Abstract: Detecting a counterfeit status of a target device by: selecting a set of frequencies that best reflect load dynamics or other information content of a reference device while undergoing a power test sequence; obtaining target electromagnetic interference (EMI) signals emitted by the target device while undergoing the same power test sequence; creating a sequence of target kiviat plots from the amplitude of the target EMI signals at each of the set of frequencies at observations over the power test sequence to form a target kiviat tube EMI fingerprint; comparing the target kiviat tube EMI fingerprint to a reference kiviat tube EMI fingerprint for the reference device undergoing the power test sequence to determine whether the target device and the reference device are of the same type; and generating a signal to indicate a counterfeit status based at least in part on the results of the comparison.

Abstract: Detecting whether a target device that includes multiple electronic components is genuine or suspected counterfeit by: performing a test sequence of energizing and de-energizing the target device and collecting electromagnetic interference (EMI) signals emitted by the target device; generating a target EMI fingerprint from the EMI signals collected; retrieving a plurality of reference EMI fingerprints from a database library, each of which corresponds to a different configuration of electronic components of a genuine device of the same make and model as the target device; iteratively comparing the target EMI fingerprint to the retrieved reference EMI fingerprints and generating a similarity metric between each compared set; and indicating that the target device (i) is genuine where the similarity metric for any individual reference EMI fingerprint satisfies a threshold test, and is a suspect counterfeit device where no similarity metric for any individual reference EMI fingerprint satisfies the test.

Abstract: The disclosed embodiments provide a system that detects sensor anomalies in a univariate time-series signal. During a surveillance mode, the system receives the univariate time-series signal from a sensor in a monitored system. Next, the system performs a staggered-sampling operation on the univariate time-series signal to produce N sub-sampled time-series signals, wherein the staggered-sampling operation allocates consecutive samples from the univariate time-series signal to the N sub-sampled time-series signals in a round-robin ordering. The system then uses a trained inferential model to generate estimated values for the N sub-sampled time-series signals based on cross-correlations with other sub-sampled time-series signals. Next, the system performs an anomaly detection operation to detect incipient sensor anomalies in the univariate time-series signal based on differences between actual values and the estimated values for the N sub-sampled time-series signals.

Abstract: Systems, methods, and other embodiments associated with autonomous cloud-node scoping for big-data machine learning use cases are described. In some example embodiments, an automated scoping tool, method, and system are presented that, for each of multiple combinations of parameter values, (i) set a combination of parameter values describing a usage scenario, (ii) execute a machine learning application according to the combination of parameter values on a target cloud environment, and (iii) measure the computational cost for the execution of the machine learning application. A recommendation regarding configuration of central processing unit(s), graphics processing unit(s), and memory for the target cloud environment to execute the machine learning application is generated based on the measured computational costs.

Abstract: Systems, methods, and other embodiments associated with off-duty-cycle-robust machine learning for anomaly detection in assets with random downtimes are described. In one embodiment, a method includes inferring ranges of asset downtime from spikes in a numerical derivative of a time series signal for an asset; extracting an asset downtime signal from the time series signal based on the inferred ranges of asset downtime; determining that the asset downtime signal carries telemetry based on the variance of the asset downtime signal; training a first machine learning model for the asset downtime signal; detecting a first spike in the numerical derivative of the time signal that indicates a transition to asset downtime; and in response to detection of the first spike, monitoring the time series signal for anomalous activity with the trained first machine learning model.

Abstract: The disclosed embodiments relate to a system that camouflages EMI fingerprints in EMI emissions from a computing system to enhance system security. During operation, the system monitors the EMI emissions from the computer system during operation of the computer system to produce corresponding EMI signals. Next, the system determines a dynamic amplitude of the EMI emissions based on the EMI signals. If the dynamic amplitude of the EMI emissions drops below a threshold value, the system executes synthetic transactions, which have interarrival times that, when superimposed on a workload of the computer system, cause the computer system to produce randomized EMI emissions.

Abstract: The system receives exemplary time-series sensor signals comprising ground truth versions of signals generated by a monitored system associated with a target use case and a synchronization objective, which specifies a desired tradeoff between synchronization compute cost and synchronization accuracy for the target use case. The system performance-tests multiple synchronization techniques by introducing randomized lag times into the exemplary time-series sensor signals to produce time-shifted time-series sensor signals, and then uses each of the multiple synchronization techniques to synchronize the time-shifted time-series sensor signals across a range of different numbers of time-series sensor signals, and a range of different numbers of observations for each time-series sensor signal. The system uses the synchronization objective to evaluate results of the performance-testing in terms of compute cost and synchronization accuracy.

Abstract: Systems, methods, and other embodiments associated with automated calibration in electromagnetic scanners are described. In one embodiment, a method includes: detecting one or more peak frequency bands in electromagnetic signals collected by the electromagnetic scanner at a geographic location; comparing the one or more peak frequency bands to broadcast frequencies assigned to local radio stations of the geographic location; and indicating that the electromagnetic scanner is calibrated by finding at least one match between one peak frequency band of the peak frequency bands and one of the broadcast frequencies. An electromagnetic scanner may be recalibrated based on comparing the one or more peak frequency bands to broadcast frequencies.

Abstract: Systems, methods, and other embodiments associated with autonomous cloud-node scoping for big-data machine learning use cases are described. In some example embodiments, an automated scoping tool, method, and system are presented that, for each of multiple combinations of parameter values, (i) set a combination of parameter values describing a usage scenario, (ii) execute a machine learning application according to the combination of parameter values on a target cloud environment, and (iii) measure the computational cost for the execution of the machine learning application. A recommendation regarding configuration of central processing unit(s), graphics processing unit(s), and memory for the target cloud environment to execute the machine learning application is generated based on the measured computational costs.

Abstract: During operation, the system uses N sensors to sample an electromagnetic interference (EMI) signal emitted by a target asset while the target asset is running a periodic workload, wherein each of the N sensors has a sensor sampling frequency f, and wherein the N sensors perform sampling operations in a round-robin ordering with phase offsets between successive samples. During the sampling operations, the system performs phase adjustments among the N sensors to maximize phase offsets between successive sensors in the round-robin ordering. Next, the system combines samples obtained through the N sensors to produce a target EMI signal having an EMI signal sampling frequency F=f×N. The system then generates a target EMI fingerprint from the target EMI signal. Finally, the system compares the target EMI fingerprint against a reference EMI fingerprint for the target asset to determine whether the target asset contains any unwanted electronic components.

Abstract: The disclosed embodiments relate to a system that characterizes susceptibility of an inferential model to follow signal degradation. During operation, the system receives a set of time-series signals associated with sensors in a monitored system during normal fault-free operation. Next, the system trains the inferential model using the set of time-series signals. The system then characterizes susceptibility of the inferential model to follow signal degradation. During this process, the system adds degradation to a signal in the set of time-series signals to produce a degraded signal. Next, the system uses the inferential model to perform prognostic-surveillance operations on the set of time-series signals with the degraded signal. Finally, the system characterizes susceptibility of the inferential model to follow degradation in the signal based on results of the prognostic-surveillance operations.

Abstract: The disclosed embodiments relate to a system that trains an inferential model based on selected training vectors. During operation, the system receives training data comprising observations for a set of time-series signals gathered from sensors in a monitored system during normal fault-free operation. Next, the system divides the observations into N subgroups comprising non-overlapping time windows of observations. The system then selects observations with a local minimum value and a local maximum value for all signals from each subgroup to be training vectors for the inferential model. Finally, the system trains the inferential model using the selected training vectors. Note that by selecting observations with local minimum and maximum values to be training vectors, the system maximizes an operational range for the training vectors, which reduces clipping in estimates subsequently produced by the inferential model and thereby reduces false alarms.

Abstract: A double-blind comparison is performed between prognostic-surveillance systems, which are located on a local system and a remote system. During operation, the local system inserts random faults into a dataset to produce a locally seeded dataset, wherein the random faults are inserted into random signals at random times with variable fault signatures. Next, the local system exchanges the locally seeded dataset with a remote system, and in return receives a remotely seeded dataset, which was produced by the remote system by inserting different random faults into the same dataset. Next, the local system uses a local prognostic-surveillance system to analyze the remotely seeded dataset to produce locally detected faults. Finally, the local system determines a performance of the local prognostic-surveillance system by comparing the locally detected faults against actual faults in the remotely seeded fault information. The remote system similarly determines a performance of a remote prognostic-surveillance system.

Abstract: The disclosed embodiments relate to a system that automatically selects a prognostic-surveillance technique to analyze a set of time-series signals. During operation, the system receives the set of time-series signals obtained from sensors in a monitored system. Next, the system determines whether the set of time-series signals is univariate or multivariate. When the set of time-series signals is multivariate, the system determines if there exist cross-correlations among signals in the set of time-series signals. If so, the system performs subsequent prognostic-surveillance operations by analyzing the cross-correlations. Otherwise, if the set of time-series signals is univariate, the system performs subsequent prognostic-surveillance operations by analyzing serial correlations for the univariate time-series signal.

Abstract: The system receives original time-series signals from sensors in a monitored system. Next, the system detects and removes spikes from the original time-series signals to produce despiked original time-series signals, which involves using the original time-series data to optimize a damping factor, which is applied to a threshold for a spike-detection technique, and using the spike-detection technique with the optimized damping factor to detect the spikes. The system then generates despiked synthetic time-series signals, which are statistically indistinguishable from the despiked original time-series signals. The system also includes synthetic spikes, which have the same temporal, amplitude and width distributions as the spikes in the original time-series signals, in the despiked synthetic time-series signals to produce synthetic time-series signals with spikes.

Abstract: Systems, methods, and other embodiments associated with automated calibration of electromagnetic interference (EMI) fingerprint scanning instrumentation based on radio frequencies are described. In one embodiment, a method for detecting a calibration state of an EMI fingerprint scanning device includes: collecting electromagnetic signals with the EMI fingerprint scanning device for a test period of time at a geographic location; identifying one or more peak frequency bands in the collected electromagnetic signals; comparing the one or more peak frequency bands to assigned radio station frequencies at the geographic location to determine if a match is found; and generating a calibration state signal based at least in part on the comparing to indicate whether the EMI fingerprint scanning device is calibrated or not calibrated.

Abstract: Detecting a counterfeit status of a target utility device by: selecting a set of frequencies that best reflect load dynamics or other information content of a reference utility device while undergoing a power test sequence; obtaining target electromagnetic interference (EMI) signals emitted by the target utility device while undergoing the same power test sequence; creating a sequence of target kiviat plots from the amplitude of the target EMI signals at each of the set of frequencies at observations over the power test sequence to form a target kiviat tube EMI fingerprint; comparing the target kiviat tube EMI fingerprint to a reference kiviat tube EMI fingerprint for the reference utility device undergoing the power test sequence to determine whether the target utility device and the reference utility device are of the same type; and generating a signal to indicate a counterfeit status based at least in part on the results of the comparison.

Abstract: The disclosed embodiments provide a system that detects unwanted electronic components in a target asset. During operation, the system obtains target electromagnetic interference (EMI) signals by monitoring EMI signals generated by the target asset while the target asset is running a periodic workload. Next, the system generates a target EMI fingerprint from the target EMI signals. The system then applies a compression/dilation technique to time-series signals in the target EMI fingerprint to achieve alignment with corresponding time-series signals in a reference EMI fingerprint to produce a synchronized target EMI fingerprint. Finally, the system compares the synchronized target EMI fingerprint against the reference EMI fingerprint to determine whether the target asset contains any unwanted electronic components.

Abstract: The disclosed embodiments provide a system that detects unwanted electronic components in a target asset. During operation, the system obtains target electromagnetic interference (EMI) signals by monitoring EMI signals generated by the target asset while the target asset is running a periodic workload. Next, the system generates a target EMI fingerprint from the target EMI signals. The system then applies a compression/dilation technique to time-series signals in the target EMI fingerprint to achieve alignment with corresponding time-series signals in a reference EMI fingerprint to produce a synchronized target EMI fingerprint. Finally, the system compares the synchronized target EMI fingerprint against the reference EMI fingerprint to determine whether the target asset contains any unwanted electronic components.

Abstract: A system is provided that detects a card skimmer in a target system, wherein the card skimmer surreptitiously gathers credit/debit card information during operation of the target system. This system first gathers target electromagnetic interference (EMI) signals by monitoring EMI signals generated by the target system through an external scanner with a directional antenna. Next, the system generates a target EMI fingerprint from the target EMI signals. The system then compares the target EMI fingerprint against a reference EMI fingerprint for the target system to determine whether the target system contains a card skimmer.