Abstract:
According to some embodiments, a plurality of heterogeneous data source nodes may each generate a series of current data source node values over time that represent a current operation of an electric power grid. A real-time threat detection computer, coupled to the plurality of heterogeneous data source nodes, may receive the series of current data source node values and generate a set of current feature vectors. The threat detection computer may then access an abnormal state detection model having at least one decision boundary created offline using at least one of normal and abnormal feature vectors. The abnormal state detection model may be executed, and a threat alert signal may be transmitted if appropriate based on the set of current feature vectors and the at least one decision boundary.
Abstract:
A method for determining fleet conditions and operational management thereof, performed by a central system includes receiving fleet data from at least one distributed data repository. The fleet data is substantially representative of information associated with a fleet of physical assets. The method also includes processing the received fleet data for the fleet using at least one process of a plurality of processes. The plurality of processes assess the received fleet data into processed fleet data. The method additionally includes determining a fleet condition status using the processed fleet data and the at least one process of the plurality of processes. The method further includes generating a fleet response. The fleet response is substantially representative of a next operational step for the fleet of physical assets. The method also includes transmitting the fleet response to at least one of a plurality of fleet response recipients.
Abstract:
A system includes a physical analysis module, a cyber analysis module, and a determination module. The physical analysis module is configured to obtain physical diagnostic information, and to determine physical analysis information using the physical diagnostic information. The cyber analysis module is configured to obtain cyber security data of the functional system, and to determine cyber analysis information using the cyber security data. The determination module is configured to obtain the physical analysis information and the cyber analysis information, and to determine a state of the functional system using the physical analysis information and the cyber analysis information. The state determined corresponds to at least one of physical condition or cyber security threat. The determination module is also configured to identify if the state corresponds to one or more of a non-malicious condition or a malicious condition.
Abstract:
Heterogeneous monitoring nodes may each generate a series of monitoring node values over time associated with operation of an industrial asset. An offline abnormal state detection model creation computer may receive the series of monitoring node values and perform a feature extraction process using a multi-modal, multi-disciplinary framework to generate an initial set of feature vectors. Then feature dimensionality reduction is performed to generate a selected feature vector subset. The model creation computer may derive digital models through a data-driven machine learning modeling method, based on input/output variables identified by domain experts or by learning from the data. The system may then automatically generate domain level features based on a difference between sensor measurements and digital model output. A decision boundary may then be automatically calculated and output for an abnormal state detection model based on the selected feature vector subset and the plurality of derived generated domain level features.
Abstract:
According to embodiments, a system, method and non-transitory computer-readable medium are provided to receive time series data associated with one or more sensors values of a piece of machinery at a first time period, perform a non-linear transformation on the time-series data to produce one or more nonlinear temporal embedding outputs, and projecting each of the nonlinear temporal embedding outputs to a different dimension space to identify at least one causal relationship in the nonlinear temporal embedding outputs. The nonlinear embeddings are further projected to the original dimension space to produce one or more causality learning outputs. Nonlinear dimensional reduction is performed on the one or more causality learning outputs to produce reduced dimension causality learning outputs. The learning outputs are mapped to one or more predicted outputs which include a prediction of one or more of the sensor values at a second time period.
Abstract:
A computing device for detecting and identifying power system events is provided. The computing device includes at least one processor in communication with at least one memory device. The at least one processor is programmed to store a database including a plurality of categorized events. Each categorized event of the plurality of categorized events is associated with an event category. The at least one processor is also programmed to receive sensor data from a plurality of sensors monitoring a power grid, identify one or more features contained in the sensor data, compare the one or more features to the plurality of categorized events, and determine an event category based on the comparison.
Abstract:
According to some embodiments, a system and method are provided to model a sparse data asset. The system comprises a processor and a non-transitory computer-readable medium comprising instructions that when executed by the processor perform a method to model a sparse data asset. Relevant data and operational data associated with the newly operational are received. A transfer model based on the relevant data and the received operational data. An input into the transfer model is received and a predication based on data associated with the received operational data and the relevant data is output.
Abstract:
embodiments are directed to a system, method, and article for monitoring a power substation asset. During an offline analysis mode, training data may be acquired and processing, and one or more classifiers may be generated for an online anomaly detection and localization mode. During the online anomaly detection and localization mode, power system related data may be received from field devices, a state of a substation system and of the power substation asset component and an unclassified state of one or instances may be generated based on the one or more classifiers. An alert may be generated to indicate the state of the substation system and of the power substation asset.
Abstract:
A threat detection model creation computer receives normal monitoring node values and abnormal monitoring node values. At least some received monitoring node values may be processed with a deep learning model to determine parameters of the deep learning model (e.g., a weight matrix and affine terms). The parameters of the deep learning model and received monitoring node values may then be used to compute feature vectors. The feature vectors may be spatial along a plurality of monitoring nodes. At least one decision boundary for a threat detection model may be automatically calculated based on the computed feature vectors, and the system may output the decision boundary separating a normal state from an abnormal state for that monitoring node. The decision boundary may also be obtained by combining feature vectors from multiple nodes. The decision boundary may then be used to detect normal and abnormal operation of an industrial asset.
Abstract:
A system for distributed computing includes a job scheduler module configured to identify a job request including request requirements and comprising one or more individual jobs. The system also includes a resource module configured to determine an execution set of computing resources from a pool of computing resources based on the request requirements. Each computing resource of the pool of computing resources has an application programming interface. The pool of computing resources comprises public cloud computing resources and internal computing resources. The system further includes a plurality of interface modules, where each interface module is configured to facilitate communication with the computing resources using the associated application programming interface. The system also includes an executor module configured to identify the appropriate interface module based on facilitating communication with the execution computing resource and transmit jobs for execution to the execution computing resource using the interface modules.