Unified multi-agent system for abnormality detection and isolation
According to some embodiments, a system, method and non-transitory computer readable medium are provided comprising a plurality of real-time monitoring nodes to receive streams of monitoring node signal values over time that represent a current operation of the cyber physical system; a local status determination module to determine an anomaly status for one or more nodes; a global status determination module to determine an anomaly status for the cyber physical system; a threat detection computer platform to: receive the monitoring node signal values, generate feature vectors from the values; compare the feature vectors with at least one decision boundary associated with each of a local abnormal detection model and a global abnormal detection model; and transmit an abnormal alert signal from the local status determination module and the global status determination module based on a result of each comparison. Numerous other aspects are provided.
1. A system to protect a cyber physical system, comprising:
a plurality of real-time monitoring nodes to receive streams of monitoring node signal values over time that represent a current operation of the cyber physical system; and
a threat detection computer platform comprising:
a local status determination module comprising an ensemble of local agents, the ensemble of local agents including two or more pluralities of local agents, wherein each plurality of local agents determines a local normal/abnormal status for a respective node of the plurality of real-time monitoring nodes, and the local status determination module is adapted to determine an anomaly status for the plurality of real-time monitoring nodes, wherein each local agent is trained with data representing a different mode of operation of the plurality of real-time monitoring nodes, and wherein each real-time monitoring node is one of a sensor, an actuator, a controller, a component and a sub-system;
a global status determination module comprising an ensemble of global agents, wherein each global agent monitors a portion of the cyber physical system and the global status determination module is adapted to determine an anomaly status for the cyber physical system;
a memory storing instructions; and
a computer processor to execute the instructions to cause the threat detection computer platform to:
receive the monitoring node signal values,
generate feature vectors from the received monitoring node signal values;
fuse, via a first status fusion module, global agent output from a plurality of global agents, the fusion generating a final global system status indicating a global normal/abnormal decision for the cyber physical system, wherein each global agent outputs its own respective anomaly status based on a comparison of global agent-specific feature vectors of the generated feature vectors to a global agent-specific decision boundary, wherein the fusion is: 1 A rule-based fusion including at least one of majority voting and dynamic detection selection, or 2 a machine-learning (ML)-based fusion;
fuse, via a second status fusion module, local agent output from each respective plurality of local agents, the fusion generating a final local node status for the respective node indicating a local normal/abnormal decision for the respective node, wherein each local agent outputs its own respective anomaly status based on a comparison of local agent-specific feature vectors of the generated feature vectors to a local agent-specific decision boundary, wherein the fusion is: 1. a rule-based fusion including at least one of majority voting and dynamic detection selection, or 2. a machine-learning (ML)-based fusion;
receive at a decision fusion module: 1 the final local node status for each respective node, and 2 the final global system status;
fuse, via the decision fusion module, the final local node status for each monitoring node and the final global system status for the cyber physical system; and
wherein each of the local status determination module, the global status determination module and the decision fusion module is a software module.
2. The system of claim 1 , wherein each local agent is adapted to determine a confidence score for their own respective anomaly status.
3. The system of claim 1 , wherein each global agent is adapted to determine the anomaly status for a mode or a region of operation of the cyber physical system.
4. The system of claim 1 , wherein each local agent and each global agent is trained to detect an anomaly via one of a two-class supervised learning process and a one-class learning process.
5. The system of claim 4 , wherein the two-class supervised learning process is based on one of a physics-based digital twin learning process and a data-driven digital twin learning process, and each of the physics-based digital twin learning process and the data-driven digital twin learning process generates simulation training data to train the respective process.
6. The system of claim 1 , wherein at least two of the plurality of local agents are developed by at least two of a physics-based method, a data-driven method and a one-class method, and at least two agents of the plurality of global agents are developed by at least two of the physics-based method the data-driven method and the one-class method.
7. The system of claim 1 , wherein each local agent is adapted to generate a confidence score for the determined anomaly status.
8. The system of claim 1 , wherein:
two or more local agents of the ensemble of the local status determination module are adapted to transfer information with each other; and
two or more global agents of the ensemble of the global status determination module are adapted to transfer information with each other.
9. A method to protect a cyber physical system comprising:
providing a local status determination module comprising an ensemble of local agents, the ensemble of local agents including two or more pluralities of local agents, wherein each plurality of local agents determines a local normal/abnormal status for a respective node of a plurality of real-time monitoring nodes;
providing a global status determination module comprising an ensemble of global agents, wherein each global agent monitors a portion of the cyber physical system;
receiving a stream of monitoring node signal values from a plurality of real-time monitoring nodes, wherein the monitoring node signal values represent a current operation of the cyber physical system;
generating feature vectors from the received monitored node signal values;
determining, via the local status determination module, an anomaly status for the plurality of real-time monitoring nodes, wherein each local agent is trained with data representing a different mode of operation of the plurality of real-time monitoring nodes, and wherein each real-time monitoring node is one of a sensor, an actuator, a controller, a component, and a sub-system;
determining, via the global status determination module, an anomaly status for the cyber physical system;
fusing, via a first status fusion module, global agent output from a plurality of global agents, the fusion generating a final global system status indicating a global normal/abnormal decision for the cyber physical system, wherein each global agent outputs its own respective anomaly status based on a comparison of global agent-specific feature vectors of the generated feature vectors to a global agent-specific decision boundary, wherein the fusion is: 1. a rule-based fusion including at least one of majority voting and dynamic detection selection, or 2. a machine-learning (ML)-based fusion;
fusing, via a second status fusion module, local agent output from each respective plurality of local agents, the fusion generating a final local node status for the respective node indicating a local normal/abnormal decision for the respective node, wherein each local agent outputs its own respective anomaly status based on a comparison of local agent-specific feature vectors of the generated feature vectors to a local agent-specific decision boundary, wherein the fusion is: 1. a rule-based fusion including at least one of majority voting and dynamic detection selection, or 2. a machine-learning (ML)-based fusion;
receiving at a decision fusion module: 1. the final local node status for each respective node, and 2. the final global system status;
fusing, via the decision fusion module, the final node status for each monitoring node and the final global system status for the cyber physical system; and
wherein each of the local status determination module, the global status determination module and the decision fusion module is a software module.
10. The method of claim 9 , further comprising:
determining, by each local agent, a confidence score for their own respective anomaly status.
11. The method of claim 9 , further comprising:
determining, by each global agent, the anomaly status for a mode of operation of the cyber physical system.
12. The method of claim 9 , wherein each local agent and each global agent is trained to detect an anomaly via one of a two-class supervised learning process and a one-class learning process.
13. The method of claim 12 , wherein the supervised learning process is one of a physics-based digital twin learning process and a data-driven digital twin learning process, and each of the physics-based digital twin learning process and the data-driven digital twin learning process generates simulation training data to train the respective process.
14. A non-transitory, computer-readable medium storing program code, the program code executable by a computer processor to cause the processor to perform a method to protect a cyber physical system associated with a plurality of monitoring nodes, each generating a series of current monitoring node values over time that represent a current operation of the cyber physical system, the method comprising:
generating feature vectors from a plurality of received monitoring node signal values;
determining, via a local status determination module comprising an ensemble of local agents, the ensemble of local agents including two or more pluralities of local agents, wherein each plurality of local agents determines a local normal/abnormal status for a respective node of a plurality of real-time monitoring nodes, an anomaly status for the plurality of monitoring nodes, wherein each local agent is trained with data representing a different mode of operation of the plurality of monitoring nodes, and wherein each monitoring node is one of a sensor, an actuator, a controller, a component and a sub-system;
determining, via a global status determination module comprising an ensemble of global agents, wherein each global agent monitors a portion of the cyber physical system, an anomaly status for the cyber physical system;
fusing, via a first status fusion module, global agent output from a plurality of global agents, the fusion generating a final global system status indicating a global normal/abnormal decision for the cyber physical system, wherein each global agent outputs its own respective anomaly status based on a comparison of global agent-specific feature vectors of the generated feature vectors to a global agent-specific decision boundary, wherein the fusion is: 1 A rule-based fusion including at least one of majority voting or dynamic detection selection, or 2 a machine-learning (ML)-based fusion;
fusing, via a second status fusion module, local agent output from each respective plurality of local agents, the fusion generating a final local node status for the respective node indicating a local normal/abnormal decision for the respective node, wherein each local agent outputs its own respective anomaly status based on a comparison of local agent-specific feature vectors of the generated feature vectors to a local agent-specific decision boundary, wherein the fusion is: 1 a rule-based fusion including at least one of majority voting or dynamic detection selection, or 2 a machine-learning (ML)-based fusion;
receiving at a decision fusion module: 1 the final local node status for each respective node, and 2 The final global system status;
fusing, via the decision fusion module, the final node status for each monitoring node and the final global system status for the cyber physical system; and
wherein each of the local status determination module, the global status determination module and the decision fusion module is a software module.
15. The medium of claim 14 , further comprising:
determining, by each local agent, a confidence score for their own respective anomaly status.
16. The medium of claim 15 , further comprising:
determining, by each global agent, the anomaly status for a mode a region of operation of the cyber physical system.
17. The medium of claim 16 , wherein each local agent and each global agent is trained to detect an anomaly via one of a two-class supervised learning process and a one-class learning process.