Cyber physical attack detection

1. A cyber-security threat detection process, comprising;

storing a first plurality of physical data measurements from a cyber-physical system;

extracting a plurality of measurement vectors from the first plurality of physical data measurements;

synchronizing the plurality of measurement vectors to a plurality of timing pulses to render a plurality of synchronized measurement vectors;

synthesizing a plurality of simulated cyber-attacks by processing a plurality of threat profiles and the plurality of synchronized measurement vectors in response to storing the plurality of physical data measurements;

applying an alternating parametrized linear and non-linear operations in response to processing the plurality of simulated cyber-attacks to render a plurality of optimized model parameters for a classification model where the plurality of optimized model parameters use a machine learning;

modifying a plurality of model parameters of a second classification model based on the plurality of optimized model parameters; and

detecting a cyber-attack by applying the modified plurality model parameters to second physical data measurements rendered by the cyber-physical system to detect the cyber-attack;

where the plurality of threat profiles are provided by a threat profiler that render parameter files that represent various types of simulated cyber-attacks; and

where the extraction of the plurality of synchronized measurement vectors comprises rendering one or more synchronized measurement vectors that are not based on the physical data measurements.

2. The process of claim 1 where extracting the plurality of measurement vectors comprises estimating a synchronized measurement vector by processing a prior synchronized measurement vector and processing a successive synchronized measurement vector.

3. The process of claim 1 where the rendering of one or more synchronized measurement vectors are based on data.

4. The process of claim 1 where the alternating parametrized linear and non-linear operations are executed by an auto-encoder.

5. The process of claim 4 where the auto-encoder executes an auto mapping of an input layer to a smaller output layer through an encoder and performs an inverse mapping of a second smaller output layer to a second input layer.

6. The process of claim 1 where the plurality of cyber-attacks comprises a replay attack, a variable latency attack, a sensor freeze attack, an additive noise attack, and a data injection attack.

7. A cyber-security threat detection system, comprising;

a hardware processor configured to store a plurality of physical data measurements from a cyber-physical system;

the hardware processor further configured to extract a plurality of measurement vectors from the plurality of physical data measurements;

the hardware processor is further configured to synchronize the plurality of measurement vectors to a plurality of timing pulses to render a plurality of synchronized measurement vectors;

the hardware processor further configured to synthesize a plurality of simulated cyber-attacks by processing a plurality of threat profiles and the plurality of synchronized measurement vectors in response to storing the plurality of physical data measurements;

the hardware processor further configured to apply an alternating parametrized linear and non-linear operations in response to processing the plurality of simulated cyber-attacks to render a plurality of optimized model parameters for a classification model where the plurality of optimized model parameters use a machine learning;

the hardware processor is further configured to modify a plurality of model parameters of a second classification model based on the plurality of optimized model parameters; and

the hardware processor further configured to detect a cyber-attack by applying the modified plurality of model parameters to second physical data measurements rendered by the cyber-physical system to detect the cyber-attack

where the plurality of threat profiles are provided by a threat profiler that render parameter files that represent various types of simulated cyber-attacks; and

where the extraction of the plurality of synchronized measurement vectors comprises rendering one or more synchronized measurement vectors that are not based on the physical data measurements.

8. The system of claim 7 where the extraction of the plurality of measurement vectors comprises estimating a synchronized measurement vector by processing a prior synchronized measurement vector and processing a successive synchronized measurement vector.

9. The system of claim 7 where the rendering of one or more synchronized measurement vectors are not based on data.

10. The system of claim 7 where the alternating parametrized linear and non-linear operations are executed by an auto-encoder.

11. The system of claim 10 where the auto-encoder executes an auto mapping of an input layer to a smaller output layer through an encoder and performs an inverse mapping of a second smaller output layer to a second input layer.

12. The system of claim 7 where the plurality of cyber-attacks comprise a replay attack, a variable latency attack, a sensor freeze attack, an additive noise attack, and a data injection attack.

13. A non-transitory machine-readable medium encoded with machine-executable instructions, wherein execution of the machine-executable instructions is for:

storing a plurality of physical data measurements from a cyber-physical system;

extracting a plurality of measurement vectors from the plurality of physical data measurements synchronized to one or more timing pulses;

synchronizing the plurality of measurement vectors to a plurality of timing pulses to render a plurality of synchronized measurement vectors;

synthesizing a plurality of simulated cyber-attacks by processing a plurality of threat profiles and the plurality of synchronized measurement vectors in response to storing the plurality of physical data measurements;

applying an alternating parametrized linear and non-linear operations in response to processing the plurality of simulated cyber-attacks to render a plurality of optimized model parameters of a classification model where the plurality of optimized model parameters use a machine learning;

modifying a plurality of model parameters of a second classification model based on the plurality of optimized model parameters; and

detecting a cyber-attack by applying the modified plurality of model parameters to second physical data measurements rendered by the cyber-physical system to detect the cyber-attack;

where the plurality of threat profiles are provided by a threat profiler that render parameter files that represent various types of simulated cyber-attacks; and

where the extraction of the plurality of synchronized measurement vectors comprises rendering one or more synchronized measurement vectors that are not based on the physical data measurements.

14. The non-transitory machine-readable medium of claim 13 where the extracting of the plurality of measurement vectors comprises estimating a synchronized measurement vector by processing a prior synchronized measurement vector and processing a successive synchronized measurement vector.

15. The non-transitory machine-readable medium of claim 13 where one or more synchronized measurement vectors are based on an interpolation.

16. The non-transitory machine-readable medium of claim 13 where the alternating parametrized linear and non-linear operations are executed through an auto-encoder.

17. The non-transitory machine-readable medium of claim 16 where the auto-encoder executes an auto mapping of an input layer to a smaller output layer through an encoder and performs an inverse mapping of a second smaller output layer to a second input layer.