Anomaly detection for cyber-physical systems

Abstract

An anomaly detector is configured to construct cyber and/or physical features comprising information configured to characterize the cyber and/or physical state of a cyber-physical system. The physical features may be based on physical and/or physics-based relationships between a plurality of physical state attributes. A health of the cyber-physical system may be based on an error between estimates of one or more of the physical state attributes and measurements of the one or more physical state attributes. The relationships may be incorporated into machine learning membership functions used to classify cyber and/or physical behavior of the system.