Anomaly detection and root cause diagnosis

A method comprising:

• obtaining operational input variables corresponding to an asset operating in an Operational Technology (OT) environment;
• obtaining operational output variables indicating an effect on the asset as a function of the operational input variables;
• generating a non-linear relationship between the operational input variables and the operational output variables;
• generating, by a prespecified Extreme Learning Machine (ELM), a non-linear inference based on the non-linear relationship, wherein the non-linear inference is to associate behavioral uncertainties at the operational output variables, wherein the prespecified ELM is trained on the non-linear inference and historical operational data associated with a normal operational behavior of the asset;
• and
• parsing the non-linear inference, through the prespecified ELM, to determine deviations in the behavioral uncertainties from the historical operational data beyond a prespecified threshold for detecting an anomaly in the asset.

A non-transitory computer readable medium having instructions stored thereon, the instructions, when executed by a processor, cause the processor to perform operations comprising:

• generating a non-linear relationship between operational input variables and operational output variables of an asset operating in an Operational Technology (OT) environment;
• generating a Directed Acyclic Graph (DAG) for the asset based on the non-linear relationship, wherein the DAG identifies a plurality of pairs of nodes, each of the plurality of pairs of nodes identifies a pair of child-parent nodes, wherein a child node in the pair of child-parent nodes is associated with the operational output variables, and a parent node in the pair of child-parent nodes is associated with the operational input variables;
• generating, by a prespecified Extreme Learning Machine (ELM), a non-linear inference by transferring behavioral uncertainties on at least one child node present in the pair of child-parent nodes of each of the pairs of nodes, wherein the prespecified ELM is trained on the non-linear inference and historical operational data associated with a normal operational behavior of the asset;
• ascertaining an anomaly in an operation of the asset on determining a deviation in the behavioral uncertainties of the at least one child node from the normal operational behavior of the asset, wherein the non-linear inference is parsed through the prespecified ELM for detecting the anomaly;
• and
• for the at least one child node for which the anomaly is detected, determining a root node among the pairs of nodes for diagnosing root cause of the anomaly, wherein the root node is without a parent node.