Title: Learning method and system for separating independent and dependent attacks

Abstract

Streams of monitoring node signal values over time, representing a current operation of the industrial asset, are used to generate current monitoring node feature vectors. Each feature vector is compared with a corresponding decision boundary separating normal from abnormal states. When a first monitoring node passes a corresponding decision boundary, an attack is detected and classified as an independent attack. When a second monitoring node passes a decision boundary, an attack is detected and a first decision is generated based on a first set of inputs indicating if the attack is independent/dependent. From the beginning of the attack on the second monitoring node until a final time, the first decision is updated as new signal values are received for the second monitoring node. When the final time is reached, a second decision is generated based on a second set of inputs indicating if the attack is independent/dependent.

Inventors:

Mestha, Lalit Keshav; Abbaszadeh, Masoud; Giani, Annartia

Issue Date:

Tue Sep 22 00:00:00 EDT 2020

Research Org.:

General Electric Co., Schenectady, NY (United States)

Sponsoring Org.:

USDOE

OSTI Identifier:

1735308

Patent Number(s):

10785237

Application Number:

15/977,558

Assignee:

General Electric Company (Schenectady, NY)

Patent Classifications (CPCs):

G - PHYSICS G06 - COMPUTING G06N - COMPUTER SYSTEMS BASED ON SPECIFIC COMPUTATIONAL MODELS

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION

Show more

G - PHYSICS G06 - COMPUTING G06N - COMPUTER SYSTEMS BASED ON SPECIFIC COMPUTATIONAL MODELS

G06N20/10 - using kernel methods, e.g. support vector machines [SVM]
G06N20/20 - Ensemble learning
G06N3/08 - Learning methods

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION

H04L63/1416 - {Event detection, e.g. attack signature detection}
H04L63/1425 - {Traffic logging, e.g. anomaly detection}
H04L63/1441 - {Countermeasures against malicious traffic

Show less

DOE Contract Number:  

OE0000833

Resource Type:

Patent

Resource Relation:

Patent File Date: 05/11/2018

Country of Publication:

United States

Language:

English

Subject:

97 MATHEMATICS AND COMPUTING