Systems and methods for global cyber-attack or fault detection model
Abstract
An industrial asset may have monitoring nodes that generate current monitoring node values representing a current operation of the industrial asset. An abnormality detection computer may detect when a monitoring node is currently being attacked or experiencing a fault based on a current feature vector, calculated in accordance with current monitoring node values, and a detection model that includes a decision boundary. A model updater (e.g., a continuous learning model updater) may determine an update time-frame (e.g., short-term, mid-term, long-term, etc.) associated with the system based on trigger occurrence detection (e.g., associated with a time-based trigger, a performance-based trigger, an event-based trigger, etc.). The model updater may then update the detection model in accordance with the determined update time-frame (and, in some embodiments, continuous learning).
- Inventors:
- Issue Date:
- Research Org.:
- General Electric Co., Schenectady, NY (United States)
- Sponsoring Org.:
- USDOE
- OSTI Identifier:
- 2222234
- Patent Number(s):
- 11740618
- Application Number:
- 17/239,054
- Assignee:
- General Electric Company (Schenectady, NY)
- DOE Contract Number:
- OE0000903
- Resource Type:
- Patent
- Resource Relation:
- Patent File Date: 04/23/2021
- Country of Publication:
- United States
- Language:
- English
Citation Formats
Xu, Rui, Yan, Weizhong, Abbaszadeh, Masoud, and Nielsen, Matthew Christian. Systems and methods for global cyber-attack or fault detection model. United States: N. p., 2023.
Web.
Xu, Rui, Yan, Weizhong, Abbaszadeh, Masoud, & Nielsen, Matthew Christian. Systems and methods for global cyber-attack or fault detection model. United States.
Xu, Rui, Yan, Weizhong, Abbaszadeh, Masoud, and Nielsen, Matthew Christian. Tue .
"Systems and methods for global cyber-attack or fault detection model". United States. https://www.osti.gov/servlets/purl/2222234.
@article{osti_2222234,
title = {Systems and methods for global cyber-attack or fault detection model},
author = {Xu, Rui and Yan, Weizhong and Abbaszadeh, Masoud and Nielsen, Matthew Christian},
abstractNote = {An industrial asset may have monitoring nodes that generate current monitoring node values representing a current operation of the industrial asset. An abnormality detection computer may detect when a monitoring node is currently being attacked or experiencing a fault based on a current feature vector, calculated in accordance with current monitoring node values, and a detection model that includes a decision boundary. A model updater (e.g., a continuous learning model updater) may determine an update time-frame (e.g., short-term, mid-term, long-term, etc.) associated with the system based on trigger occurrence detection (e.g., associated with a time-based trigger, a performance-based trigger, an event-based trigger, etc.). The model updater may then update the detection model in accordance with the determined update time-frame (and, in some embodiments, continuous learning).},
doi = {},
journal = {},
number = ,
volume = ,
place = {United States},
year = {2023},
month = {8}
}
Works referenced in this record:
Dynamic Concurrent Learning Method to Neutralize Cyber Attacks and Faults for Industrial Asset Monitoring Nodes
patent-application, July 2019
- Mestha, Lalit Keshav; Anubl, Olugbenga; Achanta, hema
- US Patent Application 15/986,996; 2019/0230119 Al
Attack Detection for Securing Cyber Physical Systems
journal, October 2019
- Yan, Weizhong; Mestha, Lalit K.; Abbaszadeh, Masoud
- IEEE Internet of Things Journal, Vol. 6, Issue 5
Continuous learning for intrusion detection
patent, August 2019
- Luo, Pengcheng; Briggs, Reeves Hoppe; Ahmad, Naveed
- US Patent Document 10,397,258