CPS Forecast Error Thresholding for Fast Anomaly Source Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cyber-physical systems (CPS) face challenges in detecting anomalies in a timely manner, as existing methods are inefficient and often result in delayed detection, which can lead to safety issues and increased costs due to the complexity and costliness of traditional monitoring systems.
Innovation Solution
A system is developed that builds a CPS feature values forecasting model to calculate a total error threshold based on CPS characteristics, allowing for early anomaly detection by identifying when the total forecast error exceeds the calculated threshold, and pinpointing the source of the anomaly by determining the contribution of each feature to the total error.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional monitoring systems are used to detect anomalies in CPS, then detection can be performed, but the time to detect anomalies is delayed and system complexity increases
Solution Approach 1:
The system performs preliminary actions by building a forecasting model during normal operation to learn the expected behavior patterns of CPS features. This model continuously generates forecasts even before anomalies occur, enabling immediate detection when actual values deviate from predictions, thus reducing anomaly detection time without sacrificing reliability
Solution Approach 2:
The system implements feedback by continuously comparing actual CPS feature values against forecasted values and using the error analysis to identify anomalies. The feedback loop calculates total forecast errors, determines contribution ratios of individual features, and triggers alerts when anomalies are detected, creating a responsive monitoring mechanism that reduces detection delay
2Reliability
If traditional monitoring systems are used to detect anomalies in CPS, then detection can be performed, but system complexity and cost increase
Solution Approach 1:
The system applies self-service by utilizing the CPS's own operational data and feature values to train and operate the forecasting model. The model learns from the system's normal behavior and monitors itself for anomalies, eliminating the need for separate complex monitoring infrastructure and reducing overall system complexity while maintaining detection reliability
Solution Approach 2:
The system changes parameters by transforming raw CPS feature values into forecasted values and error metrics. By monitoring changes in forecast errors rather than raw values directly, the system simplifies the monitoring task and reduces complexity while maintaining reliable anomaly detection capability
3Measurement precision
If forecasting model is used to detect anomalies, then detection accuracy improves, but false responses may occur
Solution Approach 1:
The system applies partial action by not treating all forecast errors as anomalies. Instead, it calculates the total forecast error and compares it against a dynamically determined threshold, triggering anomaly detection only when errors exceed this threshold. This selective approach improves detection accuracy while reducing false responses by filtering out normal variations
Data Source
Figure 1a
Figure 1b
Figure 1c
AI summary
Systems and methods for determining a source of anomaly in a cyber-physical system (CPS). A forecasting tool can obtain a plurality of CPS feature values during an input window and forecast the plurality of CPS feature values for a forecast window. An anomaly identification tool can determine a total forecast error for the plurality of CPS features in the forecast window, identify an anomaly in the cyber-physical system when the total forecast error exceeds a total error threshold, and identify at least one CPS feature as the source of the anomaly.