Xerox Corporation

General Electric Company

Palo Alto Research Center Inc.

Transportation IP Holdings, LLC

Other

Ge Infrastructure Technology, LLC

Ge Global Sourcing LLC

Niramai Health Analytix Pvt Ltd

Lalit Keshav Mestha

Yao Rong Wang

Beilei Xu

Alvaro Enrique Gil

Edgar A Bernal

Survi Kyal

Masoud Abbaszadeh

Peter M Gulvin

Martin Sidney Maltz

Daniel Francis Holzhauer

Zhigang Fan

Pinyen Lin

Tonya L Love

Cody Joe Bushey

Raja Bala

Wencheng Wu

Justin Varkey John

Peter Paul

Sohail A Dianat

Gary Walker Skinner

R Enrique Viturro

Robert P Loce

Palghat Srinivas Ramesh

Edul N Dalal

Graham Stephen Pennington

Kenneth J Mihalyov

Peter A Crean

Weizhong Yan

Peter Stanley Fisher

Himanshu Madhu

Joel A Kubby

Fred F Hubble, Iii

Yonghui Zhao

Paul Ronald Austin

John Gary Shaw

Hema Kumari Achanta

Olugbenga Moses Anubi

Joseph D Hancock

Daniel A Robbins

James D Brooks

Baomin Xu

George Cunha Cardoso

Himanshu Jayantkumar Madhu

Xuejin Wen

Stuart Alan Schweid

Peter Johan Nystrom

Dale Robert Mashtare

Gaurav Sharma

Grace T Brewington

David Clark Craig

Yeqing Zhang

Jack Gaynor Elliot

Paul S Bonino

Brian Robert Conrow

Abu Saeed Islam

Claude Fillion

Christine Ann Steurrys

Lina Fu

Prathosh Aragulla Prasad

Eli S Saber

Krithika Venkataramani

Reiner Eschbach

Barry Paul Mandel

Shen-Ge Wang

Howard A Mizes

Peter Henry Tu

Jagdish C Tandon

Patricia Joanne Donaldson

Martin Edward Hoover

Robert John Rolleston

Juan Liu

Michael Robert Furst

Steven B Bolte

John William Carbone

Geetha Manjunath

Sumit Bose

Jonathan Carl Thatcher

Shanmuga-Nathan Gnanasambandam

Benjamin Edward Beckmann

Norman W Zeck

Richard Leighton Howe

Robert E Grace

Chaitanya Ashok Baone

Rakesh Suresh Kulkarni

Meera Sampath

Nischal Murthy Piratla

James Michael Sanchez

Daniel Edgardo Viassolo

Haitham Hindi

Shawn Patrick Updegraff

Om Dadaji Deshmukh

Michael P Kehoe

Ann L McCarthy

Douglas A Kreckel

Shriram V Revankar

Eric Jackson

Jean-Pierre R M Van De Capelle

Nischal M Piratla

Jean-Philippe Yves Couderc

Connie F Purdum

Heterogeneous monitoring nodes may each generate a series of monitoring node values over time associated with operation of an industrial asset. An offline abnormal state detection model creation computer may receive the series of monitoring node values and perform a feature extraction process using a multi-modal, multi-disciplinary framework to generate an initial set of feature vectors. Then feature dimensionality reduction is performed to generate a selected feature vector subset. The model creation computer may derive digital models through a data-driven machine learning modeling method, based on input/output variables identified by domain experts or by learning from the data. The system may then automatically generate domain level features based on a difference between sensor measurements and digital model output. A decision boundary may then be automatically calculated and output for an abnormal state detection model based on the selected feature vector subset and the plurality of derived generated domain level features.

Feature extractions to model large-scale complex control systems

An alerter augmentation system includes one or more processors that determine an alertness of an operator of a vehicle system. The one or more processors also generate operator input requests that are separated in time by a temporal delay. These input requests seek responses or action by the operator in an attempt to keep or make the operator alert. The one or more processors change one or more of the temporal delay between the input requests and/or a type of the input requests that are generated based at least in part on the alertness of the operator that is determined.

Alerter augmentation system

A verification platform may include a data connection to receive a stream of industrial asset cyber-attack detection algorithm data, including a subset of the industrial asset cyber-attack detection algorithm data. The verification platform may store the subset into a data store (the subset of industrial asset cyber-attack detection algorithm data being marked as invalid) and record a hash value associated with a compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata in a secure, distributed ledger. The verification platform may then receive a transaction identifier from the secure, distributed ledger and mark the subset of industrial asset cyber-attack detection algorithm data in the data store as being valid after using the transaction identifier to verify that the recorded hash value matches a hash value of an independently created version of the compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata.

Industrial asset cyber-attack detection algorithm verification using secure, distributed ledger

A verification platform may include a data connection to receive a stream of industrial asset data, including a subset of the industrial asset data, from industrial asset sensors. The verification platform may store the subset of industrial asset data into a data store, the subset of industrial asset data being marked as invalid, and record a hash value associated with a compressed representation of the subset of industrial asset data combined with metadata in a secure, distributed ledger (e.g., associated with blockchain technology). The verification platform may then receive a transaction identifier from the secure, distributed ledger and mark the subset of industrial asset data in the data store as being valid after using the transaction identifier to verify that the recorded hash value matches a hash value of an independently created version of the compressed representation of the subset of industrial asset data combined with metadata.

Industrial data verification using secure, distributed ledger

The example embodiments are directed to a system and method for forecasting anomalies in feature detection. In one example, the method includes storing feature behavior information of at least one monitoring node of an asset, including a normalcy boundary identifying normal feature behavior and abnormal feature behavior for the at least one monitoring node in feature space, receiving input signals from the at least one monitoring node of the asset and transforming the input signals into feature values in the feature space, wherein the feature values are located within the normalcy boundary, forecasting that a future feature value corresponding to a future input signal from the at least one monitoring node is going to be positioned outside the normalcy boundary based on the feature values within the normalcy boundary, and outputting information concerning the forecasted future feature value being outside the normalcy boundary for display.

Anomaly forecasting and early warning generation

An augmented system model may include a system high fidelity model that generates a first output. The augmented system model may further include a data driven model to receive data associated with the first output and to generate a second output, and a feature space version of the second output may be output from the augmented system model. Monitoring nodes may each generate a series of current monitoring node values over time representing current operation of an industrial asset. A model adaptation element may receive the current monitoring node values, calculate a feature space version of current operation, and compare the feature space version of the second output of the augmented system model with the feature space version of current operation. Parameters of the data driven model may then be adapted based on a result of the comparison.

Real-time adaptation of system high fidelity model in feature space

A control system having one or more controllers configured to determine physical or psychophysiological (3P) changes of an operator of a vehicle. First and second imaging devices take real-time images of an operator of a vehicle. Then, based on the physical, physiological and/or psychological features extracted from the imaging device data, and a 3P model from historical data the one or more processors also configured to, responsive to the physical, physiological and/or psychological changes of the operator of the vehicle, alert the operator and control the operation of the vehicle.

Control system and method

According to some embodiments, a validation platform computer may interpret at least one received data packet to identify a control command for a controller of an industrial asset control system. The at least data packet being might be received, for example, from a network associated with a current operation of the industrial asset control system. The control command may then be introduced into an industrial asset simulation executing in parallel with the industrial asset control system. A simulated result of the control command from the industrial asset simulation may be validated, and, upon validation of the simulated result, it may be arranged for the control command to be provided to the controller of the industrial asset control system. Additionally, in some embodiments failed validation of a simulated result will prompt a threat-alert signal as well as prevent the command (e.g., data packet) from continuing to the controller.

Validation of control command in substantially real time for industrial asset control system threat detection

According to some embodiments, streams of monitoring node signal values may be received over time that represent a current operation of an industrial asset control system. A current operating mode of the industrial asset control system may be received and used to determine a current operating mode group from a set of potential operating mode groups. For each stream of monitoring node signal values, a current monitoring node feature vector may be determined. Based on the current operating mode group, an appropriate decision boundary may be selected for each monitoring node, the appropriate decision boundary separating a normal state from an abnormal state for that monitoring node in the current operating mode. Each generated current monitoring node feature vector may be compared with the selected corresponding appropriate decision boundary, and a threat alert signal may be automatically transmitted based on results of said comparisons.

Multi-mode boundary selection for threat detection in industrial asset control system

In some embodiments, a plurality of real-time monitoring node signal inputs receive streams of monitoring node signal values over time that represent a current operation of the industrial asset control system. A threat detection computer platform, coupled to the plurality of real-time monitoring node signal inputs, may receive the streams of monitoring node signal values and, for each stream of monitoring node signal values, generate a current monitoring node feature vector. The threat detection computer platform may then compare each generated current monitoring node feature vector with a corresponding decision boundary for that monitoring node, the decision boundary separating a normal state from an abnormal state for that monitoring node, and localize an origin of a threat to a particular monitoring node. The threat detection computer platform may then automatically transmit a threat alert signal based on results of said comparisons along with an indication of the particular monitoring node.

Threat detection and localization for monitoring nodes of an industrial asset control system

According to some embodiments, a system, method and non-transitory computer-readable medium are provided to protect a decision manifold of a control system for an industrial asset, comprising: a detection and neutralization module including: a decision manifold having a receiver configured to receive a training dataset comprising data, wherein the decision manifold is operative to generate a first decision manifold with the received training dataset; and a detection model; a memory for storing program instructions; and a detection and neutralization processor, coupled to the memory, and in communication with the detection and neutralization module and operative to execute program instructions to: receive the first decision manifold, wherein the first decision manifold separates a normal operating space from an abnormal operating space; determine whether there are one or more inadequacies with the detection model; generate a corrected decision manifold based on the determined one or more inadequacies with the detection model; receive a projected adversary strategy; generate a resilient decision manifold based on the corrected decision manifold and received projected adversary strategy; and an output configured to output a neutralized signal to operate the industrial asset via the control system. Numerous other aspects are provided.

Framework for determining resilient manifolds

In some embodiments, an Unmanned Aerial Vehicle ('UAV') system may be associated with a plurality of monitoring nodes, each monitoring node generating a series of monitoring node values over time that represent operation of the UAV system. An attack detection computer platform may receive the series of current monitoring node values and generate a set of current feature vectors. The attack detection computer platform may access an attack detection model having at least one decision boundary (e.g., created using a set of normal feature vectors a set of attacked feature vectors). The attack detection model may then be executed and the platform may transmit an attack alert signal based on the set of current feature vectors and the at least one decision boundary. According to some embodiments, attack localization and/or neutralization functions may also be provided.

Cyber-attack detection, localization, and neutralization for unmanned aerial vehicles

According to some embodiments, a plurality of monitoring nodes may each generate a series of current monitoring node values over time that represent a current operation of the industrial asset. A node classification computer may determine, for each monitoring node, a classification result indicating whether each monitoring node is in a normal or abnormal state. A disambiguation engine may receive the classification results from the node classification computer and associate a Hidden Markov Model ('HMM') with each monitoring node. For each node in an abnormal state, the disambiguation engine may execute the HMM associated with that monitoring node to determine a disambiguation result indicating if the abnormal state is a result of an attack or a fault and output a current status of each monitoring node based on the associated classification result and the disambiguation result.

Decision system and method for separating faults from attacks

A plurality of monitoring nodes may each generate a time-series of current monitoring node values representing current operation of a cyber-physical system. A feature-based forecasting framework may receive the time-series of and generate a set of current feature vectors using feature discovery techniques. The feature behavior for each monitoring node may be characterized in the form of decision boundaries that separate normal and abnormal space based on operating data of the system. A set of ensemble state-space models may be constructed to represent feature evolution in the time-domain, wherein the forecasted outputs from the set of ensemble state-space models comprise anticipated time evolution of features. The framework may then obtain an overall features forecast through dynamic ensemble averaging and compare the overall features forecast to a threshold to generate an estimate associated with at least one feature vector crossing an associated decision boundary.

Situation awareness and dynamic ensemble forecasting of abnormal behavior in cyber-physical system

In some embodiments, an industrial asset may be associated with a plurality of monitoring nodes, each monitoring node generating a series of monitoring node values over time that represent operation of the industrial asset. A threat detection computer may determine that an attacked monitoring node is currently being attacked. Responsive to this determination, a virtual sensor coupled to the plurality of monitoring nodes may estimate a series of virtual node values for the attacked monitoring node(s) based on information received from monitoring nodes that are not currently being attacked. The virtual sensor may then replace the series of monitoring node values from the attacked monitoring node(s) with the virtual node values. Note that in some embodiments, virtual node values may be estimated for a particular node even before it is determined that the node is currently being attacked.

Using virtual sensors to accommodate industrial asset control systems during cyber attacks

Growing community of inventors

Fairport, NY, United States of America

Lalit Keshav Mestha