System and method for detecting malicious activities and anomalies in building systems

A system for detecting malicious operation of a building system comprising:

• a power characteristic input connected to a plurality of power characteristic sensors;
• a processor and a memory, the memory storing instructions for operating at least a physics detection model, a machine learning detection model and a combination module;
• wherein the physics detection model is comprised of a plurality of predefined expected power characteristics and is configured to detect an anomaly when at least one power characteristic received at the power characteristic input deviates from a corresponding predefined expected power characteristic of the plurality of predefined expected power characteristics;
• wherein the machine learning detection model is comprised of a machine learning system configured to learn a set of expected normal power characteristics and detect the anomaly when at least one power characteristic received at the power characteristic input deviates from the learned set of expected normal power characteristics;
• wherein each of the physics detection model and the machine learning detection model separately determine whether there is an anomaly, and wherein when at least one of the physics detection model and the machine learning detection model detects an anomalous power characteristic input, the at least one of the physics detection model and the machine learning detection model provides a malicious event alert and a corresponding confidence rate to a combination module;
• and
• wherein the combination module, once a malicious event is detected,
• if both the physics detection model and the machine learning detection model have indicated a presence of the malicious event and a predetermined confidence level is achieved, the combination module is configured to output an alert, or
• if only one of the physics detection model and the machine learning detection model have indicated a presence of the malicious event, the combination module performs a tiebreaker analysis based on confidence rates from the physics detection model and the machine learning detection model across a time window to determine whether to output the alert.