Abstract: According to some embodiments, a system, method, and non-transitory computer readable medium are provided comprising a plurality of real-time monitoring nodes to receive streams of monitoring node signal values over time that represent a current operation of the cyber physical system; and a threat detection computer platform, coupled to the plurality of real-time monitoring nodes, to: receive the monitoring node signal values; compute an anomaly score; compare the anomaly score with an adaptive threshold; and detect that one of a particular monitoring node and a system is outside a decision boundary based on the comparison, and classify that particular monitoring node or system as anomalous. Numerous other aspects are provided.

Abstract: According to some embodiments, a system, method and non-transitory computer readable medium are provided comprising a memory storing processor-executable steps; and a processor to execute the processor-executable steps to cause the system to: receive a first data value of a plurality of data values from a data store, wherein the first data value is from a digital twin model of an industrial asset; determine, via a vulnerability module, whether the received at least one data value is a near boundary case or not a near boundary case; in a case it is determined the first data value is a near boundary case, generate one or more adversarial samples for the first data value; input each of the one or more adversarial samples to the digital twin model; execute the digital twin model to output a system response for each input adversarial sample; determine whether the system response to each input adversarial sample has a negative impact; in a case it is determined the system response has a negative impact for a given

Abstract: According to some embodiments, a system, method and non-transitory computer-readable medium are provided to protect a cyber-physical system having a plurality of monitoring nodes comprising: a normal space data source storing, for each of the plurality of monitoring nodes, a series of normal monitoring node values over time that represent normal operation of the cyber-physical system; a situational awareness module including an abnormal data generation platform, wherein the abnormal data generation platform is operative to generate abnormal data to represent abnormal operation of the cyber-physical system using values in the normal space data source and a generative model; a memory for storing program instructions; and a situational awareness processor, coupled to the memory, and in communication with the situational awareness module and operative to execute the program instructions to: receive a data signal, wherein the received data signal is an aggregation of data signals received from one or more of the p

Abstract: An industrial asset may have monitoring nodes that generate current monitoring node values representing a current operation of the industrial asset. An abnormality detection computer may detect when a monitoring node is currently being attacked or experiencing a fault based on a current feature vector, calculated in accordance with current monitoring node values, and a detection model that includes a decision boundary. A model updater (e.g., a continuous learning model updater) may determine an update time-frame (e.g., short-term, mid-term, long-term, etc.) associated with the system based on trigger occurrence detection (e.g., associated with a time-based trigger, a performance-based trigger, an event-based trigger, etc.). The model updater may then update the detection model in accordance with the determined update time-frame (and, in some embodiments, continuous learning).

Abstract: According to some embodiments, a system, method and non-transitory computer-readable medium are provided to protect a cyber-physical system having a plurality of monitoring nodes comprising: a normal space data source storing, for each of the plurality of monitoring nodes, a series of normal monitoring node values over time that represent normal operation of the cyber-physical system; a situational awareness module including an abnormal data generation platform, wherein the abnormal data generation platform is operative to generate abnormal data to represent abnormal operation of the cyber-physical system using values in the normal space data source and a generative model; a memory for storing program instructions; and a situational awareness processor, coupled to the memory, and in communication with the situational awareness module and operative to execute the program instructions to: receive a data signal, wherein the received data signal is an aggregation of data signals received from one or more of the p

Abstract: According to some embodiments, a system, method and non-transitory computer readable medium are provided comprising a memory storing processor-executable steps; and a processor to execute the processor-executable steps to cause the system to: receive a first data value of a plurality of data values from a data store, wherein the first data value is from a digital twin model of an industrial asset; determine, via a vulnerability module, whether the received at least one data value is a near boundary case or not a near boundary case; in a case it is determined the first data value is a near boundary case, generate one or more adversarial samples for the first data value; input each of the one or more adversarial samples to the digital twin model; execute the digital twin model to output a system response for each input adversarial sample; determine whether the system response to each input adversarial sample has a negative impact; in a case it is determined the system response has a negative impact for a given

Abstract: A system for enhanced sequential power system model calibration is provided. The system is programmed to store a model of a device. The model includes a plurality of parameters. The system is also programmed to receive a plurality of events associated with the device, receive a first set of calibration values for the plurality of parameters, generate a plurality of sets of calibration values for the plurality of parameters, for each of the plurality of sets of calibration values, analyze a first event of the plurality of events using a corresponding set of calibration values to generate a plurality of updated sets of calibration values, analyze the plurality of updated sets of calibration values to determine a current updated set of calibration values, and update the model to include the current updated set of calibration values.

Abstract: An industrial asset may have monitoring nodes that generate current monitoring node values representing a current operation of the industrial asset. An abnormality detection computer may detect when a monitoring node is currently being attacked or experiencing a fault based on a current feature vector, calculated in accordance with current monitoring node values, and a detection model that includes a decision boundary. A model updater (e.g., a continuous learning model updater) may determine an update time-frame (e.g., short-term, mid-term, long-term, etc.) associated with the system based on trigger occurrence detection (e.g., associated with a time-based trigger, a performance-based trigger, an event-based trigger, etc.). The model updater may then update the detection model in accordance with the determined update time-frame (and, in some embodiments, continuous learning).

Abstract: A method for detecting a cyberattack on a control system of a wind turbine includes providing a plurality of classification models of the control system. The method also includes receiving, via each of the plurality of classification models, a time series of operating data from one or more monitoring nodes of the wind turbine. The method further includes extracting, via the plurality of classification models, a plurality of features using the time series of operating data. Each of the plurality of features is a mathematical characterization of the time series of operating data. Moreover, the method includes generating an output from each of the plurality of classification models and determining, using a decision fusion module, a probability of the cyberattack occurring on the control system based on a combination of the outputs. Thus, the method includes implementing a control action when the probability exceeds a probability threshold.

Abstract: According to some embodiments, a system, method, and non-transitory computer readable medium are provided comprising a plurality of real-time monitoring nodes to receive streams of monitoring node signal values over time that represent a current operation of the cyber physical system; and a threat detection computer platform, coupled to the plurality of real-time monitoring nodes, to: receive the monitoring node signal values; compute an anomaly score; compare the anomaly score with an adaptive threshold; and detect that one of a particular monitoring node and a system is outside a decision boundary based on the comparison, and classify that particular monitoring node or system as anomalous. Numerous other aspects are provided.

Abstract: According to some embodiments, a system, method and non-transitory computer readable medium are provided comprising a plurality of real-time monitoring nodes to receive streams of monitoring node signal values over time that represent a current operation of the cyber physical system; a local status determination module comprising an ensemble of local agents, the module adapted to determine an anomaly status for one or more nodes; a global status determination module comprising an ensemble of global agents, the module adapted to determine an anomaly status for the cyber physical system; a threat detection computer platform comprising a memory and a computer processor, the threat detection computer platform coupled to the plurality of real-time monitoring nodes and adapted to: receive the monitoring node signal values, generate feature vectors from the received monitoring node signal values; compare via the local status determination module the feature vectors with at least one decision boundary associated with

Abstract: Briefly, embodiments are directed to a system, method, and article for identifying power system event signatures. Input measurement data may be received from one or more data sources relating to a power grid system. The input measurement data may comprise normal system operation measurement data and power system event measurement data. A processor may perform operations during an online application phase. During the online application phase, a feature matrix may be generated for the power system event measurement data and the at least one trained auto-associative model. The feature matrix for the power system event measurement data may be processed to determine power system event residuals. Also during the online application phase, the power system event signatures may be identified based on residual statistics for normal system operation measurement data residuals and on the power system event residuals.

Abstract: According to embodiments, a system, method and non-transitory computer-readable medium are provided to receive time series data associated with one or more sensors values of a piece of machinery at a first time period, perform a non-linear transformation on the time-series data to produce one or more nonlinear temporal embedding outputs, and projecting each of the nonlinear temporal embedding outputs to a different dimension space to identify at least one causal relationship in the nonlinear temporal embedding outputs. The nonlinear embeddings are further projected to the original dimension space to produce one or more causality learning outputs. Nonlinear dimensional reduction is performed on the one or more causality learning outputs to produce reduced dimension causality learning outputs. The learning outputs are mapped to one or more predicted outputs which include a prediction of one or more of the sensor values at a second time period.

Abstract: A Cyber-Physical System (“CPS”) may have monitoring nodes that generate a series of current monitoring node values representing current operation of the CPS. A normal space data source may store, for each monitoring node, a series of normal monitoring node values representing normal operation of the CPS. An abnormal data generation platform may utilize information in the normal space data source and a generative model to create generated abnormal to represent abnormal operation of the CPS. An abnormality detection model creation computer may receive the normal monitoring node values (and generate normal feature vectors) and automatically calculate and output an abnormality detection model including information about a decision boundary created via supervised learning based on the normal feature vectors and the generated abnormal data.

Abstract: Some embodiments provide systems and methods associated with an industrial asset. An ensemble of learners (e.g., base learner models) may comprise a digital twin that corresponds to the industrial asset. A learning agent platform (e.g., associated with reinforcement learning), coupled to the ensemble of learners, may manage the ensemble by receiving information about current operation of the industrial asset. The platform may then apply learning to the received information and generate data that modifies the ensemble of learners (e.g., by adding, pruning, and/or modifying models in the ensemble). In some embodiments, a boosting scheme may be employed to enhance decision making by the learning agent platform (e.g., a learner's voting weight might be inversely proportional to its error on a previous batch of information).

Abstract: A computing device for detecting and identifying power system events is provided. The computing device includes at least one processor in communication with at least one memory device. The at least one processor is programmed to store a database including a plurality of categorized events. Each categorized event of the plurality of categorized events is associated with an event category. The at least one processor is also programmed to receive sensor data from a plurality of sensors monitoring a power grid, identify one or more features contained in the sensor data, compare the one or more features to the plurality of categorized events, and determine an event category based on the comparison.

Abstract: Systems and methods may be associated with a cyber-physical system, and a blueprint repository data store may contain electronic files that represent behavior-based asset monitoring parameters for different cyber-physical system asset types. A behavior-based asset monitoring creation computer platform may receive an indication of an asset type of the cyber-physical system. The behavior-based asset monitoring creation computer platform may then search the blueprint repository data store and retrieve an electronic file representing behavior-based asset monitoring parameters for the asset type of the cyber-physical system to be monitored. The behavior-based asset monitoring creation computer platform may also receive, from the remote operator device, adjustments to the retrieved behavior-based asset monitoring parameters and automatically configure, based on the adjusted behavior-based asset monitoring parameters, at least a portion of settings for an abnormal detection model.

Abstract: Monitoring nodes may generate a series of current monitoring node values over time representing current operation of a cyber-physical system. A decision fusion computer platform may receive, from a local status determination module, an indication of whether each node has an initial local status of “normal”/“abnormal” and a local certainty score (with higher values of the local certainty score representing greater likelihood of abnormality). The computer platform may also receive, from a global status determination module, an indication of whether the system has an initial global status of “normal”/“abnormal” and a global certainty score. The computer platform may output, for each node, a fused local status of “normal” or “abnormal,” at least one fused local status being based on the initial global status. The decision fusion computer platform may also output a fused global status of “normal” or “abnormal” based on at least one initial local status.

Abstract: Briefly, embodiments are directed to a system, method, and article for identifying power system event signatures. Input measurement data may be received from one or more data sources relating to a power grid system. The input measurement data may comprise normal system operation measurement data and power system event measurement data. A processor may perform operations during an online application phase. During the online application phase, a feature matrix may be generated for the power system event measurement data and the at least one trained auto-associative model. The feature matrix for the power system event measurement data may be processed to determine power system event residuals. Also during the online application phase, the power system event signatures may be identified based on residual statistics for normal system operation measurement data residuals and on the power system event residuals.

Abstract: According to some embodiments, a system, method and non-transitory computer-readable medium are provided to protect a decision manifold of a control system for an industrial asset, comprising: a detection and neutralization module including: a decision manifold having a receiver configured to receive a training dataset comprising data, wherein the decision manifold is operative to generate a first decision manifold with the received training dataset; and a detection model; a memory for storing program instructions; and a detection and neutralization processor, coupled to the memory, and in communication with the detection and neutralization module and operative to execute program instructions to: receive the first decision manifold, wherein the first decision manifold separates a normal operating space from an abnormal operating space; determine whether there are one or more inadequacies with the detection model; generate a corrected decision manifold based on the determined one or more inadequacies with the