Abstract: A method (700) for distributed machine learning, ML, using a set of N CDs. The method includes obtaining first topology information, wherein, for each CD included in the set of N CDs, the first topology information identifies other CDs included in the set of N CDs to which the CD is connected, thereby identifying a set of CD pairs. The method also includes obtaining first network state information, wherein, for each CD included in the set of N CDs, the first network state information comprises a network state vector for the CD, wherein the network state vector for the CD comprises, for each other CD to which the CD is indicated as being connected by the first topology information, a determined network state value. The method further includes determining a consensus weight matrix (W) using the obtained first network state information and the first topology information.

Abstract: Computer-implemented methods and systems for training an adversarial neural network to simulate a stealthy blind false data injection attack on a cyber physical system are provided. Supervised learning is used to generate an initial attack vector, by an adversarial attack generation model, based on inferred grid topology and historical measurements. A final attack vector is generated, by an adversarial verification model, based on a filtered subset of the initial attack vector utilizing a substitute bad data detection threshold, wherein the final attack vector enables creation of a counter measure.

Abstract: Methods, systems and computer program products for multi-node analysis, are provided. Such methods, systems and products may comprise, or may comprise instructions operable to configure one or more processors to perform, a set of acts. Such acts may comprise receiving a performance indicator equation comprising a corresponding set of measurement parameters. Such a set of acts may also comprise, for each node from a set of nodes, receiving a set of measurement values for that node from a database and determining that node's contribution to a cluster value for a performance indicator corresponding to the performance indicator equation. Such a set of acts may also comprise reporting performance indicator information for the set of nodes wherein the reported performance indicator information is based on relative contributions of each node from the set of nodes to the cluster value for the performance indicator corresponding to the performance indicator equation.

Abstract: There is provided method for improving distributed training of an artificial intelligence (AI) model in an AI system comprising a plurality of edge servers and a plurality of edge devices. The method comprises synchronizing distributed data acquisition at a plurality of edge devices. The method comprises synchronizing the distributed training of the AI model at the plurality of edge servers, the AI model being trained using the synchronized data acquired from the plurality of edge devices. There is also provided a method executed in an edge device for synchronized data acquisition. There is also provided a method executed in an edge server for synchronized data acquisition. There is also provided a method executed in an edge server for synchronized distributed training of an artificial intelligence (AI) model.

Abstract: There is provided a method for detecting cyber-attacks at edge servers. The method comprises receiving network traffic. The method comprises extracting and normalizing network flow features from the network traffic to produce a data pattern for evaluation. The method comprises computing an anomaly detection score for the data pattern for evaluation. The method comprises comparing the anomaly detection score with a threshold and determining if the network traffic corresponds to normal traffic or to an anomaly. The method comprises, upon determining that the network traffic corresponds to an anomaly, mitigating malicious network traffic by triggering a mitigation strategy and sending an anomaly message to an anomaly classifier. A method for classifying cyber-attacks at a cloud server is also provided.

Abstract: A method for detecting anomalous behaviour in an edge communication network. The method is performed by a hierarchical system of detection nodes deployed in the edge communication network. A plurality of first detection nodes at a first hierarchical level of the system obtain samples of an incoming traffic flow from a wireless device, use an ML model to generate an anomaly detection score representative of a probability that the incoming traffic flow is associated with anomalous behaviour, provide the anomaly detection score to a detection node at a higher hierarchical level of the system, and, if the anomaly detection score is above a threshold value, initiate action to take defensive action with respect to the incoming traffic flow.