Self-certified security for assured cyber-physical systems

Patent metadata

Field	Value
Publication number	US-11343266-B2
Application number	US-201916436093-A
Country	US
Kind code	B2
Filing date	Jun 10, 2019
Priority date	Jun 10, 2019
Publication date	May 24, 2022
Grant date	May 24, 2022

Abstract

Methods and systems for self-certifying secure operation of a cyber-physical system having a plurality of monitoring nodes. In an embodiment, an artificial intelligence (AI) watchdog computer platform obtains, using the output of a local features extraction process of time series data of a plurality of monitoring nodes of a cyber-physical system and a global features extraction process, global features extraction data. The AI watchdog computer platform then obtains reduced dimensional data, generates an updated decision boundary, compares the updated decision boundary to a certification manifold, determines based on the comparison that the updated decision boundary is certified, and determines, based on an anomaly detection process, whether the cyber-physical system is behaving normally or abnormally.

First claim

We claim:

1. A method for self-certifying secure operation of a cyber-physical system having a plurality of monitoring nodes, wherein each monitoring node generates a series of current monitoring node values over time representing current operation of the cyber-physical system, comprising:
obtaining, by an artificial intelligence (AI) watchdog computer platform using the output of a local features extraction process of time series data of a plurality of monitoring nodes of a cyber-physical system and a global features extraction process, global features extraction data;
generating, by the AI watchdog computer platform utilizing a resilient dimensionality reduction process on the global features extraction data, reduced dimensional data;
generating, by the AI watchdog computer platform based on the reduced dimensional data, an updated decision boundary;
comparing, by the AI watchdog computer platform, the updated decision boundary to a certification manifold comprising polytypic bounds on current values of the features of the cyber-physical system;
determining, by the AI watchdog computer platform based on the comparison of the updated decision boundary to the certification manifold, that the updated decision boundary is certified;
determining, by the AI watchdog computer platform based on an anomaly detection process, whether the cyber-physical system is behaving normally or abnormally;
transmitting, by the AI watchdog computer platform, at least one of certification signals, normal system status signals, and abnormal system status signals to at least one remote monitoring device;
receiving, by the AI watchdog computer platform from an abnormality detection and localization computer platform, data comprising a current decision boundary of a cyber security system of the cyber-physical system;
determining, by the AI watchdog computer platform, that the current decision boundary does not satisfy the certified decision boundary; and
correcting, by the AI watchdog computer platform, the current decision boundary by projecting it onto the certification manifold.

2. The method of claim 1 , further comprising, transmitting, by the AI watchdog computer platform to the abnormality detection and localization computer platform, the corrected decision boundary.

3. The method of claim 1 , further comprising, transmitting, by the AI watchdog computer platform to a monitoring device of an operator, a system status message indicating a possible attack on the cyber-security system.

4. The method of claim 1 , further comprising:
setting, by the AI watchdog computer platform, a boundary status to projected; and
determining, by the AI watchdog computer platform based on an anomaly detection process, whether the cyber-physical system is behaving normally or abnormally.

5. The method of claim 4 , further comprising transmitting, by the AI watchdog computer platform to a monitoring device of an operator, a system status message indicating one of normal or abnormal behavior of the cyber-physical system.

6. The method of claim 1 , wherein the certification manifold is generated utilizing an off-line training process.

7. The method of claim 6 , wherein the off-line training process comprises:
generating, by the AI watchdog computer platform based on a local features extraction process of time series data of monitoring nodes data associated with the cyber-physical system and a global features extraction process, global features extraction data;
generating, by the AI watchdog computer platform using a resilient dimensionality reduction process on the global features extraction data, resilient reduced dimensional data;
generating, by the AI watchdog computer platform using a training classifier on the reduced dimensional data, a decision boundary; and
generating, by the AI watchdog computer platform using invariance learning on the reduced dimensional data, on the decision boundary, and on at least two of system models data, known invariances data, known system invariances data and data-driven uncertainty quantification data, a certification manifold.

8. The method of claim 7 , wherein invariance learning comprises utilizing at least one of a first-principle physics-based learning process of the intrinsic physical invariances of the cyber-physical systems and a data-driven learning process of the invariant principles of a cyber-physical system using artificial intelligence (AI) processing.

9. The method of claim 8 , wherein the AI processing comprises at least one of deep neural networks, recurrent neural networks, and gaussian models.

10. The method of claim 1 , wherein the global features extraction process comprises one of obtaining higher level features from local features and obtaining features that capture interaction between different signals directly from the time series data.

11. The method of claim 1 , wherein the local features extraction process comprises:
receiving, by the AI watchdog computer platform, monitoring node data of a plurality of monitoring nodes;
extracting, by the AI watchdog computer platform, feature data from the monitoring node data of each monitoring node;
utilizing, by the AI watchdog computer platform, a random projection for dimensionality reduction process on the feature data of each monitoring node to obtain corresponding projection data for each node; and
training, by the AI watchdog computer platform, corresponding classifiers to detect anomalies corresponding to each node.

12. A system for self-certifying secure operation of a cyber-physical system having a plurality of monitoring nodes wherein each monitoring node generates a series of current monitoring node values over time representing current operation of the cyber-physical system, comprising:
an abnormality detection and localization computer platform operably connected to a cyber-physical system; and
an artificial intelligence (AI) watchdog computer platform operably connected to the abnormality detection and localization computer platform and the cyber-physical system, the AI watchdog computer comprising a watchdog processor and a memory, wherein the memory stores executable instructions which when executed cause the watchdog processor to:
obtain global features extraction data by using the output of a local features extraction process of time series data of a plurality of monitoring nodes of a cyber-physical system and a global features extraction process;
generate, utilizing a resilient dimensionality reduction process on the global features extraction data, reduced dimensional data;
generate an updated decision boundary based on the reduced dimensional data;
compare the updated decision boundary to a certification manifold comprising polytypic bounds on current values of the features of the cyber-physical system;
determine, based on the comparison of the updated decision boundary to the certification manifold, that the updated decision boundary is certified;
determine, based on an anomaly detection process, whether the cyber-physical system is behaving normally or abnormally;
transmit at least one of certification signals, normal system status signals, and abnormal system status signals to at least one remote monitoring device;
receive, from an abnormality detection and localization computer platform, data comprising a current decision boundary of a cyber security system of the cyber-physical system;
determine that the current decision boundary does not satisfy the certified decision boundary; and
correct the current decision boundary by projecting it onto the certification manifold.

13. The system of claim 12 , wherein the memory of the AI watchdog

Assignees

• Gen Electric

Inventors

• Abbaszadeh Masoud
• Achanta Hema K
• Dokucu Mustafa Tekin
• Nielsen Matthew
• John Justin Varkey

Classifications

• H04L41/28

  Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L41/16

  using machine learning or artificial intelligence · CPC title

• H04L41/142

  using statistical or mathematical methods · CPC title