REAL TIME CONTROL SYSTEM MANAGEMENT

• US 20140114442A1
• Filed: 10/22/2012
• Published: 04/24/2014
• Est. Priority Date: 10/22/2012
• Status: Abandoned Application

• Current Assignee: The Boeing Co.
• Original Assignee: The Boeing Co.
• Inventors: Li, Winfeng, Ayyagari, Arun, Blair, Richard N., Khot, Monika
• Application Number:
  US13/657,440
• Publication Number:
  US 20140114442A1
• Time in Patent Office: Days
• US Class Current: 700/47
• CPC Class Codes: G05B 23/0254 based on a quantitative model, e.g. mathematical relationships between inputs and outputs; functions: observer, Kalman filter, residual calculation, Neural Networks
• CPC Class Codes: G06F 11/0736 in functional embedded systems, i.e. in a data processing system designed as a combination of hardware and software dedicated to performing a certain function testing or monitoring of automated control systems G05B23/02
• CPC Class Codes: G06F 11/0754 by exceeding limits

Abstract

Systems and methods for real time control system management in networked environments are disclosed. In one embodiment, a computer-based system for real time embedded control system behavior monitoring and anomaly detection comprises a processor and logic instructions stored in a tangible computer-readable medium coupled to the processor which, when executed by the processor, configure the processor to generate a behavior training set for the embedded control system, wherein the behavior training set correlates inputs to the embedded control system with outputs from the embedded control system during a training process to define behavior fingerprints for the embedded control system monitor inputs to the embedded control system and outputs from the embedded control system in real time during operation of the embedded control system, and generate an alert when one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation represent an anomaly.

Claims

1. A computer-based method for real time embedded control system behavior monitoring and anomaly detection, comprising:

generating a behavior training set for the embedded control system, wherein the behavior training set correlates inputs to the embedded control system with outputs from the embedded control system during a training process to define behavior fingerprints for the embedded control system;

monitoring inputs to the embedded control system and outputs from the embedded control system in real time during operation of the embedded control system; and

generating an alert when one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation represent an anomaly.

2. The computer-based method of claim 1, wherein generating a behavior training set for the embedded control system comprises tuning the behavior training set using at least one parameter.

3. The computer-based method of claim 2, wherein the at least one parameter is selected from a group of parameters, comprising:

a reservoir size parameter which defines a number of nodes within a reservoir computing network;

an input scaling parameter which weighs input attributes to the embedded control system;

an output feedback scaling parameter which defines an amount of feedback for the reservoir computing network;

a reservoir weight matrix parameter which controls one or more impulse responses in the reservoir computing network;

a leaking rate parameter which controls a sensitivity to noisy behaviors and time-warped behaviors in the reservoir computing network; and

a noise scaling parameter which controls one or more noise integrators in the reservoir computing network.

4. The computer-based method of claim 1, wherein generating an alert when one or more outputs collected from the embedded control system in real operation represent an anomaly comprises:

comparing the one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation to one or more outputs collected during the training process; and

characterizing the one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation as an anomaly when a deviation between the one or more outputs collected from the embedded control system in real time operation and the one or more outputs collected during the training process exceeds a threshold.

5. The computer-based method of claim 4, further comprising:

determining a severity of the anomaly.

6. The computer-based method of claim 1, further comprising:

publishing the alert to one or more applications coupled to the embedded control system.

7. The computer-based method of claim 6, further comprising:

storing the one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation in a memory; and

updating the behavior training set using the one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation in a memory.

8. A computer-based system for real time embedded control system behavior monitoring and anomaly detection, comprising:

a processor; and

logic instructions stored in a tangible computer-readable medium coupled to the processor which, when executed by the processor, configure the processor to;

generate a behavior training set for the embedded control system, wherein the behavior training set correlates inputs to the embedded control system with outputs from the embedded control system during a training process to define behavior fingerprints for the embedded control system;

monitor inputs to the embedded control system and outputs from the embedded control system in real time during operation of the embedded control system; and

generate an alert when one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation represent an anomaly.

9. The computer-based system of claim 8, further comprising logic instructions stored in a tangible computer-readable medium coupled to the processor which, when executed by the processor, configure the processor to tune the behavior training set using at least one parameter.

10. The computer-based system of claim 9, wherein the at least one parameter is selected from a group of parameters, comprising:

a reservoir size parameter which defines a number of nodes within a reservoir computing network;

an input scaling parameter which weighs input attributes to the embedded control system;

an output feedback scaling parameter which defines an amount of feedback for the reservoir computing network;

a reservoir weight matrix parameter which controls one or more impulse responses in the reservoir computing network;

a leaking rate parameter which controls a sensitivity to noisy behaviors and time-warped behaviors in the reservoir computing network; and

a noise scaling parameter which controls one or more noise integrators in the reservoir computing network.

11. The computer-based system of claim 8, further comprising logic instructions stored in a tangible computer-readable medium coupled to the processor which, when executed by the processor, configure the processor to:

compare the one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation to one or more outputs collected during the training process; and

characterize the one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation as an anomaly when a deviation between the one or more outputs collected from the embedded control system in real time operation and the one or more outputs collected during the training process exceeds a threshold.

12. The computer-based system of claim 11, further comprising logic instructions stored in a tangible computer-readable medium coupled to the processor which, when executed by the processor, configure the processor to determine a severity of the anomaly.

13. The computer-based system of claim 8, further comprising logic instructions stored in a tangible computer-readable medium coupled to the processor which, when executed by the processor, configure the processor to publish the alert to one or more applications coupled to the embedded control system.

14. The computer-based system of claim 8, further comprising logic instructions stored in a tangible computer-readable medium coupled to the processor which, when executed by the processor, configure the processor to:

storing the one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation in a memory; and

updating the behavior training set using the one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation in a memory.

15. A computer program product comprising logic instructions stored in a tangible computer-readable medium coupled to a processor which, when executed by the processor, configure the processor to:

generate a behavior training set for an embedded control system, wherein the behavior training set correlates inputs to the embedded control system with outputs from the embedded control system during a training process to define behavior fingerprints for the embedded control system;

monitor inputs to the embedded control system and outputs from the embedded control system in real time during operation of the embedded control system; and

generate an alert when one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation represent an anomaly.

16. The computer program product of claim 15, further comprising logic instructions stored in a tangible computer-readable medium coupled to the processor which, when executed by the processor, configure the processor to tune the behavior training set using at least one parameter.

17. The computer program product of claim 16, wherein the at least one parameter is selected from a group of parameters, comprising:

a reservoir size parameter which defines a number of nodes within a reservoir computing network;

an input scaling parameter which weighs input attributes to the embedded control system;

an output feedback scaling parameter which defines an amount of feedback for the reservoir computing network;

a reservoir weight matrix parameter which controls one or more impulse responses in the reservoir computing network;

a leaking rate parameter which controls a sensitivity to noisy behaviors and time-warped behaviors in the reservoir computing network; and

a noise scaling parameter which controls one or more noise integrators in the reservoir computing network.

18. The computer program product of claim 15, further comprising logic instructions stored in a tangible computer-readable medium coupled to the processor which, when executed by the processor, configure the processor to:

compare the one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation to one or more outputs collected during the training process; and

characterize the one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation as an anomaly when a deviation between the one or more outputs collected from the embedded control system in real time operation and the one or more outputs collected during the training process exceeds a threshold.

19. The computer program product of claim 18, further comprising logic instructions stored in a tangible computer-readable medium coupled to the processor which, when executed by the processor, configure the processor to determine a severity of the anomaly.

20. The computer program product of claim 15, further comprising logic instructions stored in a tangible computer-readable medium coupled to the processor which, when executed by the processor, configure the processor to:

store the one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation in a memory; and

update the behavior training set using the one or more of the inputs into the embedded control system or the outputs collected from the embedded control system in real time operation in a memory.