Multi-class decision system for categorizing industrial asset attack and fault types

Patent metadata

Field	Value
Publication number	US-10686806-B2
Application number	US-201715681827-A
Country	US
Kind code	B2
Filing date	Aug 21, 2017
Priority date	Aug 21, 2017
Publication date	Jun 16, 2020
Grant date	Jun 16, 2020

Abstract

According to some embodiments, a plurality of monitoring nodes may each generate a series of current monitoring node values over time that represent a current operation of the industrial asset. A node classifier computer, coupled to the plurality of monitoring nodes, may receive the series of current monitoring node values and generate a set of current feature vectors. The node classifier computer may also access at least one multi-class classifier model having at least one decision boundary. The at least one multi-class classifier model may be executed and the system may transmit a classification result based on the set of current feature vectors and the at least one decision boundary. The classification result may indicate, for example, whether a monitoring node status is normal, attacked, or faulty.

First claim

The invention claimed is:

1. A system to protect an industrial asset, comprising:
a plurality of monitoring nodes each generating a series of current monitoring node values over time that represent a current operation of the industrial asset; and
a node classifier computer, coupled to the plurality of monitoring nodes, to:
(i) receive the series of current monitoring node values and generate a set of current feature vectors, wherein information from each of the plurality of monitoring nodes is normalized and an output is expressed as a weighted linear combination of basis functions,
(ii) access at least one multi-class classifier model having at least one decision boundary, and
(iii) execute the at least one multi-class classifier model and transmit a classification result based on the set of current feature vectors and the at least one decision boundary, wherein the classification result indicates whether a monitoring node status is normal, attacked, or fault.

2. The system of claim 1 , wherein at least one monitoring node is associated with at least one of: (i) a sensor node, (ii) a critical sensor node, (iii) an actuator node, (iv) a controller node, and (v) a key software node.

3. The system of claim 1 , wherein the classification result further includes, in the case of a monitoring node status indicating a fault, a failure mode.

4. The system of claim 1 , wherein the set of current feature vectors includes at least one of: (i) a local feature vector associated with a particular monitoring node, and (ii) a global feature vector associated with a plurality of monitoring nodes.

5. The system of claim 1 , wherein the set of current feature vectors are associated with at least one of: (i) principal components, (ii) statistical features, (iii) deep learning features, (iv) frequency domain features, (v) time series analysis features, (vi) logical features, (vii) geographic or position based locations, and (viii) interaction features.

6. The system of claim 1 , wherein the multi-class classifier model is associated with at least one of: (i) an actuator attack, (ii) a controller attack, (iii) a monitoring node attack, (iv) a plant state attack, (v) spoofing, (vi) financial damage, (vii) unit availability, (viii) a unit trip, (ix) a loss of unit life, and (x) asset damage requiring at least one new part.

7. The system of claim 1 , wherein the at least one decision boundary is associated with at least one of: (i) a line, (ii) a hyperplane, and (iii) a non-linear boundary.

8. The system of claim 1 , wherein said executing includes:
determining, by a global binary classifier, whether the industrial asset is normal or abnormal;
when the industrial asset is abnormal, determining, by a 3-class classifier for each monitoring node, whether the node is normal, attacked, or faulty; and
when a node is faulty, determining, by a multi-class classifier for each monitoring node, a failure mode for the monitoring node.

9. The system of claim 1 , wherein said executing includes
determining, by a global binary classifier, whether the industrial asset is normal or abnormal; and
when the industrial asset is abnormal, determining, by a multi-class classifier for each monitoring node, whether the node is normal, attacked, or one of a pre-determined number of failure modes.

10. The system of claim 1 , wherein said executing includes
determining, by a 3-class classifier for each monitoring node, whether the node is normal, attacked, or faulty; and
when a node is faulty, determining, by a multi-class classifier for each monitoring node, a failure mode for the monitoring node.

11. The system of claim 1 , wherein said executing includes
determining, by a multi-class classifier for each monitoring node, whether the node is normal, attacked, or faulty, or one of a pre-determined number of failure modes.

12. The system of claim 1 , wherein said executing includes
determining, by global multi-class classifier, whether each monitoring node is normal or abnormal;
when a monitoring node is abnormal, determining, by a binary classifier for each monitoring node, whether the node is attacked or faulty; and
when a node is faulty, determining, by a multi-class classifier for each monitoring node, a failure mode for the monitoring node.

13. The system of claim 1 , wherein said executing includes
determining, by global multi-class classifier, whether each monitoring node is normal or abnormal;
when a monitoring node is abnormal, determining, by a binary classifier for each monitoring node, whether the node is attacked or one of a pre-determined number of failure modes.

14. The system of claim 1 , further comprising:
a normal space data source storing, for each of the plurality of monitoring nodes, a series of normal monitoring node values over time that represent normal operation of the industrial asset;
an attacked space data source storing, for each of the plurality of monitoring nodes, a series of attacked monitoring node values over time that represent attacked operation of the industrial asset;
a faulty space data source storing, for each of the plurality of monitoring nodes, a series of faulty monitoring node values over time that represent faulty operation of the industrial asset; and
a multi-class classifier model creation computer, coupled to the normal space data source, the attacked space data source, and the fault space data source, to:
(i) receive the series of normal monitoring node values and generate a set of normal feature vectors,
(ii) receive the series of attacked monitoring node values and generate a set of attacked feature vectors,
(iii) receive the series of faulty monitoring node values and generate a set of faulty feature vectors, and
(iv) automatically calculate and output the at least one decision boundary for the multi-class classifier model based on the set of normal feature vectors, the set of attacked feature vectors, and the set of faulty feature vectors.

15. The system of claim 14 , wherein at least one of the series of normal monitoring node values, the series of attacked monitoring node values, and the series of faulty monitoring node values are associated with a high fidelity equipment model.

16. The system of claim 14 , wherein at least one decision boundary exists in a multi-dimensional space and is associated with at least one of: (i) a dynamic model, (ii) design of experiment data, (iii) machine learning techniques, (iv) a support vector machine, (v) a full factorial process, (vi) Taguchi screening, (vii) a central composite methodology, (viii) a Box-Behnken methodology, (ix) real-world operating conditions, (x) a full-factorial design, (xi) a screening design, and (xii) a central composite design.

17. The system of claim 14 , wherein at least one of the normal, attacked, and faulty monitoring node values are obtained by running design of experiments on an industrial control system associated with at least one of: (i) a turbine, (ii) a gas turbine, (iii) a wind turbine, (iv) an engine, (v) a jet engine, (vi) a locomotive engine, (vii) a refinery, (viii) a power grid, and (ix) an autonomous vehicle.

18. A computerized method to protect an industrial asset, comprising:
receiving, from a normal space data source for each of a plurality of monitoring nodes, a series of normal monitoring node values over time that represent normal operation of the industrial asset;
receiving, from an attacked space data source for each of the plurality of monitoring nodes, a series of attacked monitoring node values over time that represent attacked

Assignees

• Gen Electric

Inventors

• Abbaszadeh Masoud
• Mestha Lalit Keshav
• Yan Weizhong

Classifications

• Y04S40/20

  Information technology specific aspects, e.g. CAD, simulation, modelling, system security · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title