  Significant progress has been made in anomaly detection and run-time
monitoring to improve the safety and security of cyber-physical systems (CPS).
However, less attention has been paid to hazard mitigation. This paper proposes
a combined knowledge and data driven approach, KnowSafe, for the design of
safety engines that can predict and mitigate safety hazards resulting from
safety-critical malicious attacks or accidental faults targeting a CPS
controller. We integrate domain-specific knowledge of safety constraints and
context-specific mitigation actions with machine learning (ML) techniques to
estimate system trajectories in the far and near future, infer potential
hazards, and generate optimal corrective actions to keep the system safe.
Experimental evaluation on two realistic closed-loop testbeds for artificial
pancreas systems (APS) and a real-world clinical trial dataset for diabetes
treatment demonstrates that KnowSafe outperforms the state-of-the-art by
achieving higher accuracy in predicting system state trajectories and potential
hazards, a low false positive rate, and no false negatives. It also maintains
the safe operation of the simulated APS despite faults or attacks without
introducing any new hazards, with a hazard mitigation success rate of 92.8%,
which is at least 76% higher than solely rule-based (50.9%) and data-driven
(52.7%) methods.
