Decision Fusion Platform for Cyber-Physical System Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods fail to automatically detect cyber-attacks at the domain layer of industrial control systems, where sensors, controllers, and actuators are located, and are inadequate for handling multiple simultaneous attacks or faults, leading to potential catastrophic damage.
Innovation Solution
A decision fusion computer platform receives local and global status indications from monitoring nodes, generating fused statuses and certainty scores to accurately detect abnormalities, including cyber-attacks, and outputting alerts for automatic response.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple monitoring nodes are used to detect cyber-attacks, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The system segments the monitoring function into multiple independent monitoring nodes distributed across the cyber-physical system. Each node independently monitors specific parameters and generates local decisions, which are then combined through decision fusion to achieve comprehensive detection accuracy without requiring a single complex centralized system.
Solution Approach 2:
The system merges the detection results from multiple monitoring nodes through decision fusion algorithms. By combining local decisions and measurements from distributed nodes, the system achieves improved overall detection accuracy while maintaining the simplicity of individual node designs.
2Reliability
If decision fusion is implemented to combine local and global status, then detection reliability improves, but computational complexity increases
Solution Approach 1:
The decision fusion process is segmented into hierarchical levels: local status determination at each monitoring node and global status determination at the system level. This segmentation allows computational tasks to be distributed, improving reliability through comprehensive analysis while managing computational complexity through structured division of work.
Solution Approach 2:
The decision fusion algorithm acts as an intermediary that combines local decisions from monitoring nodes with global system status. This intermediary layer processes and reconciles information from multiple sources, improving detection reliability by considering both local and global contexts while managing computational complexity through structured information integration.
Data Source
AI summary
Monitoring nodes may generate a series of current monitoring node values over time representing current operation of a cyber-physical system. A decision fusion computer platform may receive, from a local status determination module, an indication of whether each node has an initial local status of “normal”/“abnormal” and a local certainty score (with higher values of the local certainty score representing greater likelihood of abnormality). The computer platform may also receive, from a global status determination module, an indication of whether the system has an initial global status of “normal”/“abnormal” and a global certainty score. The computer platform may output, for each node, a fused local status of “normal” or “abnormal,” at least one fused local status being based on the initial global status. The decision fusion computer platform may also output a fused global status of “normal” or “abnormal” based on at least one initial local status.