## 6 Discussion  
For the self-healing of cyber-physical systems to be effective, resilience must be at its core, just as defined in [25], where it is noted to include system monitoring, adaptation, redundancy, decoupling, and focus at the edges but simple at its core. ML is a notable toolset widely accepted in various research as a critical aspect of implementing self-healing functionality in computer systems. For example, as recent research has shown when combined with a fault-solving strategy network, an ML algorithm can o implement self-healing functionality in cyber-physical systems. The primary language for implementing ML algorithms is the R language, as presented by [PERSON] in [25], and libraries such as Keras or Tensorflow are readily available to transform R language into other languages such as Python or C++. To overcome the problem of real-time systems self-healing and attack remediation issues, a framework for automated remediation triggers is possible, just as proposed by [37], and it details how self-healing can be built into the Internet of Things (IoT) devices. IoT has become popular in homes, offices, and schools, making it very important to construct self-healing devices to provide effective and uninterrupted services. The first factor to consider when developing a self-healing cyber-physical system is detecting anomalies and fault events. Naive Bayes, artificial neural networks, convolutional neural networks, deep learning, etc., are some of the algorithms available to researchers to utilise in training anomaly datasets and to create a classified pattern of threat events. The dilemma in making this consideration is how to prevent the algorithm chosen from flagging up business-as-usual events wrongly as anomaly events; hence, the ML algorithm must be able to differentiate between these events. Danger theory is one approach that can be deployed to resolve the false-negative issues, in the sense that a threat alarm can only be raised when there exists the presence of potentially harmful events that the system is not familiar with and thereby eliminate \"zero-day\" attacks or in other words, attacks that the system had not seen previously. The next step after detecting anomaly events when implementing a self-healing cyber-physical system is to be able to trigger warnings to other parts of systems and or other \begin{table}
\begin{tabular}{l l c c c c c c c} \hline \hline  & **Model** & **Accuracy** & **AUC** & **Recall** & **Prec.** & **F1** & **Kappa** & **Mcc** & **TT (S)** \\ \hline mlp & MLP classifier & 0.3493 & 0.5215 & 0.3493 & 0.3498 & 0.3327 & 0.0201 & 0.0210 & 0.1620 \\ svm & SVM-Linear Kernel & 0.3357 & 0.0000 & 0.3357 & 0.3007 & 0.2735 & 0.0052 & 0.0047 & 0.0670 \\ rf & Random Forest Classifier & 0.3336 & 0.4965 & 0.3336 & 0.3349 & 0.3334 & \(-\)0.0002 & \(-\)0.0002 & 0.1950 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Models PyCarat analysis experiment result. processes within the system components or the network. An alert trigger can be activated similarly as described in [18] using alert management that relays system status to the intrusion mitigation system and then takes actions to stop the presence of potential threats through a programmed remediation process. In this instance, intrusion mitigation encompasses removing the identified threat event and restoring the system to its stable state. The system's data module profiles the normal state of the system and creates datasets for ML training derived from the system logs. There are options for creating a dictionary of possible attack vectors, which the ML algorithm that is primed for detecting anomalies can rely on to ascertain if events fall within a suspicious category class of threats. This approach is the most widely available and studied, as described by [33] in a proposal that uses a knowledge-based algorithm to identify attack vectors. The approach, though, has increasingly become problematic as cyber-physical systems attacks have become more sophisticated.