Higher-Order Moment-Based Anomaly Detection

Anomaly Detection Under Multiplicative Noise Model Uncertainty

“…Further, it is evident that the covariance of the residual computed from either of the approach ( 12), ( 28) is a function of covariance matrices of both the additive and multiplicative noises. This is in sharp contrast to the case in [1], [7], [8] where the residual covariance was just a function of the additive noise covariance. Apart from accounting for the multiplicative noises, the above mentioned problem clearly necessitates a distributionally robust handling of residual data to obtain a detector threshold satisfying a desired false alarm rate.…”

“…We propose to use the higher order moment based anomaly detector design proposed in [7] to design the detector threshold in this setting. The residual data r k from either of the two approaches is collected for a sufficiently long period of time to form the s-moments based ambiguity set P s q .…”

“…However, in reality due to the multiplicative noise, Q † z k is non-Gaussian thereby not making the chi-squared detector an optimal choice. This necessitates a moment-based approach for constructing the threshold and we can directly invoke Theorem 4 in [7] to obtain the required detector threshold α q,s 1 corresponding to F.…”

“…A common practice is to model a CPS as either a deterministic system or a stochastic system with additive Gaussian uncertainties. Motivated by the recent developments in distributionally robust optimization (DRO) techniques [4]- [6], authors in [7]- [9] have developed DRO anomaly detectors that remove assumptions on specific functional forms of the uncertainties in the stochastic CPS model. On the other hand, no matter whether a deterministic or a stochastic approach is taken to model the CPS, it is widely assumed that the true system dynamics are known exactly.…”

“…Contributions: This paper is part of our ongoing work [7], [8] to leverage results from distributionally robust optimization to design robust anomaly detectors. Specifically, the detector threshold corresponding to a desired false alarm rate in the setting considered in this paper can be effectively computed only through the moment-based approaches explained [7]. In prior work we addressed detectors robust to non-Gaussian additive noise.…”