Ao Kaspersky Lab

Vyacheslav I Shkulev

Andrey B Lavrentyev

Nikolay N Demidov

Dmitry A Ivanov

Artem M Vorontsov

Pavel V Filonov

Dmitry K Shalyga

Alexander V Travov

Maxim A Mamaev

Artyom M Nechiporuk

A method for diagnostics and monitoring of anomalies in a cyber-physical system (CPS) includes obtaining information related to anomalies identified in the CPS. The obtained information includes at least one value of one or more CPS variables. One or more classifying features of the identified anomalies in the CPS are generated based on the obtained information. Classification of the identified anomalies in the CPS into two or more anomaly classes is performed based on the generated classifying features. Each of the two or more anomaly classes is associated with one or more anomaly characteristics. Diagnostics of anomalies are performed in each of the two or more anomaly classes by calculating values of the anomaly characteristics associated with each of the two or more anomaly classes. Anomalies of each of the two or more anomaly classes are monitored based on the calculated values of the anomaly characteristics associated with each of the two or more anomaly classes.

System and method for diagnostics and monitoring of anomalies of a cyber-physical system

Systems and methods for determining a source of anomaly in a cyber-physical system (CPS). A forecasting tool can obtain a plurality of CPS feature values during an input window and forecast the plurality of CPS feature values for a forecast window. An anomaly identification tool can determine a total forecast error for the plurality of CPS features in the forecast window, identify an anomaly in the cyber-physical system when the total forecast error exceeds a total error threshold, and identify at least one CPS feature as the source of the anomaly.

System and method for detecting anomalies in cyber-physical system with determined characteristics

The present disclosure provides systems and methods of early determination of anomalies using a graphical user interface. In one aspect such a method comprises: receiving information about one or more features of a cyber-physical system, receiving information about a period of time for monitoring the one or more features, generating a forecast of values of the one or more features of the cyber-physical system over the period of time based on a forecasting model for graphing in a graphical user interface, determining a total error of the forecast for all of the one or more features and determining an error for each of the one or more features over the period of time, determining that the error for one feature of the one or more features is greater than a predetermined threshold and identifying the one feature as a source of an anomaly in the cyber-physical system.

System and method of generating data for monitoring of a cyber-physical system for early determination of anomalies

Growing community of inventors

Moscow, Russia

Vyacheslav I Shkulev