Patent ID: 11934522
Assignee: CARRIER CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC G  H  Y | IPC G  H

Claim 12:
13. A method for detecting malicious activity in a smart building system comprising:
detecting power input characteristics of a building including multiple smart building systems behind a meter;
comparing detected power characteristics against a predefined physics model of expected power characteristics and providing an alert to a combination module when at least one detected power characteristic varies from the expected power characteristics;
comparing the detected power characteristics against a machine learning model of expected power characteristics and providing an alert to the combination module when at least one detected power characteristic varies from the machine learned expected power characteristics;
each of the physics model and the machine learning model separately determining whether there is an anomaly, and wherein when at least one of the physics model and the machine learning model detects an anomalous power characteristic input, the at least one of the physics model and the machine learning model provides a malicious event alert and a corresponding confidence rate to a combination module; and
once a malicious event is detected
if both the physics model and the machine learning model have indicated a presence of the malicious event and a predetermined confidence level is achieved, outputting an alert from the combination module, or
if only one of the physics model and the machine learning model have indicated a presence of the malicious event, performing a tiebreaker analysis with the combination module based on confidence rates from the physics model and the machine learning model across a time window to determine whether to output the alert.