Patent ID: 11916940
Assignee: GE INFRASTRUCTURE TECHNOLOGY LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 17:
18. A non-transitory, computer-readable medium storing program code, the program code executable by a computer processor to cause the processor to perform a method to protect a cyber physical system associated with a plurality of real-time monitoring nodes, each generating a series of current monitoring node values over time that represent a current operation of the cyber physical system, the method comprising:
receiving a stream of monitoring node signal values from the plurality of real-time monitoring nodes, wherein each real-time monitoring node is one of a sensor and an actuator;
computing an anomaly score;
selecting one of a multi-level process and a continuous process to generate an adaptive threshold;
generating the adaptive threshold via the selected process;
comparing the anomaly score with the generated adaptive threshold; and
detecting that one of a particular monitoring node and a system is outside a decision boundary based on the comparison, and classifying that particular monitoring node or system as anomalous.