Decision system and method for separating faults from attacks

1. A system to protect an industrial asset, comprising:

a plurality of monitoring nodes each generating a series of current monitoring node values over time that represent a current operation of the industrial asset;

a node classification computer, coupled to the plurality of monitoring nodes, to:

determine, for each monitoring node, a classification result indicating whether each monitoring node is in a normal or abnormal state, and

output the classification results;

execute a conformance test to determine if an abnormality is an independent abnormality or a dependent abnormality; and

a disambiguation engine, coupled to the node classification computer, to:

receive the classification results from the node classification computer,

assign a Hidden Markov Model (“HMM”) to each monitoring node, for each node in an abnormal state:

execute the HMM assigned to that monitoring node to determine a disambiguation result indicating if the abnormal state is a result of an attack or a fault, further comprising:

in the case of the independent abnormality:

determine the independent abnormality is a single independent abnormality in a case that there are no other detected independent abnormalities, and execute the HMM assigned to that monitoring node to determine if the abnormal state is a result of an attack or a fault;

determine the independent abnormality is a multiple independent abnormality in a case of multiple instances of independent abnormalities, and if the independent abnormality is the multiple independent abnormality, determine that the abnormal state is a result of an attack;

in the case of the dependent abnormality associated with an originating monitoring node:

in the case of an originating monitoring node associated with an attack, determine that the dependent abnormality is a result of an attack, and

in the case of an originating monitoring node associated with a fault, determine that the dependent abnormality is a result of a fault and adjusting at least one of a HMM state transition matrix and a HMM emission probability matrix; and

output a current status of each monitoring node based on the associated classification result and the disambiguation result.

2. The system of claim 1 , wherein at least one HMM further determines a type of fault associated with an abnormal state.

3. The system of claim 1 , wherein each HMM receives a series of observations associated with the series of current monitoring node values over time that represent a current operation of the industrial asset.

4. The system of claim 3 , wherein each observation is associated with one of: (i) a fixed range of values, and (ii) variable ranges of values.

5. The system of claim 1 , wherein at least one HMM is initially trained to create a state transition matrix using data collected from the monitoring nodes and domain knowledge.

6. The system of claim 5 , wherein the state transition matrix is updated during operation of the industrial asset.

7. The system of claim 6 , wherein elements of the state transition matrix are updated using:

a ik =(1−α) a ik +αδ kj , k= 1 , . . . , S

where α is a learning parameter in (0,1), δ is the Kronecker's delta (δ kj is 1 if i=j and 0 otherwise), S is the total number of states and the parameter a is using maximum a posteriori estimation.

8. The system of claim 1 , wherein the node classification computer determines the classification result by:

receiving the series of current monitoring node values and generate a set of current feature vectors,

accessing at least one classification model having at least one decision boundary, and

executing the at least one classification model and transmitting the classification result based on the set of current feature vectors and the at least one decision boundary.

9. The system of claim 8 , wherein at least one monitoring node is associated with at least one of: (i) a sensor node, (ii) a critical sensor node, (iii) an actuator node, (iv) a controller node, and (v) a key software node.

10. The system of claim 8 , wherein the set of current feature vectors are associated with at least one of: (i) principal components, (ii) statistical features, (iii) deep learning features, (iv) frequency domain features, (v) time series analysis features, (vi) logical features, (vii) geographic or position based locations, and (viii) interaction features.

11. The system of claim 8 , wherein the at least one decision boundary is associated with at least one of: (i) a line, (ii) a hyperplane, and (iii) a non-linear boundary.

12. The system of claim 8 , further comprising:

a normal space data source storing, for each of the plurality of monitoring nodes, a series of normal monitoring node values over time that represent normal operation of the industrial asset;

an abnormal space data source storing, for each of the plurality of monitoring nodes, a series of abnormal monitoring node values over time that represent abnormal operation of the industrial asset; and

a classification model creation computer, coupled to the normal space data source and the abnormal space data source, to:

receive the series of normal monitoring node values and generate a set of normal feature vectors,

receive the series of abnormal monitoring node values and generate a set of attacked feature vectors, and

automatically calculate and output the at least one decision boundary for the classification model based on the set of normal feature vectors, the set of attacked feature vectors, and the set of faulty feature vectors.

13. The system of claim 12 , wherein at least one of the normal, attacked, and faulty monitoring node values are obtained by running design of experiments on an industrial control system associated with at least one of: (i) a turbine, (ii) a gas turbine, (iii) a wind turbine, (iv) an engine, (v) a jet engine, (vi) a locomotive engine, (vii) a refinery, (viii) a power grid, (ix) a dam, and (x) an autonomous vehicle.

14. A computerized method to protect an industrial asset, comprising:

generating, for a plurality of monitoring nodes each, a series of current monitoring node values over time that represent a current operation of the industrial asset;

determining, by a node classification computer for each monitoring node, a classification result indicating whether each monitoring node is in a normal or abnormal state;

outputting the classification results;

executing a conformance test to determine if an abnormality is an independent abnormality or a dependent abnormality; and

receiving, by a disambiguation engine, the classification results from the node classification computer;

assigning a Hidden Markov Model (“HMM”) to each monitoring node, for each node in an abnormal state:

executing the HMM assigned to that monitoring node to determine a disambiguation result indicating if the abnormal state is a result of an attack or a fault, further comprising:

in the case of the independent abnormality:

determining the independent abnormality is a single independent abnormality in a case that there are no other detected independent abnormalities, and

executing the HMM assigned to that monitoring node to determine if the abnormal state is a result of an attack or a fault;

determining the independent abnormality is a multiple independent abnormality in a case of multiple instances of independent abnormalities, and if the independent abnormality is the multiple independent abnormality, determine that the abnormal state is a result of an attack;

in the case of the dependent abnormality associated with an originating monitoring node:

in the case of an originating monitoring node associated with an attack, determining that the dependent abnormality is a result of an attack, and

in the case of an originating monitoring node associated with a fault, determining that the dependent abnormality is a result of a fault and adjusting at least one of a HMM state transition matrix and a HMM emission probability matrix; and

outputting a current status of each monitoring node based on the associated classification result and the disambiguation result.

15. A non-transitory computer-readable medium storing instructions that, when executed by a computer processor, cause the computer processor to perform a method to protect an industrial asset, the method comprising:

generating, for a plurality of monitoring nodes each, a series of current monitoring node values over time that represent a current operation of the industrial asset;

determining, by a node classification computer for each monitoring node, a classification result indicating whether each monitoring node is in a normal or abnormal state;

outputting the classification results;

executing a conformance test to determine if an abnormality is an independent abnormality or a dependent abnormality; and

receiving, by a disambiguation engine, the classification results from the node classification computer;

assigning a Hidden Markov Model (“HMM”) to each monitoring node, for each node in an abnormal state:

executing the HMM assigned to that monitoring node to determine a disambiguation result indicating if the abnormal state is a result of an attack or a fault, further comprising:

in the case of the independent abnormality:

determining the independent abnormality is a single independent abnormality in a case that there are no other detected independent abnormalities, and

executing the HMM assigned to that monitoring node to determine if the abnormal state is a result of an attack or a fault;

determining the independent abnormality is a multiple independent abnormality in a case of multiple instances of independent abnormalities, and if the independent abnormality is the multiple independent abnormality, determine that the abnormal state is a result of an attack;

in the case of the dependent abnormality associated with an originating monitoring node:

in the case of an originating monitoring node associated with an attack, determining that the dependent abnormality is a result of an attack, and

in the case of an originating monitoring node associated with a fault, determining that the dependent abnormality is a result of a fault and adjusting at least one of a HMM state transition matrix and a HMM emission probability matrix; and

outputting a current status of each monitoring node based on the associated classification result and the disambiguation result.