Abstract: The disclosed embodiments relate to a system that trains an inferential model based on selected training vectors. During operation, the system receives training data comprising observations for a set of time-series signals gathered from sensors in a monitored system during normal fault-free operation. Next, the system divides the observations into N subgroups comprising non-overlapping time windows of observations. The system then selects observations with a local minimum value and a local maximum value for all signals from each subgroup to be training vectors for the inferential model. Finally, the system trains the inferential model using the selected training vectors. Note that by selecting observations with local minimum and maximum values to be training vectors, the system maximizes an operational range for the training vectors, which reduces clipping in estimates subsequently produced by the inferential model and thereby reduces false alarms.

Abstract: The disclosed embodiments relate to a system that automatically selects a prognostic-surveillance technique to analyze a set of time-series signals. During operation, the system receives the set of time-series signals obtained from sensors in a monitored system. Next, the system determines whether the set of time-series signals is univariate or multivariate. When the set of time-series signals is multivariate, the system determines if there exist cross-correlations among signals in the set of time-series signals. If so, the system performs subsequent prognostic-surveillance operations by analyzing the cross-correlations. Otherwise, if the set of time-series signals is univariate, the system performs subsequent prognostic-surveillance operations by analyzing serial correlations for the univariate time-series signal.

Abstract: The system receives original time-series signals from sensors in a monitored system. Next, the system detects and removes spikes from the original time-series signals to produce despiked original time-series signals, which involves using the original time-series data to optimize a damping factor, which is applied to a threshold for a spike-detection technique, and using the spike-detection technique with the optimized damping factor to detect the spikes. The system then generates despiked synthetic time-series signals, which are statistically indistinguishable from the despiked original time-series signals. The system also includes synthetic spikes, which have the same temporal, amplitude and width distributions as the spikes in the original time-series signals, in the despiked synthetic time-series signals to produce synthetic time-series signals with spikes.

Abstract: The disclosed embodiments provide a system that estimates a remaining useful life (RUL) for a fan. During operation, the system receives telemetry data associated with the fan during operation of the critical asset, wherein the telemetry data includes a fan-speed signal. Next, the system uses the telemetry data to construct a historical fan-speed profile, which indicates a cumulative time that the fan has operated in specific ranges of fan speeds. The system then computes an RUL for the fan based on the historical fan-speed profile and empirical time-to-failure (TTF) data, which indicates a TTF for the same type of fan as a function of fan speed. Finally, when the RUL falls below a threshold, the system generates a notification indicating that the fan needs to be replaced.

Abstract: The system receives a set of present time-series signals gathered from sensors in the asset. Next, the system uses an inferential model to generate estimated values for the set of present time-series signals, and performs a pairwise differencing operation between actual values and the estimated values for the set of present time-series signals to produce residuals. The system then performs a sequential probability ratio test (SPRT) on the residuals to produce SPRT alarms with associated tripping frequency (TF). While the TF exceeds a TF threshold, the system iteratively adjusts sensitivity parameters for the SPRT to reduce the TF, and performs the SPRT again on the residuals. The system then uses a logistic regression model to compute a risk index for the asset based on the TF. If the risk index exceeds a threshold, the system generates a notification indicating that the asset needs to be replaced.

Abstract: The disclosed embodiments relate to a system that determines whether an inferential model is susceptible to spillover false alarms. During operation, the system receives a set of time-series signals from sensors in a monitored system. The system then trains the inferential model using the set of time-series signals. Next, the system tests the inferential model for susceptibility to spillover false alarms by performing the following operations for one signal at a time in the set of time-series signals. First, the system adds degradation to the signal to produce a degraded signal. The system then uses the inferential model to perform prognostic-surveillance operations on the time-series signals with the degraded signal. Finally, the system detects spillover false alarms based on results of the prognostic-surveillance operations.

Abstract: Systems, methods, and other embodiments associated with automated calibration of electromagnetic interference (EMI) fingerprint scanning instrumentation based on radio frequencies are described. In one embodiment, a method for detecting a calibration state of an EMI fingerprint scanning device includes: collecting electromagnetic signals with the EMI fingerprint scanning device for a test period of time at a geographic location; identifying one or more peak frequency bands in the collected electromagnetic signals; comparing the one or more peak frequency bands to assigned radio station frequencies at the geographic location to determine if a match is found; and generating a calibration state signal based at least in part on the comparing to indicate whether the EMI fingerprint scanning device is calibrated or not calibrated.

Abstract: Detecting a counterfeit status of a target utility device by: selecting a set of frequencies that best reflect load dynamics or other information content of a reference utility device while undergoing a power test sequence; obtaining target electromagnetic interference (EMI) signals emitted by the target utility device while undergoing the same power test sequence; creating a sequence of target kiviat plots from the amplitude of the target EMI signals at each of the set of frequencies at observations over the power test sequence to form a target kiviat tube EMI fingerprint; comparing the target kiviat tube EMI fingerprint to a reference kiviat tube EMI fingerprint for the reference utility device undergoing the power test sequence to determine whether the target utility device and the reference utility device are of the same type; and generating a signal to indicate a counterfeit status based at least in part on the results of the comparison.

Abstract: The disclosed embodiments provide a system that detects unwanted electronic components in a target asset. During operation, the system obtains target electromagnetic interference (EMI) signals by monitoring EMI signals generated by the target asset while the target asset is running a periodic workload. Next, the system generates a target EMI fingerprint from the target EMI signals. The system then applies a compression/dilation technique to time-series signals in the target EMI fingerprint to achieve alignment with corresponding time-series signals in a reference EMI fingerprint to produce a synchronized target EMI fingerprint. Finally, the system compares the synchronized target EMI fingerprint against the reference EMI fingerprint to determine whether the target asset contains any unwanted electronic components.

Abstract: The disclosed embodiments provide a system that detects unwanted electronic components in a target asset. During operation, the system obtains target electromagnetic interference (EMI) signals by monitoring EMI signals generated by the target asset while the target asset is running a periodic workload. Next, the system generates a target EMI fingerprint from the target EMI signals. The system then applies a compression/dilation technique to time-series signals in the target EMI fingerprint to achieve alignment with corresponding time-series signals in a reference EMI fingerprint to produce a synchronized target EMI fingerprint. Finally, the system compares the synchronized target EMI fingerprint against the reference EMI fingerprint to determine whether the target asset contains any unwanted electronic components.

Abstract: A system is provided that detects a card skimmer in a target system, wherein the card skimmer surreptitiously gathers credit/debit card information during operation of the target system. This system first gathers target electromagnetic interference (EMI) signals by monitoring EMI signals generated by the target system through an external scanner with a directional antenna. Next, the system generates a target EMI fingerprint from the target EMI signals. The system then compares the target EMI fingerprint against a reference EMI fingerprint for the target system to determine whether the target system contains a card skimmer.

Abstract: In one embodiment, a method for auditing the results of a machine learning model includes: retrieving a set of state estimates for original time series data values from a database under audit; reversing the state estimation computation for each of the state estimates to produce reconstituted time series data values for each of the state estimates; retrieving the original time series data values from the database under audit; comparing the original time series data values pairwise with the reconstituted time series data values to determine whether the original time series and reconstituted time series match; and generating a signal that the database under audit (i) has not been modified where the original time series and reconstituted time series match, and (ii) has been modified where the original time series and reconstituted time series do not match.

Abstract: Systems, methods, and other embodiments associated with automated calibration of electromagnetic interference (EMI) fingerprint scanning instrumentation for utility power system counterfeit detection are described. In one embodiment, a method for detecting a calibration state of an EMI fingerprint scanning device includes: collecting electromagnetic signals with the EMI fingerprint scanning device for a test period of time at a geographic location; identifying one or more peak frequency bands in the collected electromagnetic signals; comparing the one or more peak frequency bands to assigned radio station frequencies at the geographic location to determine if a match is found; and generating a calibration state signal based at least in part on the comparing to indicate whether the EMI fingerprint scanning device is calibrated or not calibrated.

Abstract: The disclosed embodiments provide a system that detects unwanted electronic components in a target computing system. During operation, the system obtains target electromagnetic interference (EMI) signals, which were gathered by monitoring EMI signals generated by the target computing system, using an insertable device, wherein when the insertable device is inserted into the target computing system, the insertable device gathers the target EMI signals from the target computing system. Next, the system generates a target EMI fingerprint from the target EMI signals. Finally, the system compares the target EMI fingerprint against a reference EMI fingerprint for the target computing system to determine whether the target computing system contains any unwanted electronic components.

Abstract: Detecting a counterfeit status of a target utility device by: selecting a set of frequencies that best reflect load dynamics or other information content of a reference utility device while undergoing a power test sequence; obtaining target electromagnetic interference (EMI) signals emitted by the target utility device while undergoing the same power test sequence; creating a sequence of target kiviat plots from the amplitude of the target EMI signals at each of the set of frequencies at observations over the power test sequence to form a target kiviat tube EMI fingerprint; comparing the target kiviat tube EMI fingerprint to a reference kiviat tube EMI fingerprint for the reference utility device undergoing the power test sequence to determine whether the target utility device and the reference utility device are of the same type; and generating a signal to indicate a counterfeit status based at least in part on the results of the comparison.

Abstract: A model-based approach to determining an optimal configuration for a data center may use an environmental chamber to characterize the performance of various data center configurations at different combinations of temperature and altitude. Telemetry data may be recorded from different configurations as they execute a stress workload at each temperature/altitude combination, and the telemetry data may be used to train a corresponding library of models. When a new data center is being configured, the temperature/altitude of the new data center may be used to select a pre-trained model from a similar temperature/altitude. Performance of the current configuration can be compared to the performance of the model, and if the model performs better, a new configuration based on the model may be used as an optimal configuration for the data center.

Abstract: During a surveillance mode, the system receives present time-series signals gathered from sensors in the power transformer. Next, the system uses an inferential model to generate estimated values for the present time-series signals, and performs a pairwise differencing operation between actual values and the estimated values for the present time-series signals to produce residuals. The system then performs a sequential probability ratio test on the residuals to produce alarms having associated tripping frequencies (TFs). Next, the system uses a logistic-regression model to compute a risk index for the power transformer based on the TFs. If the risk index exceeds a threshold, the system generates a notification that the power transformer needs to be replaced. The system also periodically updates the logistic-regression model based on the results of periodic dissolved gas analyses for the transformer to more accurately compute the index for the power transformer.

Abstract: Detecting whether a target utility device that includes multiple electronic components is genuine or suspected counterfeit by: performing a test sequence of energizing and de-energizing the target device and collecting electromagnetic interference (EMI) signals emitted by the target device; generating a target EMI fingerprint from the EMI signals collected; retrieving a plurality of reference EMI fingerprints from a database library, each of which corresponds to a different configuration of electronic components of a genuine device of the same make and model as the target device; iteratively comparing the target EMI fingerprint to the retrieved reference EMI fingerprints and generating a similarity metric between each compared set; and indicating that the target device (i) is genuine where the similarity metric for any individual reference EMI fingerprint satisfies a threshold test, and is a suspect counterfeit device where no similarity metric for any individual reference EMI fingerprint satisfies the test.

Abstract: The disclosed embodiments relate to a system that camouflages EMI fingerprints in EMI emissions from a computing system to enhance system security. During operation, the system monitors the EMI emissions from the computer system during operation of the computer system to produce corresponding EMI signals. Next, the system determines a dynamic amplitude of the EMI emissions based on the EMI signals. If the dynamic amplitude of the EMI emissions drops below a threshold value, the system executes synthetic transactions, which have interarrival times that, when superimposed on a workload of the computer system, cause the computer system to produce randomized EMI emissions.

Abstract: The disclosed embodiments provide a system that detects unwanted electronic components in a target asset. During operation, the system generates a sinusoidal load for the target asset. Next, the system obtains target electromagnetic interference (EMI) signals by monitoring EMI signals generated by the target asset while the target asset is executing the sinusoidal load. The system then generates a target EMI fingerprint from the target EMI signals. Finally, the system compares the target EMI fingerprint against a reference EMI fingerprint for the target asset to determine whether the target asset contains unwanted electronic components.