Resilient estimation for grid situational awareness

Patent metadata

Field	Value
Publication number	US-2021037044-A1
Application number	US-201916525807-A
Country	US
Kind code	A1
Filing date	Jul 30, 2019
Priority date	Jul 30, 2019
Publication date	Feb 4, 2021
Grant date	—

Abstract

According to some embodiments, a system, method and non-transitory computer-readable medium are provided to protect a cyber-physical system having a plurality of monitoring nodes comprising: a normal space data source storing, for each of the plurality of monitoring nodes, a series of normal monitoring node values over time that represent normal operation of the cyber-physical system; a situational awareness module including an abnormal data generation platform, wherein the abnormal data generation platform is operative to generate abnormal data to represent abnormal operation of the cyber-physical system using values in the normal space data source and a generative model; a memory for storing program instructions; and a situational awareness processor, coupled to the memory, and in communication with the situational awareness module and operative to execute the program instructions to: receive a data signal, wherein the received data signal is an aggregation of data signals received from one or more of the plurality of monitoring nodes, wherein the data signal includes at least one real-time stream of data source signal values that represent a current operation of the cyber-physical system; determine, via a trained classifier, whether the received data signal is a normal signal or an abnormal signal, wherein the trained classifier is trained with the generated abnormal data and normal data; localize an origin of an anomaly when it is determined the received data signal is the abnormal signal; receive the determination and localization at a resilient estimator module; execute the resilient estimator module to generate a state estimation for the cyber-physical system. Numerous other aspects are provided.

First claim

1 . A system to protect a cyber-physical system having a plurality of monitoring nodes comprising:
a normal space data source storing, for each of the plurality of monitoring nodes, a series of normal monitoring node values over time that represent normal operation of the cyber-physical system; a situational awareness module including an abnormal data generation platform, wherein the abnormal data generation platform is operative to generate abnormal data to represent abnormal operation of the cyber-physical system using values in the normal space data source and a generative model; a memory for storing program instructions; and a situational awareness processor, coupled to the memory, and in communication with the situational awareness module and operative to execute the program instructions to:
receive a data signal, wherein the received data signal is an aggregation of data signals received from one or more of the plurality of monitoring nodes, wherein the data signal includes at least one real-time stream of data source signal values that represent a current operation of the cyber-physical system;
determine, via a trained classifier, whether the received data signal is a normal signal or an abnormal signal, wherein the trained classifier is trained with the generated abnormal data and normal data;
localize an origin of an anomaly when it is determined the received data signal is the abnormal signal;
receive the determination and localization at a resilient estimator module; and
execute the resilient estimator module to generate a state estimation for the cyber-physical system.

2 . The system of claim 1 , wherein the abnormal data generation platform creates at least one of: (i) generated abnormal feature information, and (ii) generated abnormal monitoring node sensor values.

3 . The system of claim 1 , wherein the abnormal generation generative model comprises a complementary Generative Adversarial Network (GAN).

4 . The system of claim 3 , wherein the complimentary GAN includes a generator network and a discriminator network.

5 . The system of claim 4 , wherein the trained classifier is generated with program instructions comprising:
receive a set of normal training data; generate a simulated adversarial data set via the complementary GAN based on the received set of normal training data; generate at least one decision boundary based on the received set of normal training data and the simulated adversarial data set; and train the trained classifier to distinguish between normal and abnormal signals via the at least one decision boundary to generate the trained classifier.

6 . The system of claim 5 , wherein the adversarial data set is complementary to the set of normal training data.

7 . The system of claim 5 , further comprising program instructions to build a regression map between the received set of normal training data and a state of the cyber-physical system.

8 . The system of claim 1 , wherein the trained classifier is operative to output, for the received data signal an indication the data signal is one of abnormal or normal.

9 . The system of claim 1 , wherein localization of the origin of the anomaly is determined based on each monitoring node having its own decision boundary and the time at which a first decision boundary associated with a first monitoring node is crossed as compared to another time at which a second decision boundary associated with a second monitoring node is crossed.

10 . The system of claim 1 , wherein the abnormal data generation platform creates the generated abnormal data utilizing either: (i) no actual abnormal information from the cyber-physical system, or (ii) sparse actual abnormal information from the cyber-physical system.

11 . The system of claim 5 , wherein the at least one decision boundary is associated with at least one of: (i) a linear boundary, (ii) a non-linear boundary, and (iii) a plurality of boundaries.

12 . The system of claim 1 , wherein the cyber-physical system is associated with at least one of: (i) a power grid, (ii) an industrial control system, (iii) a heat recovery and steam generation unit, (iv) a turbine, (v) a gas turbine, (vi) an engine, (vii) a jet engine, (viii) a locomotive engine, (ix) a refinery, (x) a dam, (xi) an autonomous vehicle; and (xii) a drone.

13 . The system of claim 1 , wherein at least one monitoring node is associated with at least one of: (i) a sensor node, (ii) a critical sensor node, (iii) an actuator node, (iv)a controller node, and (v) a key software node.

14 . A method comprising:
receiving a data signal, wherein the received data signal is an aggregation of data signals received from one or more of a plurality of monitoring nodes, wherein the data signal includes at least one real-time stream of data source signal values that represent a current operation of the cyber-physical system; determining, via a trained classifier, whether the received data signal is a normal signal or an abnormal signal, wherein the trained classifier is trained with the generated abnormal data and normal training data; localizing an origin of an anomaly when it is determined the received data signal is the abnormal signal; receiving the determination and localization at a resilient estimator module; and executing the resilient estimator module to generate a state estimation for the cyber-physical system.

15 . The method of claim 14 , wherein the abnormal data generation platform creates at least one of: (i) generated abnormal feature information, and (ii) generated abnormal monitoring node sensor values.

16 . The method of claim 14 , wherein the abnormal generation generative model comprises a complementary Generative Adversarial Network (GAN).

17 . A non-transient, computer-readable medium storing instructions to be executed by a processor to perform a method comprising:
receiving a data signal, wherein the received data signal is an aggregation of data signals received from one or more of a plurality of monitoring nodes, wherein the data signal includes at least one real-time stream of data source signal values that represent a current operation of the cyber-physical system; determining, via a trained classifier, whether the received data signal is a normal signal or an abnormal signal, wherein the trained classifier is trained with the generated abnormal data and normal training data; localizing an origin of an anomaly when it is determined the received data signal is the abnormal signal; receiving the determination and localization at a resilient estimator module; and executing the resilient estimator module to generate a state estimation for the cyber-physical system.

18 . The medium of claim 17 , wherein the abnormal data generation platform creates at least one of: (i) generated abnormal feature information, and (ii) generated abnormal monitoring node sensor values.

19 . The medium of claim 17 , wherein the abnormal generation generative model comprises a complementary Generative Adversarial Network (GAN).

20 . The medium of claim 17 , wherein the trained classifier is generated with program instructions comprising:
receive a set of normal training data; generate a simulated adversarial data set via the complementary GAN based on the received set of normal training data; generate at least one decision boundary based on the received set of normal training data and the simulated adversarial data set; and train the trained classifier to distinguish between normal and abnormal signals via t

Assignees

• Gen Electric

Inventors

• Achanta Hema K
• Abbaszadeh Masoud
• Yan Weizhong
• Dokucu Mustafa Tekin

Classifications

• G06V10/82

  using neural networks · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G06F18/214

  Generating training patterns; Bootstrap methods, e.g. bagging or boosting · CPC title

• G06N3/045

  Combinations of networks · CPC title

• G06F18/2411

  based on the proximity to a decision surface, e.g. support vector machines · CPC title