Abstract: According to some embodiments, a system, method and non-transitory computer-readable medium are provided to protect a cyber-physical system having a plurality of monitoring nodes comprising: a normal space data source storing, for each of the plurality of monitoring nodes, a series of normal monitoring node values over time that represent normal operation of the cyber-physical system; a situational awareness module including an abnormal data generation platform, wherein the abnormal data generation platform is operative to generate abnormal data to represent abnormal operation of the cyber-physical system using values in the normal space data source and a generative model; a memory for storing program instructions; and a situational awareness processor, coupled to the memory, and in communication with the situational awareness module and operative to execute the program instructions to: receive a data signal, wherein the received data signal is an aggregation of data signals received from one or more of the p

Abstract: Systems and methods for power system switching element (PSSE) anomaly detection are disclosed. An example PSSE anomaly detection unit may include a power system switching element position estimator (PSSEPE) and a comparison unit. The PSSEPE may be configured to receive a set of measurements and a set of control commands associated with a PSSE, calculate an anomaly confidence score based on the set of measurements and the set of control commands, and estimate a calculated PSSE position based on the set of measurements and the set of control commands. The comparison unit may be configured to receive the calculated PSSE position from the PSSEPE, receive the set of measurements and the set of control commands from the PSSEPE, receive a reported PSSE position associated with the PSSE, and determine a PSSE anomaly decision based on a difference between the reported PSSE position and the calculated PSSE position.

Abstract: A method for controlling a distributed power system is provided, the system including an aggregator communicatively coupled to a plurality of nodes, each of the plurality of nodes including an associated load. The method includes receiving, at the aggregator, a commanded power profile from an independent service operator, the commanded power profile including a commanded power deviation for the distributed power system, calculating, using the aggregator, a score for each of the plurality of nodes based on a current operating power of each node, selecting, using the aggregator, a subset of the plurality of nodes based on the calculated scores, and commanding, using the aggregator, each node in the subset to adjust its current power by a respective predetermined amount, the predetermined amounts determined based on the commanded power deviation.

Abstract: A training data store may contain training data associated with monitoring node values during normal operation of an industrial asset and simulated abnormal data. An offline model tuning platform accesses the training data from normal operation of the industrial asset and the simulated abnormal data in the training data store. Based on the training data from normal operation of the industrial asset, the simulated abnormal data, an abnormal operating condition, and a constrained optimization solution, controller tuning parameters are created for at least one tuned data-driven adaptive controller such that an operating condition of the industrial asset will move from the abnormal operating condition to a normal operation condition through a stable trajectory. An online monitoring platform receives a stream of current monitoring node values and, when the abnormal operating condition is detected, utilizes the controller tuning parameters to implement the at least one tuned data-driven adaptive controller.

Abstract: The present application describes techniques for node selection and ranking for, e.g., attack detection and localization in cyber-physical systems, without relying on digital twins, computer models of assets, or operational domain expertise. The described techniques include obtaining an input dataset of values for a plurality of nodes (e.g., sensors, actuators, controllers, software nodes) of industrial assets, computing a plurality of principal components (PCs) for the input dataset according to variance of values for each node, computing a set of common weighted PCs based on the plurality of PCs according to variance of each PC, and ranking each node based on the node's contribution to the set of common weighted PCs.

Abstract: In some embodiments, a system node data store may contain historical system node data associated with normal operation of an industrial asset, and a plurality of artificial intelligence model construction platforms may receive historical system node data. Each platform may then automatically construct a data-driven, dynamic artificial intelligence model associated with the industrial asset based on received system node data. The plurality of artificial intelligence models are interconnected and simultaneously trained to create a digital twin of the industrial asset. A synthetic disturbance platform may inject at least one synthetic disturbance into the plurality of artificial intelligence models to create, for each of a plurality of monitoring nodes, a series of synthetic disturbance monitoring node values over time that represent simulated abnormal operation of the industrial asset.

Abstract: Systems and methods are provided for the control of a wind turbine. Accordingly, a wind classification module of a controller determines a current aerodynamic state of the wind resource based, at least in part, on a current operational data set of the wind turbine. The current operational data set is indicative of a current operation of the wind turbine. A configuration intelligence module of the controller then generates an estimated configuration for a turbine estimator module and a predictive control configuration for a predictive control module based, at least in part, on the current aerodynamic state. An operation of the wind turbine is emulated via the turbine estimator module to generate a control initial state for the predictive control module. The predictive control module then determines a predicted performance of the wind turbine over a predictive interval based on the control initial state and the predictive control configuration.

Abstract: According to some embodiments, a system, method and non-transitory computer-readable medium are provided to protect a cyber-physical system having a plurality of monitoring nodes comprising: a normal space data source storing, for each of the plurality of monitoring nodes, a series of normal monitoring node values over time that represent normal operation of the cyber-physical system; a situational awareness module including an abnormal data generation platform, wherein the abnormal data generation platform is operative to generate abnormal data to represent abnormal operation of the cyber-physical system using values in the normal space data source and a generative model; a memory for storing program instructions; and a situational awareness processor, coupled to the memory, and in communication with the situational awareness module and operative to execute the program instructions to: receive a data signal, wherein the received data signal is an aggregation of data signals received from one or more of the p

Abstract: The present application describes techniques for node selection and ranking for, e.g., attack detection and localization in cyber-physical systems, without relying on digital twins, computer models of assets, or operational domain expertise. The described techniques include obtaining an input dataset of values for a plurality of nodes (e.g., sensors, actuators, controllers, software nodes) of industrial assets, computing a plurality of principal components (PCs) for the input dataset according to variance of values for each node, computing a set of common weighted PCs based on the plurality of PCs according to variance of each PC, and ranking each node based on the node's contribution to the set of common weighted PCs.

Abstract: A method for detecting a cyberattack on a control system of a wind turbine includes providing a plurality of classification models of the control system. The method also includes receiving, via each of the plurality of classification models, a time series of operating data from one or more monitoring nodes of the wind turbine. The method further includes extracting, via the plurality of classification models, a plurality of features using the time series of operating data. Each of the plurality of features is a mathematical characterization of the time series of operating data. Moreover, the method includes generating an output from each of the plurality of classification models and determining, using a decision fusion module, a probability of the cyberattack occurring on the control system based on a combination of the outputs. Thus, the method includes implementing a control action when the probability exceeds a probability threshold.

Abstract: According to some embodiments, a system, method, and non-transitory computer readable medium are provided comprising a plurality of real-time monitoring nodes to receive streams of monitoring node signal values over time that represent a current operation of the cyber physical system; and a threat detection computer platform, coupled to the plurality of real-time monitoring nodes, to: receive the monitoring node signal values; compute an anomaly score; compare the anomaly score with an adaptive threshold; and detect that one of a particular monitoring node and a system is outside a decision boundary based on the comparison, and classify that particular monitoring node or system as anomalous. Numerous other aspects are provided.

Abstract: According to some embodiments, a system, method and non-transitory computer-readable medium are provided to protect a cyber-physical system having a plurality of monitoring nodes comprising: a normal space data source storing, for each of the plurality of monitoring nodes, a series of normal monitoring node values over time that represent normal operation of the cyber-physical system; a situational awareness module including an abnormal data generation platform, wherein the abnormal data generation platform is operative to generate abnormal data to represent abnormal operation of the cyber-physical system using values in the normal space data source and a generative model; a memory for storing program instructions; and a situational awareness processor, coupled to the memory, and in communication with the situational awareness module and operative to execute the program instructions to: receive a data signal, wherein the received data signal is an aggregation of data signals received from one or more of the p

Abstract: Systems and methods are provided for the control of an industrial asset, such as a power generating asset. Accordingly, a cyber-attack model predicts a plurality of operational impacts on the industrial asset resulting from a plurality of potential cyber-attacks. The cyber-attack model also predicts a corresponding plurality of potential mitigation responses. In operation, a cyber-attack impacting at least one component of the industrial asset is detected via the cyber-attack neutralization module and a protected operational impact of the cyber-attack is identified based on the cyber-attack model. The cyber-attack neutralization module selects at least one mitigation response of the plurality of mitigation responses based on the predicted operational impact and an operating state of the industrial asset is altered based on the selected mitigation response.

Abstract: Systems and methods for power system switching element (PSSE) anomaly detection are disclosed. An example PSSE anomaly detection unit may include a power system switching element position estimator (PSSEPE) and a comparison unit. The PSSEPE may be configured to receive a set of measurements and a set of control commands associated with a PSSE, calculate an anomaly confidence score based on the set of measurements and the set of control commands, and estimate a calculated PSSE position based on the set of measurements and the set of control commands. The comparison unit may be configured to receive the calculated PSSE position from the PSSEPE, receive the set of measurements and the set of control commands from the PSSEPE, receive a reported PSSE position associated with the PSSE, and determine a PSSE anomaly decision based on a difference between the reported PSSE position and the calculated PSSE position.

Abstract: An industrial asset may have monitoring nodes that generate current monitoring node values representing a current operation of the industrial asset. An abnormality detection computer may detect when a monitoring node is currently being attacked or experiencing a fault based on a current feature vector, calculated in accordance with current monitoring node values, and a detection model that includes a decision boundary. A model updater (e.g., a continuous learning model updater) may determine an update time-frame (e.g., short-term, mid-term, long-term, etc.) associated with the system based on trigger occurrence detection (e.g., associated with a time-based trigger, a performance-based trigger, an event-based trigger, etc.). The model updater may then update the detection model in accordance with the determined update time-frame (and, in some embodiments, continuous learning).

Abstract: An industrial asset may have monitoring nodes that generate current monitoring node values. A dynamic, resilient estimator may split a temporal monitoring node space into normal and one or more abnormal subspaces associated with different kinds of attack vectors. According to some embodiments, a neutralization model is constructed and trained for each attack vector using supervised learning and the associated abnormal subspace. In other embodiments, a single model is created using out-of-range values for abnormal monitoring nodes. Responsive to an indication of a particular abnormal monitoring node or nodes, the system may automatically invoke the appropriate neutralization model to determine estimated values of the particular abnormal monitoring node or nodes (e.g., by selecting the correct model or using out-of-range values). The series of current monitoring node values from the abnormal monitoring node or nodes may then be replaced with the estimated values.

Abstract: According to some embodiments, a system, method and non-transitory computer-readable medium are provided to protect a cyber-physical system having a plurality of monitoring nodes comprising: a normal space data source storing, for each of the plurality of monitoring nodes, a series of normal monitoring node values over time that represent normal operation of the cyber-physical system; a situational awareness module including an abnormal data generation platform, wherein the abnormal data generation platform is operative to generate abnormal data to represent abnormal operation of the cyber-physical system using values in the normal space data source and a generative model; a memory for storing program instructions; and a situational awareness processor, coupled to the memory, and in communication with the situational awareness module and operative to execute the program instructions to: receive a data signal, wherein the received data signal is an aggregation of data signals received from one or more of the p

Abstract: In some embodiments, identifying a replay attack in an industrial control system of an industrial asset includes receiving a first set of time series data associated with an ambient condition of one or more first monitoring nodes at a first location of the industrial control system. An actual system feature value for the industrial asset is determined based upon the first set of time series data. A second set of time series data indicative of the ambient condition at a second location is received, and a nominal system feature value is determined based upon the second set of time series data. A correlation between the actual feature value and the nominal system feature value is analyzed to determine a correlation result. A request received by the industrial control system is selectively categorized as a replay attack based upon the correlation result.

Abstract: A cyber-physical system may have a plurality of system nodes including a plurality of monitoring nodes each generating a series of current monitoring node values over time that represent current operation of the cyber-physical system. According to some embodiments, a watermarking computer platform may randomly inject a watermarking signal into an injection subset of the system nodes. The watermarking computer platform may then receive current monitoring node values over time and generate a current watermarking feature vector based on the current monitoring node values. The watermarking computer platform might comprise a dedicated watermarking abnormality detection platform or a unified abnormality detection platform (e.g., that also uses data-drive feature vectors). The injection subset may be associated with a randomly selected subset of the system nodes and/or magnitudes of watermarking signals that are randomly selected.

Abstract: Systems and methods are provided for the control of an industrial asset, such as a power generating asset. Accordingly, an interceptor module receives a state-change instruction from a state module that directs a change from a first state condition to a second state condition. The first and second state conditions direct modes of operation of at least one sub module of the controller of the industrial asset. The interceptor module then correlates the state-change instruction to a state-change classification. Based on the state-change classification, the interceptor module identifies an indication of a mode-switching attack. In response to the identification of the mode-switching attack, at least one mitigation response is implemented.