<i>d</i>-TV-DBN: A Hierarchical and Distributed Architecture for Scalable Cyber-Physical Anomaly Detection with Bayesian Networks

The wide availability of diverse data from monitoring industrial cyber-physical systems enables data-driven anomaly detection. In particular, the scientific literature has addressed explainable cyber-physical anomaly detection using Bayesian networks, involving decision fusion from an ensemble of detectors. However, the aggregation of multiple decisions from different detectors within a single Bayesian network may negatively affect anomaly detection performance due to the heterogeneity of distributed environments. Furthermore, such decision fusion may be affected by scalability issues due to Bayesian inference being NP-hard. To address these issues, we present <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">d</i>-TV-DBN, a hierarchical and distributed architecture to scale cyber-physical anomaly detection with the state-of-the-art ensemble decision fusion technique based on Time-Varying Dynamic Bayesian networks. We provide a Proof-of-Concept evaluation of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">d</i>-TV-DBN and evaluate its scalability and detection performance, comparing the results with several ensemble decision fusion approaches. The results demonstrate that the proposed <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">d</i>-TV-DBN outperforms the current state-of-the-art decision fusion techniques while maintaining a remarkably low mean inference time for reaching the final decision.