Remedial Actions for Self-Healing in Cyber-Physical Systems

Abstract Building upon our previous work on theLog Intelligence and Self-Healing System (LISH), whichutilised CountVectorizer and Multinomial Naive Bayes(MNB) for multi-platform anomaly detection, this pa-per advances the self-healing paradigm by operational-ising the autonomous execution of remedial actions fol-lowing anomaly classification. We introduce CROSS:Cross-platform Remediation and Observability Self-Healing System, a novel framework designed to auto-mate post-detection recovery tasks such as system up-dates, service restarts, device reboots, disk clean-up,and configuration enforcement across Android, Linux,macOS, and Windows environments. CROSS processespre-classified logs to detect elevated error and warninglevels per system and initiates platform-specific cor-rective actions through a unified handler mechanism.Upon breach, it triggers remediation routines tailoredto the target environment, ensuring contextual appro-priateness and minimal manual oversight. Prometheusmetrics are integrated to expose fine-grained teleme-try on detected anomalies and remedial actions, en-hancing observability and enabling external policy en-forcement or audit. Experimental validation across het-erogeneous cyber-physical system (CPS) environmentsdemonstrates significant improvements in recovery la-tency and fault tolerance. This research reinforces theimperative of automating the post-detection responsephase in security-focused self-healing systems. Futurework will address risk-aware remedial action selectionand integrate secure execution constraints to mitigate the threat surface introduced by autonomous system-level interventions.