SYSTEM AND METHOD FOR DETERMINING ANOMALY SOURCE IN CYBER-PHYSICAL SYSTEM HAVING CERTAIN CHARACTERISTICS Russian patent published in 2020 - IPC G06F21/50 G06N20/00 

FIELD: computer equipment.

SUBSTANCE: invention relates to computer engineering. Disclosed is a computer-implemented method of teaching a prediction model of values of features of a cyber-physical system (CPS) and calculating an error threshold for determining anomalies in CPS, wherein: a) using the training apparatus, obtaining an initial sample containing the values of the CPS criteria for the historical period of observing the CPS, wherein the anomaly fraction does not exceed a given value, wherein the CPS characteristics are numerical characteristics of the control subjects; b) using a training apparatus based on the initial sample and taking into account the characteristics of the CPS, a training sample is formed, including values of at least one of the said CPS characteristics, for the observation period, which is contained in the historical observation period; c) using the training apparatus, constructing a model for predicting the values of the CPS attributes at each moment in the prediction window based on the values of said CPS attributes at each time point of the input window, wherein the input window and the prediction window are time intervals contained within the observation period, and, besides, said input window and prediction window are selected depending on the CPS characteristics, and the distance between the input window and the prediction window is equal to the prediction horizon, which is selected depending on the CPS characteristics; d) using the training apparatus, the prediction model is trained on the training sample data; e) using the trained prediction model using the calculation means, performing the CPS characteristics values prediction at each observation time instant; e) using the calculation means, determining the overall prediction error obtained using the constructed prediction model at each time point of the observation period; g) using the training apparatus, calculating a common error threshold depending on the CPS characteristics such that exceeding the calculated threshold with a common prediction error means an anomaly in the CPS.

EFFECT: technical result is providing training model prediction values of features of cyber-physical system (CPS) and calculation of error threshold to determine abnormality in CPS.

24 cl, 21 dwg