Systems and methods for node selection and ranking in cyber-physical systems
The present application describes techniques for node selection and ranking for, e.g., attack detection and localization in cyber-physical systems, without relying on digital twins, computer models of assets, or operational domain expertise. The described techniques include obtaining an input dataset of values for a plurality of nodes (e.g., sensors, actuators, controllers, software nodes) of industrial assets, computing a plurality of principal components (PCs) for the input dataset according to variance of values for each node, computing a set of common weighted PCs based on the plurality of PCs according to variance of each PC, and ranking each node based on the node's contribution to the set of common weighted PCs.
1. A computer-implemented method for node selection and ranking in a cyber-physical system, the method comprising:
obtaining an input dataset of values for a plurality of nodes of industrial assets, the input dataset comprising a number of groups of multivariate time series (MTS) data items, each group represented by a number of observations related to a number of nodes, wherein the plurality of nodes are physically co-located or connected through a wired or wireless network;
computing a plurality of principal components (PCs) for the input dataset according to variance of values for each node;
computing a set of common weighted PCs based on the plurality of PCs according to variance of each PC; and
ranking each node based on the node's contribution to the set of common weighted PCs.
2. The method of claim 1 , wherein the number of groups of MTS data items are represented as X t ∈ n i *p , t=1, . . . , g, where g is the number of groups of MTS data items, n i , is the number of observations for each group, and p is the number of nodes.
3. The method of claim 2 , wherein each group is represented by its first k PCs with each PC axis being denoted by z i (t) ∈ p , with i=1, . . . , k, t=1, . . . , g, and 1≤k≤p.
4. The method of claim 3 , wherein the set of common weighted PCs is computed by performing eigen-decomposition on the matrix H w =Σ t=1 g L t T W t L t ≥0 to determine a set of common axes according to the variance of each PC of the different subspaces described by L t , t=1, . . . , g, wherein W t =diag ([w 1 (t) , . . . , w k (t) ])∈ k*k is the weighting matrix, where w i (t) ≥0 is proportional to the variance σ i (t) ≥0 of the i-th PC belonging to the t-th group.
5. The method of claim 4 , wherein w i (t) =σ i (t) .
6. The method of claim 4 , wherein w i (t) =σ i (t) /Σ i,t σ i (t) .
7. The method of claim 1 , wherein each node's contribution comprises weighted norm of value corresponding to the node on the set of common weighted PCs.
8. The method of claim 1 , wherein the plurality of PCs are computed based on kernel principal component analysis, which includes computing the plurality of PCs based on nonlinear kernel functions in the input space, and the set of common weighted PCs is computed based on a finite-dimensional optimization problem in accordance with a Gram matrix of the input dataset.
9. The method of claim 1 , further comprising:
clustering and ranking nodes within each cluster, based on a weighted norm of a value corresponding to each node on the set of common weighted PCs, thereby selecting a node from each cluster and discarding other nodes of the cluster.
10. The method of claim 1 , wherein the input dataset includes normal runs data and load sweep data.
11. The method of claim 1 , wherein obtaining the input dataset comprises normalizing the input dataset to a predetermined range of values.
12. The method of claim 10 , wherein the predetermined range is [0, 1].
13. The method of claim 10 , further comprising:
selecting the predetermined range based on magnitudes of variabilities within each window, wherein the input dataset includes a plurality of windows.
14. The method of claim 10 , wherein the input dataset includes normal runs data and load sweep data, the method further comprising:
discarding the normal runs data after normalization.
15. The method of claim 1 , further comprising:
using the high-ranking nodes as inputs to anomaly detection systems or as secured hardened nodes to be the anchors for neutralization signal reconstruction.
16. The method of claim 1 , wherein the plurality of nodes are not physically co-located or are communicatively coupled via a network.
17. The method of claim 1 , wherein the input dataset includes multivariate time series (MTS) data items for a plurality of runs, the method further comprising:
defining breaking points for each node for each run based on identifying abrupt changes in values for the node; and
defining windows for the input dataset based on the breaking points; and
in accordance with a determination that size of the windows is larger than a predetermined threshold, defining additional breakpoints for the input dataset.
18. A system for implementing node selection and ranking in a cyber-physical system, comprising:
one or more processors;
memory; and
one or more programs stored in the memory, wherein the one or more programs are configured for execution by the one or more processors and include instructions for:
obtaining an input dataset of values for a plurality of nodes of industrial assets, the input dataset comprising a number of groups of multivariate time series (MTS) data items, each group represented by a number of observations related to a number of nodes, wherein the plurality of nodes are physically co-located or connected through a wired or wireless network;
computing a plurality of principal components (PCs) for the input dataset according to variance of values for each node;
computing a set of common weighted PCs based on the plurality of PCs according to variance of each PC; and
ranking each node based on the node's contribution to the set of common weighted PCs.
19. The system of claim 18 , wherein the plurality of PCs are computed based on kernel principal component analysis, which includes computing the plurality of PCs based on nonlinear kernel functions in the input space, and the set of common weighted PCs is computed based on a finite-dimensional optimization problem in accordance with a Gram matrix of the input dataset.
20. A non-transitory computer-readable storage medium storing one or more programs for execution by one or more processors of an electronic device, the one or more programs including instructions for:
obtaining an input dataset of values for a plurality of nodes of industrial assets, the input dataset comprising a number of groups of multivariate time series (MTS) data items, each group represented by a number of observations related to a number of nodes, wherein the plurality of nodes are physically co-located or connected through a wired or wireless network;
computing a plurality of principal components (PCs) for the input dataset according to variance of values for each node;
computing a set of common weighted PCs based on the plurality of PCs according to variance of each PC; and
ranking each node based on the node's contribution to the set of common weighted PCs.