Time Series Anomaly Detection for Cyber-Physical Systems via Neural System Identification and Bayesian Filtering

TL;DR

This paper introduces NSIBF, a novel anomaly detection method for cyber-physical systems that combines neural system identification with Bayesian filtering, effectively handling complex dynamics and noise.

Contribution

The paper presents a new neural network-based system identification approach integrated with Bayesian filtering for improved anomaly detection in CPS.

Findings

NSIBF outperforms existing methods on synthetic data.

NSIBF achieves significant improvements on real-world CPS datasets.

The approach effectively manages system complexity and sensor noise.

Abstract

Recent advances in AIoT technologies have led to an increasing popularity of utilizing machine learning algorithms to detect operational failures for cyber-physical systems (CPS). In its basic form, an anomaly detection module monitors the sensor measurements and actuator states from the physical plant, and detects anomalies in these measurements to identify abnormal operation status. Nevertheless, building effective anomaly detection models for CPS is rather challenging as the model has to accurately detect anomalies in presence of highly complicated system dynamics and unknown amount of sensor noise. In this work, we propose a novel time series anomaly detection method called Neural System Identification and Bayesian Filtering (NSIBF) in which a specially crafted neural network architecture is posed for system identification, i.e., capturing the dynamics of CPS in a dynamical state-space model; then a Bayesian filtering algorithm is naturally applied on top of the "identified" state-space model for robust anomaly detection by tracking the uncertainty of the hidden state of the system recursively over time. We provide qualitative as well as quantitative experiments with the proposed method on a synthetic and three real-world CPS datasets, showing that NSIBF compares favorably to the state-of-the-art methods with considerable improvements on anomaly detection in CPS.