Adaptive, self-tuning virtual sensing system for cyber-attack neutralization

1. A system to protect an industrial asset, comprising:

a plurality of monitoring nodes, each monitoring node generating a series of monitoring node values over time that represent a current operation of the industrial asset;

an abnormality detection computer to determine that at least one abnormal monitoring node is currently being attacked or experiencing a fault; and

an autonomous, resilient estimator, coupled to the plurality of monitoring nodes and the abnormality detection computer and having an estimation error standard deviation substantially comparable to each monitoring node, to:

(i) continuously execute an adaptive learning process to create or update virtual sensor models for the monitoring nodes,

(ii) responsive to an indication that the at least one abnormal monitoring node is currently being attacked or experiencing a fault, automatically determine a level of neutralization,

(iii) dynamically reconfigure the autonomous, resilient estimator to estimate a series of virtual node values for the abnormal monitoring node or nodes based on information from normal monitoring nodes, appropriate virtual sensor models, and the determined level of neutralization, and

(iv) replace the series of monitoring node values from the abnormal monitoring node or nodes with the series of virtual node values.

2. The system of claim 1 , wherein the determined level of neutralization is based on: (i) an identified criticality of an encountered cyber-attack, (ii) an identified criticality of the industrial asset, and (iii) a current operating mode of the industrial asset.

3. The system of claim 1 , wherein the determined level of neutralization is associated with at least one of: (i) minimal performance degradation, (ii) degraded but secure performance, and (iii) a safe shutdown procedure.

4. The system of claim 1 , wherein the determined level of neutralization is associated with estimation error statistics of a virtually sensed node.

5. The system of claim 4 , wherein the estimation error statistics are associated with confidence boundaries for at least one of: (i) failure mode and effect analysis, and (ii) threat mode and effect analysis.

6. The system of claim 1 , wherein the adaptive learning process is associated with a reinforcement learning method.

7. The system of claim 6 , wherein the reinforcement learning method is associated with at least one of: (i) Q-learning, (ii) a recursive least-squares method, and (iii) a recursive weighted least-squares method.

8. The system of claim 1 , wherein the autonomous, resilient estimator is associated with a partially observed Markov decision process with continuous state and action spaces.

9. The system of claim 1 , wherein the virtual sensor models are created or updated based on at least one of: (i) an analysis of variance, and (ii) a correlation/regression analysis.

10. The system of claim 1 , wherein the dynamic reconfiguration is associated with at least one of: (i) an indexed selector, (ii) bumpless transfer control, and (iii) a proportional-integral-derivative controller, (iv) a switched adaptive control, and (v) a smooth transition controller.

11. The system of claim 1 , wherein the autonomous, resilient estimator estimates the series of virtual node values directly in time space after pre-filtering.

12. The system of claim 11 , wherein the pre-filtering includes: (i) de-noising via low pass filtering using low pass filters with individual cut-off frequencies tuned based on individual bandwidths of each monitoring node, and (ii) outlier removal by computing a standard deviation of measurement over a sliding window.

13. The system of claim 1 , wherein the autonomous, resilient estimator further: (i) is unbiased with a zero-mean error, (ii) has white Gaussian noise associated with a Cramer-Rao information bound, and (iii) is statistically efficient with an error asymptotically converging to zero.

14. The system of claim 1 , wherein the industrial asset is associated with at least one of: (i) a turbine, (ii) a gas turbine, (iii) a wind turbine, (iv) an engine, (v) a jet engine, (vi) a locomotive engine, (vii) a refinery, (viii) a power grid, (ix) a dam, and (x) an autonomous vehicle.

15. A computerized method to protect an industrial asset associated with a plurality of monitoring nodes, each monitoring node generating a series of monitoring node values over time that represent current operation of the industrial asset, comprising:

determining, by an abnormality detection computer, that at least one abnormal monitoring node is currently being attacked or experiencing a fault;

continuously executing, by an autonomous, resilient estimator, an adaptive learning process to create or update virtual sensor models for the monitoring nodes;

responsive to an indication that the at least one abnormal monitoring node is currently being attacked or experiencing a fault, automatically determining a level of neutralization, wherein the determined level of neutralization is based on a confidence boundary associated with a virtually sensed node; and

dynamically reconfiguring the autonomous, resilient estimator to estimate a series of virtual node values for the abnormal monitoring node or nodes based on information from normal monitoring nodes, appropriate virtual sensor models, and the determined level of neutralization; and

replacing the series of monitoring node values from the abnormal monitoring node or nodes with the series of virtual node values.

16. The method of claim 15 , wherein the determined level of neutralization is based at least in part on at least one of: (i) an identified criticality of an encountered cyber-attack, (ii) an identified criticality of the industrial asset, and (iii) a current operating mode of the industrial asset.

17. The method of claim 15 , wherein the determined level of neutralization is associated with at least one of: (i) minimal performance degradation, (ii) degraded but secure performance, and (iii) a safe shutdown procedure.

18. The method of claim 15 , wherein the determined level of neutralization is associated with estimation error statistics of a virtually sensed node.

19. The method of claim 18 , wherein the estimation error statistics are associated with confidence boundaries for at least one of: (i) failure mode and effect analysis, and (ii) threat mode and effect analysis.

20. The method of claim 15 , wherein the adaptive learning process is associated with a reinforcement learning method.

21. A non-transitory, computer-readable medium storing instructions that, when executed by a computer processor, cause the computer processor to perform a method to protect an industrial asset associated with a plurality of monitoring nodes, each monitoring node generating a series of monitoring node values over time that represent current operation of the industrial asset, the method comprising: determining, by an abnormality detection computer, that at least one abnormal monitoring node is currently being attacked or experiencing a fault; continuously executing, by an autonomous, resilient estimator, an adaptive learning process to create or update virtual sensor models for the monitoring nodes; responsive to an indication that the at least one abnormal monitoring node is currently being attacked or experiencing a fault, dynamically reconfiguring the autonomous, resilient estimator to estimate a series of virtual node values for the abnormal monitoring node or nodes based on information from normal monitoring nodes and appropriate virtual sensor models; replacing the series of monitoring node values from the abnormal monitoring node or nodes with the series of virtual node values; and responsive to an indication that the at least one abnormal monitoring node is no longer currently being attacked or experiencing a fault, replacing the series of virtual node values with the series of monitoring node values from the abnormal monitoring node is no longer currently being attacked or experiencing a fault.