# US 10,771,495 B2 · Cyber-attack detection and neutralization > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,495 B2 - Document ID: US10771495B2 - Status: Granted - Kind: B2 - Application number: 15/454,144 - Filed: 2017-03-09 - Published: 2018-09-06 - Granted: 2020-09-08 - Earliest claimed: 2017-03-02 - Assignees: General Electric Company - Applicants: General Electric Company - Inventors: Lalit Keshav Mestha; Olugbenga Anubi; Masoud Abbaszadeh - Web page: https://patentgrep.com/patent/US10771495B2 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The example embodiments are directed to a system and method for neutralizing abnormal signals in a cyber-physical system. In one example, the method includes receiving input signals comprising time series data associated with an asset and transforming the input signals into feature values in a feature space, detecting one or more abnormal feature values in the feature space based on a predetermined normalcy boundary associated with the asset, and determining an estimated true value for each abnormal feature value, and performing an inverse transform of each estimated true value to generate neutralized signals comprising time series data and outputting the neutralized signals. ## Claims ### Claim 1 A method comprising: receiving, from a plurality of sensors, time-series input signals comprising time series sensor data that is measured of an industrial operation of an industrial asset and transforming the time series sensor data into feature values in a feature space; detecting an abnormal feature value among the transformed feature values in the feature space based on a position of the abnormal feature value with respect to predetermined normalcy boundary line integrated within the feature space, wherein the normalcy boundary line identifies abnormal feature values corresponding to abnormal transformed time series sensor readings measured by one or more sensors; converting the abnormal feature value from the transformed time-series input signals into a normal feature value within the predetermined normalcy boundary representing a true estimate of a time-series input signal of the abnormal feature value by masking a portion of, but not all of, the abnormal feature value to generate neutralized signals; and outputting the neutralized signals to a computing device associated with the industrial asset while the industrial asset remains powered on. ### Claim 2 (depends on 1) The method of claim 1, wherein the transforming comprises transforming one or more of speed, weight, force, acceleration, and thrust, measured from the operation of the industrial asset into data points in feature space. ### Claim 3 (depends on 1) The method of claim 1, wherein the transforming comprises transforming the time series sensor data from the industrial asset into feature vectors. ### Claim 4 (depends on 1) The method of claim 1, wherein the transforming the time series sensor data into feature values is based on an identity transform. ### Claim 5 (depends on 1) The method of claim 1, further comprising determining the normalcy boundary line in the feature space based on one or more of a historical sensor data measured from the industrial asset, and a data set obtained from input-output design of experiments on a digital twin of the industrial asset. ### Claim 6 (depends on 5) The method of claim 5, further comprising updating the normalcy boundary line based on currently sensed sensor data measured from the industrial asset. ### Claim 7 (depends on 1) The method of claim 1, wherein the detected abnormal feature value corresponds to a time-series attack signal associated with the industrial asset. ### Claim 8 (depends on 1) The method of claim 1, wherein the time-series input signals are received from a computing device of the industrial asset and the neutralized signals are output to a control system that controls industrial operation of the industrial asset. ### Claim 9 (depends on 1) The method of claim 1, wherein the outputting comprises transforming the converted abnormal feature value into the true-estimate of the time-series input signal, and outputting the true-estimate of the time-series input signal to the computing device. ### Claim 10 A computing system comprising: a receiver configured to receive, from a plurality of sensors, time-series input signals comprising time series sensor data that is measured of an industrial operation of an industrial asset; a processor configured to transform the time series sensor data into feature values in a feature space, detect an abnormal feature among the transformed feature values in the feature space based on a position of the feature value with respect to a predetermined normalcy boundary line integrated within the features space, wherein the normalcy boundary line identifies abnormal feature values corresponding to abnormal transformed time series sensor readings measured by one or more sensors, and convert the abnormal feature value from the transformed time-series input signals into a normal feature value within the predetermined normalcy boundary representing a true estimate of a time-series input signal of the abnormal feature value by masking a portion of, but not all of, the abnormal feature value to generate neutralized signals; and an output configured to output the neutralized signals to a computing device associated with the industrial asset while the industrial asset remains powered on. ### Claim 11 (depends on 10) The computing system of claim 10, wherein the processor transforms one or more of speed, weight, force, acceleration, and thrust, measured from the operation of the industrial asset into data points in feature space. ### Claim 12 (depends on 10) The computing system of claim 10, wherein the processor is configured to transform the time series sensor data from the industrial asset into feature vectors. ### Claim 13 (depends on 10) The computing system of claim 10, wherein the processor transforms the timer series sensor data into feature values based on an identity transform. ### Claim 14 (depends on 10) The computing system of claim 10, wherein the processor is further configured to determine the normalcy boundary line in the feature space based on one or more of a historical sensor data measured from the industrial asset, and a data set obtained from input-output design of experiments on a digital twin of the industrial asset. ### Claim 15 (depends on 14) The computing system of claim 14, wherein the processor is further configured to update the normalcy boundary line based on currently sensed data associated with the industrial asset. ### Claim 16 (depends on 10) The computing system of claim 10, wherein the detected abnormal feature value corresponds to a time-series attack signal associated with the industrial asset. ### Claim 17 (depends on 10) The computing system of claim 10, wherein the receiver receives the time-series input signals from a computing system of the industrial asset and the output outputs the neutralized signals to a control system for controlling operations of the industrial asset. ### Claim 18 A non-transitory computer readable storage medium having stored therein instructions that when executed cause a processor to perform a method comprising: receiving, from a plurality of sensors, time-series input signals comprising time series sensor data that is measured of an industrial operation of an industrial asset and transforming the time series sensor data into feature values in a feature space; detecting an abnormal feature value among the transformed feature values in the feature space based on a position of the abnormal feature value with respect to predetermined normalcy boundary line integrated within the feature space, wherein the normalcy boundary line identifies abnormal feature values corresponding to abnormal transformed time series sensor readings measured by one or more sensors; converting the abnormal feature value from the transformed time-series input signals into a normal feature value within the predetermined normalcy boundary representing a true estimate of a time-series input signal of the abnormal feature value by masking a portion of, but not all of, the abnormal feature value to generate neutralized signals; and outputting the neutralized signals to a computing device associated with the industrial asset while the industrial asset remains powered on. ### Claim 19 (depends on 1) The method of claim 1, wherein the feature space comprises two or more axes corresponding to two or more features, respectively, and the predetermined normalcy boundary line comprises a multi-dimensional line which separates normal feature values and abnormal feature values for the two or more features when plotted.