Systems and methods for securing industrial asset control systems

Abstract

The present invention provides a system and method for protecting industrial asset control systems. The normal spatial data source stores, for each of the plurality of threat nodes, a series of normal values ​​representative of normal operation of the industrial asset control system, and the threatened spatial data source stores a series of threatened values. The model creation computer can generate a set of normal feature vectors and threatened feature vectors. The computer may also calculate and output at least one decision boundary for a threat detection model based on the normal feature vector and the threatened feature vector. The plurality of threat nodes may then generate a series of current values ​​from the threat node representing current operation of the asset control system. A threat detection computer may receive the series of current values ​​from a threat node, generate a set of current feature vectors, execute the threat detection model, and send a threat alert signal based on the current feature vectors and the at least one decision boundary.

Description

technical field [0001] The present invention generally relates to industrial asset control systems, and more particularly to systems and methods for protecting industrial asset control systems, and corresponding domain level threat detection. Background technique [0002] Industrial control systems that operate physical systems (eg, associated with power turbines, jet engines, locomotives, autonomous vehicles, etc.) are increasingly connected to the Internet. Accordingly, these control systems are increasingly vulnerable to threats such as cyber-attacks (eg, associated with computer viruses, malware, etc.), which may disrupt power generation and distribution, damage engines, cause vehicle breakdowns, and the like. Current approaches mainly consider information technology ("IT" (Information Technology), such as computers that store, retrieve, transmit, and manipulate data) and operational technology ("OT" (Operation Technology), such as direct monitoring devices and communica...

AI Technical Summary

Problems solved by technology

Existing methods for securing industrial control systems, such as fault and diagnostic techniques, may not be sufficient to address these threats, especially when multiple attacks occur simultaneously because the multiple error / fault diagnostic techniques are not designed to address Automatic way to detect stealthy attacks

Images