CPS Anomaly Detection Using Forecast Error Thresholds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cyber-physical systems (CPS) face challenges in detecting anomalies in a timely manner, as existing methods are inert and rely on manual intervention, leading to delayed detection and increased risk in hazardous environments like the petrochemical industry, where equipment failures and cyber attacks can cause significant threats.
Innovation Solution
A system is developed that builds a CPS feature values forecasting model to calculate a total error threshold, allowing for early anomaly detection by identifying when the total forecast error exceeds the calculated threshold, and pinpointing the source of the anomaly based on contributing features.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional Emergency Shutdown Systems (ESS) with manual control are used, then system reliability is maintained through human decision-making, but the detection time of anomalies is delayed due to considerable inertness of processes
Solution Approach 1:
The system performs preliminary actions by continuously forecasting CPS feature values and calculating total forecast errors in advance, comparing them against pre-determined thresholds to detect anomalies before they manifest as actual threats, thereby reducing detection time while maintaining reliability through automated preliminary monitoring
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring CPS feature values, comparing actual values against forecasted values, and automatically adjusting anomaly detection based on the total forecast error, enabling real-time feedback loops that reduce detection delays while maintaining system reliability
2Ease of operation
If built-in self-diagnostics systems are deployed on individual devices, then local monitoring capability is improved, but the system remains isolated from other processes and detection occurs at a later stage
Solution Approach 1:
The system merges isolated local monitoring capabilities into a unified centralized platform that aggregates CPS feature values from multiple devices and processes, enabling correlated analysis across the entire system and reducing anomaly detection time by identifying patterns that span multiple previously isolated monitoring points
3Loss of information
If additional external monitoring systems are installed, then diagnostic information processing capacity is increased, but the cost and complexity of the system become excessively high
Solution Approach 1:
The system implements multi-functionality by using a single centralized platform that performs multiple functions: collecting CPS feature values, forecasting values, calculating errors, detecting anomalies, and identifying sources, thereby achieving unlimited diagnostic information processing capacity without the complexity and cost of multiple separate external monitoring systems
Data Source
AI summary
Systems and methods for determining a source of anomaly in a cyber-physical system (CPS). A forecasting tool can obtain a plurality of CPS feature values during an input window and forecast the plurality of CPS feature values for a forecast window. An anomaly identification tool can determine a total forecast error for the plurality of CPS features in the forecast window, identify an anomaly in the cyber-physical system when the total forecast error exceeds a total error threshold, and identify at least one CPS feature as the source of the anomaly.