  Model-Based Anomaly Detection has been a successful approach to identify
deviations from the expected behavior of Cyber-Physical Production Systems.
Since manual creation of these models is a time-consuming process, it is
advantageous to learn them from data and represent them in a generic formalism
like timed automata. However, these models - and by extension, the detected
anomalies - can be challenging to interpret due to a lack of additional
information about the system. This paper aims to improve model-based anomaly
detection in CPPS by combining the learned timed automaton with a formal
knowledge graph about the system. Both the model and the detected anomalies are
described in the knowledge graph in order to allow operators an easier
interpretation of the model and the detected anomalies. The authors
additionally propose an ontology of the necessary concepts. The approach was
validated on a five-tank mixing CPPS and was able to formally define both
automata model as well as timing anomalies in automata execution.
