Sensor contribution ranking
View Patent ↗Methods and systems for detecting and correcting anomalies include detecting an anomaly in a cyber-physical system, based on a classification of time series information from sensors that monitor the cyber-physical system as being anomalous. A similarity graph is determined for each of the sensors, based on the time series information. A subset of the sensors that are related to the classification is selected, based on a spectral embedding of the similarity graphs. A corrective action is performed responsive to the detected anomaly, prioritized according to the selected subset.
1. A method for detecting and correcting anomalies, comprising:
detecting an anomaly in a cyber-physical system, based on a classification of time series information from a plurality of sensors that monitor the cyber-physical system as being anomalous;
determining a similarity graph for each of the plurality of sensors, based on the time series information;
selecting a subset of the plurality of sensors that are related to the classification, based on a spectral embedding of the similarity graphs; and
performing a corrective action responsive to the detected anomaly, prioritized according to the selected subset.
2. The method of claim 1 , wherein each similarity graph includes a set of nodes that represent measurements from a respective sensor at different time segments.
3. The method of claim 2 , wherein a weight between nodes in each similarity graph is determined according to a distance metric that compares pairs of the respective measurements.
4. The method of claim 2 , wherein a structure of the similarity graph is determined as a k-nearest neighbor graph that preserves a geometry structure of an original data distribution.
5. The method of claim 1 , further comprising determining the spectral embedding of each of the plurality of similarity graphs, including a power iteration embedding of the similarity graph as a one-dimensional vector.
6. The method of claim 1 , wherein selecting the subset includes ranking the plurality of sensors includes determining a score for each sensor, based on a respective spectral embedding vector for the sensor and an entropy.
7. The method of claim 6 , wherein determining the score includes calculating:
score
(
v
t
,
y
)
=
I
(
v
t
,
y
)
H
(
v
t
)
H
(
y
)
where I(⋅) is a mutual information function, H(⋅) is an entropy function, v t is the spectral embedding vector, and y is a label vector.
8. The method of claim 1 , wherein selecting the subset includes minimizing a degree of redundancy between the plurality of sensors.
9. The method of claim 8 , wherein minimizing the degree of redundancy includes minimizing an objective function using a coordinate descent.
10. The method of claim 1 , wherein performing the corrective action includes an action selected from the group consisting of changing a security setting for an application or hardware component, changing an operational parameter of an application or hardware component, halting an application, restarting an application, halting a hardware component, rebooting a hardware component, changing an environmental condition, and changing a network interface's status.
11. A system for detecting and correcting anomalies, comprising:
a hardware processor; and
a memory, configured to store a computer program that, when executed by the hardware processor, implements:
anomaly detection code that detects an anomaly in a cyber-physical system, based on a classification of time series information from a plurality of sensors that monitor the cyber-physical system as being anomalous;
sensor selection code that determines a similarity graph for each of the plurality of sensors, based on the time series information and selects a subset of the plurality of sensors that are related to the classification, based on a spectral embedding of the similarity graphs; and
a controller that performs a corrective action responsive to the detected anomaly, prioritized according to the selected subset.
12. The system of claim 11 , wherein each similarity graph includes a set of nodes that represent measurements from a respective sensor at different time segments.
13. The system of claim 12 , wherein the sensor selection code determines a weight between nodes in each similarity graph according to a distance metric that compares pairs of the respective measurements.
14. The system of claim 12 , the sensor selection code determines a structure of the similarity graph as a k-nearest neighbor graph that preserves a geometry structure of an original data distribution.
15. The system of claim 11 , wherein the sensor selection code further determines the spectral embedding of each of the plurality of similarity graphs, including a power iteration embedding of the similarity graph as a one-dimensional vector.
16. The system of claim 11 , wherein the sensor selection code further determines a score for each sensor, based on a respective spectral embedding vector for the sensor and an entropy.
17. The system of claim 16 , wherein the sensor selection code calculates a score as:
score
(
v
t
,
y
)
=
I
(
v
t
,
y
)
H
(
v
t
)
H
(
y
)
where I(⋅) is a mutual information function, H(⋅) is an entropy function, v t is the spectral embedding vector, and y is a label vector.
18. The system of claim 11 , wherein the sensor selection code minimizes a degree of redundancy between the plurality of sensors.
19. The system of claim 18 , wherein the sensor selection code minimizes an objective function using a coordinate descent.
20. The system of claim 11 , wherein the controller performs a corrective action selected from the group consisting of changing a security setting for an application or hardware component, changing an operational parameter of an application or hardware component, halting an application, restarting an application, halting a hardware component, rebooting a hardware component, changing an environmental condition, and changing a network interface's status.