System and Method to Monitor Programmable Logic Controller (PLCS) In a Cyber Physical Environment

An anomaly monitoring system for a cyber-physical environment having at least one programmable logic controller and a monitored component, the anomaly monitoring system having a human machine interface, a separate controller with at least a processor and associated memory, and providing a communication network for electronic communication between components of the cyber-physical environment, the anomaly monitoring system providing at least one plugin module to monitor a performance of the monitored component and the PLC, as provided through the communication network through a PLC data collection module, the plugin module comparing data from the PLC data collection module to a model of learned behavior patterns, and thereby classify reviewed data as being normal or anomaly events, in the at least one plugin module to monitor the performance of the monitored component and the PLC is configured to execute an algorithm including at least the steps of:

• (1) data collection by monitoring and collecting data output by at least one sensor associated with the at least one programmable logic controller and the monitored component (2) pre-processing and feature extraction by parsing the collected data, analyzing and identifying features within the collected data for further analysis (3) comparison and classification of identified features within the collected data to a model library of representative patterns and identifying collected data as indicative of normal or anomalous behavior, and (4) logging and a response generation by directing a portion of the data or classification of identified features to at least one of memory and database and optionally initiating a response in operation of the monitored component.