Abstract: A method for imputing data to a time series of events include collecting data relating to a plurality of events, storing the collected data in a database, defining a set of rules based on patterns observed, defining a new data relating to one of the plurality of events based on the set of rules. Defining additional rules and new data is iteratively performed based on new data and rules established in a prior iteration. The iterations may be stopped when no new rules or data is established in a previous iteration. The new data may be sequential temporal information of the event in the time series or may be a tag relating to the class of the event. The new data may be generated using rule mining. The new data is propagated to the rule mining and additional rules are defined based on the new data.

Abstract: A system and method adaptively control a heterogeneous system of systems. A graph convolutional network (GCN) that receive a time series of graphs representing topology of an observed environment at a time moment and state of a system. Embedded features are generated having local information for each graph node. Embedded features are divided into embedded states grouped according to a defined grouping, such as node type. Each of several reinforcement learning algorithms are assigned to a unique group and include an adaptive control policy in which a control action is learned for a given embedded state. Reward information is received from the environment with a local reward related to performance specific to the unique group and a global reward related to performance of the whole graph responsive to the control action. Parameters of the GCN and adaptive control policy are updated using state information, control action information, and reward information.

Abstract: A method performed in an industrial control system where User and Entity Behavior Analytics (UEBA) is applied to specific actions that are performed within the industrial control system to detect security and safety anomalies related to actions of process engineers and plant operators. Malicious and non-malicious, as well as intentional and accidental, misuses of engineering workstations and human machine interfaces (HMIs) are detected.