Abstract: Computer-implemented methods and systems for training an adversarial neural network to simulate a stealthy blind false data injection attack on a cyber physical system are provided. Supervised learning is used to generate an initial attack vector, by an adversarial attack generation model, based on inferred grid topology and historical measurements. A final attack vector is generated, by an adversarial verification model, based on a filtered subset of the initial attack vector utilizing a substitute bad data detection threshold, wherein the final attack vector enables creation of a counter measure.

Abstract: There is provided method for improving distributed training of an artificial intelligence (AI) model in an AI system comprising a plurality of edge servers and a plurality of edge devices. The method comprises synchronizing distributed data acquisition at a plurality of edge devices. The method comprises synchronizing the distributed training of the AI model at the plurality of edge servers, the AI model being trained using the synchronized data acquired from the plurality of edge devices. There is also provided a method executed in an edge device for synchronized data acquisition. There is also provided a method executed in an edge server for synchronized data acquisition. There is also provided a method executed in an edge server for synchronized distributed training of an artificial intelligence (AI) model.

Abstract: There is provided a method for detecting cyber-attacks at edge servers. The method comprises receiving network traffic. The method comprises extracting and normalizing network flow features from the network traffic to produce a data pattern for evaluation. The method comprises computing an anomaly detection score for the data pattern for evaluation. The method comprises comparing the anomaly detection score with a threshold and determining if the network traffic corresponds to normal traffic or to an anomaly. The method comprises, upon determining that the network traffic corresponds to an anomaly, mitigating malicious network traffic by triggering a mitigation strategy and sending an anomaly message to an anomaly classifier. A method for classifying cyber-attacks at a cloud server is also provided.

Abstract: A method for detecting anomalous behaviour in an edge communication network. The method is performed by a hierarchical system of detection nodes deployed in the edge communication network. A plurality of first detection nodes at a first hierarchical level of the system obtain samples of an incoming traffic flow from a wireless device, use an ML model to generate an anomaly detection score representative of a probability that the incoming traffic flow is associated with anomalous behaviour, provide the anomaly detection score to a detection node at a higher hierarchical level of the system, and, if the anomaly detection score is above a threshold value, initiate action to take defensive action with respect to the incoming traffic flow.