Systems, methods and computer program products for anomaly detection

A method for configuring an anomaly detection system for process control environments, the system comprising at least a first processor implemented classifier model located at a first edge node, a second processor implemented classifier model located at a second edge node, and a third processor implemented classifier model located at a cloud based central server, wherein each of said first, second and third processor implemented classifier models is configured to detect anomaly events within process control environments, the method comprising:

• receiving a first set of information from a first set of field devices located within a process control environment;
• transmitting a first input vector generated based on the first set of information, to the first processor implemented classifier model located at the first edge node;
• and
• responsive to the first processor implemented classifier model detecting an anomaly event based on the transmitted first input vector, modifying the classification parameters of the second processor implemented classifier model.

A system for anomaly detection in process control environments, the system comprising:

• at least one processor implemented edge node configured to provide gateway access to a process control environment, wherein the at least one processor implemented edge node is further configured to:
• receive a first set of information from a first set of field devices located within the process control environment;
• provide to a first anomaly detector implemented within said processor implemented edge node, a first input vector based on the first set of information, wherein said first anomaly detector implements a first classifier model;
• at least one cloud based server that is communicably coupled to the at least one processor implemented edge node, wherein said cloud based server is configured to:
• respond to the first anomaly detector detecting an anomaly event based on the transmitted first input vector, by providing a second input vector to a second anomaly detector implemented within said cloud based server, wherein:
• the second input vector is generated based on a second set of information received from a second set of field devices located within the process control environment;
• the second input vector is different from the first input vector;
• and
• the second anomaly detector implements a second classifier model, wherein said second classifier model is different from the first classifier model;
• a processor implemented alert engine, configured to generate an anomaly event alert responsive to at least one of the first anomaly detector and the second anomaly detector detecting an anomaly event.