ANOMALY DETECTION IN CYBER-PHYSICAL SYSTEMS BASED ON HYBRID NEURAL NETWORKS MODELS

Nowadays cyber-physical systems are widely used in different application domains. In parallel, machine learning algorithms are used widely to detect the anomalies in the behavior of these systems. However, this detection is limited to two states: normal behavior and faulty functioning. The goal of this thesis was to create a hybrid neural network that could distinguish between three states of a cyber-physical system: normal behavior, a fault, and an attack. First and foremost, a power system is provided as a working example. Then, three potential ways for achieving the initial goal were presented: changing the values of features, using distances between samples, and using the Hidden Markov Model. They were tested on three different machine learning classifiers-Decision Tree, Random Forest and Multilayer Perceptron. Later, various tools for feature analysis are presented and an algorithm to find the features that contributed the most into the false predictions is described. Finally, three solutions to the initial problem are presented and evaluated. For Decision Tree classifier the most efficient enhancement method was using the proposed method that works on distances between samples. For Random Forest classifier, the most effective method was modifying the values of features. And for Multilayer Perceptron classifier all the proposed methods failed.