# CyPhERS: A Cyber-Physical Event Reasoning System providing real-time situational awareness for attack and fault response

arXiv: https://arxiv.org/abs/2305.16907 · HTML: https://mlsanity.com/paper/2305.16907/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 14 of its 54 references that are in the map.
- First posted on arXiv 26 May 2023.

## Builds on (most cited first, 14 of 14)

- [Detecting Spacecraft Anomalies Using LSTMs and Nonparametric Dynamic Thresholding](https://mlsanity.com/paper/1802.04431/) (2018)
- [TranAD: Deep Transformer Networks for Anomaly Detection in Multivariate Time Series Data](https://mlsanity.com/paper/2201.07284/) (2022)
- [A Deep Neural Network for Unsupervised Anomaly Detection and Diagnosis in Multivariate Time Series Data](https://mlsanity.com/paper/1811.08055/) (2018)
- [MAD-GAN: Multivariate Anomaly Detection for Time Series Data with Generative Adversarial Networks](https://mlsanity.com/paper/1901.04997/) (2019)
- [Darts: User-Friendly Modern Machine Learning for Time Series](https://mlsanity.com/paper/2110.03224/) (2021)
- [Consistency of random forests](https://mlsanity.com/paper/1405.2881/) (2014)
- [Kaggle forecasting competitions: An overlooked learning opportunity](https://mlsanity.com/paper/2009.07701/) (2020)
- [Toeplitz Inverse Covariance-Based Clustering of Multivariate Time Series Data](https://mlsanity.com/paper/1706.03161/) (2017)
- [Time Series Anomaly Detection for Cyber-Physical Systems via Neural System Identification and Bayesian Filtering](https://mlsanity.com/paper/2106.07992/) (2021)
- [A Survey on Anomaly Detection for Technical Systems using LSTM Networks](https://mlsanity.com/paper/2105.13810/) (2021)
- [Dynamic Detection of False Data Injection Attack in Smart Grid using Deep Learning](https://mlsanity.com/paper/1808.01094/) (2018)
- [HURRA! Human readable router anomaly detection](https://mlsanity.com/paper/2107.11078/) (2021)
- [RSM-GAN: A Convolutional Recurrent GAN for Anomaly Detection in Contaminated Seasonal Multivariate Time Series](https://mlsanity.com/paper/1911.07104/) (2019)
- [Assessment of Cyber-Physical Intrusion Detection and Classification for Industrial Control Systems](https://mlsanity.com/paper/2202.09352/) (2022)

## Abstract (arXiv)

Cyber-physical systems (CPSs) constitute the backbone of critical infrastructures such as power grids or water distribution networks. Operating failures in these systems can cause serious risks for society. To avoid or minimize downtime, operators require real-time awareness about critical incidents. However, online event identification in CPSs is challenged by the complex interdependency of numerous physical and digital components, requiring to take cyber attacks and physical failures equally into account. The online event identification problem is further complicated through the lack of historical observations of critical but rare events, and the continuous evolution of cyber attack strategies. This work introduces and demonstrates CyPhERS, a Cyber-Physical Event Reasoning System. CyPhERS provides real-time information pertaining the occurrence, location, physical impact, and root cause of potentially critical events in CPSs, without the need for historical event observations. Key novelty of CyPhERS is the capability to generate informative and interpretable event signatures of known and unknown types of both cyber attacks and physical failures. The concept is evaluated and benchmarked on a demonstration case that comprises a multitude of attack and fault events targeting various components of a CPS. The results demonstrate that the event signatures provide relevant and inferable information on both known and unknown event types.