Abstract: Systems and methods are provided for incident analysis in Cyber-Physical Systems (CPS) using a Temporal Graph-based Incident Analysis System (TGIAS) and/or Transition Based Categorical Anomaly Detection (TCAD). Dynamically gathered multimodal data from a distributed network of sensors across the CPS are preprocessed to identify abnormal sensor readings indicative of potential incidents, and a multi-layered incident timeline graph, representing abnormal sensor readings, relationships to specific CPS components, and temporal sequencing of events is constructed. Severity scores are calculated, and severity rankings are assigned to identified anomalies based on a composite index including impact on CPS operation, comparison with historical incident data, and predictive risk assessments.

Abstract: Methods and systems for training and deploying a neural network mode include training a modular encoder model using training data collected from heterogeneous system types. The modular encoder model includes layers of neural network blocks and a selectively enabled connections between neural network blocks of adjacent layers. Each neural network block includes neural network layers. The modular encoder model is deployed to a system corresponding to one of the heterogeneous system types.

Abstract: Methods and systems include generating general annotations for input time series data based on annotations from one or more source domains. Domain-specific annotations are generated for the input time series based on annotations from a target domain and based on the general annotations. An action is performed responsive to the domain-specific annotations and the general annotations.

Abstract: Methods and systems for anomaly detection include encoding a multivariate time series and a multi-type event sequence using respective transformers and an aggregation network to generate a feature vector. Anomaly detection is performed using the feature vector to identify an anomaly within a system. A corrective action is performed responsive to the anomaly to correct or mitigate an effect of the anomaly. The detected anomaly can be used in a healthcare context to support decision making by medical professionals with respect to the treatment of a patient. The encoding may include machine learning models to implement the transformers and the aggregation network using deep learning.

Abstract: Methods and systems include comparing a description of an issue to documents to generate similarity scores for the documents. A set of most-relevant documents are selected from the documents based on the similarity scores. A large language model (LLM) is prompted to generate a solution to the issue. A corrective action is performed based on the solution to correct the issue.

Abstract: Systems and methods are provided for incident analysis in Cyber-Physical Systems (CPS) using a Temporal Graph-based Incident Analysis System (TGIAS) and/or Transition Based Categorical Anomaly Detection (TCAD). Dynamically gathered multimodal data from a distributed network of sensors across the CPS are preprocessed to identify abnormal sensor readings indicative of potential incidents, and a multi-layered incident timeline graph, representing abnormal sensor readings, relationships to specific CPS components, and temporal sequencing of events is constructed. Severity scores are calculated, and severity rankings are assigned to identified anomalies based on a composite index including impact on CPS operation, comparison with historical incident data, and predictive risk assessments.

Abstract: Methods and systems for anomaly detection include determining whether a system is in a stable state or a dynamic state based on input data from one or more sensors in the system, using reconstruction errors from a respective stable model and dynamic model. It is determined that the input data represents anomalous operation of the system, responsive to a determination that the system is in a stable state, using the reconstruction errors. A corrective operation is performed on the system responsive to a determination that the input data represents anomalous operation of the system.

Abstract: A method for vehicle fault detection is provided. The method includes training, by a cloud module controlled by a processor device, an entity-shared modular and a shared modular connection controller. The entity-shared modular stores common knowledge for a transfer scope, and is formed from a set of sub-networks which are dynamically assembled for different target entities of a vehicle by the shared modular connection controller. The method further includes training, by an edge module controlled by another processor device, an entity-specific decoder and an entity-specific connection controller. The entity-specific decoder is for filtering entity-specific information from the common knowledge in the entity-shared modular by dynamically assembling the set of sub-networks in a manner decided by the entity specific connection controller.

Abstract: Systems and methods for generating categorical data for missing values in anomaly detection systems. In an embodiment, irregular time-series data can be aligned into regular time-series data by utilizing a generated timestamp sequence to obtain aligned time-series data. Missing values from the aligned time-series data can be filled with generated categorical time-series data. Anomaly detection can be performed for the cyber-physical system to obtain system anomalies. A corrective action can be performed to resolve issues with the cyber-physical system caused by the system anomalies.

Abstract: Methods and systems for root cause analysis include combining system logs and system metrics into time-series data. Individual root cause analysis is performed to determine individual causal scores for respective system entities. Topological root cause analysis is performed to capture topological patterns of system anomalies. The individual causal scores and the topological patterns are integrated by a weighted sum. A corrective action is performed on an entity identified based on the weighted sum.

Abstract: Systems and methods for an agent-based carbon emission reduction system. A carbon product of a supply chain system can be limited below a carbon product threshold by performing a corrective action to monitored entities based on a calculated carbon emission. The carbon emission can be calculated based on carbon-relevant data and a calculation route by utilizing an agent-based simulation model that simulates a learned relationship between a supply chain system and the carbon-relevant data. The calculation route can be determined based on the carbon-relevant data based on a relevance of a carbon product contribution of monitored entities to a goal of the monitored entities. Carbon-relevant data can be extracted from the monitored entities.

Abstract: Systems and methods for optimizing key performance indicators (KPIs) using adversarial imitation deep learning include processing sensor data received from sensors to remove irrelevant data based on correlation to a final KPI and generating, using a policy generator network with a transformer-based architecture, an optimal sequence of actions based on the processed sensor data. A discriminator network is employed to differentiate between the generated action sequences and real-world high performance sequences employing. Final KPI results are estimated based on the generated action sequences using a performance prediction network. The generated action sequences are applied to the process to optimize the KPI in real-time.

Abstract: Systems and methods are provided for classifying components include monitoring sensors to collect sensor data related to a state of a plurality of components; processing, by a computing system, the sensor data to generate an action sequence using a transformer-based policy network for each of the components. A risk score is generated for the action sequence using a Generative Adversarial Network (GAN), wherein the GAN includes a generator for generating action sequences and a discriminator to distinguish low-risk action sequences in accordance with a threshold. The low-risk action sequences are associated with components in the plurality of components based on the risk score. A status of the low-risk action sequences is communicated to the components.

Abstract: Systems and methods train a transformer-based policy network and Generative Adversarial Network (GAN) by initializing a transformer-based policy network to model action sequences by encoding temporal dependencies within sensor data. Multi-head self-attention mechanisms process sequential sensor inputs by being pre-trained on a labeled dataset having sensor data from known low-risk action sequences. A generator within the GAN is trained to produce generated action sequences, which mimic behavior of low-risk action sequences. A discriminator within the GAN is concurrently trained to differentiate between action sequences derived from the labeled dataset and synthetic action sequences produced by the generator. A feedback loop is employed to adjust parameters to produce sequences indistinguishable from real low-risk action sequences.

Abstract: Systems and methods include converting historical data into categorical time series data and de-noising the categorical time series data by removing noisy transitions sets according to a coefficient of variation. A likelihood of a category transition is determined based on historical events using a Hawkes process to generate a relationship graph. Relationships between pairs of nodes are determined using the relationship graph, where the relationships indicate a degree of correlation between the nodes based on de-noised categorical time-series data. An anomaly threshold is determined based on anomaly scores for a validation dataset using the relationship graph, wherein a likelihood output of the Hawkes process that exceeds the anomaly threshold indicates an anomaly.

Abstract: Systems and methods for creating a model include converting historical data into categorical time series data; de-noising the categorical time series data by organizing events into transition sets and removing noisy transitions sets according to a coefficient of variation. A relationship graph is generated that determines relationships between pairs of nodes, where the nodes relate to respective data sources and where the relationships indicate a degree of correlation between nodes based on the de-noised categorical time-series data, using a Hawkes process that determines a likelihood of a category transition based on historical events. An anomaly threshold is determined based on anomaly scores for a validation dataset using the relationship graph, wherein a likelihood output of the Hawkes process that exceeds the anomaly threshold indicates an anomaly.

Abstract: Systems and methods for pre-processing time series data include assigning transition events from categorical time series data into a list of transition sets that each include transitions from a respective first category to a respective second category and determining a mean duration and standard deviation, for each transition set, of the respective first category before the transition to the respective second category. A ratio is compared between the mean duration and the standard deviation to a threshold value to identify noisy transition sets; removing noisy transition sets from the list of transition sets to output de-noised transition sets. A probability of an event occurrence is predicted using the de-noised transition sets, and an action is performed responsive to the probability.

Abstract: Systems and methods for event prediction include converting event information into categorical time series data for a plurality of properties; determining relationships between pairs of properties of the plurality of properties based on a plurality of data types. A likelihood of an event occurring is predicted during a future period by summing over a Hawkes process for the pairs of properties, the Hawkes process taking as input the relationships between the pairs of properties and comparing the likelihood to an anomaly threshold that is based on a range of normal intensity values for transition sets based on the categorical time series data; and performing an action responsive to a determination that the likelihood exceeds the anomaly threshold.

Abstract: Systems and methods for training a time-series-language (TSLa) model adapted for domain-specific tasks. An encoder-decoder neural network can be trained to tokenize time-series data to obtain a discrete-to-language embedding space. The TSLa model can learn a linear mapping function by concatenating token embeddings from the discrete-to-language embedding space with positional encoding to obtain mixed-modality token sequences. Token augmentation can transform the tokens from the mixed-modality token sequences with to obtain augmented tokens. The augmented tokens can train the TSLa model using a computed token likelihood to predict next tokens for the mixed-modality token sequences to obtain a trained TSLa model. A domain-specific dataset can fine-tune the trained TSLa model to adapt the trained TSLa model to perform a domain-specific task.

Abstract: Systems and methods for data fusion and analysis of vehicle sensor data, including receiving a multiple modality input data stream from a plurality of different types of vehicle sensors, determining latent features by extracting modality-specific features from the input data stream, and aligning a distribution of the latent features of different modalities by feature-level data fusion. Classification probabilities can be determined for the latent features using a fused modality scene classifier. A tree-organized neural network can be trained to determine path probabilities and issue driving pattern judgments, with the tree-organized neural network including a soft tree model and a hard decision leaf. One or more driving pattern judgments can be issued based on a probability of possible driving patterns derived from the modality-specific features.