Abstract: Disclosed herein are systems and methods for detecting anomalies in a cyber-physical system. In one aspect, an exemplary method comprises, for a list of parameters of the CPS, collecting data containing values of the parameters of the CPS, generating at least two subsets of parameters of the CPS from the collected data, selecting at least two anomaly detectors from a list of anomaly detectors and selecting at least one corresponding subset of the parameters of the CPS for each selected anomaly detector, pre-processing each subset of the parameters of the CPS and transmitting an output of the pre-processing to the corresponding anomaly detector, for each pre-processed subset, detecting anomalies in the data using the corresponding respective anomaly detector, and detecting a combined anomaly in the CPS by combining and processing results obtained from the selected at least two anomaly detectors.

Abstract: Disclosed herein are methods for identifying the structure of patterns and anomalies in flow of events from the cyber-physical system or information system. In one aspect, an exemplary method comprises, using at least one connector, getting event data, generating at least one episode consisting of a sequence of events, and transferring the generated episodes to an event processor; and using the event processor, process episodes using a neurosemantic network, wherein the processing includes recognizing events and patterns previously learned by the neurosemantic network, training the neurosemantic network, identifying a structure of patterns by mapping to the patterns of neurons on a hierarchy of layers of the neurosemantic network, attributing events and patterns corresponding to neurons of the neurosemantic network to an anomaly depending on a number of activations of the corresponding neuron, and storing the state of the neurosemantic network.

Abstract: Disclosed herein are systems for identifying the structure of patterns and anomalies in flow of events from the cyber-physical system or information system. In one aspect, an exemplary method comprises, using at least one connector, getting event data, generating at least one episode consisting of a sequence of events, and transferring the generated episodes to an event processor; and using the event processor, process episodes using a neurosemantic network, wherein the processing includes recognizing events and patterns previously learned by the neurosemantic network, training the neurosemantic network, identifying a structure of patterns by mapping to the patterns of neurons on a hierarchy of layers of the neurosemantic network, attributing events and patterns corresponding to neurons of the neurosemantic network to an anomaly depending on a number of activations of the corresponding neuron, and storing the state of the neurosemantic network.

Abstract: A method for determination of anomalies in a cyber-physical system (CPS) includes generating one or more diagnostic rules configured to calculate at least one auxiliary CPS variable. One or more values of the at least one auxiliary CPS variable are calculated for a predefined output interval of time based on collected values of a group of primary CPS variables for a predefined input interval of time based on the generated diagnostic rule. An anomaly is determined based on the collected values of the group of primary CPS variables and the one or more calculated values of the at least one auxiliary CPS variable.

Abstract: A method for diagnostics and monitoring of anomalies in a cyber-physical system (CPS) includes obtaining information related to anomalies identified in the CPS. The obtained information includes at least one value of one or more CPS variables. One or more classifying features of the identified anomalies in the CPS are generated based on the obtained information. Classification of the identified anomalies in the CPS into two or more anomaly classes is performed based on the generated classifying features. Each of the two or more anomaly classes is associated with one or more anomaly characteristics. Diagnostics of anomalies are performed in each of the two or more anomaly classes by calculating values of the anomaly characteristics associated with each of the two or more anomaly classes. Anomalies of each of the two or more anomaly classes are monitored based on the calculated values of the anomaly characteristics associated with each of the two or more anomaly classes.

Abstract: Systems and methods for determining a source of anomaly in a cyber-physical system (CPS). A forecasting tool can obtain a plurality of CPS feature values during an input window and forecast the plurality of CPS feature values for a forecast window. An anomaly identification tool can determine a total forecast error for the plurality of CPS features in the forecast window, identify an anomaly in the cyber-physical system when the total forecast error exceeds a total error threshold, and identify at least one CPS feature as the source of the anomaly.

Abstract: The present disclosure provides systems and methods of early determination of anomalies using a graphical user interface. In one aspect such a method comprises: receiving information about one or more features of a cyber-physical system, receiving information about a period of time for monitoring the one or more features, generating a forecast of values of the one or more features of the cyber-physical system over the period of time based on a forecasting model for graphing in a graphical user interface, determining a total error of the forecast for all of the one or more features and determining an error for each of the one or more features over the period of time, determining that the error for one feature of the one or more features is greater than a predetermined threshold and identifying the one feature as a source of an anomaly in the cyber-physical system.

Abstract: Systems and methods for determining a source of anomaly in a cyber-physical system (CPS). A forecasting tool can obtain a plurality of CPS feature values during an input window and forecast the plurality of CPS feature values for a forecast window. An anomaly identification tool can determine a total forecast error for the plurality of CPS features in the forecast window, identify an anomaly in the cyber-physical system when the total forecast error exceeds a total error threshold, and identify at least one CPS feature as the source of the anomaly.

Abstract: The present disclosure provides systems and methods of early determination of anomalies using a graphical user interface. In one aspect such a method comprises: receiving information about one or more features of a cyber-physical system, receiving information about a period of time for monitoring the one or more features, generating a forecast of values of the one or more features of the cyber-physical system over the period of time based on a forecasting model for graphing in a graphical user interface, determining a total error of the forecast for all of the one or more features and determining an error for each of the one or more features over the period of time, determining that the error for one feature of the one or more features is greater than a predetermined threshold and identifying the one feature as a source of an anomaly in the cyber-physical system.