into the JDL framework in the context of critical decision support on cyber-physical surveillance in urban spaces. The JDL is much more adaptive for big data processing, machine learning, context knowledge modelling and augmented situational awareness of the cyber-physical space.