Scalable hierarchical abnormality localization in cyber-physical systems

1. A system to protect a cyber-physical system having a plurality of monitoring nodes each generating a series of current monitoring node values over time that represent current operation of the cyber-physical system, comprising:

a hierarchical abnormality localization computer platform having a memory and a computer processor adapted to:

access a multi-level hierarchy of elements, wherein at least some elements in a first level of the hierarchy are associated with a plurality of elements in at least one lower level of the hierarchy and at least some elements are associated with monitoring nodes,

determine, based on feature vectors and a decision boundary, the decision boundary indicating a distinction between normal operation and abnormal operation of at least a portion of the cyber-physical system within a multi-dimensional feature space, an abnormality status for a first element in the highest level of the hierarchy associated with a global feature vector,

if the abnormality status indicates an abnormality, determine an abnormality status for elements, associated with the first element, in at least one level of the hierarchy lower than the level of the first element, and

repeating said determinations until an abnormality is localized to at least one monitoring node.

2. The system of claim 1 , wherein the hierarchical abnormality localization computer platform is further adapted to:

create the multi-level hierarchy of elements.

3. The system of claim 2 , wherein said creating is performed by knowledge-based subsystem selection for the cyber-physical system.

4. The system of claim 2 , wherein said creating is performed by automatic data-driven subsystem selection for the cyber-physical system.

5. The system of claim 4 , wherein the automatic data-driven subsystem selection is associated with at least one of: (i) a data clustering method, (ii) a distance between node data and a cluster centroid, (iii) a Euclidian distance, (iv) a Mahalanobis distance, and (v) a correlation coefficient.

6. The system of claim 2 , wherein said creating is performed by a hybrid process including both knowledge-based and automatic data-driven subsystem selection for the cyber-physical system.

7. The system of claim 1 , wherein at least one decision boundary and abnormality status signal are associated with a local feature vector.

8. The system of claim 1 , further comprising:

a normal space data source storing, for each of the plurality of monitoring nodes, a series of normal monitoring node values over time that represent normal operation of the cyber-physical system;

an abnormal space data source storing, for each of the plurality of monitoring nodes, a series of abnormal monitoring node values over time that represent abnormal operation of the cyber-physical system; and

an abnormality detection model creation computer platform having a memory and a computer processor adapted to:

receive the series normal monitoring node values and generate a set of normal feature vectors,

receive the series of abnormal monitoring node values and generate a set of abnormal feature vectors, and

automatically calculate and output an abnormality detection model including information about the at least one decision boundary based on the set of normal feature vectors and the set of abnormal feature vectors.

9. The system of claim 8 , wherein the at least one decision boundary is associated with at least one of: (i) a linear boundary, (ii) a non-linear boundary, and (iii) a plurality of boundaries.

10. The system of claim 1 , wherein the cyber-physical system is associated with at least one of: (i) an industrial control system, (ii) a heat recovery and steam generation unit, (iii) a turbine, (iv) a gas turbine, (v) a wind turbine, (vi) an engine, (vii) a jet engine, (viii) a locomotive engine, (ix) a refinery, (x) a power grid, (xi) a dam, (xii) an autonomous vehicle, and (xiii) a drone.

11. The system of claim 1 , wherein at least one monitoring node is associated with at least one of: (i) a sensor node, (ii) a critical sensor node, (iii) an actuator node, (iv) a controller node, and (v) a key software node.

12. A method to protect a cyber-physical system having a plurality of monitoring nodes each generating a series of current monitoring node values over time that represent current operation of the cyber-physical system, the method comprising:

accessing, by a hierarchical abnormality localization computer platform, a multi-level hierarchy of elements, wherein at least some elements in a first level of the hierarchy are associated with a plurality of elements in at least one lower level of the hierarchy and at least some elements are associated with monitoring nodes;

determining, by the hierarchical abnormality localization computer platform based on feature vectors and a decision boundary, the decision boundary indicating a distinction between normal operation and abnormal operation of at least a portion of the cyber-physical system within a multi-dimensional feature space, an abnormality status for a first element in the highest level of the hierarchy associated with a global feature vector;

if the abnormality status indicates an abnormality, determining, by the hierarchical abnormality localization computer platform, an abnormality status for elements, associated with the first element, in at least one level of the hierarchy lower than the level of the first element; and

repeating said determinations, by the hierarchical abnormality localization computer platform, until an abnormality is localized to at least one monitoring node.

13. The method of claim 12 , further comprising:

creating, by the hierarchical abnormality localization computer platform, the multi-level hierarchy of elements.

14. The method of claim 13 , wherein said creating is performed by knowledge-based subsystem selection for the cyber-physical system.

15. The method of claim 13 , wherein said creating is performed by automatic data-driven subsystem selection for the cyber-physical system.

16. The method of claim 15 , wherein the automatic data-driven subsystem selection is associated with at least one of: (i) a data clustering method, (ii) a distance between node data and a cluster centroid, (iii) a Euclidian distance, (iv) a Mahalanobis distance, and (v) a correlation coefficient.

17. The method of claim 13 , wherein said creating is performed by a hybrid process including both knowledge-based and automatic data-driven subsystem selection for the cyber-physical system.

18. A non-transient, computer-readable medium storing instructions to be executed by a processor to perform a method to protect a cyber-physical system having a plurality of monitoring nodes each generating a series of current monitoring node values over time that represent current operation of the cyber-physical system, the method comprising:

accessing, by a hierarchical abnormality localization computer platform, a multi-level hierarchy of elements, wherein at least some elements in a first level of the hierarchy are associated with a plurality of elements in at least one lower level of the hierarchy and at least some elements are associated with monitoring nodes;

determining, by the hierarchical abnormality localization computer platform based on feature vectors and a decision boundary, the decision boundary indicating a distinction between normal operation and abnormal operation of at least a portion of the cyber-physical system within a multi-dimensional feature space, an abnormality status for a first element in the highest level of the hierarchy associated with a global feature vector,

if the abnormality status indicates an abnormality, determining, by the hierarchical abnormality localization computer platform, an abnormality status for elements, associated with the first element, in at least one level of the hierarchy lower than the level of the first element, and

repeating said determinations, by the hierarchical abnormality localization computer platform, until an abnormality is localized to at least one monitoring node.

19. The medium of claim 18 , wherein the method further comprises:

creating, by the hierarchical abnormality localization computer platform, the multi-level hierarchy of elements, wherein said creating is performed by at least one of: (i) knowledge-based sub system selection for the cyber-physical system, automatic data-driven sub system selection for the cyber-physical system, and (iii) a hybrid process including both knowledge-based and automatic data-driven sub system selection for the cyber-physical system.

20. A system to protect a cyber-physical system having a plurality of monitoring nodes each generating a series of current monitoring node values over time that represent current operation of the cyber-physical system, comprising:

a hierarchical abnormality localization computer platform having a memory and a computer processor adapted to:

access a multi-level hierarchy of elements, wherein at least some elements in a first level of the hierarchy are associated with a plurality of elements in at least one lower level of the hierarchy and at least some elements are associated with monitoring nodes,

determine, based on feature vectors and a decision boundary, the decision boundary indicating a distinction between normal operation and abnormal operation of at least a portion of the cyber-physical system within a multi-dimensional feature space, an abnormality status for a first element in the highest level of the hierarchy associated with a local feature vector,

if the abnormality status indicates an abnormality, determine an abnormality status for elements, associated with the first element, in at least one level of the hierarchy lower than the level of the first element, and

repeating said determinations until an abnormality is localized to at least one monitoring node.

21. The system of claim 20 , wherein the hierarchical abnormality localization computer platform is further adapted to:

create the multi-level hierarchy of elements.

22. The system of claim 21 , wherein said creating is performed by knowledge-based subsystem selection for the cyber-physical system.

23. The system of claim 21 , wherein said creating is performed by automatic data-driven subsystem selection for the cyber-physical system.

24. The system of claim 23 , wherein the automatic data-driven subsystem selection is associated with at least one of: (i) a data clustering method, (ii) a distance between node data and a cluster centroid, (iii) a Euclidian distance, (iv) a Mahalanobis distance, and (v) a correlation coefficient.