Patent Document ID: 9569615
Application ID: 15152702

Base Claim:
1. A computer implemented method for detecting cyber physical system behavior, comprising: utilizing one or more hardware processors and associated memory storing one or more programs for execution by the one or more hardware processors, the one or more programs including instructions for: receiving data from a plurality of sensors associated with a cyber physical system, wherein the receiving the data includes receiving time series data from the plurality of sensors monitoring the cyber physical system and wherein the cyber physical system is an electrical power grid system; constructing a metrization of the data utilizing a data structuring; determining at least one ensemble and at least one summary variable from the metrized data, wherein the at least one summary variable is based on automata model utilizing a probabilistic grammatical inference that includes discovering common subtrees of a string parse tree via a nonparametric Bayesian clustering method including a Dirichlet Process or a Beta Process or a diffusion map technique; applying a thermodynamic formalism to the at least one summary variable to classify a plurality of system behaviors; identifying the plurality of system behaviors based at least in part on the classified plurality of system behaviors; obtaining, by the one or more hardware processors, a baseline of the system behavior associated with the classified plurality of systems behaviors; and detecting an anomalous condition based on a deviation of the plurality of system behaviors from the baseline.

---

Claim 2:
2. The method for detecting cyber physical system behavior of claim 1 , wherein the determining the at least one summary variable includes a symbolic encoding of the metrized data.