Hybrid feature-driven learning system for abnormality detection and localization

A method for a system having a plurality of monitoring nodes each generating a series of current monitoring node values over time that represent current operation of a cyber-physical system, comprising:

• receiving, by a data-driven features extraction computer platform, the series of current monitoring node values;
• determining, by the data-driven features extraction computer platform, current data-driven feature vectors based on the series of current monitoring node values;
• receiving, by a residual features extraction computer platform, the series of current monitoring node values;
• executing, by the residual features extraction computer platform, a system model and utilize a stochastic filter together to generate current residual values, wherein the generated current residual values describe the difference between expected values predicted by the system model and the series of current monitoring node values;
• determining, by the residual features extraction computer platform, current residual-driven feature vectors based on the current residual values;
• receiving the current data-driven and residual-driven feature vectors at an abnormal detection platform;
• comparing, by the abnormal detection platform, the current data-driven and residual-driven feature vectors with at least one decision boundary associated with an abnormal detection model;
• and
• transmitting, by the abnormal detection platform, an abnormal alert signal based on a result of said comparison.

A non-transitory, computer-readable medium storing program code, the program code executable by a computer processor to cause the processor to perform a method for a system having a plurality of monitoring nodes each generating a series of current monitoring node values over time that represent current operation of a cyber-physical system, the method comprising:

• receiving, by a data-driven features extraction computer platform, the series of current monitoring node values;
• determining, by the data-driven features extraction computer platform, current data-driven feature vectors based on the series of current monitoring node values;
• receiving, by a residual features extraction computer platform, the series of current monitoring node values;
• executing, by the residual features extraction computer platform, a system model and utilize a stochastic filter together to generate current residual values, wherein the generated current residual values describe the difference between expected values predicted by the system model and the series of current monitoring node values;
• determining, by the residual features extraction computer platform, current residual-driven feature vectors based on the current residual values;
• receiving the current data-driven and residual-driven feature vectors at an abnormal detection platform;
• comparing, by the abnormal detection platform, the current data-driven and residual-driven feature vectors with at least one decision boundary associated with an abnormal detection model;
• and
• transmitting, by the abnormal detection platform, an abnormal alert signal based on a result of said comparison.