Abstract: According to some embodiments, a plurality of heterogeneous data source nodes may each generate a series of data source node values over time associated with operation of an electric power grid control system. An offline abnormal state detection model creation computer may receive the series of data source node values and perform a feature extraction process to generate an initial set of feature vectors. The model creation computer may then perform feature selection with a multi-model, multi-disciplinary framework to generate a selected feature vector subset. According to some embodiments, feature dimensionality reduction may also be performed to generate the selected feature subset. At least one decision boundary may be automatically calculated and output for an abnormal state detection model based on the selected feature vector subset.

Abstract: According to some embodiments, a plurality of heterogeneous data source nodes may each generate a series of current data source node values over time that represent a current operation of an electric power grid. A real-time threat detection computer, coupled to the plurality of heterogeneous data source nodes, may receive the series of current data source node values and generate a set of current feature vectors. The threat detection computer may then access an abnormal state detection model having at least one decision boundary created offline using at least one of normal and abnormal feature vectors. The abnormal state detection model may be executed, and a threat alert signal may be transmitted if appropriate based on the set of current feature vectors and the at least one decision boundary.

Abstract: A threat detection model creation computer receives normal monitoring node values and abnormal monitoring node values. At least some received monitoring node values may be processed with a deep learning model to determine parameters of the deep learning model (e.g., a weight matrix and affine terms). The parameters of the deep learning model and received monitoring node values may then be used to compute feature vectors. The feature vectors may be spatial along a plurality of monitoring nodes. At least one decision boundary for a threat detection model may be automatically calculated based on the computed feature vectors, and the system may output the decision boundary separating a normal state from an abnormal state for that monitoring node. The decision boundary may also be obtained by combining feature vectors from multiple nodes. The decision boundary may then be used to detect normal and abnormal operation of an industrial asset.

Abstract: According to some embodiments, a system and method are provided to model a sparse data asset. The system comprises a processor and a non-transitory computer-readable medium comprising instructions that when executed by the processor perform a method to model a sparse data asset. Relevant data and operational data associated with the newly operational are received. A transfer model based on the relevant data and the received operational data. An input into the transfer model is received and a predication based on data associated with the received operational data and the relevant data is output.

Abstract: Systems and methods for predictive modeling of an industrial asset. In some embodiments, a database stores an electronic file containing a machine learning library and predictive modeling tools associated with the industrial asset. A computer processor accesses the machine learning library and predictive modeling tools, provides a model building framework user interface and receives a selection of a feature engineering (FE) technique, including one of evolutionary feature selection, evolutionary feature synthesis, and symbolic regression. Next, an input selection interface is provided, industrial asset input data and parameter data received, and at least one of an evolutionary feature selection process, an evolutionary feature synthesis process, and a symbolic regression process is executed.

Abstract: A method of continuously modeling industrial asset performance includes an initial model build block creating a first model based on a combination of an industrial asset historical data, configuration data and training data, filtering at least one of the historical data, configuration data, and training data, and a continuous learning block predicting performance of one or more members of an ensemble of models by evaluating a result of the one or more ensemble members to a predetermined threshold. A model application block pushing a selected model ensemble member to a performance diagnostic center, selecting the member based on comparing model ensemble members to a fielded modeling algorithm. A system and computer-readable medium are disclosed.

Abstract: A method for determining fleet conditions and operational management thereof, performed by a central system includes receiving fleet data from at least one distributed data repository. The fleet data is substantially representative of information associated with a fleet of physical assets. The method also includes processing the received fleet data for the fleet using at least one process of a plurality of processes. The plurality of processes assess the received fleet data into processed fleet data. The method additionally includes determining a fleet condition status using the processed fleet data and the at least one process of the plurality of processes. The method further includes generating a fleet response. The fleet response is substantially representative of a next operational step for the fleet of physical assets. The method also includes transmitting the fleet response to at least one of a plurality of fleet response recipients.

Abstract: Some embodiments are associated with a receipt, at a feature learning platform, of sensor data associated with normal operation of an industrial asset, the sensor data including values for a plurality of sensors over a period of time. The feature learning platform may extract a plurality of features via hierarchically deep learning, which may capture characteristics of normal operation of the industrial asset and provide the learned features to a classification modeling platform. The classification modeling platform may then create classification models utilizing the learned features, and the classification models may be executed to automatically identify a potential anomaly for an operating industrial asset.

Abstract: A method for determining fleet conditions and operational management thereof, performed by a central system includes receiving fleet data from at least one distributed data repository. The fleet data is substantially representative of information associated with a fleet of physical assets. The method also includes processing the received fleet data for the fleet using at least one process of a plurality of processes. The plurality of processes assess the received fleet data into processed fleet data. The method additionally includes determining a fleet condition status using the processed fleet data and the at least one process of the plurality of processes. The method further includes generating a fleet response. The fleet response is substantially representative of a next operational step for the fleet of physical assets. The method also includes transmitting the fleet response to at least one of a plurality of fleet response recipients.

Abstract: A system includes a physical analysis module, a cyber analysis module, and a determination module. The physical analysis module is configured to obtain physical diagnostic information, and to determine physical analysis information using the physical diagnostic information. The cyber analysis module is configured to obtain cyber security data of the functional system, and to determine cyber analysis information using the cyber security data. The determination module is configured to obtain the physical analysis information and the cyber analysis information, and to determine a state of the functional system using the physical analysis information and the cyber analysis information. The state determined corresponds to at least one of physical condition or cyber security threat. The determination module is also configured to identify if the state corresponds to one or more of a non-malicious condition or a malicious condition.

Abstract: Some embodiments are associated with a support vector machine having model parameters. According to some embodiments, a set of evaluation data may be received and a computer processor may automatically tune the model parameters during a training process using the set of evaluation data. The automatically tuned model parameters for the support vector machine may then be output directly from the training process.

Abstract: An intrusion detection method, system and computer-readable media are disclosed. The system can include a processor programmed to perform computer network intrusion detection. The intrusion detection can include an identification module and a detection module. The identification module can be adapted to perform semi-supervised machine learning to identify key components of a network attack and develop MDL models representing those attack components. The detection module can cluster the MDL models and use the clustered MDL models to classify network activity and detect polymorphic or zero-day attacks.

Abstract: A system includes identification of a first dataset comprising n data samples, identification of b data samples of the n data samples of the first dataset, wherein b is less than n, creation of a first plurality of datasets, each of the first plurality of datasets comprising m data samples, where m is greater than b, and wherein each of the m data samples of each of the first plurality of datasets is selected from the b data samples, identification of c data samples of the n data samples of the first dataset, wherein c is less than n, and wherein the c data samples are not identical to the b data samples, creation of a second plurality of datasets, each of the second plurality of datasets comprising p data samples, where p is greater than c, and wherein each of the p data samples of each of the second plurality of datasets is selected from the c data samples, identification, for each of the b data samples, of a cluster based on the first plurality of datasets, and identification, for each of the c data sample

Abstract: A system includes a physical analysis module, a cyber analysis module, and a determination module. The physical analysis module is configured to obtain physical diagnostic information, and to determine physical analysis information using the physical diagnostic information. The cyber analysis module is configured to obtain cyber security data of the functional system, and to determine cyber analysis information using the cyber security data. The determination module is configured to obtain the physical analysis information and the cyber analysis information, and to determine a state of the functional system using the physical analysis information and the cyber analysis information. The state determined corresponds to at least one of physical condition or cyber security threat. The determination module is also configured to identify if the state corresponds to one or more of a non-malicious condition or a malicious condition.

Abstract: Starter control valve failure prediction machines, systems, computer readable media, program products, and computer implemented methods to predict and trend starter control valve failures in gas turbine engines using a starter control valve health prognostic and to make predictions of starter control valve failures, are provided.

Abstract: A system for distributed computing includes a job scheduler module configured to identify a job request including request requirements and comprising one or more individual jobs. The system also includes a resource module configured to determine an execution set of computing resources from a pool of computing resources based on the request requirements. Each computing resource of the pool of computing resources has an application programming interface. The pool of computing resources comprises public cloud computing resources and internal computing resources. The system further includes a plurality of interface modules, where each interface module is configured to facilitate communication with the computing resources using the associated application programming interface.

Abstract: A computer-implemented system for identifying a precursor to a failure of a particular type of component in a physical system is provided. The physical system includes sensors coupled to the physical system. The computer-implemented system includes a computing device, a database, a processor, and a memory device. The memory device includes historical data including sensor measurements. When instructions are executed by the processor, the processor receives the historical data from the memory device. The processor generates a predictive model. The predictive model uses, as inputs, sensor measurements in the historical data. The predictive model is able to differentiate between sensor measurements taken before the repair event and those taken after the repair event without a time of the repair event being an input to the predictive model. The processor designates at least one sensor measurements used as inputs to the predictive model as precursors to the failure of the component.

Abstract: A method for determining fleet conditions and operational management thereof, performed by a central system includes receiving fleet data from at least one distributed data repository. The fleet data is substantially representative of information associated with a fleet of physical assets. The method also includes processing the received fleet data for the fleet using at least one process of a plurality of processes. The plurality of processes assess the received fleet data into processed fleet data. The method additionally includes determining a fleet condition status using the processed fleet data and the at least one process of the plurality of processes. The method further includes generating a fleet response. The fleet response is substantially representative of a next operational step for the fleet of physical assets. The method also includes transmitting the fleet response to at least one of a plurality of fleet response recipients.

Abstract: A system includes a library of algorithms, and a request module configured to receive an execution request. The system also includes a job scheduler/optimizer module configured to select algorithms from the library and to create at least one execution job based on the algorithms and the execution request. The system further includes a resource module configured to determine execution computing resources from multiple computing sources, including internal computing resources and external computing resources. The system also includes an executor module configured to transmit an execution job to the computing resources.

Abstract: A computer-implemented system for creating customized model ensembles on demand is provided. An input module is configured to receive a query. A selection module is configured to create a model ensemble by selecting a subset of models from a plurality of models, wherein selecting includes evaluating an aspect of applicability of the models with respect to answering the query. An application module is configured to apply the model ensemble to the query, thereby generating a set of individual results. A combination module is configured to combine the set of individual results into a combined result and output the combined result, wherein combining the set of individual results includes evaluating performance characteristics of the model ensemble relative to the query.