Safety and security of cyber-physical systems connected through IoT network
A system to protect an asset includes a plurality of monitoring nodes each generating a data stream of current monitoring node values in time-domain. An anomalous space data source stores sets of anomalous feature vectors for each of the plurality of monitoring nodes generated by an anomaly detection model. A current system function processor, coupled to the plurality of monitoring nodes over a network, receives receive data streams from each of the plurality of monitoring nodes, and generates a set of current feature vectors. An anomaly detection computer coupled to the plurality of monitoring nodes receives the data streams from the plurality of monitoring nodes and the set of anomalous feature vectors, and outputs at least one decision boundary based on processing, using the anomaly detection model, of the current feature vectors relative to the sets of anomalous feature vectors.
1 . A system to protect an asset, the system comprising:
a plurality of monitoring nodes for the asset, each of the monitoring nodes generating a respective data stream of current monitoring node values in a time-domain; and
an anomaly detection computer coupled to the plurality of monitoring nodes, the anomaly detection computer configured to:
receive the respective data streams from each of the plurality of monitoring nodes,
synchronize, in real-time, the respective data streams by aligning monitoring node values using last available data from each monitoring node and by down-sampling higher-rate data streams to a uniform common sampling time,
automatically calculate and output at least one decision boundary based on processing, using an anomaly detection model during operation of the asset, of current feature vectors relative to sets of anomalous feature vectors, wherein the current feature vectors are representative of the synchronized respective data streams of current monitoring node values in the time-domain for each of the plurality of monitoring nodes, wherein the anomalous feature vectors are representative of anomalous operation of one or more of the plurality of monitoring nodes and/or anomalous operation of the asset,
determine whether the asset is behaving anomalously by comparing the current feature vectors to the at least one decision boundary,
determine, based on the comparison, a probability that a detected anomaly corresponds to a malfunction or failure of one or more monitoring nodes and a probability that the detected anomaly corresponds to an attack or a threat, and
generate an alert in response to a determination that the asset is behaving anomalously.
2 . The system of claim 1 , wherein the anomaly detection model comprises a plurality of sub-models, each sub-model operating concurrently on different temporal resolutions of the synchronized data streams.
3 . The system of claim 1 , wherein the anomaly detection computer is coupled wirelessly to the plurality of monitoring nodes.
4 . The system of claim 1 , wherein the anomaly detection model is configured to generate a set of anomalous feature vectors corresponding to a malfunction or failure of a first one or more of the monitoring nodes, and/or a set of anomalous features vectors corresponding to an attack or a threat on a second one or more of the monitoring nodes.
5 . The system of claim 1 , wherein the anomaly detection model comprises at least one sub-model based on historical operation of the plurality of monitoring nodes and the asset.
6 . The system of claim 5 , wherein the at least one sub-model is based on historically normal operation of the plurality of monitoring nodes and the asset.
7 . The system of claim 6 , further comprising a normal space data source storing sets of normal feature vectors for each of the plurality of monitoring nodes generated by the at least one sub-model based on historically normal operation of the plurality monitoring nodes and the asset.
8 . The system of claim 1 , wherein the at least one decision boundary is calculated in real-time relative to the operation of the plurality of monitoring nodes.
9 . The system of claim 1 , wherein each of the respective data streams is at a same frame rate as a collection sampling time of a set of sensors associated with its respective monitoring node.
10 . The system of claim 1 , wherein the anomaly detection model is built in state-space and using one of black-box and grey-box system identification techniques.
11 . The system of claim 1 , wherein the anomaly detection model is built automatically.
12 . The system of claim 1 , wherein the anomaly detection model is associated with a linear or non-linear model.
13 . The system of claim 1 , wherein the anomaly detection model is associated with an order automatically selected via a Hankel norm analysis.
14 . The system of claim 13 , wherein parameters of the anomaly detection model are estimated via a system identification method associated with at least one of: (i) Prediction Error (“PE”) minimization, (ii) subspace methods, (iii) Subspace State Space System Identification (“N4SID”), and (iv) Eigen-system Realization Algorithm (“ERA”) techniques.
15 . The system of claim 1 , wherein the anomaly detection model is associated with one of: (i) a Single-Input, Single-Output (“SISO”) model, (ii) a Single-Input, Multi-Output (“SIMO”) model, (ii) a Multi-Input, Single-Output (“MISO”) model, and (iv) a Multi-Input, Multi-Output (“MIMO”) model, (v) an actuator attack, (vi) a controller attack, (vii) a monitoring node attack, (viii) a plant state attack, (ix) spoofing, (x) financial damage, (xi) unit availability, (xii) a unit trip, (xiii) a loss of unit life, and (xiv) asset damage requiring at least one new part.
16 . The system of claim 1 , wherein the current feature vectors includes at least one of: (i) a local feature vector associated with a particular monitoring node, and (ii) a global feature vector associated with the plurality of monitoring nodes.
17 . The system of claim 1 , wherein the anomaly detection model includes an artificial intelligence model trained to dynamically update the at least one decision boundary based on temporal evolution of current feature vectors and that generates the at least one decision boundary based on recognition of patterns in the current feature vectors as being normal or anomalous.
18 . The system of claim 17 , wherein the artificial intelligence model further recognizes (i) patterns in the current feature vectors caused by a fault or malfunction at a respective monitoring node and (ii) patterns in the current feature vectors caused by a threat or an attack on a respective monitoring node and/or the asset.