Abstract: A system and method including receiving a set of deep neural networks (DNN) including DNNs trained with an embedded trojan and DNNs trained without any embedded trojan, each of the trained DNNs being represented by a mathematical formulation learned by the DNNs and expressing a relationship between an input of the DNNs and an output of the DNNs; extracting at least one characteristic feature from the mathematical formulation of each of the trained DNNs; statistically analyzing the at least one characteristic feature to determine whether there is a difference between the DNNs trained with the embedded trojan and the DNNs trained without any embedded trojan; generating, in response to the determination indicating there is a difference, a detector model to execute the statistical analyzing on deep neural networks; and storing a file including the generated detector model in a memory device.

Abstract: A method for detecting a cyberattack on a control system of a wind turbine includes providing a plurality of classification models of the control system. The method also includes receiving, via each of the plurality of classification models, a time series of operating data from one or more monitoring nodes of the wind turbine. The method further includes extracting, via the plurality of classification models, a plurality of features using the time series of operating data. Each of the plurality of features is a mathematical characterization of the time series of operating data. Moreover, the method includes generating an output from each of the plurality of classification models and determining, using a decision fusion module, a probability of the cyberattack occurring on the control system based on a combination of the outputs. Thus, the method includes implementing a control action when the probability exceeds a probability threshold.

Abstract: A system and method including receiving a set of deep neural networks (DNN) including DNNs trained with an embedded trojan and DNNs trained without any embedded trojan, each of the trained DNNs being represented by a mathematical formulation learned by the DNNs and expressing a relationship between an input of the DNNs and an output of the DNNs; extracting at least one characteristic feature from the mathematical formulation of each of the trained DNNs; statistically analyzing the at least one characteristic feature to determine whether there is a difference between the DNNs trained with the embedded trojan and the DNNs trained without any embedded trojan; generating, in response to the determination indicating there is a difference, a detector model to execute the statistical analyzing on deep neural networks; and storing a file including the generated detector model in a memory device.