Attack detection and localization with adaptive thresholding

1. A system to protect a cyber physical system, comprising:

a plurality of real-time monitoring nodes to receive streams of monitoring node signal values over time that represent a current operation of the cyber physical system, wherein each real-time monitoring node is one of a sensor or an actuator; and

a threat detection computer platform, coupled to the plurality of real-time monitoring nodes, to:

receive the monitoring node signal values;

compute an anomaly score;

select one of a multi-level process and a continuous process to generate an adaptive threshold;

generate the adaptive threshold via the selected process;

compare the anomaly score with the generated adaptive threshold; and

detect that one of a particular monitoring node and a system is outside a decision boundary based on the comparison, and classify that particular monitoring node or system as anomalous.

2. The system of claim 1 , wherein the adaptive threshold is one of a multi-level threshold and a continuous adaptive threshold.

3. The system of claim 2 , wherein in a case the adaptive threshold is the multi-level threshold, the threat detection computer platform further adapted to:

receive a trigger signal indicative of a level of the multi-level threshold prior to comparison of the anomaly score values with the adaptive threshold;

determine the adaptive threshold based on the received trigger signal; and

compare the monitoring node signal values to the indicated level of the multi-level threshold.

4. The system of claim 3 , wherein the levels of the multi-level threshold are based on one of a mode of operation, a region of operation and one or more ambient conditions.

5. The system of claim 2 , wherein the levels of the multi-level threshold are finite.

6. The system of claim 2 , wherein the continuous adaptive threshold is continuously modified in real-time.

7. The system of claim 2 , wherein the continuous adaptive threshold is based on one of:

a static model, wherein an underlying model governing changes in the threshold is static; and

a dynamic model, wherein an underlying model governing changes in the threshold is a time-series model.

8. The system of claim 7 , wherein the static model is one of a threshold look-up table and a regression model.

9. The system of claim 1 , wherein the threat detection computer platform is further adapted to generate, for each stream of monitoring node signal values, a current monitoring node feature vector for computation of an anomaly score and comparison with the adaptive threshold.

10. The system of claim 1 , wherein at least one of the monitoring nodes is associated with at least one of: sensor data, an auxiliary equipment input signal, a control intermediary parameter, valves, circuit breakers, and a control logic value.

11. The system of claim 1 , wherein the threat detection computer platform is further adapted to:

generate a safe margin for the adaptive threshold, wherein the safe margin is a distance between the adaptive threshold and a normal variation in the anomaly score.

12. The system of claim 11 , wherein the distance is generated based on one of: 1. a combination of a mean, standard deviation and extreme values, and 2. a time-series model.

13. A computer-implemented method to protect a cyber physical system comprising:

receiving a stream of monitoring node signal values from a plurality of real-time monitoring nodes, wherein the monitoring node signal value represent a current operation of the cyber physical system, wherein each real-time monitoring node is one of a sensor and an actuator;

computing an anomaly score;

selecting one of a multi-level process and a continuous process to generate an adaptive threshold;

generating the adaptive threshold via the selected process;

comparing the anomaly score with the generated adaptive threshold; and

detecting that one of a particular monitoring node and a system is outside a decision boundary based on the comparison, and classifying that particular monitoring node or system as anomalous.

14. The method of claim 13 , wherein the adaptive threshold is one of a multi-level threshold and a continuous adaptive threshold.

15. The method of claim 14 , wherein in a case the adaptive threshold is the multi-level threshold:

receiving a trigger signal indicative of a first level of the multi-level threshold prior to comparison of the anomaly score values with the adaptive threshold; and

comparing the monitoring node signal values to the indicated level of the multi-level threshold.

16. The method of claim 15 , wherein the levels of the multi-level threshold are based on one of a mode of operation, region of operation, an ambient condition, and a weather event.

17. The method of claim 14 , wherein the levels of the multi-level threshold are finite.

18. A non-transitory, computer-readable medium storing program code, the program code executable by a computer processor to cause the processor to perform a method to protect a cyber physical system associated with a plurality of real-time monitoring nodes, each generating a series of current monitoring node values over time that represent a current operation of the cyber physical system, the method comprising:

receiving a stream of monitoring node signal values from the plurality of real-time monitoring nodes, wherein each real-time monitoring node is one of a sensor and an actuator;

computing an anomaly score;

selecting one of a multi-level process and a continuous process to generate an adaptive threshold;

generating the adaptive threshold via the selected process;

comparing the anomaly score with the generated adaptive threshold; and

detecting that one of a particular monitoring node and a system is outside a decision boundary based on the comparison, and classifying that particular monitoring node or system as anomalous.

19. The medium of claim 18 , wherein the adaptive threshold is one of a multi-level threshold and a continuous adaptive threshold.

20. The medium of claim 19 , wherein in a case the adaptive threshold is the multi-level threshold, the method further comprising:

receiving a trigger signal indicative of a first level of the multi-level threshold prior to comparison of the anomaly score values with the adaptive threshold; and

comparing the monitoring node signal values to the indicated level of the multi-level threshold.