Using behavior models for anomaly detection in hybrid systems

The importance of safety and reliability in today's real-world complex hybrid systems, such as process plants, led to the development of various anomaly detection and diagnosis techniques. Model-based approaches established themselves among the most successful ones in the field. However, they depend on a model of a system, which usually needs to be derived manually. Manual modeling requires a lot of efforts and resources. This paper gives a procedure for anomaly detection in hybrid systems that uses automatically generated behavior models. The model is learned from logged system's measurements in a hybrid automaton framework. The presented anomaly detection algorithm utilizes the model to predict the system behavior, and to compare it with the observed behavior in an online manner. Alarms are raised whenever a discrepancy is found between these two. The effectiveness of this approach is demonstrated in detecting several types of anomalies in a real-world running production system.