Patent ID: 11916940
Assignee: GE INFRASTRUCTURE TECHNOLOGY LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A system to protect a cyber physical system, comprising:
a plurality of real-time monitoring nodes to receive streams of monitoring node signal values over time that represent a current operation of the cyber physical system, wherein each real-time monitoring node is one of a sensor or an actuator; and
a threat detection computer platform, coupled to the plurality of real-time monitoring nodes, to:
receive the monitoring node signal values;
compute an anomaly score;
select one of a multi-level process and a continuous process to generate an adaptive threshold;
generate the adaptive threshold via the selected process;
compare the anomaly score with the generated adaptive threshold; and
detect that one of a particular monitoring node and a system is outside a decision boundary based on the comparison, and classify that particular monitoring node or system as anomalous.