Domain level threat detection for industrial asset control system

Abstract

A normal space data source 110 stores, for each of a plurality of threat nodes 130, a series of normal values that represent normal operation of an industrial asset control system, and a threatened space data source 120 stores a series of threatened values. A model creation computer 140 may generate sets of normal and threatened feature vectors. The computer 140 may also calculate and output at least one decision boundary for a threat detection model 155 based on the normal and threatened feature vectors. The plurality of threat nodes 130 may then generate a series of current values from threat nodes that represent a current operation of the asset control system. A threat detection computer 150 may receive the series of current values from threat nodes 130, generate a set of current feature vectors, execute the threat detection model 155, and transmit a threat alert signal based on the current feature vectors and at the least one decision boundary.

Description

technical field [0001] The present invention generally relates to industrial asset control systems, and more particularly to systems and methods for protecting industrial asset control systems, and corresponding domain level threat detection. Background technique [0002] Industrial control systems that operate physical systems (eg, associated with power turbines, jet engines, locomotives, autonomous vehicles, etc.) are increasingly connected to the Internet. Accordingly, these control systems are increasingly vulnerable to threats such as cyber-attacks (eg, associated with computer viruses, malware, etc.), which may disrupt power generation and distribution, damage engines, cause vehicle breakdowns, and the like. Current approaches mainly consider information technology ("IT" (Information Technology), such as computers that store, retrieve, transmit, and manipulate data) and operational technology ("OT" (Operation Technology), such as direct monitoring devices and communica...

AI Technical Summary

Problems solved by technology

Existing methods for securing industrial control systems, such as fault and diagnostic techniques, may not be sufficient to address these threats, especially when

Images