Distributed State Estimation for Real-Time Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing control systems lack effective security perimeter protections against unauthorized or malicious access, and conventional anomaly detection methods based on cyber behavior can be exploited by attackers, while state estimation systems are unsuitable for real-time detection of anomalies in cyber-physical attacks.
Innovation Solution
A state-estimation based anomaly detection system utilizing a distributed, multi-tier physical state monitoring system with lower-level and upper-level monitoring functions, combined with artificial intelligence/machine-learning models, to detect anomalies in real-time by analyzing physical state estimates and behavior patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional anomaly detection methods based on cyber behavior are used, then detection capability is provided, but the system can be exploited by attackers who conform attacks to known patterns
Solution Approach 1:
The patent replaces cyber-behavior-based detection with physical-state-based detection. Instead of monitoring digital network traffic and cyber behaviors, the system uses physical sensors to monitor actual physical states (temperature, pressure, flow rates) of the controlled process. This substitution makes the system resistant to cyber-attacks that conform to known patterns, as attackers cannot spoof physical measurements without actually altering the physical state, which would be detected by the anomaly detection algorithm.
2Measurement precision
If state estimation systems are used to monitor power systems, then system state can be estimated, but real-time detection of anomalies in cyber-physical attacks is not achievable
Solution Approach 1:
The patent implements preliminary action by continuously maintaining an updated state estimate of the power system through state estimation algorithms that process measurement data in real-time. The system pre-computes expected behavior models and thresholds, enabling immediate anomaly detection when deviations occur. This continuous state estimation combined with real-time comparison against expected behavior allows for timely detection of cyber-physical attacks without the delays associated with periodic snapshots.
3Productivity
If static state estimation systems are used, then periodic state estimates can be generated, but detection of dynamic anomalies during cyber-physical attacks is insufficient
Solution Approach 1:
The patent transitions from static to dynamic state estimation. The system continuously updates state estimates in real-time as new measurement data becomes available, rather than generating periodic snapshots. This dynamic approach allows the state estimate to reflect the current system state at any moment, enabling reliable detection of dynamic anomalies and transient conditions that occur during cyber-physical attacks. The dynamic state estimation maintains computational efficiency while significantly improving detection reliability.
Data Source
AI summary
Disclosed herein are systems and methods for anomaly detection. A distributed physical state estimation system determines low-level state estimates covering respective sections of a cyber-physical system based on raw, high-performance measurement data. Low-level state estimates may be determined for a plurality of sections (substations) concurrently. An upper-level state estimate may be derived from the low-level state estimates. Anomalies pertaining to the system may be detected through analysis of the low-level and upper-level state estimates. The anomalies may be analyzed to determined whether the system is exhibiting behavior indicative of a fault, cyber-attack, and/or compromise.