Systems, methods and computer program products for anomaly detection

A method for configuring an anomaly detection system for process control environments, the system comprising at least a first processor implemented classifier model located at a first edge node, a second processor implemented classifier model located at a second edge node, and a third processor implemented classifier model located at a cloud based central server, wherein each of said first, second and third processor implemented classifier models is configured to detect anomaly events within process control environments, each of the anomaly events being a same type of anomaly event, the method comprising:

• receiving a first set of information from a first set of field devices located within a process control environment in an industrial plant;
• transmitting a first input vector comprising temperature values generated based on the first set of information, to the first processor implemented classifier model located at the first edge node;
• and
• responsive to the first processor implemented classifier model detecting an anomaly event based on the transmitted first input vector, modifying the classification parameters of the second processor implemented classifier model to train the second processor implement classifier model to detect an anomaly event of a same type as the detected anomaly event.

A system for anomaly detection in process control environments, the system comprising:

• at least one processor implemented edge node configured to provide gateway access to a process control environment in an industrial plant;
• at least one cloud based server that is communicably coupled to the at least one processor implemented edge node;
• and
• a processor implemented alert engine,
• wherein the at least one processor implemented edge node is configured to:
• receive a first set of information from a first set of field devices located within the process control environment in the industrial plant;
• detect, by a first anomaly detector that is implemented within said processor implemented edge node and that implements a first classifier model, a first anomaly event according to a first input vector comprising temperature values generated based on the first set of information,
• based on the first anomaly detector detecting the first anomaly event, determine a second anomaly detector that is implemented within said at least one cloud based server, that implements a second classifier model having a complexity higher than a complexity of the first classifier model, and that is configured to detect anomaly events of a same anomaly type as the detected first anomaly event, and
• transmit, to the determined second anomaly detector that is implemented within said at least one cloud based server, a second input vector that is generated based on a second set of information received from a second set of field devices located within the process control environment,
• wherein said at least one cloud based server is configured to:
• detect, by the second anomaly detector implemented within the at least one cloud server, a second anomaly event based on the second input vector,
• wherein the processor implemented alert engine is configured to generate an anomaly event alert responsive to the second anomaly event.