General Electric Company

Lockheed Martin Corporation

Ge Infrastructure Technology, LLC

Genworth Financial, Inc.

Ge Vernova Infrastructure Technology LLC

General Electric Renovables Espana, S.l.

Weizhong Yan

Piero Patrone Bonissone

Masoud Abbaszadeh

Naresh Sundaram Iyer

Kai F Goebel

Lalit Keshav Mestha

Anil Varma

Feng Xue

Neil Holger White Eklund

Matthew Christian Nielsen

Rajesh Venkat Subbu

Hai Qiu

Scott Charles Evans

Peter Henry Tu

Honggang Wang

Xiao Liang Hu

Frederick Wilson Wheeler

Timothy Gerard Richter

Karim Younsi

Bruce Gordon Barnett

Pradeep Vijayan

Justin Varkey John

Kareem Sherif Aggour

Xiaoming Liu

Mustafa Tekin Dokucu

James Kenneth Aragones

John Erik Hershey

Peter Michael Edic

Hao Huang

Lembit Salasoo

Achalesh Kumar Pandey

Sumit Bose

Rasiklal Punjalal Shah

Robert Frank Hoskin

Hema Kumari Achanta

Anindya Chakraborty

Yingneng Zhou

Cecil Rivers, Jr

Jeremy Impson

Vijaysai Prasad

Eric R Steinbrecher

Sean Dwyer

Bernhard Joseph Scholz

Rui Xu

Richard Paul Messmer

Sameh Ramadan Salem

Charles Terrance Hatch

Fernando Javier D'Amato

Daniel Francis Holzhauer

Aditya Kumar

Chaitanya Ashok Baone

Ya Xue

James Joseph Schmid

Ramu Sharat Chandra

Abdelkrim Younsi

Thomas Stephen Markham

Gian Carlo Montanari

Larry Swanson

Maria Iatrou

Robert J Mitchell, Jr

Erdogan Cesmeli

Olugbenga Moses Anubi

Santosh Sambamoorthy Veda

Stephen J Dill

Walter Charles Yund

Chad Eric Knodle

Richard Brownell Arthur

Bouchra Bouqata

Saikat Ray Majumder

Lincoln Mamoru Fujita

Noemie Dion Ouellet

Neil H Eklund

Yuh-Shyang Wang

Fuxiao Xin

Morgan Carthledge Salter

Richard Bejtlich

David Joseph Hartman

T Stephen Markham

Annartia Giani

Varma Anil

Kaveri Mahapatra

Zhaoyuan Yang

Piyush Mishra

Kai Frank Goebel

Richard J Mitchell

Timothy Gerard Ricter

According to some embodiments, a system, method and non-transitory computer readable medium are provided comprising a plurality of real-time monitoring nodes to receive streams of monitoring node signal values over time that represent a current operation of the cyber physical system; a local status determination module to determine an anomaly status for one or more nodes; a global status determination module to determine an anomaly status for the cyber physical system; a threat detection computer platform to: receive the monitoring node signal values, generate feature vectors from the values; compare the feature vectors with at least one decision boundary associated with each of a local abnormal detection model and a global abnormal detection model; and transmit an abnormal alert signal from the local status determination module and the global status determination module based on a result of each comparison. Numerous other aspects are provided.

Unified multi-agent system for abnormality detection and isolation

According to some embodiments, a system, method and non-transitory computer-readable medium are provided to protect a cyber-physical system having a plurality of monitoring nodes comprising: a normal space data source storing, for each of the plurality of monitoring nodes, a series of normal monitoring node values over time that represent normal operation of the cyber-physical system; a situational awareness module including an abnormal data generation platform, wherein the abnormal data generation platform is operative to generate abnormal data to represent abnormal operation of the cyber-physical system using values in the normal space data source and a generative model; a memory for storing program instructions; and a situational awareness processor, coupled to the memory, and in communication with the situational awareness module and operative to execute the program instructions to: receive a data signal, wherein the received data signal is an aggregation of data signals received from one or more of the plurality of monitoring nodes, wherein the data signal includes at least one real-time stream of data source signal values that represent a current operation of the cyber-physical system; determine, via a trained classifier, whether the received data signal is a normal signal or an abnormal signal, wherein the trained classifier is trained with the generated abnormal data and normal data; localize an origin of an anomaly when it is determined the received data signal is the abnormal signal; receive the determination and localization at a resilient estimator module; execute the resilient estimator module to generate a state estimation for the cyber-physical system. Numerous other aspects are provided.

Resilient estimation for grid situational awareness

Heterogeneous monitoring nodes may each generate a series of monitoring node values over time associated with operation of an industrial asset. An offline abnormal state detection model creation computer may receive the series of monitoring node values and perform a feature extraction process using a multi-modal, multi-disciplinary framework to generate an initial set of feature vectors. Then feature dimensionality reduction is performed to generate a selected feature vector subset. The model creation computer may derive digital models through a data-driven machine learning modeling method, based on input/output variables identified by domain experts or by learning from the data. The system may then automatically generate domain level features based on a difference between sensor measurements and digital model output. A decision boundary may then be automatically calculated and output for an abnormal state detection model based on the selected feature vector subset and the plurality of derived generated domain level features.

Feature extractions to model large-scale complex control systems

A method for detecting a cyberattack on a control system of a wind turbine includes providing a plurality of classification models of the control system. The method also includes receiving, via each of the plurality of classification models, a time series of operating data from one or more monitoring nodes of the wind turbine. The method further includes extracting, via the plurality of classification models, a plurality of features using the time series of operating data. Each of the plurality of features is a mathematical characterization of the time series of operating data. Moreover, the method includes generating an output from each of the plurality of classification models and determining, using a decision fusion module, a probability of the cyberattack occurring on the control system based on a combination of the outputs. Thus, the method includes implementing a control action when the probability exceeds a probability threshold.

System and method for cyberattack detection in a wind turbine control system

According to some embodiments, a system, method, and non-transitory computer readable medium are provided comprising a plurality of real-time monitoring nodes to receive streams of monitoring node signal values over time that represent a current operation of the cyber physical system; and a threat detection computer platform, coupled to the plurality of real-time monitoring nodes, to: receive the monitoring node signal values; compute an anomaly score; compare the anomaly score with an adaptive threshold; and detect that one of a particular monitoring node and a system is outside a decision boundary based on the comparison, and classify that particular monitoring node or system as anomalous. Numerous other aspects are provided.

Attack detection and localization with adaptive thresholding

According to some embodiments, a system, method and non-transitory computer readable medium are provided comprising a memory storing processor-executable steps; and a processor to execute the processor-executable steps to cause the system to: receive a first data value of a plurality of data values from a data store, wherein the first data value is from a digital twin model of an industrial asset; determine, via a vulnerability module, whether the received at least one data value is a near boundary case or not a near boundary case; in a case it is determined the first data value is a near boundary case, generate one or more adversarial samples for the first data value; input each of the one or more adversarial samples to the digital twin model; execute the digital twin model to output a system response for each input adversarial sample; determine whether the system response to each input adversarial sample has a negative impact; in a case it is determined the system response has a negative impact for a given input adversarial sample, update a trained attack detection model with the given input adversarial sample; and generate a second decision boundary based on the updated trained attack detection model. Numerous other aspects are provided.

Vulnerability-driven cyberattack protection system and method for industrial assets

An industrial asset may have monitoring nodes that generate current monitoring node values representing a current operation of the industrial asset. An abnormality detection computer may detect when a monitoring node is currently being attacked or experiencing a fault based on a current feature vector, calculated in accordance with current monitoring node values, and a detection model that includes a decision boundary. A model updater (e.g., a continuous learning model updater) may determine an update time-frame (e.g., short-term, mid-term, long-term, etc.) associated with the system based on trigger occurrence detection (e.g., associated with a time-based trigger, a performance-based trigger, an event-based trigger, etc.). The model updater may then update the detection model in accordance with the determined update time-frame (and, in some embodiments, continuous learning).

Systems and methods for global cyber-attack or fault detection model

A system for enhanced sequential power system model calibration is provided. The system is programmed to store a model of a device. The model includes a plurality of parameters. The system is also programmed to receive a plurality of events associated with the device, receive a first set of calibration values for the plurality of parameters, generate a plurality of sets of calibration values for the plurality of parameters, for each of the plurality of sets of calibration values, analyze a first event of the plurality of events using a corresponding set of calibration values to generate a plurality of updated sets of calibration values, analyze the plurality of updated sets of calibration values to determine a current updated set of calibration values, and update the model to include the current updated set of calibration values.

Systems and methods for enhanced sequential power system model parameter estimation

Briefly, embodiments are directed to a system, method, and article for identifying power system event signatures. Input measurement data may be received from one or more data sources relating to a power grid system. The input measurement data may comprise normal system operation measurement data and power system event measurement data. A processor may perform operations during an online application phase. During the online application phase, a feature matrix may be generated for the power system event measurement data and the at least one trained auto-associative model. The feature matrix for the power system event measurement data may be processed to determine power system event residuals. Also during the online application phase, the power system event signatures may be identified based on residual statistics for normal system operation measurement data residuals and on the power system event residuals.

Signature identification for power system events

According to embodiments, a system, method and non-transitory computer-readable medium are provided to receive time series data associated with one or more sensors values of a piece of machinery at a first time period, perform a non-linear transformation on the time-series data to produce one or more nonlinear temporal embedding outputs, and projecting each of the nonlinear temporal embedding outputs to a different dimension space to identify at least one causal relationship in the nonlinear temporal embedding outputs. The nonlinear embeddings are further projected to the original dimension space to produce one or more causality learning outputs. Nonlinear dimensional reduction is performed on the one or more causality learning outputs to produce reduced dimension causality learning outputs. The learning outputs are mapped to one or more predicted outputs which include a prediction of one or more of the sensor values at a second time period.

Deep causality learning for event diagnosis on industrial time-series data

A Cyber-Physical System ('CPS') may have monitoring nodes that generate a series of current monitoring node values representing current operation of the CPS. A normal space data source may store, for each monitoring node, a series of normal monitoring node values representing normal operation of the CPS. An abnormal data generation platform may utilize information in the normal space data source and a generative model to create generated abnormal to represent abnormal operation of the CPS. An abnormality detection model creation computer may receive the normal monitoring node values (and generate normal feature vectors) and automatically calculate and output an abnormality detection model including information about a decision boundary created via supervised learning based on the normal feature vectors and the generated abnormal data.

Intelligent data augmentation for supervised anomaly detection associated with a cyber-physical system

Systems and methods may be associated with a cyber-physical system, and a blueprint repository data store may contain electronic files that represent behavior-based asset monitoring parameters for different cyber-physical system asset types. A behavior-based asset monitoring creation computer platform may receive an indication of an asset type of the cyber-physical system. The behavior-based asset monitoring creation computer platform may then search the blueprint repository data store and retrieve an electronic file representing behavior-based asset monitoring parameters for the asset type of the cyber-physical system to be monitored. The behavior-based asset monitoring creation computer platform may also receive, from the remote operator device, adjustments to the retrieved behavior-based asset monitoring parameters and automatically configure, based on the adjusted behavior-based asset monitoring parameters, at least a portion of settings for an abnormal detection model. The abnormal detection model may then be created about output to be executed by an abnormal detection platform.

Framework to develop cyber-physical system behavior-based monitoring

Monitoring nodes may generate a series of current monitoring node values over time representing current operation of a cyber-physical system. A decision fusion computer platform may receive, from a local status determination module, an indication of whether each node has an initial local status of 'normal'/'abnormal' and a local certainty score (with higher values of the local certainty score representing greater likelihood of abnormality). The computer platform may also receive, from a global status determination module, an indication of whether the system has an initial global status of &#x201c;normal&#x201d;/&#x201c;abnormal&#x201d; and a global certainty score. The computer platform may output, for each node, a fused local status of &#x201c;normal&#x201d; or &#x201c;abnormal,&#x201d; at least one fused local status being based on the initial global status. The decision fusion computer platform may also output a fused global status of &#x201c;normal&#x201d; or &#x201c;abnormal&#x201d; based on at least one initial local status.

Local and global decision fusion for cyber-physical system abnormality detection

According to some embodiments, a system, method and non-transitory computer-readable medium are provided to protect a decision manifold of a control system for an industrial asset, comprising: a detection and neutralization module including: a decision manifold having a receiver configured to receive a training dataset comprising data, wherein the decision manifold is operative to generate a first decision manifold with the received training dataset; and a detection model; a memory for storing program instructions; and a detection and neutralization processor, coupled to the memory, and in communication with the detection and neutralization module and operative to execute program instructions to: receive the first decision manifold, wherein the first decision manifold separates a normal operating space from an abnormal operating space; determine whether there are one or more inadequacies with the detection model; generate a corrected decision manifold based on the determined one or more inadequacies with the detection model; receive a projected adversary strategy; generate a resilient decision manifold based on the corrected decision manifold and received projected adversary strategy; and an output configured to output a neutralized signal to operate the industrial asset via the control system. Numerous other aspects are provided.

Framework for determining resilient manifolds

Growing community of inventors

Clifton Park, NY, United States of America

Weizhong Yan