Abstract: According to some embodiments, a validation platform computer may interpret at least one received data packet to identify a control command for a controller of an industrial asset control system. The at least data packet being might be received, for example, from a network associated with a current operation of the industrial asset control system. The control command may then be introduced into an industrial asset simulation executing in parallel with the industrial asset control system. A simulated result of the control command from the industrial asset simulation may be validated, and, upon validation of the simulated result, it may be arranged for the control command to be provided to the controller of the industrial asset control system. Additionally, in some embodiments failed validation of a simulated result will prompt a threat-alert signal as well as prevent the command (e.g., data packet) from continuing to the controller.

Abstract: A normal space data source stores, for each of a plurality of threat nodes, a series of normal values that represent normal operation of an industrial asset control system, and a threatened space data source stores a series of threatened values. A model creation computer may generate sets of normal and threatened feature vectors. The computer may also calculate and output at least one decision boundary for a threat detection model based on the normal and threatened feature vectors. The plurality of threat nodes may then generate a series of current values from threat nodes that represent a current operation of the asset control system. A threat detection computer may receive the series of current values from threat nodes, generate a set of current feature vectors, execute the threat detection model, and transmit a threat alert signal based on the current feature vectors and at the least one decision boundary.

Abstract: According to some embodiments, streams of monitoring node signal values may be received over time that represent a current operation of an industrial asset control system. A current operating mode of the industrial asset control system may be received and used to determine a current operating mode group from a set of potential operating mode groups. For each stream of monitoring node signal values, a current monitoring node feature vector may be determined. Based on the current operating mode group, an appropriate decision boundary may be selected for each monitoring node, the appropriate decision boundary separating a normal state from an abnormal state for that monitoring node in the current operating mode. Each generated current monitoring node feature vector may be compared with the selected corresponding appropriate decision boundary, and a threat alert signal may be automatically transmitted based on results of said comparisons.

Abstract: According to some embodiments, a threat detection model creation computer may receive a series of normal monitoring node values (representing normal operation of the industrial asset control system) and generate a set of normal feature vectors. The threat detection model creation computer may also receive a series of threatened monitoring node values (representing a threatened operation of the industrial asset control system) and generate a set of threatened feature vectors. At least one potential decision boundary for a threat detection model may be calculated based on the set of normal feature vectors, the set of threatened feature vectors, and an initial algorithm parameter. A performance of the at least one potential decision boundary may be evaluated based on a performance metric. The initial algorithm parameter may then be tuned based on a result of the evaluation, and the at least one potential decision boundary may be re-calculated.

Abstract: An augmented system model may include a system high fidelity model that generates a first output. The augmented system model may further include a data driven model to receive data associated with the first output and to generate a second output, and a feature space version of the second output may be output from the augmented system model. Monitoring nodes may each generate a series of current monitoring node values over time representing current operation of an industrial asset. A model adaptation element may receive the current monitoring node values, calculate a feature space version of current operation, and compare the feature space version of the second output of the augmented system model with the feature space version of current operation. Parameters of the data driven model may then be adapted based on a result of the comparison.

Abstract: A threat detection model creation computer receives normal monitoring node values and abnormal monitoring node values. At least some received monitoring node values may be processed with a deep learning model to determine parameters of the deep learning model (e.g., a weight matrix and affine terms). The parameters of the deep learning model and received monitoring node values may then be used to compute feature vectors. The feature vectors may be spatial along a plurality of monitoring nodes. At least one decision boundary for a threat detection model may be automatically calculated based on the computed feature vectors, and the system may output the decision boundary separating a normal state from an abnormal state for that monitoring node. The decision boundary may also be obtained by combining feature vectors from multiple nodes. The decision boundary may then be used to detect normal and abnormal operation of an industrial asset.

Abstract: According to some embodiments, a threat detection computer platform may receive a plurality of real-time monitoring node signal values over time that represent a current operation of the industrial asset. For each stream of monitoring node signal values, the platform may generate a current monitoring node feature vector. The feature vector may also be estimated using a dynamic model output with that monitoring node signal values. The platform may then compare the feature vector with a corresponding decision boundary for that monitoring node, the decision boundary separating a normal state from an abnormal state for that monitoring node. The platform may detect that a particular monitoring node has passed the corresponding decision boundary and classify that particular monitoring node as being under attack. The platform may then automatically determine if the attack on that particular monitoring node is an independent attack or a dependent attack.

Abstract: What is disclosed is a system and method for selecting a region of interest for extracting physiological parameters from a video of a subject. In one embodiment the present method involves performing the following. First, time-series signals are received which have been generated by having processing image frames of a video of a subject captured using a single band video camera with a bandpass filter with a pass band in a wavelength range of 495-565 nm and/or 800-1000 nm. The regions of interest are areas where a plethysmographic signal can be detected by the camera. Each time-series signal is associated with a different region of interest. A signal strength is then calculated for each of the time-series signals. The region associated with the time-series signal having a highest signal strength is selected. The time-series signal associated with the selected region can be processed to extract a videoplethysmographic (VPG) signal containing physiological parameters.

Abstract: Operation of an industrial asset control system may be simulated or monitored under various operating conditions to generate a set of operating results. Subsets of the operating results may be used to calculate a normalization function for each of a plurality of operating conditions. Streams of monitoring node signal values over time may be received that represent a current operation of the industrial asset control system. A threat detection platform may then dynamically calculate normalized monitoring node signal values based at least in part on a normalization function in the operating mode database. For each stream of normalized monitoring node signal values, a current monitoring node feature vector may be generated and compared with a corresponding decision boundary for that monitoring node, the decision boundary separating normal and abnormal states for that monitoring node. A threat alert signal may then be automatically transmitted based on results of said comparisons.

Abstract: In some embodiments, a plurality of real-time monitoring node signal inputs receive streams of monitoring node signal values over time that represent a current operation of the industrial asset control system. A threat detection computer platform, coupled to the plurality of real-time monitoring node signal inputs, may receive the streams of monitoring node signal values and, for each stream of monitoring node signal values, generate a current monitoring node feature vector. The threat detection computer platform may then compare each generated current monitoring node feature vector with a corresponding decision boundary for that monitoring node, the decision boundary separating a normal state from an abnormal state for that monitoring node, and localize an origin of a threat to a particular monitoring node. The threat detection computer platform may then automatically transmit a threat alert signal based on results of said comparisons along with an indication of the particular monitoring node.

Abstract: A normal space data source stores, for each of a plurality of threat nodes, a series of normal values that represent normal operation of an industrial asset control system, and a threatened space data source stores a series of threatened values. A model creation computer may generate sets of normal and threatened feature vectors. The computer may also calculate and output at least one decision boundary for a threat detection model based on the normal and threatened feature vectors. The plurality of threat nodes may then generate a series of current values from threat nodes that represent a current operation of the asset control system. A threat detection computer may receive the series of current values from threat nodes, generate a set of current feature vectors, execute the threat detection model, and transmit a threat alert signal based on the current feature vectors and at the least one decision boundary.

Abstract: What is disclosed is a system and method for estimating a vector of skin parameters from in-vivo color measurements obtained from a video. In one embodiment, a video of exposed skin is received which comprises a plurality of time-sequential image frames acquired over time t. A vector of in-vivo color measurements is obtained on a per-frame basis from at least one imaging channel of a video imaging device used to capture the video. In a manner more fully disclosed herein, an intermediate vector of estimated skin parameters is determined based on an initial vector of estimated skin parameters and the in-vivo color measurements of all image frames averaged over time t. A final vector of estimated skin parameters is then determined for each image frame of the video based on the intermediate vector. The temporally successive final vectors are used to predict changes in time-varying skin parameters for the subject.

Abstract: A video is received of a region of a subject where a signal corresponding to respiratory function can be registered by a video device. Pixels in the region in each of the image frames are processed to identify a respiratory pattern with peak/valley pairs. A peak/valley pair of interest is selected. An array of optical flow vectors is determined between a window of groups of pixel locations in a reference image frame corresponding to a peak of the pair/valley pair and a window in each of a number of image frames corresponding to the respiratory signal between the peak and ending at a valley point. Optical flow vectors have a direction and a magnitude. A ratio is determined between upwardly pointing optical flow vectors and downwardly pointing optical flow vectors. Based on the ratio, a determination is made whether the respiration phase for that peak/valley pair is inspiration or expiration.

Abstract: What is disclosed is a system and method for determining a subject's respiratory pattern from a video of that subject. One embodiment involves receiving a video comprising N?2 time-sequential image frames of a region of interest (ROI) of a subject where a signal corresponding to the subject's respiratory function can be registered by at least one imaging channel of a video imaging device. The ROI comprises P pixels. Time-series signals of duration N are generated from pixels isolated in the ROI. Features are extracted from the time-series signals and formed into P-number of M-dimensional vectors. The feature vectors are clustered into K clusters. The time-series signals corresponding to pixels represented by the feature vectors in each cluster are averaged along a temporal direction to obtain a representative signal for each cluster. One of the clusters is selected. A respiratory pattern is determined for the subject based on the representative signal.

Abstract: What is disclosed is a system and method for determining respiration rate from a video of a subject. In one embodiment, a video is received comprising plurality of time-sequential image frames of a region of a subject's body. Features of pixels are extracted from that region from each image frame and vectors formed from these features. Each image frame has an associated feature vector. A N×M video matrix of the vectors of length N is constructed such that a total number of columns M in the video matrix correspond to a time duration over which the subject's respiration rate is to be determined. The video matrix is processed to obtain a matrix of eigenvectors where principal axes of variations due to motion associated with respiration are contained in a first few eigenvectors. One eigenvector is selected from the first few eigenvectors. A respiration rate is obtained from the selected eigenvector.

Abstract: A video is received of a region of a subject where a signal corresponding to respiratory function can be registered by a video device. Pixels in the region in each of the image frames are processed to identify a respiratory pattern with peak/valley pairs. A peak/valley pair of interest is selected. An array of optical flow vectors is determined between a window of groups of pixel locations in a reference image frame corresponding to a peak of the pair/valley pair and a window in each of a number of image frames corresponding to the respiratory signal between the peak and ending at a valley point. Optical flow vectors have a direction and a magnitude. A ratio is determined between upwardly pointing optical flow vectors and downwardly pointing optical flow vectors. Based on the ratio, a determination is made whether the respiration phase for that peak/valley pair is inspiration or expiration.

Abstract: What is disclosed is a system and method for extracting photoplethysmographic (PPG) signal (i.e., a cardiac signal) on a continuous basis from a time-series signals obtained from video images captured of a subject being monitored for cardiac function in a non-contact remote sensing environment involves the following. First, a time-series signal obtained from video images captured of a region of exposed skin where a photoplethysmographic (PPG) signal of a subject of interest can be registered. A sliding window is then used to define consecutive sequential segments of the time-series signal for processing. Each of the consecutive time-series signal segments is detrended such that low frequency variations and non-stationary components are removed. The detrended signals are processed to obtain, for each segment, a PPG signal. The PPG signal segments are then stitched together using a stitching method, as disclosed herein, to obtain a continuous PPG signal for the subject.

Abstract: What is disclosed is a system and method for the detection of cancerous tissue by analyzing blocks of pixels in a thermal image of a region of exposed skin tissue. In one embodiment, matrices are received which have been derived from vectors of temperature values associated with pixels in blocks of pixels which have been isolated from a plurality of thermal images of both cancerous and non-cancerous tissue. The vectors are rearranged to form matrices. A thermal image of a subject is received. Blocks of pixels which reside within a region of exposed skin tissue are identified and isolated. For each identified pixel block, an image vector comprising temperature values associated with these pixels is formed. The vector is provided to a classifier which uses the matrices to classify tissue associated with this block of pixels as being either cancerous or non-cancerous tissue.

Abstract: What is disclosed is a system and method for representing a subject's state of mind given a plurality of physiological inputs. In one embodiment, a vector of physiological features is received. The vector of physiological features is provided to a psychophysiological model which comprises a plurality of models which fit the physiological features to psychological quantities, each representing a different state of mind. In a manner more fully disclosed herein, the psychological quantities are then aggregated to obtain an aggregate output that is representative of the subject's overall state of mind. Once the subject's state of mind has been represented, remedial action can then be taken.

Abstract: What is disclosed is a system and method for generating a respiration gating signal from a video of a subject for gating diagnostic imaging and therapeutic delivery applications which require respiration phase and/or respiration amplitude gating. One embodiment involves receiving a video of a subject and generating a plurality of time-series signals from the video image frames. A set of features are extracted from the time-series signals and multi-dimensional feature vectors are formed. The feature vectors are clustered. Time-series signals corresponding in each of the clusters are averaged in a temporal direction to obtain a representative signal for each cluster. One cluster is selected and a respiration gating signal is generated from that cluster's representative signal. Thereafter, the respiration gating signal is used to gate diagnostic imaging and therapeutic delivery applications which requires gating based on a threshold set with respect to either respiration phase or respiration amplitude.