RU2825558C1 - Method of reducing stream of observations of parameters of cyberphysical system coming in real time to equal-interval time grid - Google Patents

Abstract

FIELD: cybernetics.

SUBSTANCE: invention relates to a method of reducing a stream of observations of parameters of a cyberphysical system (CPS) coming in real time to an equal-interval time grid (EITG). Method is carried out using a stream processor and includes steps of: a) obtaining at least one new observation of the CPS parameter from the input stream, after which each obtained observation of the CPS parameter is accumulated and referred to the EITG unit in accordance with the time of the data of said observation of the CPS parameter; b) for each obtained observation of the CPS parameter, at least one criterion for recognizing a new EITG head unit is checked and when said criterion is met, the EITG unit corresponding to the time of data of said observation of the CPS parameter is recognized as the EITG head unit; c) checking, using at least one unloading criterion, the possibility of unloading at least one unit of the EITG, wherein the unloading criterion is checked taking into account the properties of the flow of observations of parameters of the CPS from the set of input parameters of the CPS, where CPS parameter observation corresponds to CPS parameter value and data time; d) when at least one unloading criterion is met, at least one unit of the EITG is unloaded, for which said at least one unloading criterion is met, and said observation of the CPS parameter is also unloaded; e) in each unloaded unit of the EITG for each output parameter of the CPS from the set of output parameters of the CPS, its value is calculated based on the said unloaded unit of the EITG, wherein each output parameter of the CPS is associated with at least one of the input parameters of the CPS, in particular coincides with one of the input parameters of the CPS or is a derivative of at least one of the input parameters of the CPS.

EFFECT: possibility of reducing the flow of observations of parameters of a cyberphysical system to an equal-interval time grid.

17 cl, 20 dwg

Description

Field of technology

The invention relates to the field of information technology and information control systems, including information and industrial security, and more specifically to systems and methods for converting the flow of observations of parameters of a cyber-physical system, received in real time, to an equal-interval time grid.

State of the art

The operation of modern enterprises is provided by cyber-physical systems (CPS) with thousands of sensors, actuators, PID controllers (proportional-integral-differentiative controller), PLC (programmable logic controller), as well as information systems (IS) with many computing devices in the network. Therefore, such enterprises also install various monitoring systems designed to monitor and analyze enterprise data.

The specified CFS or IS are also called a monitoring object (hereinafter referred to as an object). Thus, monitoring objects are characterized by the presence of a data flow characterizing the operation of these objects. Such data serve as an important subject of analysis both in real time (online) and retrospectively based on the collected data to detect anomalies (deviations from the normal operation of the object), as well as to form predictions about the future state of the object.

Predictive models based on neural networks and other machine learning methods (classification, clustering, regression, and other methods), hereinafter referred to as anomaly detectors (detectors), as well as predictive analyzers, are successfully used to analyze telemetry data of physical processes (i.e., values of CFS parameters, such as sensor readings, setpoint values, control action levels, hereinafter referred to as telemetry). Examples of such detectors and predictive analyzers are described, for example, in patents RU2724716, RU2724075, RU2749252, US11175976, US11494252. The specified telemetry analysis can be performed, for example, to detect anomalies or to predict the behavior of an object in the future.

The mathematical basis of most machine learning methods, including neural networks, is to restore an unknown continuous function describing the operation of an object from an array of discrete observations made on the object. However, in practice, and especially in cases where the anomaly detector must work in real time, various problems arise, for the solution of which special methods of streaming data processing are used.

For neural network-based models to work on time series (e.g. telemetry data), it is necessary that adjacent observations are spaced equally apart. When a neural network analyzes a time series, it typically considers not one observation at a time, but many observations in a certain time interval (the so-called "window"). Working with a window is necessary to perceive the dynamics of a process unfolding in time. Having analyzed the behavior of an object in a window, the neural network produces the result of its work - for example, a prediction of the future behavior of the object or a classification of the current behavior of the object. Then the window is shifted a specified step forward (adjacent windows may not overlap, or partially overlap), and the process is repeated on a new time interval. During training, the neural network goes through windows (i.e. windows are received alternately at the input of the neural network) over a long time interval in order to "understand" all the details and hidden rules of the object's functioning. In inference mode, the neural network analyzes one window at a time in real time and produces a result based on its “knowledge” gained during training.

For a neural network to operate as described above and demonstrate consistent quality, all windows, both in training and in production mode, must provide the same "overview" of the monitoring object. This means that all windows must represent equal time intervals, divided into the same number of moments in which the object is observed, and at each such moment the object is observed in the same way. It follows that the object telemetry entering the machine learning model must be represented by observations taken at the nodes of some equal-interval time grid (EITT), and at each node the values of all input parameters must be known.

However, the situation where the incoming observations are already distributed among the RIVS nodes does not usually occur. Instead, the detector encounters one or more of the following features of the data (observations) flow:

observations of the parameters of the CFS are received at random intervals that do not coincide with the period of the RIVS;

observations of some parameters of the FSC are formed frequently, others - rarely, and others - sporadically (based on the fact of a certain event);

even if the proper periods of observation of different parameters of the CFS coincide, their phases (specific moments of measurements) differ;

observations may be late or arrive early relative to adjacent observations, in other words, the timestamp of a new observation received by the detector may be in the past relative to the timestamp of the previously received observation. This may be caused by fluctuations in the load on the monitoring system processors, variations in delays in the data transmission network, or differences in the clock readings that form observations on the side of the monitoring object;

some observations are lost during transmission or are not generated at all due to overload of the monitoring system and/or due to hardware problems that arise in the processes of functioning of the FSC;

the data flow may be interrupted from time to time, completely or partially, including routinely (planned periodic shutdown of the unit).

Thus, in the general case, observations arrive chaotically, for example, they are generated at random intervals, arrive in random order, are not synchronous with each other and with the RIVS, are delayed or lost along the way. For example, for a RIVS with a period of 10 sec. the neural network expects to receive the values of the parameters of the FSC "A", "B" and "C" at 12:00:00, then at 12:00:10, then at 12:00:20, etc. In fact, the measurements of the values of the parameter of the FSC "A" can be taken at 12:00:01, 12:00:09, 12:00:21. The measurements of the parameter of the FSC "B" - at 11:59:48 and 12:00:08, with the latter being late and received after the value of the parameter of the FSC "A" from 12:00:21. The last time observations of the parameter of the FSC "C" were received was at 11:30. When working with such a flow of observations, the results of the detectors, relying on the uniform and synchronous receipt of measurements of the parameters "A", "B", "C", will be erroneous, and the results of the predictive analyzers will not be accurate enough.

Therefore, a technical problem arises, the solution to which is aimed at the declared technical solution, which consists of creating a computer-implemented method for reducing an arbitrarily distributed flow of observations of the parameters of a cyber-physical system, received in real time, to an equal-interval time grid.

The prior art discloses methods for reducing observations of various historical data, previously collected in their entirety into a static array covering the entire time interval to be analyzed, to a DVS (see, for example, patent US8818919). However, such methods are not applicable to a flow of observations arriving in real time, where future observations and the time of their arrival are unknown. In particular, when receiving a flow, it is unknown whether all observations for a certain DVS node have already been received by now, or some have not yet been received, or another part of the observations will never be received, since these observations were either not made at the facility or were lost. When working with a static data array, such a problem does not exist in principle, since all received observations for all DVS nodes are immediately and simultaneously available to the data processor. In addition, when reducing a static data array to a DVS, there is no need to identify and specially process late or too early observations, to detect a "flow loss", to adapt to a change in the speed of data time relative to the processing time.

Thus, known technologies have shortcomings that prevent a full solution to the stated technical problem, which is why the need for the stated invention arises.

Disclosure of the essence of the invention

The first technical result consists of converting a randomly distributed flow of observations of the parameters of the CFS, received in real time, to the RIVS.

The second technical result consists in reducing the time required to bring a randomly distributed flow of observations of the parameters of the CFS, received in real time, to the RIVS.

The third technical result consists in the formation of a stream of output parameter values of the CFS reduced to the RIVS without gaps.

The fourth technical result consists of preparing data in the form and volume necessary for the correct operation of anomaly detectors and predictive analyzers.

According to an embodiment, a computer-implemented method is used for reducing a flow of observations of parameters of a cyber-physical system, received in real time, to an equal-interval time grid, comprising the stages of: checking, using at least one unloading criterion, the possibility of unloading at least one node of the RIVS, wherein the unloading criterion is checked taking into account the properties of the flow of observations of the parameters of the CPS from a set of input parameters of the CPS, where the observation of the parameter of the CPS corresponds to the value of the parameter of the CPS and the time of the data; when at least one unloading criterion is met, at least one node of the RIVS is unloaded, for which the specified at least one unloading criterion is met; in each unloaded node of the RIVS, for each output parameter of the CFS from the set of output parameters of the CFS, its value is calculated based on the said unloaded node of the RIVS, wherein each output parameter of the CFS is associated with at least one of the input parameters of the CFS, in particular, coincides with one of the input parameters of the CFS or is derived from at least one of the input parameters of the CFS.

According to one particular embodiment, the properties of the stream include at least one of the following: a stream unload distance, a timeout.

According to another particular embodiment, the unloading criterion is at least one of the following: unloading by stream; unloading by timeout.

According to another particular embodiment, if the possibility of unloading at least two RIVS nodes is checked and if the unloading criterion by flow is met for one RIVS node, and the unloading criterion by timeout is met for another RIVS node, then the one of the specified RIVS nodes with the larger time stamp is selected.

According to one of the particular implementation options, one or more other RIVS nodes are additionally unloaded, successively preceding the RIVS node that satisfies the unloading criterion.

According to another particular embodiment, if the unloaded RIVS node includes an observation of at least one parameter of the CFS, the specified at least one observation of the parameter of the CFS is also unloaded.

According to another particular embodiment, if at least one observation of the input parameter of the CFS related to the output parameter of the CFS pertains to the RIVS node, then it is taken into account when calculating the value of the output parameter of the CFS.

According to one particular embodiment, a method is used that additionally includes the steps that are preliminarily performed on condition of receipt of at least one new observation of the CFS parameter from the stream, according to which each received observation of the CFS parameter is accumulated and assigned to the RIVS node in accordance with the time of the data of the specified observation, and also for each received observation of the CFS parameter, at least one criterion for recognizing a new RIVS head node is checked and, if it is met, the RIVS node corresponding to the time of the data of the specified observation of the CFS parameter is recognized as the RIVS head node.

According to another particular implementation option, the criterion for recognizing a new head node of the RIVS is one of: the criterion for recognition by representation; the criterion for recognition by the proportionality of the interval; the criterion for recognition in the state of complete stop of the flow.

According to another particular embodiment, a method is used in which an incident is additionally generated if at least one of the conditions for generating an incident is met.

According to one of the particular implementation options, the conditions for incident formation include the following: for the "late observation" incident: the time of the observation data of the KFS parameter corresponds to the previously unloaded RIVS node; for the "source clock failure" incident: the time of the observation data of the KFS parameter is ahead of the time stamp of the RIVS head node by a specified time interval; for the "flow loss" incident: in the event of termination of the receipt of observations of the KFS parameter during a certain time specified for the KFS parameter, and information about the incident is additionally added to the value of the KFS output parameter.

According to another particular embodiment, a method is used that additionally includes steps in which the properties of the flow are redefined in the event that the frequency of occurrence of “late observation” or “source clock failure” incidents exceeds a specified threshold.

According to another particular embodiment, a method is used in which, if the set of input parameters of the CFS coincides with the set of output parameters of the CFS, then in each of the unloaded nodes of the RIVS, a value is calculated for each parameter of the CFS from the set of output parameters of the CFS depending on the number of observations of the corresponding input parameter of the CFS assigned to the RIVS node, and if one or more observations have been accumulated for the input parameter of the CFS in the specified RIVS node, aggregation is performed based on the accumulated observations of the input parameter of the CFS in the specified node of the RIVS.

According to one particular implementation option, if the set of input parameters of the CFS coincides with the set of output parameters of the CFS and if none of the observations have been accumulated for the CFS parameter in the unloaded RIVS node, the missing value of the CFS parameter is imputed based on the observations of the CFS parameter for earlier RIVS nodes.

According to another particular embodiment, the value of the output parameter of the CFS is calculated in the RIVS node according to the dependence on the parameters of the CFS associated with it, wherein the values for each parameter of the CFS are calculated depending on the number of observations of the specified parameter of the CFS assigned to the RIVS node, wherein if one or more observations have been accumulated for the specified parameter of the CFS in the specified RIVS node, aggregation is performed based on the accumulated observations of the parameter of the CFS in the specified RIVS node or in earlier nodes of the RIVS or in the specified RIVS node and earlier nodes of the RIVS.

According to another particular embodiment, a method is used in which the value of the output parameter of the CFS in the RIVS node is calculated according to the dependence on the parameters of the CFS associated with it, and if none of the observations have been accumulated in the unloaded RIVS node for at least one associated parameter of the CFS, imputation of the missing value of the specified parameter of the CFS is performed based on observations of the specified parameter of the CFS for earlier RIVS nodes or based on previously calculated values of the specified parameter of the CFS for earlier RIVS nodes or based on a combination of observations of the specified parameter of the CFS and previously calculated values of the specified parameter of the CFS for earlier RIVS nodes.

According to one of the particular implementation options, the value of the output parameter of the CFS in the RIVS node is calculated additionally based on the values of other output or other input parameters of the CFS associated with the specified output parameter of the CFS.

According to another particular embodiment, a method is used that additionally includes steps in which the properties of a stream are determined in the event of the start of the arrival of a stream or the resumption of the arrival of a stream after an interruption.

Brief description of the drawings

Additional objects, features and advantages of the present invention will be apparent from reading the following description of the embodiment of the invention with reference to the accompanying drawings, in which:

Fig. 1 shows an example of a cyber-physical system and its interactions with a stream processor.

Fig. 2 shows examples of anomaly detectors.

Fig. 3 shows examples of predictive analyzers.

Fig. 4 shows the architecture of the stream processor.

Fig. 5 shows an example of the operation of a stream processor, in particular an example of a method for converting a stream of observations of the parameters of the CFS, received in real time, to the RIVS.

Fig. 6 shows an example of a method for detecting anomalies in the CFS in real time.

Fig. 7 shows an example of a method for implementing predictive analysis in the CFS in real time.

Fig. 8 shows an example of a RIVS.

Fig. 9a-9g show examples of the flow of observations of the parameters of the CFS.

Fig. 10a-10g show examples of changes in the time of observation data of the parameters of the CFS in the flow.

Fig. 11 shows an example of observations of the parameters of the CFS indicating an incident in the data.

Fig. 12 shows an example of the operation of a flow processor using a dense flow of observations of the parameters of the CFS.

Fig. 13 shows an example of the operation of a stream processor using a sparse stream of observations of the parameters of the CFS.

Fig. 14 is an example of a general purpose computer system with which the present invention may be implemented.

Implementation of the invention

The objects and features of the present invention, the methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, it can be embodied in various forms. The description provided is intended to help a person skilled in the art to fully understand the invention, which is defined only within the scope of the appended claims.

Glossary

An information system (IS) is a set of computing devices and communications used to connect them.

Cyber-physical system (CPS) is an information technology concept that involves the integration of computing resources into physical processes. Examples of a cyber-physical system are a technological system, the Internet of Things (including wearable devices), and the Industrial Internet of Things.

The Internet of Things (IoT) is a computing network of physical objects ("things") equipped with built-in network technologies for interacting with each other or with the external environment. The Internet of Things includes technologies such as wearable devices, electronic vehicle systems, smart cars, smart cities, industrial systems, etc.

The Industrial Internet of Things (IIoT) is a collection of connected hardware and advanced analytics platforms that process data from connected devices. IIoT devices range from small weather sensors to complex industrial robots. Although the word “industrial” often conjures up images of warehouses, shipyards, and manufacturing plants, IIoT technologies have great potential for use in a variety of industries, including agriculture, healthcare, financial services, retail, and advertising. The Industrial Internet of Things is a subcategory of the Internet of Things.

Object - an object of monitoring, in particular an IS or a CFS.

Technological process (TP) - a process of material production, consisting of a sequential change of states (as well as certain properties) of a material entity (subject of labor). For example, a physical process, a chemical process. TP can be carried out in the CFS.

Uniform temporal grid (UTG) is an infinite sequence of time moments in which the distance between adjacent elements of the sequence is constant (the same).

RIVS node (UTG node) - any of the moments in time that make up the RIVS.

The timestamp of a RIVS node is the moment in time corresponding to a specific RIVS node.

A RIVS node cell is a time interval around a RIVS node whose length is equal to the distance between nodes (i.e., the timestamps of RIVS nodes). A cell defines which points on the time axis belong to a RIVS node. In the preferred embodiment, a RIVS node is located at the center of its cell. In other embodiments, a RIVS node is located to the left or right of the center of its cell.

The RIVS is characterized by three parameters (see example in Fig. 8 ):

period (inversely proportional to frequency) - the distance between grid nodes;

phase - the position of nodes relative to the time of day (for example, the interval between midnight and the nearest RIVS node following midnight);

left margin of a cell - the distance between the left border of a cell and the corresponding RIVS node as a fraction of the RIVS period (0.5 if the RIVS node is in the center of its cell).

A process variable (PV) is a current measured value of a certain state of a process flow, a process control system, or an IS that is being observed or controlled. Examples of process variables include temperature, pressure, flow rate, volume, mass, and others.

Setpoint - a supported value of a process variable. For example, for the process variable "temperature", the setpoint may be the supported temperature (for example, 0 degrees or 100 degrees Celsius). In another example, for the process variable "pressure", the setpoint may be the supported pressure.

Manipulated Variable (MV) - a parameter that is adjusted to maintain the value of a process parameter at the setpoint level. For example, to maintain the water temperature in a tank (process parameter) at the setpoint level of 100 degrees, the level of gas supply (manipulated parameter) from the cylinder to the gas heater is adjusted.

CPS variable, tag - a parameter characterizing the operation of the CPS, including one of the following: a process parameter, a setpoint, a controlled parameter that relates to the CPS, as well as derived parameters calculated on the basis of the parameters listed above. For example, for a physical or chemical process, the CPS parameter is the process parameter of the CPS. Moreover, these processes are continuous. Therefore, the CPS parameter is also continuous and at each moment in time takes a certain value, regardless of whether the value of the specified CPS parameter was measured or not at any moment in time.

The parameters of the CFS can be divided into two types - natural parameters and derived parameters. The values of the CFS parameter can come from the object where they were measured (such a parameter of the CFS is also called a natural parameter of the CFS, or original tag), or be calculated by the data recipient based on the values of one or more natural parameters of the CFS (such a parameter of the CFS is called a derived parameter of the CFS, while the parameters of the CFS, based on which the derived parameter of the CFS is calculated, are called the original parameters of the CFS for the specified derived parameter of the CFS). A derived parameter of the CFS can also be calculated based on other derived parameters of the CFS or based on both natural and derived parameters of the CFS. The claimed invention works equally correctly with any parameters of the CFS - both natural and derived. Therefore, all types of CFS parameters will be meant in the description of the implementation options. However, in certain particular embodiments, where this is important for the operation of the invention, the parameters of the FSC will be divided into natural and derivative.

Examples of natural parameters of the FSC: T1 (temperature of one sensor), T2 (temperature of another sensor), P (pressure), V (volume), U (electrical voltage), I (current).

Examples of derived parameters of the FSC: T3 = T1 /100 (temperature T1 as a percentage of 100 degrees); W = U ⋅ I (electric power); T3 is equal to the moving average of T1 ; T4 = T1-T2 (difference indicator); P1 = 1 if the values of P are received and the condition P>10 is met, and otherwise P1 = 0 .

Telemetry is a set of parameters of the FSC. Telemetry data is a set of values of the FSC parameters.

Data time (or event time) is the moment in time at which the value of the CFS parameter was measured or otherwise generated according to the clock of the data source (monitoring object). The data time uniquely determines the RIVS node to which the corresponding observation of the CFS parameter belongs, in accordance with the RIVS node cell to which the specified data time belongs.

Processing time (also system time, processing time) is the time measured by the clock of the data recipient - for example, by the system clock of the computer on which the stream processor is running.

Observation, observation of a CFS parameter - a set of three values, which includes: the identifier of the CFS parameter (name, serial number or other indication of a specific CFS parameter); the value of the CFS parameter, measured or otherwise formed at a certain point in time (data time); the value of the point in time (data time) itself according to the clock of the CFS parameter data source. In the context of data flow processing, a distinction can be made between observation as such (data point) and observation received by the data receiver (observation). In the latter case, the observation arrival time according to the clock of the data receiver (processing time) is added to the observation attributes.

The flow of the KFS parameter is a sequence of observations of the KFS parameter, perceived in the processing time.

Telemetry flow, flow of observations of the parameters of the CFS, flow of values of the parameters of the CFS, input flow (hereinafter referred to as flow) - a sequence of observations of the parameters of the CFS (also - input parameters of the CFS) from a given set of input parameters of the CFS.

Output telemetry flow, flow of observations of the output parameters of the CFS, flow of values of the output parameters of the CFS, output flow - a sequence of observations of the output parameters of the CFS from a given set of output parameters of the CFS - that is, a sequence of values of the output parameters of the CFS in the nodes of the RIVS.

Stream processor (SP) is a hardware and software module (service) that performs in near real time the conversion of an arbitrarily distributed in time flow of observations of the parameters of the CFS into a flow of observations of the same or derived parameters of the CFS (output parameters of the CFS) converted to the RIVS - that is, it performs the conversion (fit) of an arbitrarily distributed flow of observations of the parameters of the CFS to the RIVS. "In near real time" means that the delay in converting the flow at the output of the stream processor relative to the input flow is perceived by the user as insignificant or not noticeable at all.

The data path management system (DPS) is a part of the CFS data flow analysis system responsible for transmitting observations and accompanying data between various modules (services) of the system that receive, process, or store them. DPS is a system external to the flow processor that calls the flow processor and accepts the results of its work.

Aggregation is a procedure for determining the value of a CFS parameter in a RIVS node based on one or more observations of this CFS parameter assigned to a cell of this RIVS node. Examples of aggregation: taking the value of the latest observation (by data time); calculating the average value of observations. For a derived CFS parameter that depends on one or more other CFS parameters (initial CFS parameters), in one example of implementation, aggregation can be performed by determining the value of the derived CFS parameter in a RIVS node based on one or more observations, the specified initial CFS parameters assigned to a cell of this RIVS node. In another example of implementation, the values of the specified one or more output parameters of the CFS are first determined, including using aggregation, after which the value of the derived CFS parameter is determined in accordance with the dependence on the specified one or more initial CFS parameters.

An empty RIVS node is a node in whose cell not a single observation of a specific parameter of the CFS or not a single observation at all has been received.

Imputation is a procedure for determining the value of a CFS parameter for an empty RIVS node based on the values of this CFS parameter generated for earlier RIVS nodes. An example of imputation: repeating the value of a CFS parameter from the previous node. In the context of the subject area of this document, imputation is a special case of interpolation: both procedures are intended to restore a missing value, but imputation can only use known values from the past, while interpolation can use values from both the past and the future. Accordingly, imputation can be applied during stream processing, while interpolation in general cannot. For a derived CFS parameter that depends on one or more other CFS parameters (initial CFS parameters), in one example of implementation, imputation can be performed for an empty RIVS node based on the values of this derived CFS parameter generated for earlier RIVS nodes. In another example of implementation, for a derived parameter of the CFS, imputation can be performed for an empty RIVS node based on the values specified for one or more initial parameters of the CFS generated for earlier RIVS nodes. In yet another example of implementation, for a derived parameter of the CFS, imputation can be performed for an empty RIVS node based on both the values of the specified one or more initial parameters of the CFS assigned to earlier RIVS nodes and the values of this derived parameter of the CFS generated for earlier RIVS nodes.

A computer attack (also cyber attack, from the English cyber attack) is a targeted impact on information systems and information and telecommunication networks using software and hardware, carried out with the aim of violating the security of information in these systems and networks.

Anomaly in the CFS or IS, anomaly - deviation from the technological process in the CFS or IS. An anomaly may arise, for example, due to a computer attack, due to incorrect or illegitimate human intervention in the operation of the TS or TP, due to a failure or deviation of the technological process, including those associated with periods of change of its modes, due to the transfer of control circuits to manual mode or due to incorrect sensor readings, as well as for other reasons known from the state of the art. An anomaly may be characterized by a deviation of the CFS parameters.

Anomaly area, anomaly localization area - the time range of anomaly observation (time area) and/or the location of anomaly occurrence - i.e. an indication of the element or part of the CFS where the anomaly occurred (spatial area), for example, an indication of the sensor or its coordinates where the anomaly occurred. For each anomaly, an anomaly localization area is defined - temporal and/or spatial. To determine spatial areas, the CFS can be divided into different parts in accordance with belonging to different TP or its parts, in accordance with belonging to different physical or logical areas of the CFS and according to other criteria, including those specified by the CFS operator.

Fig. 1 shows an example of a cyber-physical system 100 and its interactions with a stream processor 400. The CPS 100 is presented in a simplified version. Examples of CPS 100 are a technological system (TS), the Internet of Things, the Industrial Internet of Things, IS, TP. For the sake of certainty, the TS will be considered as the main example of a CPS 100 in the description below. The CPS 100 contains a plurality of sensors, actuators, PID controllers (programmable logic controller), the data of which is transmitted in unprocessed form to a PLC (programmable logic controller, PLC). In this case, an analog signal can be used to transmit data. Then the PLC processes the data and converts the data into digital form - into observations of the CPS parameters (i.e., into the CPS 100 telemetry stream), as well as into events (for example, turning on a particular sensor, triggering sensor alarms, individual commands, etc.). The observations of the parameters of the CFS are then transmitted, for example, to the SCADA system 101 (supervisory control and data acquisition) and the CFS data flow analysis system 102 (for example, a system like Kaspersky MLAD (machine learning anomaly detection) or any other system for analyzing the CFS data flow), which includes the data path management system (DPS) 110 .

The SUTD 110 is a system responsible for transmitting observations of the parameters of the CFS and associated data between various other modules (services) that receive, process, or store them, in particular the stream processor 400 , anomaly detectors 200 , and predictive analyzers 300. The SUTD 110 is a system external to the stream processor 400 that calls (initiates the start or resumption of operation by transmitting data necessary for said start or resumption of operation) the stream processor 400 and receives the results of its operation, which can then be transmitted to the anomaly detectors 200 (also anomaly detection modules, hereinafter referred to as detectors), as well as to the predictive analyzers 300. Examples of detectors 200 , in particular means 201-205 , are shown in Fig. 2 , and examples of predictive analyzers 300 are shown in Fig. 3 . A description of the implementation options for detectors 200 and predictive analyzers 300 is presented below.

Description of anomaly detectors 200, Fig. 2

Detectors 200 serve to detect anomalies in the CFS 100 in the values of the CFS output parameters reduced to the RIVS, as well as to determine accompanying information about the detected anomalies. In a particular embodiment, the information about the anomalies in the CFS 100 includes such information about the anomaly as the anomaly localization area, the values of the CFS output parameters at each moment of the anomaly observation time range, the contribution of each CFS output parameter to the anomaly, information about the method for detecting the said anomaly (i.e., about the detector 200 that detected the anomaly). In yet another particular embodiment, the information about the anomalies in the CFS 100 additionally includes for each CFS output parameter at least one of: a time series of values, a current value of the deviation of the predicted value from the actual value, a smoothed value of the deviation of the predicted value from the actual value. In another particular case, information about anomalies in the CFS 100 additionally includes information about the maximum, minimum and average values of the CFS output parameters taken in the area of the anomaly localization, other statistical and deterministic characteristics, including sample variances and quantiles, the Fourier spectrum and wavelet transforms, and convolution operators from the CFS output parameters.

The detectors 200 can be a system and method for determining anomaly 201 in the CFS 100 , previously described in patents RU2724716, RU2724075, RU2749252, which determine anomalies by predicting the values of a subset of the CFS output parameters (the term “CFS features” was used in the mentioned patents, corresponding to the term “CFS parameters” in the claimed invention) and then determining the total forecast error for the subset of the CFS output parameters, wherein the anomaly in the CFS 100 is determined in the event that the total forecast error exceeds the threshold value, and in addition, the contribution of the subset of the CFS output parameters to the total forecast error is determined as the contribution of the forecast error of the corresponding CFS output parameter to the total forecast error.

The detectors 200 may include a base model module 202 designed to apply a trained machine learning model to detect anomalies based on the values of a subset of the output parameters of the CPS (hereinafter referred to as the base model). In this case, the base model may be trained on the data of a training sample, including known anomalies in the CPS 100 or not including known anomalies, but including known behavior during normal operation of the CPS 100 , as well as the values of a subset of the output parameters of the CPS for a certain period of time - that is, a supervised machine learning model is used. In addition, an unsupervised machine learning model may be used as the base model. To improve the quality of the base model, testing and validation of the trained base model may be performed on the test and validation samples, respectively. In this case, the test and validation samples may include known anomalies and values of a subset of the output parameters of the CFS for a certain period of time preceding the known anomaly in the CFS 100 , but the specified test and validation samples differ from the training sample.

In another embodiment, the detectors 200 include a rule-based detection module 203 , using which rules for detecting anomalies are applied. Such rules may be pre-formed and received from the CPS operator via a feedback interface and contain conditions applied to the values of a subset of the CPS output parameters, upon fulfillment of which an anomaly is determined.

In another particular embodiment, the detectors 200 include a limit value-based detection module 204 , using which an anomaly is determined when the value of at least one output parameter of the CPS from a subset of parameters of the output CPS has gone beyond a predetermined range of values for the specified output parameter of the CPS. In this case, the specified ranges of values can be calculated from the values of characteristics or documentation for the CPS 100 or received from the CPS operator via a feedback interface.

In another particular embodiment, the detectors 200 include a diagnostic rules module 205 , using which diagnostic rules are formed by specifying a list of output parameters of the CFS used in the specified diagnostic rule, and a method for calculating the values of the auxiliary (indicator) parameter of the CFS with subsequent calculation of the values of the auxiliary parameters of the CFS using the specified list of output parameters of the CFS and in accordance with the formed diagnostic rule. As a result, the diagnostic rules module 205 determines an anomaly in the CFS 100 based on the values of all output parameters of the CFS. An example of a diagnostic rules module 205 is described in patent RU2790331.

In another particular embodiment, detectors 200 include a graphical interface system for manually determining an anomaly by the FSC operator (see patent RU2724716), information about which can be transmitted via a feedback interface.

Predictive analyzers 300, Fig. 3

Predictive analyzers 300 serve for predictive analysis of the output parameters of the CFS reduced to the RIVS, that is, for forming a judgment about the most probable behavior of the CFS 100 in the future based on observations of the parameters of the CFS (that is, the input parameters of the CFS associated with the mentioned output parameters of the CFS) in the present and the past.

In the context of the description of predictive analyzers 300, the “future”, as applied to each specific parameter of the CFS, is considered to be all and any of the data time points following the latest data time point T for which the CFS parameter value is known from observation at the time of formation of the result of the work of the predictive analyzer 300. The data time point T is considered to be “present”.

In the context of using predictive analyzers 300 with a stream processor 400 , the concept of "future" is specified as all and any of the RIVS nodes following the last unloaded RIVS node, i.e., the last RIVS node for which the values of the output parameters of the CFS from the set of output parameters of the CFS are calculated. This last RIVS node is considered "present" (moment in time).

The unloading of at least one RIVS node is carried out by the accumulator 420 and includes reading the data (for example, into the RAM 25 ) of the selected at least one RIVS node and, in the case of the presence of selected observations of the parameters of the CFS, for their use, in particular, by the calculator 430 .

In a particular embodiment, the result of the operation of the predictive analyzer 200 includes a prediction of probable values of one or more output parameters of the CFS at one or more points in time of the data in the future (predictive analyzer 300-1 ).

In another particular embodiment, the result of the work of the predictive analyzer 300 includes a time interval of data in the future, within which the value of the output parameter of the CFS with a given probability will reach a given level (predictive analyzer 300-2 ). This embodiment is called "time to event estimation".

In yet another particular embodiment, the result of the predictive analyzer 300 operation includes predicting probable values of one or more output parameters of the CPS in the present or in one or more data points in the future, when the above-mentioned output parameters of the CPS are not observed (i.e., observations of the input parameters of the CPS associated with the said output parameters of the CPS were not generated by the source or were not received by the recipient) at least in the present and in the near past (a specified time interval back relative to the current time), although they may have been observed at some remote moments in the past (more than a specified time interval back relative to the current time). This embodiment is carried out by the predictive analyzer 300-3 and is called a "virtual sensor" (English: virtual sensor or soft sensor).

Fig. 4 shows the architecture of the stream processor 400. The stream processor 400 may include a calibrator 410 , a drive 420 and a calculator 430. The stream processor 400 and its constituent elements may be implemented on a computer 20 , an example of which is shown in Fig. 14 .

The stream processor 400 receives observations of the parameters of the CFS (from the set of input parameters of the CFS) from the flow of observations of the parameters of the CFS as input. The result of the work of the stream processor 400 contains the values of the output parameters of the CFS (from the set of output parameters of the CFS) in the nodes of the RIVS. The set of input parameters of the CFS and the set of output parameters of the CFS can be specified in advance, for example, by the operator of the CFS 100 , the SUTD 110 , the stream processor 400 . In one example of implementation, the set of output parameters of the CFS can be specified first, after which the set of input parameters of the CFS associated with the specified output parameters of the CFS will be determined.

Each output parameter of the CFS is associated with (depends on) at least one of the input parameters of the CFS, in particular, it coincides with one of the input parameters of the CFS (for example, for natural parameters of the CFS, but it is also true if the input parameter is a derivative parameter of the CFS from other natural parameters of the CFS) or is a derivative of at least one of the input parameters of the CFS. That is, the output parameters of the CFS can be both natural and derivative parameters of the CFS.

In this way, the stream processor 400 converts a randomly distributed in time flow of observations of the parameters of the CFS into a flow of observations of the same parameters of the CFS or their derivatives (output parameters of the CFS), converted to the RIVS.

In one particular implementation variant, the output parameters of the CFS correspond to the parameters of the CFS (from the set of input parameters of the CFS). In this case, the set of output parameters of the CFS also coincides with the set of input parameters of the CFS.

In another particular embodiment, the set of output parameters of the CFS contains at least one parameter of the CFS from the set of input parameters of the CFS, as well as at least one derived parameter of the CFS, depending on at least one input parameter of the CFS.

In another particular embodiment, the set of output parameters of the CFS contains only the derivative parameters of the CFS from at least one input parameter of the CFS.

For example, if the set of input parameters of the CFS, which are natural parameters of the CFS, include the length, height and width of some parallelepiped-shaped object, then the output parameters of the CFS may include the length, height and width of the same object, but there may also be a derived parameter of the CFS characterizing the volume of this object, equal to the product of the length, height and width. In another example, if the set of input parameters of the CFS includes the natural parameter of the CFS - air temperature, then the output parameters of the CFS will include the air temperature, but there may also be a derived parameter of the CFS equal to the moving average of the air temperature calculated over the last 10 days. In the third example, if the set of input parameters of the CFS includes the air temperature and the surface temperature of the object, the output parameters of the CFS will not include the air temperature (natural parameter), but the surface temperature of the object will be present, but there will also be a moving average of the air temperature (derived parameter of the air temperature). In the fourth example, if the set of input parameters of the CFS includes air temperature and object surface temperature, then the output parameters of the CFS may not include either air temperature or object surface temperature, but will include a moving average of the air temperature calculated over the last 10 days, as well as a moving average of the object surface temperature calculated over the last 10 days.

Calibrator 410 is intended for analyzing a given volume of data in the flow of observations of the parameters of the CFS (input parameters of the CFS) from the set of input parameters of the CFS in order to determine or redefine the properties of flow 411 (i.e., calibration and recalibration of accumulator 420 , the properties of flow 411 will be disclosed in more detail in Fig. 5 ). The properties of flow 411 can also be set to default values. The properties of flow 411 are used by accumulator 420 in the normal operating mode of flow processor 400 . Accumulator 420 is intended for accumulating the parameters of the CFS obtained from the flow of observations, assigning them to the corresponding nodes of the RIVS. In addition, accumulator 420 is also intended for unloading RIVS nodes corresponding to the unloading criterion, together with the observations of the parameters of the CFS assigned to them for their subsequent transmission to computer 430 . Unloading of RIVS nodes occurs relative to the head node of the RIVS.

The RIVS head node is the RIVS node to which the majority of the CFS parameter observations, already received and still expected around the current moment of processing time, belong. The RIVS head node characterizes the relationship between the data time and the processing time. The RIVS head node is assigned (recognized) according to the acknowledgement criteria of a new RIVS head node, which will be disclosed below.

The calculator 430 is designed to calculate the values of the output parameters of the CFS from a set of output parameters of the CFS in the RIVS nodes based on the RIVS nodes downloaded from the accumulator 420 and observations of the parameters of the CFS (if any) in the specified RIVS nodes.

A detailed disclosure of the implementation of the stream processor 400 , as well as variants of its implementation, are presented below in Fig. 5 .

Fig. 5 shows an example of the operation of the stream processor 400 , in particular an example of a method for bringing the flow of observations of the parameters of the CFS, received in real time, to the RIVS.

In one embodiment, the stream processor 400 may be an independent module that determines its own start of operation. In another embodiment, the stream processor 400 may start operation upon a call from an external system, such as the TSDS 110 or the data stream analysis system CFS 102 . In an example, the TSDS 110 calls the stream processor 400 when one of the following occurs:

a new observation of the CFS parameter (or several new observations of the CFS parameters at once) was received from the monitoring object;

the moment of processing time previously proposed (indicated) by the stream processor 400 itself for its call has arrived.

Regarding the latter case, it is worth noting that, generally speaking, the SUTD 110 can call the stream processor 400 at any time. The result of the operation of the stream processor 400 (i.e., the composition of the values of the output parameters of the CFS in the RIVS nodes) does not depend on how often and when exactly the SUTD 110 will call the stream processor 400. But in order for the output stream to be generated in a time as close as possible to real time (which is determined, for example, by a lag of a given amount in the time of generation of the output stream relative to real time), in one embodiment, the calls of the stream processor 400 occur at the moments of processing time proposed (indicated) by it.

At each call of the stream processor 400, the SUTD 110 passes to the input of the stream processor 400 , in particular, one or more of the following arguments:

a list of new observations received in the input stream, i.e. new values of the parameters of the FSC (the list may be empty if the stream processor 400 is called by time);

current processing time (for example, the readings of the system clock SUTD 110 ).

After each call, the stream processor 400 may return to the STS 110 at least one of the following lists, where any of the returned lists may be empty:

output observations, that is, the values of the output parameters of the CFS in the RIVS nodes;

proposed moments of subsequent calls of the stream processor 400 in processing time;

a list of incidents that occurred while processing the input stream (e.g. "late observation", "source clock failure", "stream loss").

The SUTD 110 may manage the results of calling the stream processor 400 as follows:

the values of the output parameters of the CFS in the RIVS nodes are placed in the data path (output stream), from where they are sent to the next consumer, for example, to anomaly detectors 200 , to predictive analyzers 300 (see more details in Fig. 6 , Fig. 7 );

incidents are sent to a module (service, not indicated in the drawing) designed to handle incidents;

The proposed subsequent call times are used to set timers for calling the stream processor 400 in the future.

The SUTD 110 calls the stream processor 400 at step 501 .

In the case where the stream processor 400 is implemented according to the architecture described in Fig. 4 , steps 520 - 521 are performed by the calibrator 410 , steps 502 - 507 are performed by the accumulator 420 , and step 508 is performed by the calculator 430 .

At step 502, the receipt of at least one new observation of the CFS parameter from the stream is checked and, in the case of receipt at step 503, each received observation of the CFS parameter is accumulated and assigned to the RIVS node in accordance with the time of the data of the said observation of the CFS parameter. Accumulation of observations of the CFS parameters and RIVS nodes means any storage of the said data with the possibility of their subsequent reading. The data can be saved (accumulated) both on a machine-readable medium (for example, storage devices 27 - 28 in Fig. 14 ), and in random access memory (for example, RAM 25 of computer 20 in Fig. 14 ). Storage (accumulation) of data can be carried out in the form of a list, database, files or in any other way.

At step 504, for each received observation of the CFS parameter, at least one criterion for recognizing a new head node of the RIVS is checked and, if it is met, at step 505 the RIVS node corresponding to the time of the data of the specified observation of the CFS parameter is recognized as the head node of the RIVS.

In a particular embodiment, the criterion for recognizing a new RIVS head node, checked at step 504 , is one of:

recognition criterion by representation: a RIVS node (node N ) following the head node of the RIVS (node H ) is recognized as the head node of the RIVS if observations have been received for node N for such a number of parameters of the CFS that is equal to or higher than a specified number (regularity of the flow R );

recognition criterion based on interval proportionality: node N is recognized as the head node of the RIVS if an observation of the parameter of the CFS corresponding to node N at the moment of processing time ( T_now ) is received, and And , where Th is the processing time when node H was recognized as the head node of the RIVS, p is the RIVS period, Da is the average processing time interval between recognitions of a given number of the last head nodes of the RIVS;

recognition criterion in the state of complete flow stop (the “standstill” state): if the accumulator 420 is in the “standstill” state, then node N is recognized as the head node of the RIVS immediately after receiving any observation of the parameter of the CFS corresponding to node N.

In another particular implementation option, the recognition criterion based on the proportionality of the interval is used under the condition that the recognition criterion based on representation is not applicable.

In another particular embodiment, the recognition criterion based on the proportionality of the interval is configured in the settings of the stream processor 400 : the said criterion is used either for all parameters of the CFS, or only for predetermined parameters of the CFS. In the latter case, the accumulator 420 checks both criteria simultaneously (representation of the values of the CFS parameters among the entire set of input parameters of the CFS and the proportionality of the interval for the said predetermined parameters of the CFS), and the new head node of the RIVS is recognized if at least one of the checked criteria has worked.

In a particular embodiment, at the beginning of the operation of the accumulator 420, the first received observation of the parameter of the CFS forms the first head node of the RIVS for the flow.

If at step 502 not a single new observation of the CFS parameter was received, then proceed to step 506. In addition, if at step 504 none of the criteria for recognizing a new head node of the RIVS were met, then proceed to step 506 as well.

At step 506, the possibility of unloading at least one RIVS node is checked using at least one unloading criterion, wherein the unloading criterion is checked taking into account, in particular, the properties of the flow 411 of observations of the parameters of the CFS from the set of input parameters of the CFS. If none of the unloading criteria is met, then the stream processor 400 returns the results of the operation 510 of the SUTD 110 , which will not contain the values of the output parameters of the CFS in the RIVS nodes, but may contain the expected moments of subsequent calls of the stream processor 400 .

At the same time, when at least one unloading criterion is fulfilled, at least one RIVS node is unloaded at step 507 , for which the specified at least one unloading criterion is fulfilled. In a particular embodiment, if the unloaded RIVS node includes an observation of at least one CFS parameter, the specified at least one observation of the CFS parameter is also unloaded.

By unloading is meant reading data (for example, into the RAM 25 ) of the selected RIVS nodes and, in the case of the presence of selected observations of the parameters of the CFS for their use at step 508 . Moreover, the unloaded data will be excluded from the number of accumulated data. The exclusion may include the removal or addition of a mark to the unloaded data that, at the next call of the stream processor 400, the unloaded data will not be used when checking the unloading criteria at step 506 and at subsequent stages. In this way, the operation of the claimed invention is ensured in a mode as close as possible to the real-time mode.

The downloaded data may also be stored on a machine-readable medium for subsequent use both at step 508 and at a subsequent call to the stream processor 400 .

At step 508, in each of the unloaded RIVS nodes, for each output parameter of the CFS from the set of output parameters of the CFS, its value is calculated based on the said unloaded RIVS node, wherein this value corresponds to the data time equal to the timestamp of the RIVS node to which the value of the output parameter of the CFS refers. In a particular embodiment, if at least one observation of the input parameter of the CFS related to the RIVS node refers to the RIVS node, then it is taken into account when calculating the value of the output parameter of the CFS. Calculation of the values of the output parameters of the CFS from the set of output parameters of the CFS in the RIVS nodes is carried out based on the unloaded RIVS nodes and observations of the parameters of the CFS (if any) in the said RIVS nodes.

In a particular embodiment, the properties of the stream 411 include at least one of the following: the stream unloading distance - Ds (the specified number of RIVS nodes to which the values of the CFS parameters coming from the stream can be assigned), the timeout - Dt (the specified processing time interval that determines the maximum waiting time for the receipt of the CFS parameter values from the stream). The calibration of the accumulator 420 , that is, the determination of the specified values Ds, Dt, is carried out in such a way that the output stream of observations (the values of the output parameters of the CFS in the RIVS nodes) is formed with a minimum delay (the value of such a delay can be determined in advance) relative to the stream (that is, the input stream), but at the same time so that all observations of the CFS parameters, with the exception of lagging or early ones (that is, constituting an incident), are classified as having arrived on time (English: on time) and are transmitted to the computer 430 . Based on the above, a minimum possible value, for example 2 or 3, can be additionally defined for Ds (by default or at the calibration stage).

The unloading criterion is at least one of the following:

downstream unloading: between the RIVS node for which the unloading possibility is being checked and the head RIVS node there is such a number of other RIVS nodes that is equal to or greater than the downstream unloading distance Ds , thus the RIVS node satisfies the downstream unloading criterion and the RIVS nodes preceding it in time , etc.), where H is the head node of the RIVS, p is the period of the RIVS;

unload by timeout: the time elapsed from the previous processing time, during which the RIVS node, for which the unloading possibility is checked, was recognized as the head node of the RIVS, until the processing time (current) is equal to or exceeds the timeout Dt , thus, node H was recognized as the head node of the RIVS at the moment of processing time Th , then it will be unloaded by timeout when the current processing time is equal to or exceeds the value Th + Dt .

It is worth noting that if the possibility of unloading at least two RIVS nodes is checked and if the unloading criterion by flow is met for one RIVS node, and the unloading criterion by timeout is met for another RIVS node, then the one of the specified RIVS nodes with the higher timestamp is selected.

In a preferred embodiment, all RIVS nodes following the last unloaded node up to and including the RIVS node that satisfies the unloading criterion are additionally unloaded.

In one particular embodiment, at step 508 , an incident is additionally generated (e.g., a “late observation,” a “source clock failure,” or a “flow loss”) if at least one of the conditions for generating an incident is met: for a “late observation” incident: the time of the observation data of the CFS parameter corresponds to the previously unloaded RIVS node; for a “source clock failure” incident: the time of the observation data of the CFS parameter is ahead of the time stamp of the RIVS head node by a specified time interval; for a “flow loss” incident: in the event of a cessation of receipt of observations of the CFS parameter during a certain time specified for the CFS parameter, and information about the incident is additionally added to the value of the output parameter of the CFS.

In another particular embodiment, the method in Fig. 5 additionally includes steps 520 - 521 , in which the properties of the stream 411 are redefined (step 521 ) in the event that the frequency of occurrence of incidents associated with the delay or failure of the source clock exceeds the established threshold (checked at step 520 ). In another particular embodiment, the properties of the stream 411 are determined in the event of the start of the stream arrival or the resumption of the stream arrival after an interruption or "loss of stream". The need to determine/redefine the properties of the stream 411 is checked at step 520 taking into account the information received from the TSMS 110 when calling the stream processor 400 at step 501 .

In one particular embodiment, at step 508 , when the set of input parameters of the CFS coincides with the set of output parameters of the CFS, in each of the unloaded nodes of the RIVS, a value is calculated for each parameter of the CFS from the set of output parameters of the CFS depending on the number of observations of the corresponding input parameter of the CFS assigned to the RIVS node:

if one or more observations have been accumulated for the input parameter of the CFS in the specified node of the RIVS, aggregation is performed based on the accumulated observations of the input parameter of the CFS in the specified node of the RIVS;

If no observations have been accumulated for the KFS parameter in the specified RIVS node, the missing value of the KFS parameter is imputed based on the observations of the KFS parameter for earlier RIVS nodes.

In another particular embodiment, at step 508 , the value of the output parameter of the CFS in the RIVS node is calculated according to the dependence on the parameters of the CFS associated with it, and the values for each parameter of the CFS are calculated depending on the number of observations of the specified parameter of the CFS assigned to the RIVS node:

if one or more observations have been accumulated for the specified CFS parameter in the specified RIVS node, aggregation is performed based on the accumulated observations of the CFS parameter in the specified RIVS node or in earlier RIVS nodes or in the specified RIVS node and earlier RIVS nodes;

if no observations have been accumulated for the KFS parameter in the specified RIVS node, the missing value of the KFS parameter is imputed based on observations of the KFS parameter for earlier RIVS nodes or based on previously calculated values of the KFS parameter for earlier RIVS nodes or based on a combination of observations of the KFS parameter and previously calculated values of the KFS parameter for earlier RIVS nodes.

In a particular case, the value of the output parameter of the CFS in the RIVS node is calculated additionally based on the values of other output or other input parameters of the CFS associated with the specified output parameter of the CFS (hereinafter referred to as intermediate parameters).

In this example, the value of the mentioned intermediate parameter of the CFS is calculated, after which the value of the output parameter of the CFS is calculated based on the associated parameters of the CFS from the set of input parameters of the CFS, as well as on the intermediate parameter of the CFS. For example, the input parameters of the CFS are parameters A2, A3, A4, A6. The output parameter of the CFS is parameter A30, which depends on parameters A2, A3, A4 according to the following dependence: A30 = F(A20, A6), where F is the moving average of the values of parameters A20, A6 in the previous nodes of the RIVS. However, in order to calculate the value of parameter A30, it is first necessary to calculate the value of the intermediate parameter A20 according to its dependence on parameters A2, A3, A4, which is determined by the formula: A20 = G(A2, A3, A4), where G is the average value of parameters A2, A3, A4 in the current node of the RIVS. Thus, the claimed invention allows the use of any dependence of the output parameters of the CFS on the input parameters of the CFS, including the use of intermediate parameters of the CFS.

A break in the flow of a KFS parameter is a situation when not a single observation of a given KFS parameter has been received for the RIVS node by the time of its unloading. There are two types of breaks: flow interruption and "flow loss".

A flow interruption is a gap that has arisen due to the loss of one or an insignificant (below a certain value) number of observations of the CFS parameter or due to the fact that the proper period of formation of observations of the CFS parameter is greater than the period of the RVS. A flow interruption is not associated with any change in the behavior of the monitoring object. The computer 430 does not attempt to interpret the flow interruption in a special way, but simply fills the gap by imputation (for example, by repeating the last known value of the CFS parameter, or the average of several recent values of the CFS parameter) at step 508 . In a particular embodiment, the computer 430 also similarly fills the gap in the flow of the CFS output parameter, i.e., by imputation (for example, by repeating the last calculated value of the CFS output parameter, or the average of several recent calculated values of the CFS output parameter) at step 508 .

"Loss of flow" is a long-term (during a certain time interval specified for the CFS parameter, or the loss of such a number of observations of the CFS parameter that exceeds a certain value) cessation of receipt of observations of the CFS parameter, which may be caused by disconnection of the monitoring object (or part thereof) or an accident in the data transmission network. Due to the fact that "loss of flow" indicates a significant change in the state of the observed system, at step 508 the computer 430 processes the "loss of flow" in a special way: it generates a special "loss of data" (LoD) incident and/or sets for the CFS parameter whose flow was lost the default value specified for the specified CFS parameter in the RIVS nodes, starting from the RIVS node in which the "loss of flow" was identified. In a particular embodiment, the computer 430 handles the "flow loss" of the CFS output parameter in a similar manner, i.e., sets a default value for the CFS output parameters that are associated with the CFS parameter whose flow was lost.

In the embodiment, breaks in the flows of one or more parameters of the CFS do not create a special situation for the accumulator 420 , as long as at least one observation of any parameter of the CFS is received for each node of the RIVS. Observations received from other parameters of the CFS allow unloading the nodes of the RIVS by flow (if the flow is dense) or by timeout (if the flow is sparse), and, therefore, calling the computer 430 to process these nodes of the RIVS.

In another particular implementation option, when a simultaneous flow rupture occurs, a state of complete flow stop (“standstill”) occurs for all parameters of the FSC.

The state of complete flow stop is diagnosed by the 420 accumulator when the following conditions are met simultaneously:

a) accumulator 420 has determined that node N is to be unloaded;

b) the head node of the RIVS precedes or is equal to the node to be unloaded: H ≤ N . This means that the input stream has not arrived for some time and node N is unloaded due to a timeout;

c) the timeout unload queue is empty (i.e. node N was the last one in the queue).

In a particular embodiment, to identify the processing of "flow loss" of the CFS parameter observations when the flow completely stops in the flow processor 400 , a mechanism for unloading a certain number of empty RIVS nodes "by inertia" is provided. This mechanism is called afterlife. When the drive 420 goes into a state of complete flow stop, it simultaneously goes into the run-out mode; the run-out duration in the RIVS nodes is specified in the settings of the flow processor 400 .

In the coast-down mode, the drive 420 requests the TSCS 211 to call itself at equal processing time intervals corresponding to the coast-down period Da . The coast-down period can be calculated at the moment of transition to the coast-down mode as follows. In the process of processing the input stream, the stream processor 400 remembers the processing time intervals between recognitions of neighboring RIVS head nodes for a given number (e.g., 10 or 20) of the last recognized RIVS head nodes. The coast-down period Da is taken to be equal to a given percentile (e.g., 75% or 90%) of these intervals. Thus, the coast-down is performed approximately at the same data time rate relative to the processing time that was observed before the flow was stopped, and the coast-down period Da approximately corresponds to the RIVS period measured in processing time, with a correction upwards. The correction is needed to reduce the risk that the coast-down will outpace the data time. In the coast-down mode, the node unloading timeout is actually taken to be equal to Da , and the RIVS head node does not change. The speed of the data time relative to the processing time is the ratio of the difference between the times of the data of two observations to the difference between the moments of time of arrival of these observations in the accumulator 420 , measured by the processing clock (i.e. the processing time of these observations, see the description in more detail in Figs. 9a-10g ). In this case, the specified speed can be measured both between two adjacent observations and between two observations lagging behind by a certain time interval.

At each call of itself in the run-down mode, the accumulator 420 places the next RIVS node in the unloading queue by timeouts at the moment T_now + Da, where T_now is the current moment of processing time, and, accordingly, unloads by timeout the previous RIVS node, which in this case may be completely empty. Unloading even a completely empty RIVS node at step 507 initiates a call to the calculator 430 for processing this RIVS node at step 508 , therefore, the calculator 430 gets the opportunity to impute or identify the "flow loss" of those parameters of the CFS for which such actions are configured.

The run-out duration is set to be no less than the number of RIVS nodes required by the 430 computer to identify and process the “flow loss” of all the CFS parameters for which such actions are configured.

Exit from the state of complete flow stop (“standstill”) is performed upon receipt of any observation related to the node Z of the RIVS located in the future relative to the current head node of the RIVS H ( Z > H ), and node Z is immediately recognized as the new head node of the RIVS. Upon exit from the state of complete flow stop, a simultaneous flush discharge may occur up to node Z exclusively (i.e. node Z will not be flushed), which, depending on the current state of the coasting process, may include complete or partial completion of the coasting (up to node min( H + a×p , Z - p ), where a is the configured coasting duration, p is the RIVS period) and/or skipping empty nodes located between the last possible coasting node (or node H if coasting is not configured) and node Z . Skipping nodes means that the nodes are considered unloaded, but are not fed to the computer 430 , since their processing would be unproductive: the "flow loss" state has already been detected and processed at the run-out stage, after which empty nodes do not carry any useful information. Thus, when skipping nodes, the next RIVS node after the last possible run-out node (or the last non-empty node D : H ≤ D < Z , if run-out is not configured), which will be unloaded into the computer and for which, accordingly, the values of the output parameters of the CFS will be generated, will be node Z , the unloading of which will occur in due time in a regular manner, that is, by flow or by timeout.

Thus, the claimed method of reducing a randomly distributed flow of observations of the parameters of the CFS, received in real time, to the RIVS makes it possible to solve the claimed technical problem and achieve the claimed technical results, which consist in reducing a randomly distributed flow of observations of the parameters of the CFS, received in real time, to the RIVS, in reducing the time of reducing the randomly distributed flow of observations of the parameters of the CFS, received in real time, to the RIVS (for example, in comparison with reducing observations of historical data to the RIVS, when it is necessary to wait for the formation of such a set of data before proceeding to reduce them to the RIVS), in forming a flow of values of the output parameters of the CFS reduced to the RIVS without gaps, as well as in preparing data in the form and volume necessary for the correct operation of anomaly detectors and predictive analyzers.

The results of the work of the stream processor 510 can be transmitted via the STS 110 for the detection of anomalies 511 using anomaly detectors 200 (more details in Fig. 6 ), as well as for predictive analysis 512 using predictive analyzers 300 (more details in Fig. 7 ).

Fig. 6 shows an example of a method for detecting anomalies in the CFS in real time. At step 601 , a randomly distributed flow of observations of the CFS parameters is obtained in real time. Then, at step 602 , when at least one of the call conditions is met, the flow of observations of the CFS parameters is converted to the RIVS using the stream processor 400 according to the method of Fig. 5 . Finally, at step 603, at least one anomaly in the CFS is detected in the values of the output parameters of the CFS converted to the RIVS using at least one anomaly detector 200 .

In one particular embodiment, the call conditions include at least one of the following:

at least one new observation of the CFS parameter has been received from the stream;

one of the pre-set points in time has arrived.

The detectors from the list of detectors 200 implement at least one of the following methods of detecting anomalies:

a method according to which an anomaly is detected in the event that the overall forecast error exceeds a threshold value, while first forecasting the values of the output parameters of the CFS and then determining the overall forecast error for the output parameters of the CFS;

a method by which an anomaly is detected by applying a machine learning model to the output parameter values of a CFS;

a method by which an anomaly is detected when an anomaly detection rule is followed;

a method according to which an anomaly is identified based on a comparison of the obtained values of the output parameters of the CFS with the limit values of the established ranges of values for the output parameters of the CFS;

ensemble of the results of the work of at least one of the above methods.

Other possible, but not exhaustive, ways of implementing detectors 200 are shown in Fig. 2 .

Thus, the method declared in Fig. 6 allows solving the declared technical problem and achieving the technical results listed earlier for the method in Fig. 5. In addition, another technical result is achieved, consisting in improving the quality of detecting anomalies in the CFS by bringing an arbitrarily distributed flow of observations of the CFS parameters, received in real time, to the RIVS and detecting anomalies in the values of the output parameters of the CFS reduced to the RIVS, wherein high quality includes, in particular, a low number of errors of the first and second kind, a reduction in the time of detecting anomalies.

Fig. 7 shows an example of a method for implementing predictive analysis in the CFS in real time. At step 701 , a randomly distributed flow of observations of the CFS parameters is obtained in real time. Then, at step 702 , when at least one of the call conditions is met, the flow of observations of the CFS parameters is converted to the RIVS using the stream processor 400 according to the method of Fig. 5 . Finally, at step 703, using predictive analyzers 300 (see Fig. 3 ), predictive analysis is performed in the values of the output parameters of the CFS converted to the RIVS.

In one particular embodiment, the call conditions include at least one of the following:

at least one new observation of the CFS parameter has been received from the stream;

one of the pre-set points in time has arrived.

Thus, the method declared in Fig. 7 allows solving the declared technical problem and achieving the technical results listed earlier for the method in Fig. 5. In addition, another technical result is achieved, consisting in improving the quality of the predictive analysis of the parameters of the CFS by bringing an arbitrarily distributed flow of observations of the parameters of the CFS, received in real time, to the RIVS and performing a predictive analysis in the values of the output parameters of the CFS brought to the RIVS, wherein high quality includes, in particular, high accuracy of predicting the values of one or several output parameters of the CFS over a long period of time.

Fig. 9a-9g show examples of the flow of observations of the parameters of the CFS.

Here and below, the abscissa axis shows the processing time ( T ^p ), and the ordinate axis shows the data time ( T ^d ). The RIVS is defined in the data time and, accordingly, the ordinate axis also shows the time marks of the corresponding RIVS nodes ( t ₁ , t ₂ , etc.). In the graphs, circles of different shades correspond to observations of different parameters of the CFS. Fig. 9a shows an example of an ideal flow of observations of the parameters of the CFS. Such a flow is characterized by the following conditions:

a) the values of all parameters of the FSC are measured at the monitoring object simultaneously;

b) the values of the parameters of the CFS are measured precisely in the RIVS nodes, that is, the time of the data exactly corresponds to the time stamp of the RIVS node;

c) the values of the parameters of the CFS are measured in each node of the RIVS;

d) the values of the parameters of the FSC, taken at the monitoring object simultaneously, are delivered to the flow processor 400 together (in one observation package);

d) the delay of delivery of each packet of observations of the parameters of the CFS from the monitoring object to the stream processor 400 is the same, and the speed of the data time relative to the processing time is constant. The delay of delivery can be measured as the time interval between the data time and the processing time.

It is worth noting that in real FSCs the ideal flow shown in Fig. 9a is practically impossible. The stated technical problem is related to this. Almost always, data transmission networks and multicomponent systems are involved in monitoring and processing the telemetry flow, including SUTD 110 , in which the absence of delivery delays (condition d) cannot be guaranteed due to technical limitations. Other conditions (a-d) are not met at different objects in different combinations.

Fig. 9b shows an example of flow disruption due to jitter in the delay of arrival of the CFS parameter observations. For example, at data times t1 and t2 , the observation of the first CFS parameter (dark circle) relative to the data time arrived first among the observations of all four CFS parameters, while at data time t3 , the observation of the first CFS parameter arrived last (the delay increased), and at data time t4 , it arrived second (the delay decreased). The situation is similar with observations of other CFS parameters. In addition, the speed of data time relative to the processing time also varies.

Fig. 9c shows an example of a flow in which the values of the parameters of the CFS are measured not in the RIVS nodes, and there is no variation in the delay in the arrival of the observations of the parameters of the CFS - that is, the time interval between the data time and the processing time for the observations of the parameters of the CFS remains constant, and the rate of the data time relative to the processing time also remains constant.

Fig. 9g shows an example of a realistic flow in which none of the ideal flow conditions are met.

In addition to the examples in Figs. 9b-9d related to the violation of the data flow, the speed of the data time relative to the processing time may also be distorted in the data flow. Figs. 10a-10d show examples of the change in the time of the observations of the parameters of the CFS in the flow. The designations are similar to the designations in Figs. 9a-9d . The line illustrates the time of the data relative to the processing time. The time of the data is understood to be the time corresponding to the current head node of the RIVS, to which most of the observations of the parameters of the CFS received at the current moment of processing time or immediately before it are related. Accordingly, the change (advancement into the future) of the head node of the RIVS reflects the time of the data in the processing time.

Fig. 10a shows an example of fluctuation in the data time rate relative to the processing time caused by variations in the load on various systems processing the movement of the FSC parameter observation stream from the monitoring object to the stream processor 400. Fig. 10b shows an example in which the data stream is interrupted (e.g., there was a temporary network outage), after which the monitoring object quickly sends the accumulated FSC parameter observations and returns to regular telemetry sending. In Fig. 10c, the data time is split into three streams due to the fact that the FSC parameter values are measured at the monitoring object using three different clocks. Observations of the FSC parameters of one stream (one set of FSC parameters) lag behind observations of the FSC parameters of another stream (another set of FSC parameters) by a constant interval in data time, and observations of the FSC parameters of the third stream (third set of FSC parameters) go into the future, then the data time of this stream is adjusted, and then the process is repeated.

Finally, Fig. 10g shows a seemingly impossible situation - a data time jump into the future. However, this is a quite realistic scenario: this can happen when the telemetry source plays a pre-recorded stream that for some reason could not be transmitted to the receiving party (anomaly detector 200 or predictive analyzer 300 ) in real time, but the task of detecting anomalies in it or performing predictive analysis is relevant. The stream recording contains long pauses (e.g., corresponding to equipment shutdown intervals) and to speed up the process, the telemetry source reduces these pauses to some minimum value in the processing time.

Thus, Fig. 9b-9g, Fig. 10a-10g show examples of distortion of the flow of observations of the parameters of the CFS, and the present invention makes it possible to bring a randomly distributed flow of observations of the parameters of the CFS (including as in the indicated examples), arriving in real time, to the RIVS, an example of which is shown in Fig. 9a , thus solving the stated technical problem.

Fig. 11 shows an example of the values of the CFS parameters indicating incidents in the data.

It should be noted that the data time represents the readings of the clock running on the computers of the monitoring object (for example, the CFS), which are not necessarily synchronized with the true physical time. It may well turn out that the time of the data of individual observations of the CFS parameters does not correspond to the true time of creation of these observations of the CFS parameters due to various delays and inaccuracies that may arise in the computer system engaged in the formation of observations of the CFS parameters on the side of the monitoring object. In the general case, the difference between the data time and the true time of the observed process may vary randomly. In some cases, the stream processor 400 may determine an incorrectness of the source clock, for example, when the observation of the CFS parameter was received with the data time from the future relative to the time of the data of the main volume received at the current moment of time of processing the observations of the CFS parameters. Such observations may be marked as early, and the calculator 430 at step 508 may not calculate the values of those output parameters of the CFS that depend on the input parameters of the CFS in the said early observations. At the same time, when receiving such early observations of the parameters of the FSC, an incident of "source clock failure" will be created, because the time of such observations of the parameters of the FSC cannot be correct. The causes of such incidents cannot always be stopped automatically and require investigation by a specialist.

On the other hand, the occurrence (or increase in the occurrence frequency) of late observations of the CFS parameters (late), whose data time significantly lags behind the data time of the main volume of currently received observations of the CFS parameters, is not necessarily a sign of the clock of the monitoring object lagging behind the true time. An increase in the delay in the delivery of observations of the CFS parameters can be explained by many other reasons related to the functioning of intermediate agents. To reduce the number of late observations of the CFS parameters, an automatic recalibration of the accumulator 420 (redefinition of the properties of the stream 411 , parameters Ds, Dt ) can be configured in the flow processor 400 , activated if the frequency of late values of the CFS parameters exceeds a specified threshold. If the recalibration does not have an effect, an investigation of the situation by a specialist may be required. The calibration of the accumulator 420 is carried out in such a way that the output flow of observations (the values of the output parameters of the CFS in the RIVS nodes) is formed with a minimum delay relative to the flow (i.e. the input flow), but at the same time so that all observations of the parameters of the CFS, with the exception of lagging or early ones (i.e. those constituting an incident), are classified as having arrived on time (English: on time) and are transmitted to the computer 430. This will allow solving the specified technical problem and achieving the declared technical results.

In other cases, i.e. when observations of the parameters of the CFS cannot be classified as early or late, the stream processor 400 and data consumers (anomaly detectors 200 , predictive analyzers 300 ) can consider that the data time corresponds to the true physical time of the process observed at the monitoring object.

Fig. 12 shows an example of the operation of a flow processor using a dense flow of observations of the parameters of the CFS.

The current moment of processing time is shown by a vertical line. Stream processor 400 , being called at this moment by the fact of arrival of one of the observations of the parameters of the CFS related to node 7, decides to recognize node 7 as the head node of the RIVS. As a result, taking into account that Ds = 3, node 4 is subject to unloading by flow. Since the last unloaded node of the RIVS is node 2, then nodes 3 and 4 will actually be unloaded. Nodes 5, 6 and the head node of the RIVS 7 will continue to accumulate observations of the parameters of the CFS.

Rectangular frames for each RIVS node correspond to the accumulation time of the KFS parameter observations by the data clock (height of the vertical side of the frame) and by the processing clock (length of the horizontal side of the frame). Vertically, the accumulation time corresponds to the RIVS node cell, and horizontally it represents the interval between the arrival at the processor of the first observation of the KFS parameter related to this node and the moment of node unloading.

Based on the fact of recognition of the head node of RIVS 7, the moment of unloading of this node by timeout is also established, which is located in the future at a distance Dt from the current moment in processing time. This moment is added to the unloading queue by timeouts - a list of RIVS nodes and the corresponding moments of processing time when the corresponding node should be unloaded by timeout. In this example, nodes 5 and 6 are already in the unloading queue by timeouts. How exactly nodes 5-7 will be unloaded, by stream or by timeout, is currently unknown to stream processor 400 (they will be unloaded at the moment of processing time when one or another unloading criterion is met); the corresponding frames are shown with a dotted line.

As for the previously unloaded nodes, it is clear from Fig. 12 that they were unloaded in a flow: for example, node 2 was unloaded at the moment when RIVS 5 was recognized as the head node. Formally, nodes 1-4 are still in the unloading queue due to timeouts, but these elements will be removed from the queue as the processing time progresses.

Fig. 13 shows an example of the operation of a stream processor using a sparse stream of observations of the parameters of the CFS.

In this example, the data flow is sparse. At the current moment of processing time, the stream processor 400 was called by time. The recommended time of calling the stream processor 400 was set earlier at the moment of recognizing node 2 as the head node of the RIVS as the time when node 2 should be unloaded by timeout Dt . In fact, the SUTD 110 performed the call of the stream processor 400 somewhat later than the designated time, which is quite acceptable.

At the moment of the call, the accumulator 420 detects that no new observations of the parameters of the CFS have been received and, therefore, node 2 remains the head node of the RIVS. The distance of the unloading along the flow Ds is equal to 2, i.e. node 0 is subject to unloading along the flow, which has long been unloaded, since the last unloaded node L = 1. Inspecting the queue for unloading by timeout, the accumulator 420 finds the only node 2 in it; the time of its unloading has already come, but it has not yet been unloaded. Thus, as a result of calling the stream processor 400 , node 2 will be unloaded at the current moment.

It is evident that in a sparse flow, the decision to unload a node by timeout is systematically made earlier than the decision to unload the same node by flow would be made. If node 2 were unloaded by flow, then this event would have to wait until node 4 is recognized as the head node of the RIVS.

Fig. 14 shows a computer system on which various embodiments of the systems and methods disclosed in this description can be implemented. Computer system 20 can be a system configured to implement the present invention and can be represented as a single computing device or as multiple computing devices, such as a desktop computer, a portable computer, a notebook, a server, a mainframe, an embedded device, and other forms of computing devices.

As shown in Fig. 14 , the computer system 20 includes: a central processor 21 , a system memory 22 and a system bus 23 that connects various system components, including memory associated with the central processor 21 . The system bus 23 is implemented as any bus structure known in the art, which in turn contains a bus memory or a bus memory controller, a peripheral bus and a local bus capable of interacting with any other bus architecture. Examples of buses are: PCI, ISA, PCI-Express, HyperTransport™, InfiniBand™, Serial ATA, I2C and other suitable connections between components of the computer system 20 . The central processor 21 contains one or more processors having one or more cores. The central processor 21 executes one or more sets of machine-readable instructions that implement the methods presented in this document. The system memory 22 may be any memory for storing data and/or computer programs executed by the central processor 21 . The system memory may contain both a read-only memory (ROM) 24 and a random access memory (RAM) 25 . The main input/output system (BIOS) 26 contains the main procedures that ensure the transfer of information between elements of the computer system 20 , for example, at the time of loading the operating system using the ROM 24 .

The computer system 20 includes one or more data storage devices, such as one or more removable storage devices 27 , one or more non-removable storage devices 28 , or combinations of removable and non-removable devices. One or more removable storage devices 27 and/or non-removable storage devices 28 are connected to the system bus 23 via the interface 32. In one embodiment, the removable storage devices 27 and the corresponding computer-readable storage media are non-volatile modules for storing computer instructions, data structures, program modules and other data of the computer system 20. The system memory 22 , the removable storage devices 27 and the non-removable storage devices 28 can use various computer-readable storage media. Examples of computer-readable storage media include computer memory such as cache memory, SRAM, DRAM, Z-RAM, T-RAM, eDRAM, EDO RAM, DDR RAM, EEPROM, NRAM, RRAM, SONOS, PRAM; flash memory or other memory technologies such as solid-state drives (SSD) or flash drives; magnetic cassettes, magnetic tapes, and magnetic disks such as hard disks or floppy disks; optical media such as compact discs (CD-ROM) or digital versatile discs (DVD); and any other media that can be used to store desired data and that can be accessed by a computer system 20 .

The system memory 22 , the removable storage devices 27 and the non-removable storage devices 28 contained in the computer system 20 are used to store the operating system 35 , applications 37 , other program modules 38 and program data 39. The computer system 20 includes a peripheral interface 46 for transmitting data from input devices 40 , such as a keyboard, mouse, stylus, game controller, voice input device, touch input device, or other peripheral devices, such as a printer or scanner through one or more input/output ports, such as a serial port, parallel port, universal serial bus (USB) or other peripheral interface. A display device 47 , such as one or more monitors, projectors or built-in displays, is also connected to the system bus 23 through an output interface 48 , such as a video adapter. In addition to the display devices 47 , the computer system 20 is equipped with other peripheral output devices (not shown in Fig. 14 ), such as speakers and other audiovisual devices.

The computer system 20 may operate in a network environment using a network connection with one or more remote computers 49. The remote computer (or computers) 49 is a working personal computer or a server that contains most or all of the components mentioned earlier in describing the essence of the computer system 20 shown in Fig. 14. Other devices may also be present in the network environment, such as routers, network stations or other network nodes. The computer system 20 may include one or more network interfaces 51 or network adapters for communicating with the remote computers 49 via one or more networks, such as a local area network (LAN) 50 , a wide area network (WAN), an intranet and the Internet. Examples of a network interface 51 are an Ethernet interface, a Frame Relay interface, a SONET interface and wireless interfaces.

Embodiments of the present invention may be a system, a method, or a computer-readable storage medium (or carrier).

A computer-readable storage medium is a tangible device that stores and stores program code in the form of computer-readable instructions or data structures that are accessible to the central processor 21 of the computer system 20. The computer-readable storage medium may be an electronic, magnetic, optical, electromagnetic, semiconductor memory device, or any suitable combination thereof. As an example, such a computer-readable storage medium may include random access memory (RAM), read-only memory (ROM), EEPROM, a portable compact disc with read-only memory (CD-ROM), a digital versatile disk (DVD), flash memory, a hard disk, a portable computer diskette, a memory card, a floppy disk, or even a mechanically encoded device such as punched cards or relief structures with instructions recorded thereon.

The system and method of the present invention can be considered in terms of means. The term "means" as used herein refers to an actual device, component or group of components implemented by hardware, such as an application-specific integrated circuit (ASIC) or FPGA, or as a combination of hardware and software, such as a microprocessor system and a set of machine-readable instructions for implementing the functionality of the means, which (when executed) transform the microprocessor system into a special-purpose device. The means can also be implemented as a combination of these two components, whereby some functions can be implemented only by hardware, and other functions - by a combination of hardware and software. In some embodiments, at least part, and in some cases all, of the means can be executed on the central processor 21 of the computer system 20. Accordingly, each means can be implemented in various suitable configurations and should not be limited to any particular embodiment given herein.

Finally, it should be noted that the information provided in the description is examples that do not limit the scope of the present invention defined by the claims. It will be clear to one skilled in the art that in developing any actual embodiment of the present invention, many decisions specific to a particular embodiment must be made in order to achieve specific goals, and these specific goals will be different for different embodiments. It is understood that such development efforts can be complex and time-consuming, but, nevertheless, they will be a routine engineering task for those of ordinary skill in the art, using the present disclosure.

Claims (27)

1. A computer-implemented method for converting a flow of observations of the parameters of a cyber-physical system (hereinafter referred to as the CPS), received in real time, to an equal-interval time grid (hereinafter referred to as the EITG), wherein the method is implemented using a flow processor and includes the following stages: a) at least one new observation of the CFS parameter is obtained from the input stream, after which each obtained observation of the CFS parameter is accumulated and assigned to the RIVS node in accordance with the time of the data of the specified observation of the CFS parameter; b) for each received observation of the parameter of the CFS, at least one criterion for recognizing a new head node of the RIVS is checked and, if the specified criterion is met, the RIVS node corresponding to the time of the data of the specified observation of the parameter of the CFS is recognized as the head node of the RIVS; c) the possibility of unloading at least one RIVS node is checked using at least one unloading criterion, wherein the unloading criterion is checked taking into account the properties of the flow of observations of the parameters of the CFS from the set of input parameters of the CFS, where the observation of the parameter of the CFS corresponds to the value of the parameter of the CFS and the time of the data; d) when at least one unloading criterion is met, at least one RIVS node is unloaded for which the specified at least one unloading criterion is met, and the specified observation of the KFS parameter is also unloaded; d) in each unloaded node of the RIVS, for each output parameter of the CFS from the set of output parameters of the CFS, its value is calculated based on the said unloaded node of the RIVS, wherein each output parameter of the CFS is associated with at least one of the input parameters of the CFS, in particular, coincides with one of the input parameters of the CFS or is derived from at least one of the input parameters of the CFS. 2. The method according to claim 1, wherein the properties of the stream include at least one of the following: a stream unloading distance, a timeout. 3. The method according to claim 2, wherein the unloading criterion is at least one of the following: a) downstream unloading: between the RIVS node and the RIVS head node there is such a number of other RIVS nodes that is equal to or greater than the downstream unloading distance; b) unloading by timeout: the time elapsed from the previous processing time, during which the RIVS node was recognized as the head node of the RIVS, to the processing time is equal to or exceeds the timeout. 4. The method according to paragraph 3, in which, if the possibility of unloading at least two RIVS nodes is checked and if the unloading criterion by flow is met for one RIVS node, and the unloading criterion by timeout is met for another RIVS node, then the one of the specified RIVS nodes with the longer time stamp is selected. 5. The method according to paragraph 1, in which one or more other RIVS nodes are additionally unloaded, successively preceding the RIVS node that satisfies the unloading criterion. 6. The method according to paragraph 1, wherein if the unloaded RIVS node includes an observation of at least one parameter of the CFS, the specified at least one observation of the parameter of the CFS is also unloaded. 7. The method according to item 6, wherein if at least one observation of the input parameter of the CFS related to the output parameter of the CFS pertains to the RIVS node, then it is taken into account when calculating the value of the output parameter of the CFS. 8. The method according to paragraph 1, in which the criterion for recognizing a new RIVS head unit is one of: a) recognition criterion by representation: a RIVS node (node N ) following the RIVS head node (node H ) is recognized as the RIVS head node if observations have been received for node N for such a number of CFS parameters that is equal to or greater than a specified number; b) recognition criterion based on interval proportionality: a RIVS node (node N ) is recognized as the head node of the RIVS (node H ) if an observation of the CFS parameter corresponding to node N at the processing time ( T_now ) is received, and Where - the processing time when node H was recognized as the head node of the RIVS, p is the RIVS period, Da is the average processing time interval between recognitions of a given number of the last head nodes of the RIVS; c) the criterion for recognition in a state of complete flow stop: if the flow accumulator the processor is in a certain state, then the nodeNare recognized as the head node of the RIVS immediately after receiving any observation of the parameter of the KFS corresponding to the nodeN. 9. The method according to paragraph 1, wherein, additionally after step d), an incident is generated if at least one of the conditions for generating an incident is met. 10. The method according to item 9, wherein the conditions for the formation of an incident include the following: for the incident of "late observation": the time of the observation data of the KFS parameter corresponds to the previously unloaded node of the RIVS; for the incident of "source clock failure": the time of the observation data of the KFS parameter is ahead of the time stamp of the head node of the RIVS by a specified time interval; for the incident of "loss of flow": in the event of cessation of receipt of observations of the KFS parameter during a certain time specified for the KFS parameter, and information about the incident is additionally added to the value of the output parameter of the KFS. 11. The method of claim 10, further comprising the steps of redefining the properties of the flow if the frequency of occurrence of “late observation” or “source clock failure” incidents exceeds a specified threshold. 12. The method according to item 1, wherein, if the set of input parameters of the CFS coincides with the set of output parameters of the CFS, then in each of the unloaded nodes of the RIVS, a value is calculated for each parameter of the CFS from the set of output parameters of the CFS depending on the number of observations of the corresponding input parameter of the CFS assigned to the RIVS node, and if one or more observations have been accumulated for the input parameter of the CFS in the specified RIVS node, aggregation is performed based on the accumulated observations of the input parameter of the CFS in the specified node of the RIVS. 13. The method according to claim 1, wherein, if the set of input parameters of the CFS coincides with the set of output parameters of the CFS and if none of the observations have been accumulated for the CFS parameter in the unloaded RIVS node, the missing value of the CFS parameter is imputed based on the observations of the CFS parameter for earlier RIVS nodes. 14. The method according to item 1, in which the value of the output parameter of the CFS in the RIVS node is calculated according to the dependence on the parameters of the CFS associated with it, and the values for each parameter of the CFS are calculated depending on the number of observations of the specified parameter of the CFS assigned to the RIVS node, and if one or more observations have been accumulated for the specified parameter of the CFS in the specified RIVS node, aggregation is performed based on the accumulated observations of the parameter of the CFS in the specified RIVS node or in earlier nodes of the RIVS or in the specified RIVS node and earlier nodes of the RIVS. 15. The method according to claim 1, wherein the value of the output parameter of the CFS in the RIVS node is calculated according to the dependence on the parameters of the CFS associated with it, wherein, if none of the observations have been accumulated in the unloaded RIVS node for at least one associated parameter of the CFS, imputation of the missing value of the specified parameter of the CFS is performed based on observations of the specified parameter of the CFS for earlier RIVS nodes or based on previously calculated values of the specified parameter of the CFS for earlier RIVS nodes or based on a combination of observations of the specified parameter of the CFS and previously calculated values of the specified parameter of the CFS for earlier RIVS nodes. 16. The method according to item 1, in which the value of the output parameter of the CFS in the RIVS node is calculated additionally based on the values of other output or other input parameters of the CFS associated with the specified output parameter of the CFS. 17. The method according to claim 1, further comprising the steps of determining the properties of the flow in the event of the beginning of the flow receipt or the resumption of the flow receipt after an interruption.