Multi-class decision system for categorizing industrial asset attack and fault types

A computerized method to protect an industrial asset, comprising:

• receiving, from a normal space data source for each of a plurality of monitoring nodes, a series of normal monitoring node values over time that represent normal operation of the industrial asset;
• receiving, from an attacked space data source for each of the plurality of monitoring nodes, a series of attacked monitoring node values over time that represent attacked operation of the industrial asset;
• receiving, from a fault space data source for each of the plurality of monitoring nodes, a series of fault monitoring node values over time that represent fault operation of the industrial asset;
• and
• automatically calculating and outputting, by a multi-class classifier model creation computer, at least one decision boundary for a multi-class classifier model based on the set of normal feature vectors, the set of attacked feature vectors, and the set of fault feature vectors.

A non-transitory, computer-readable medium storing instructions that, when executed by a computer processor, cause the computer processor to perform a method to protect an industrial asset, the method comprising:

• receiving, from a normal space data source for each of a plurality of monitoring nodes, a series of normal monitoring node values over time that represent normal operation of the industrial asset;
• receiving, from an attacked space data source for each of the plurality of monitoring nodes, a series of attacked monitoring node values over time that represent attacked operation of the industrial asset;
• receiving, from a fault space data source for each of the plurality of monitoring nodes, a series of faulty monitoring node values over time that represent faulty operation of the industrial asset;
• and
• automatically calculating and outputting, by a multi-class classifier model creation computer, at least one decision boundary for a multi-class classifier model based on the set of normal feature vectors, the set of attacked feature vectors, and the set of faulty feature vectors.