Cyber-attack detection and neutralization

A computing system comprising:

• a receiver configured to receive, from a plurality of sensors, time-series input signals comprising time series sensor data that is measured of an industrial operation of an industrial asset;
• a processor configured to
• transform the time series sensor data into feature values in a feature space,
• detect an abnormal feature among the transformed feature values in the feature space based on a position of the feature value with respect to a predetermined normalcy boundary line integrated within the features space, wherein the normalcy boundary line identifies abnormal feature values corresponding to abnormal transformed time series sensor readings measured by one or more sensors, and
• convert the abnormal feature value from the transformed time-series input signals into a normal feature value within the predetermined normalcy boundary representing a true estimate of a time-series input signal of the abnormal feature value by masking a portion of, but not all of, the abnormal feature value to generate neutralized signals;
• and
• an output configured to output the neutralized signals to a computing device associated with the industrial asset while the industrial asset remains powered on.

A non-transitory computer readable storage medium having stored therein instructions that when executed cause a processor to perform a method comprising:

• receiving, from a plurality of sensors, time-series input signals comprising time series sensor data that is measured of an industrial operation of an industrial asset and transforming the time series sensor data into feature values in a feature space;
• detecting an abnormal feature value among the transformed feature values in the feature space based on a position of the abnormal feature value with respect to predetermined normalcy boundary line integrated within the feature space, wherein the normalcy boundary line identifies abnormal feature values corresponding to abnormal transformed time series sensor readings measured by one or more sensors;
• converting the abnormal feature value from the transformed time-series input signals into a normal feature value within the predetermined normalcy boundary representing a true estimate of a time-series input signal of the abnormal feature value by masking a portion of, but not all of, the abnormal feature value to generate neutralized signals;
• and
• outputting the neutralized signals to a computing device associated with the industrial asset while the industrial asset remains powered on.