Hybrid feature-driven learning system for abnormality detection and localization

1. A system having a plurality of monitoring nodes each generating a series of current monitoring node values over time that represent current operation of a cyber-physical system, comprising:

a data-driven features extraction computer platform having a memory and a computer processor adapted to:

receive the series of current monitoring node values, and

generate current data-driven feature vectors based on the series of current monitoring node values;

a residual features extraction computer platform having a memory and a computer processor adapted to:

receive the series of current monitoring node values,

execute a system model and utilize a stochastic filter together to generate current residual values, wherein the generated current residual values describe the difference between expected values predicted by the system model and the series of current monitoring node values, and

generate current residual-driven feature vectors based on the current residual values; and

an abnormal detection platform having a memory and a computer processor adapted to:

receive the current data-driven and residual-driven feature vectors,

compare the current data-driven and residual-driven feature vectors with at least one decision boundary associated with an abnormal detection model, and

transmit an abnormal alert signal based on a result of said comparison.

2. The system of claim 1 , wherein the stochastic filter is associated with at least one of: (i) a Kalman filter, (ii) an extended Kalman filter, and (iii) an unscented Kalman filter.

3. The system of claim 1 , wherein the system model is associated with at least one of: (i) a linear time invariant form, (ii) a linear time varying form, (iii) a linear parameter varying form, and (iv) a non-linear form.

4. The system of claim 1 , wherein the current data-driven and residual-driven feature vectors undergo a feature augmentation process prior to being received by the abnormal detection platform.

5. The system of claim 1 , wherein the at least one decision boundary and abnormal alert signal are associated with global feature vectors.

6. The system of claim 1 , where sub-sets of the current data-driven feature vectors, current residual-driven feature vectors, and decision boundaries are associated with local feature vectors.

7. The system of claim 1 , further comprising:

a normal space data source storing, for each of the plurality of monitoring nodes, a series of normal monitoring node values over time that represent normal operation of the cyber-physical system;

an abnormal space data source storing, for each of the plurality of monitoring nodes, a series of abnormal monitoring node values over time that represent abnormal operation of the cyber-physical system; and

a data-driven and residual features extraction computer platform having a memory and a computer processor adapted to:

receive the series normal monitoring node values and generate a set of normal feature vectors,

receive the series of abnormal monitoring node values and generate a set of abnormal feature vectors, and

automatically calculate and output the at least one decision boundary for the abnormal detection platform based on the set of normal feature vectors and the set of abnormal feature vectors.

8. The system of claim 7 , wherein the at least one decision boundary is based at least in part on at least one residual-driven feature vector.

9. The system of claim 8 , wherein the at one decision boundary is calculated without determining a threshold value for the at least one residual-driven feature vector.

10. A method for a system having a plurality of monitoring nodes each generating a series of current monitoring node values over time that represent current operation of a cyber-physical system, comprising:

receiving, by a data-driven features extraction computer platform, the series of current monitoring node values;

determining, by the data-driven features extraction computer platform, current data-driven feature vectors based on the series of current monitoring node values;

receiving, by a residual features extraction computer platform, the series of current monitoring node values;

executing, by the residual features extraction computer platform, a system model and utilize a stochastic filter together to generate current residual values, wherein the generated current residual values describe the difference between expected values predicted by the system model and the series of current monitoring node values;

determining, by the residual features extraction computer platform, current residual-driven feature vectors based on the current residual values;

receiving the current data-driven and residual-driven feature vectors at an abnormal detection platform;

comparing, by the abnormal detection platform, the current data-driven and residual-driven feature vectors with at least one decision boundary associated with an abnormal detection model; and

transmitting, by the abnormal detection platform, an abnormal alert signal based on a result of said comparison.

11. The method of claim 10 , wherein the stochastic filter is associated with at least one of: (i) a Kalman filter, (ii) an extended Kalman filter, and (iii) an unscented Kalman filter.

12. The method of claim 10 , wherein the system model is associated with at least one of: (i) a linear time invariant form, (ii) a linear time varying form, (iii) a linear parameter varying form, and (iv) a non-linear form.

13. The method of claim 10 , wherein the current data-driven and residual-driven feature vectors undergo a feature augmentation process prior to being received by the abnormal detection platform.

14. The method of claim 10 , wherein the at least one decision boundary and abnormal alert signal are associated with global feature vectors.

15. The method of claim 10 , where sub-sets of the current data-driven feature vectors, current residual-driven feature vectors, and decision boundaries are associated with local feature vectors.

16. A non-transitory, computer-readable medium storing program code, the program code executable by a computer processor to cause the processor to perform a method for a system having a plurality of monitoring nodes each generating a series of current monitoring node values over time that represent current operation of a cyber-physical system, the method comprising:

receiving, by a data-driven features extraction computer platform, the series of current monitoring node values;

determining, by the data-driven features extraction computer platform, current data-driven feature vectors based on the series of current monitoring node values;

receiving, by a residual features extraction computer platform, the series of current monitoring node values;

executing, by the residual features extraction computer platform, a system model and utilize a stochastic filter together to generate current residual values, wherein the generated current residual values describe the difference between expected values predicted by the system model and the series of current monitoring node values;

determining, by the residual features extraction computer platform, current residual-driven feature vectors based on the current residual values;

receiving the current data-driven and residual-driven feature vectors at an abnormal detection platform;

comparing, by the abnormal detection platform, the current data-driven and residual-driven feature vectors with at least one decision boundary associated with an abnormal detection model; and

transmitting, by the abnormal detection platform, an abnormal alert signal based on a result of said comparison.

17. The medium of claim 16 , wherein the stochastic filter is associated with at least one of: (i) a Kalman filter, (ii) an extended Kalman filter, and (iii) an unscented Kalman filter.

18. The medium of claim 16 , wherein the system model is associated with at least one of: (i) a linear time invariant form, (ii) a linear time varying form, (iii) a linear parameter varying form, and (iv) a non-linear form.

19. The medium of claim 16 , wherein the current data-driven and residual-driven feature vectors undergo a feature augmentation process prior to being received by the abnormal detection platform.

20. The medium of claim 16 , wherein the at least one decision boundary and abnormal alert signal are associated with global feature vectors.

21. The medium of claim 16 , where sub-sets of the current data-driven feature vectors, current residual-driven feature vectors, and decision boundaries are associated with local feature vectors.