Local and global decision fusion for cyber-physical system abnormality detection

A method to protect a cyber-physical system associated with a plurality of monitoring nodes, each generating a series of current monitoring node values over time that represent a current operation of the cyber-physical system, comprising:

• receiving, at a decision fusion computer platform from a local status determination module, an indication of whether each monitoring node has an initial local status of “normal” or “abnormal,” and, when an initial local status is “normal,” a local certainty score such that higher values of the local certainty score are associated with greater likelihood of abnormality;
• receiving, at the decision fusion computer platform from a global status determination module, an indication of whether the system has an initial global status of “normal” or “abnormal” and, when the initial global status is “abnormal,” a global certainty score such that higher values of the global certainty score are associated with greater likelihood of abnormality;
• outputting, for each monitoring node, a fused local status of “normal” or “abnormal,” at least one fused local status being potentially based on the initial global status;
• and
• outputting a fused global status of “normal” or “abnormal” potentially based on at least one initial local status.

A non-transitory, computer-readable medium storing program code, the program code executable by a computer processor to cause the processor to perform a method to protect a cyber-physical system associated with a plurality of monitoring nodes, each generating a series of current monitoring node values over time that represent a current operation of the cyber-physical system, the method comprising:

• receiving, at a decision fusion computer platform from a local status determination module, an indication of whether each monitoring node has an initial local status of “normal” or “abnormal,” and, when an initial local status is “normal,” a local certainty score such that higher values of the local certainty score are associated with greater likelihood of abnormality;
• receiving, at the decision fusion computer platform from a global status determination module, an indication of whether the system has an initial global status of “normal” or “abnormal” and, when the initial global status is “abnormal,” a global certainty score such that higher values of the global certainty score are associated with greater likelihood of abnormality;
• outputting, for each monitoring node, a fused local status of “normal” or “abnormal,” at least one fused local status being potentially based on the initial global status;
• and
• outputting a fused global status of “normal” or “abnormal” potentially based on at least one initial local status.