Abstract: A system for detecting malicious operation of a building system includes a power characteristic input connected to a plurality of power characteristic sensors, a processor and a memory. The memory stores instructions for operating at least a physics model detection, a machine learning model detection and a combination module. The physics model detection includes multiple predefined expected power characteristics and is configured to detect an anomaly when at least one power characteristic received at the power characteristic input deviates from a corresponding predefined expected power characteristic of the predefined expected power characteristics. The machine learning model includes a machine learning system configured to learn a set of expected normal power characteristics and detect the anomaly when at least one power characteristic received at the power characteristic input deviates from the learned set of expected normal power characteristics.

Abstract: A system for detecting malicious operation of a building system includes a power characteristic input connected to a plurality of power characteristic sensors, a processor and a memory. The memory stores instructions for operating at least a physics model detection, a machine learning model detection and a combination module. The physics model detection includes multiple predefined expected power characteristics and is configured to detect an anomaly when at least one power characteristic received at the power characteristic input deviates from a corresponding predefined expected power characteristic of the predefined expected power characteristics. The machine learning model includes a machine learning system configured to learn a set of expected normal power characteristics and detect the anomaly when at least one power characteristic received at the power characteristic input deviates from the learned set of expected normal power characteristics.