Temporal graph-based anomaly analysis and control in cyber physical systems
Systems and methods are provided for incident analysis in Cyber-Physical Systems (CPS) using a Temporal Graph-based Incident Analysis System (TGIAS) and/or Transition Based Categorical Anomaly Detection (TCAD). Dynamically gathered multimodal data from a distributed network of sensors across the CPS are preprocessed to identify abnormal sensor readings indicative of potential incidents, and a multi-layered incident timeline graph, representing abnormal sensor readings, relationships to specific CPS components, and temporal sequencing of events is constructed. Severity scores are calculated, and severity rankings are assigned to identified anomalies based on a composite index including impact on CPS operation, comparison with historical incident data, and predictive risk assessments. Probable root causes of incidents and pathways for anomaly propagation through the CPS are identified using causal interference and the incident timeline graph to detect underlying vulnerabilities and predict future system weaknesses. Recommended actions are generated and executed for incident resolution and system optimization.
1 . A method for detecting anomalies in a Cyber-Physical System (CPS) using Transition Based Categorical Anomaly Detection (TCAD), comprising:
receiving historical normal categorical data from a plurality of sensors within the CPS;
automatically generating a transition library for each sensor based on the received data, wherein the transition library represents categorical state transitions for the sensor;
constructing a sensor relationship graph model based on identified transition points from the transition library, wherein each relationship edge of the graph represents a transition relationship between a pair of sensors;
constructing a temporal graph framework by aligning sensors that reported abnormal signals from the received data, the temporal graph framework including nodes that are aligned with temporal edges based on incident periods for the abnormal signals;
generating an incident timeline graph model by integrating the sensor relationship graph model and the temporal graph framework by matching the relationship edges with the temporal edges;
sampling additional sensor data using a sliding window technique;
calculating a relationship score for each edge of the incident timeline graph model based on the sampled data;
determining a normal relationship range for each edge of the incident timeline graph model using a Weibull distribution;
evaluating a threshold for an amount of broken edges in the incident timeline graph model, wherein a broken edge indicates a potential anomaly; and
issuing an alert and performing corrective actions if the amount of broken edges exceeds the threshold, the corrective actions include turning off an engine of an autonomous vehicle to resolve a detected anomalous pressure in the engine of the autonomous vehicle based on the incident timeline graph model for the autonomous vehicle as the CPS.
2 . The method of claim 1 , further comprising labeling each type of transition in the transition library with a unique identifier.
3 . The method of claim 1 , wherein the relationship score is based on a frequency of concurrent transitions in the pair of sensors associated with each edge.
4 . The method of claim 1 , further comprising updating the transition library based on the sampled additional sensor data.
5 . The method of claim 1 , wherein the sliding window technique is applied synchronously across multiple sensors to maintain temporal correlation.
6 . The method of claim 1 , further comprising adjusting the threshold dynamically based on historical anomaly detection outcomes.
7 . The method of claim 1 , wherein the Weibull distribution is further utilized to determine confidence intervals for the normal relationship range.
8 . A system for detecting anomalies in a Cyber-Physical System (CPS) using Transition Based Categorical Anomaly Detection (TCAD), comprising:
a processor operatively coupled to a non-transitory computer-readable storage medium, the processor configured for:
receiving historical normal categorical data from a plurality of sensors within the CPS;
automatically generating a transition library for each sensor based on the received data, wherein the transition library represents categorical state transitions for the sensor;
constructing a sensor relationship graph model based on identified transition points from the transition library, wherein each relationship edge of the graph represents a transition relationship between a pair of sensors;
constructing a temporal graph framework by aligning sensors that reported abnormal signals from the received data, the temporal graph framework including nodes that are aligned with temporal edges based on incident periods for the abnormal signals;
generating an incident timeline graph model by integrating the sensor relationship graph model and the temporal graph framework by matching the relationship edges with the temporal edges;
sampling additional sensor data using a sliding window technique;
calculating a relationship score for each edge of the incident timeline graph model based on the sampled data;
determining a normal relationship range for each edge of the incident timeline graph model using a Weibull distribution;
evaluating a threshold for an amount of broken edges in the incident timeline graph model, wherein a broken edge indicates a potential anomaly; and
issuing an alert and performing corrective actions if the amount of broken edges exceeds the threshold, the corrective actions include turning off an engine of an autonomous vehicle to resolve a detected anomalous pressure in the engine of the autonomous vehicle based on the incident timeline graph model for the autonomous vehicle as the CPS.
9 . The system of claim 8 , wherein the processor is further configured for labeling each type of transition in the transition library with a unique identifier.
10 . The system of claim 8 , wherein the relationship score is based on a frequency of concurrent transitions in the pair of sensors associated with each edge.
11 . The system of claim 8 , wherein the processor is further configured for updating the transition library based on the sampled additional sensor data.
12 . The system of claim 8 , wherein the sliding window technique is applied synchronously across multiple sensors to maintain temporal correlation.
13 . The system of claim 8 , wherein the processor is further configured for adjusting the threshold dynamically based on historical anomaly detection outcomes.
14 . The system of claim 8 , wherein the Weibull distribution is further utilized to determine confidence intervals for the normal relationship range.
15 . A computer program product for detecting anomalies in a Cyber-Physical System (CPS) using Transition Based Categorical Anomaly Detection (TCAD), the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method comprising:
receiving historical normal categorical data from a plurality of sensors within the CPS;
automatically generating a transition library for each sensor based on the received data, wherein the transition library represents categorical state transitions for the sensor;
constructing a sensor relationship graph model based on identified transition points from the transition library, wherein each relationship edge of the graph represents a transition relationship between a pair of sensors;
constructing a temporal graph framework by aligning sensors that reported abnormal signals from the received data, the temporal graph framework including nodes that are aligned with temporal edges based on incident periods for the abnormal signals;
generating an incident timeline graph model by integrating the sensor relationship graph model and the temporal graph framework by matching the relationship edges with the temporal edges;
sampling additional sensor data using a sliding window technique;
calculating a relationship score for each edge of the incident timeline graph model based on the sampled data;
determining a normal relationship range for each edge of the incident timeline graph model using a Weibull distribution;
evaluating a threshold for an amount of broken edges in the incident timeline graph model, wherein a broken edge indicates a potential anomaly; and
issuing an alert and performing corrective actions if the amount of broken edges exceeds the threshold, the corrective actions include turning off an engine of an autonomous vehicle to resolve a detected anomalous pressure in the engine of the autonomous vehicle based on the incident timeline graph model for the autonomous vehicle as the CPS.
16 . The computer program product of claim 15 , further comprising labeling each type of transition in the transition library with a unique identifier.
17 . The computer program product of claim 16 , further comprising adjusting the threshold dynamically based on historical anomaly detection outcomes.
18 . The computer program product of claim 16 , wherein the Weibull distribution is further utilized to determine confidence intervals for the normal relationship range.
19 . The computer program product of claim 15 , wherein the relationship score is based on a frequency of concurrent transitions in the pair of sensors associated with each edge.
20 . The computer program product of claim 15 , wherein the sliding window technique is applied synchronously across multiple sensors to maintain temporal correlation.