Safety-related diagnostic messages

Abstract

The present invention proposes a method, which comprises: a) receiving a diagnostic message generated by a technical object (7) of a technical device; b) analyzing the diagnostic message, thereby identifying the diagnostic message related to the safety of the operation of the technical device by means of comparing data records, wherein within the scope of analyzing the diagnostic message, a machine learning network is used to evaluate the safety relevance of the diagnostic message, the machine learning network being trained in advance with specific inputs from an operator of the technical device, who evaluates past diagnostic messages with respect to their safety relevance; c) if necessary, adapting the pre-identified diagnostic message to the requirements of a computer-implemented safety module (15) of the technical device; d) transmitting the pre-identified and, if necessary, adapted diagnostic message to the computer-implemented safety module (15) of the technical device.

Description

Technical Field

[0001] The invention relates to a method. The invention also relates to a control system for a technical plant, in particular a production or process plant. Background Art

[0002] Given the growing potential for threats to technology devices, it is important to proactively identify possible attacks, anomalies, and policy violations, as well as to store security-related information over the long term with the right tools. For operators of critical device infrastructure, this proactive identification and traceability based on long-term storage of security-related information is more important than ever.

[0003] So-called Security Information Event Management (SIEM) tools for detecting, correlating and storing so-called security events over a long period of time and for generating alerts based on the correlation results significantly increase the level of protection of components, systems and facilities and help to comply with the requirements of the relevant standards. The corresponding requirements are laid down, for example, in the standard IEC 62443-3-3.

[0004] An important prerequisite for the effective and successful use of such tools is that the components and systems used in industrial facilities can detect various safety events and make them available via standardized interfaces.

[0005] For example, the Siemens industrial controller SIMATIC S7 410 supports the security events described in the standard IEC 62443-3-3. In this case, the security events can be sent by the CPU of the controller in so-called syslog messages to up to four external SIEM servers.

[0006] Another important prerequisite is the correlation rules that are tailored to the respective technical equipment and are used to identify various attack scenarios and signs of violations of mandatory guidelines. Such rules can be divided into the categories of general, standard-specific, industry-specific, IT-specific, manufacturer-specific and facility-specific.

[0007] In recent years, the following findings were obtained from testing various SIEM tools and anomaly identification tools in industrial environments:

[0008] Security incidents and identified network anomalies are important but may not be sufficient for the comprehensive identification of attacks (especially so-called "complex attacks" that specifically exploit weaknesses in a specific environment) and deviations. In the case of security incidents, the problem is that the security incidents are defined by the device / software or system manufacturer during the design phase, where not all scenarios that subsequently prove to be possible when using the technical device are known or foreseeable during the design phase.

[0009] In the case of anomaly identification tools, this is because: they either identify already known network attacks (such as IP spoofing), or they have to learn the normal behavior of the system during a longer phase and only then can estimate possible deviations from normal behavior, where the anomaly identification tool completely ignores information from the device (such as security events).

[0010] In order to carry out comprehensive security diagnosis and attack identification that is as good as possible and tailored to the corresponding system facility, other information should also be taken into account, in particular information about various plant components, operator station servers, automation devices and field devices, and detected system and device diagnostic messages, which, although not security-related by definition, can be proven to be security-related in specific facility scenarios.

[0011] For example, all plant diagnostic messages of the automation and field level of the technical plant, of the plant at the base level along the level of the automation pyramid and of the operator station server are collected in the operator station server.

[0012] Field devices report their diagnostic data as device diagnostic messages to the associated automation devices. Network devices report their diagnostic data as device diagnostic messages to the associated automation devices. The automation devices aggregate their own device diagnostic messages with the device diagnostic messages of the field devices and network devices and report them to the operator station server. The operator station server aggregates its diagnostic data with its device diagnostic messages and the aggregated device diagnostic messages of the automation devices and reports them to the maintenance station.

[0013] Therefore, all plant diagnostic messages which may be relevant for the “safety analysis” are already provided at the level of the operator station server for each sub-installation.

[0014] Here, device diagnostic messages are messages that contain a large amount of additional value in addition to the message text (e.g., process alarms) and are designed primarily for maintenance tasks. Since a large number of devices are included in the control system of a technical plant and there are a large number of diagnostic messages for each device, each operator station server has a large number of diagnostic messages. Although technically it is also possible to evaluate all detected device diagnostic messages via a SIEM system, this is not goal-oriented because not every diagnostic message is safety-related in a specific facility scenario. In addition, not every diagnostic message is suitable for safety analysis.

[0015] IT professionals are usually responsible for installing SIEM systems on site in technical installations. Such professionals usually have no knowledge (or no detailed knowledge) of the automation components installed in the facility and their diagnostic messages and security events. As a result, IT professionals can only create the correlation rules required for anomaly identification inadequately (or without the support of facility personnel or automation professionals) and optimally adapt the correlation rules to the corresponding technical installations.

[0016] However, facility personnel are usually mainly engaged in the maintenance tasks of the availability and operation of the facility, so that the joint development of the required correlation rules is either only carried out to a small extent or not at all. As a result, a large amount of various information (including various equipment diagnostic messages) enters the SIEM system without being concise.

[0017] By fully automatically evaluating this information in real time according to specific IT-oriented or network-oriented, partly very general, correlation or identification rules, standard attacks (e.g., server denial, IP spoofing) can be identified, but targeted, installation-specific attacks cannot be identified. Until now, it has not been known that in the context of fully automatic evaluation, when evaluating specific installation diagnostic messages with respect to their safety relevance, the corresponding automation and installation specialists could be involved, if necessary. Summary of the invention

[0018] The basic object of the invention is to provide a more efficient alarm handling by a control system of a technical installation from a safety point of view.

[0019] The object is achieved by the method according to the invention. In addition, the object is achieved by the control system according to the invention for a technical plant, in particular a production or process plant.

[0020] According to the invention, a method of the type described in the introduction comprises the following steps:

[0021] a) receiving diagnostic messages generated by an object of a technical device, in particular a manufacturing or process device;

[0022] b) analyzing the diagnostic messages in order to identify diagnostic messages that are relevant to the safety of the operation of the technical installation, wherein within the scope of the analysis of the diagnostic messages a machine learning network, in particular a neural network, is used for assessing the safety relevance of the diagnostic messages, the machine learning network having been previously trained with specific inputs from an operator of the technical installation, the operator assessing past diagnostic messages with regard to their safety relevance;

[0023] c) adapting the pre-authenticated diagnostic messages to the requirements of the computer-implemented safety module of the technical device, if necessary;

[0024] d) Transmitting the pre-authenticated and, if appropriate, adapted diagnostic message to a computer-implemented security module of the technical device.

[0025] The technical equipment may be equipment from the process industry (e.g. chemical, pharmaceutical, petrochemical process industry) or equipment from the food and beverage industry. This also includes equipment from the production industry, in factories producing all types of vehicles or goods. Technical equipment suitable for carrying out the method according to the invention may also come from the field of energy production. Wind turbines, solar systems or power plants for generating electricity also belong to the technical equipment.

[0026] The device has a control system or at least one computer-aided module for controlling and regulating the ongoing processing or production. In this context, a control system is understood to be a computer-aided engineering system that includes functions for displaying, operating and controlling engineering systems such as manufacturing or production facilities. In the current case, the control system includes sensors for automotive measurement values ​​and various actuators. In addition, the control system includes so-called processing or production-related components for operating actuators or sensors. In addition, the control system also has mechanisms for visualizing technical equipment and for engineering design. A control system is also understood to be additional computing units for more complex rules and systems for data storage and processing.

[0027] A technical object can usually be an individual sensor or actuator of a technical device. However, a technical object can also be a combination of multiple sensors and / or actuators (eg, a motor, a reactor, a pump or a valve system).

[0028] A message is generally understood to be a report of an event that indicates a transition from one discrete state to another within a technical device. A diagnostic message is a special type of message and contains additional accompanying values ​​in addition to the original message text. Diagnostic messages (also called device diagnostic messages) are primarily intended for maintenance tasks that occur in technical devices and involve the corresponding technical objects.

[0029] An operator is understood to be a person who operates a technical device. The operator interacts with the technical device or its control system with the aid of a specific user interface and controls specific technical functions of the installation. For this purpose, the operator has access to the operating and observation systems of the control system.

[0030] According to the invention, diagnostic messages are first received from a technical object of a technical device and then analyzed. In this case, a comparative data record is used, which enables the identification of diagnostic messages that are relevant to the safety of the operation of the technical device. In other words, the received diagnostic messages are classified as safety-relevant messages or safety-irrelevant messages according to a previously known data pattern.

[0031] In the context of analyzing diagnostic messages to assess the safety relevance of diagnostic messages, a machine learning network, in particular a neural network, is used, which is previously trained with analysis data related to earlier diagnostic messages. The machine learning network is trained with specific inputs from an operator of the technical system, who assesses past diagnostic messages with respect to their safety relevance.

[0032] If necessary, the diagnostic message is then converted in order to adapt it to the requirements of the computer-implemented security module. Such requirements can be included, for example, in the content and structure of so-called auditable events, which are also referred to as security events, as set out in standard IEC 62443-3-3. If necessary, the diagnostic message that has been identified as relevant in advance is then adapted or transformed according to the content specified in standard IEC 62443-3-3.

[0033] The pre-authenticated and possibly adapted diagnostic message is finally transmitted to a computer-implemented security module of the technical device. Such a security module can be a SIEM system, for example.

[0034] By filtering the diagnostic messages (and adapting them if necessary), the amount of information forwarded to the subsequent security analysis tools (or security modules) can be reduced significantly. However, the information content and use of this information for identifying attacks on technical devices is significantly increased.

[0035] In an advantageous development of the invention, the diagnostic messages transmitted to the computer-implemented safety module are presented graphically to an operator of the technical installation, thereby providing the operator with an overview of the safety-related status of the technical installation.

[0036] It is possible to further train the machine learning network by further evaluation by an operator in order, for example, to adapt the learning network to changing safety framework conditions.

[0037] During the automatic evaluation of the safety relevance of diagnostic messages, the message classes and / or message types of diagnostic messages can be taken into account. Message classes are, for example, "Automation system control technology messages", "Operator station server control technology messages", "Operator messages" or "Process messages". Message types can be, for example, "Alarm" or "Disturbance". This is based on the fact that individual diagnostic messages are usually associated with individual message classes and message types, whereby the classification explained above can be significantly simplified.

[0038] In the context of a preferred development of the method, diagnostic messages identified in advance as relevant are adapted to a standardized data format, preferably a common event format, before they are transmitted to a computer-implemented safety module of the technical device.

[0039] Furthermore, the above-mentioned object is achieved by a control system for a technical device, in particular a manufacturing or process device, which control system comprises an operator station server, a computer-implemented analysis module, a computer-implemented adaptation module and a computer-implemented safety module, wherein the analysis module and the adaptation module are implemented on the operator station server. Here, the computer-implemented analysis module is designed and arranged to receive diagnostic messages generated by a technical object of the technical device, in particular a manufacturing or process device, and to analyze the diagnostic messages so as to identify diagnostic messages relevant to the safety of the operation of the technical device. Here, the computer-implemented analysis module is designed and arranged to use a machine learning network, in particular a neural network, in the context of analyzing the diagnostic messages, in order to evaluate the safety relevance of the diagnostic messages, the machine learning network being trained in advance by specific inputs of an operator of the technical device, who evaluates past diagnostic messages in terms of their safety relevance. Furthermore, the computer-implemented analysis module is designed and arranged to forward diagnostic messages that have been identified as relevant in advance to the computer-implemented adaptation module. The computer-implemented adaptation module is designed and arranged to adapt diagnostic messages that have been identified as relevant in advance by the computer-implemented analysis module to the requirements of the computer-implemented safety module, if necessary. Furthermore, the computer-implemented adaptation module is designed and configured to forward a diagnostic message previously received by the computer-implemented evaluation module to the computer-implemented safety module.

[0040] At present, an "operator station server" is understood to be a server that centrally detects the data of the operating and monitoring system and usually detects the alarms and measured value archives of the process control system of the technical equipment and makes them available to the user. The operator station server usually establishes a communication connection to the automation system of the technical equipment and forwards the data of the technical equipment to the so-called client, which is used to operate and monitor the operation of the individual functional elements of the technical equipment. The operator station server can be (but is not limited to) the industrial workstation server SIMATIC PCS 7 of Siemens.

[0041] Particularly preferably, the control system also has an operator station client which is designed and arranged to receive diagnostic messages from the operator station server and to present them to an operator of the technical installation. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] The above-mentioned features, characteristics and advantages of the present invention and the manner and method for achieving the same will become more clearly understood from the following description of an embodiment which is explained in detail with reference to the accompanying drawings.

[0043] Figure 1 A part of a control system according to the invention of a technical system is shown in a schematic diagram. DETAILED DESCRIPTION

[0044] Figure 1 A part of a control system 1 according to the invention, which is designed as a method technology device, is shown. The control system 1 comprises an operating system server or operator station server 2 and its associated operator station client 3. The operator station server 2 and the operator station client 3 are connected to each other via a terminal bus 4 and to other components of the control system 1, not shown, such as an engineering system server or a process data archive.

[0045] In the operation and observation scenario, the user or operator accesses the operator station server 2 via the terminal bus 4 with the aid of the operator station server 3. The terminal bus 4 may be, for example, an industrial Ethernet, but is not limited thereto.

[0046] The operator station server 2 has a device interface 5 connected to a device bus 6. Via the device interface, the operator station server 2 can communicate with (external) facilities 7. Here, the connected facilities 7 can optionally also be applications, in particular web applications. Within the scope of the present invention, any number of devices and / or applications can be connected to the operator station server 2. The device bus 6 can be configured, for example, but not limited to, as an industrial Ethernet. The facilities 7 can also be connected to any number of subsystems (not shown).

[0047] A visualization service 8 is integrated into the operator station server 2, via which (visualization) data can be transmitted to the operator station client 3. The operator station server 4 also has a process image 9 and an alarm service 10. The alarm service 10 in turn includes a computer-implemented analysis module 11 and a computer-implemented adaptation module 12.

[0048] The alarm service 10 accesses the process image 9 in order to obtain diagnostic messages of the individual installations 7. The received diagnostic messages are first analyzed by a computer-implemented analysis module 11 in such a way that diagnostic messages relevant to the operational safety of the technical installation are identified. For this purpose, the computer-implemented analysis module 11 accesses a database 13 in which rules are stored for classifying the individual diagnostic messages with respect to the operational safety of the technical installation.

[0049] If necessary, the computer-implemented adaptation module 12 adapts the diagnostic messages identified in advance as relevant to a specific predefined, for example, common event format.

[0050] The diagnostic messages identified as relevant and, if necessary, converted are subsequently transmitted to a message sequence display (alarm control) 14 of the control system 1. The corresponding operating image of the message sequence display 14 is presented graphically to the operator station client 3 for the operator of the control system 1. Furthermore, the aforementioned diagnostic messages are transmitted to a computer-implemented security module 15 designed as a SIEM system for further processing.

[0051] If a new and unknown diagnostic message type is received, the alarm service 10 transmits information to the operator by means of the message sequence display 14 that new rules must be stored in the database 13 in order to be able to correctly process this diagnostic message type.

[0052] Although the present invention has been described and illustrated in detail by preferred exemplary embodiments, the present invention is not limited to the disclosed examples and other variants can be derived therefrom by a person skilled in the art without departing from the scope of protection of the present invention.

Claims

1. A method for controlling a technical device, comprising: a) receiving diagnostic messages generated by technical objects of technical equipment; b) analyzing the diagnostic messages in order to identify diagnostic messages relevant to the safety of operation of the technical installation by means of comparison data records, wherein within the scope of the analysis of the diagnostic messages a machine learning network is used for assessing the safety relevance of the diagnostic messages, the machine learning network being trained in advance with specific inputs from an operator of the technical installation, and the diagnostic messages are classified according to a rule for classifying the individual diagnostic messages with respect to the safety of operation of the technical installation, the operator assessing past diagnostic messages with respect to their safety relevance; c) adapting the pre-authenticated diagnostic message to the requirements of a computer-implemented security module (15) of the technical device; d) transmitting the pre-authenticated and adapted diagnostic message to the computer-implemented security module (15) of the technical device.

2. The method according to claim 1, wherein: The technical equipment is manufacturing or process equipment.

3. The method according to claim 1, wherein: The machine learning network is a neural network.

4. The method according to any one of claims 1 to 3, wherein: The diagnostic message transmitted to the computer-implemented safety module (15) is presented graphically to an operator of the technical device.

5. The method according to any one of claims 1 to 3, wherein: During the automatic evaluation of the safety relevance of a diagnostic message, a message class and / or a message type of the diagnostic message is taken into account.

6. The method according to any one of claims 1 to 3, wherein: The diagnostic messages previously identified as relevant are adapted to a standardized data format before being transmitted to the computer-implemented security module (15) of the technical device.

7. The method according to claim 6, wherein: The diagnostic messages previously identified as relevant are adapted to a common event format before being transmitted to the computer-implemented security module (15) of the technical device.

8. A control system (1) for a technical device, the control system comprising an operator station server (2), an analysis module (11) implemented by a computer, an adaptation module (12) implemented by a computer and a safety module (15) implemented by a computer, wherein: The analysis module (11) and the adaptation module (12) are implemented on the operator station server (2). The computer-implemented analysis module (11) is designed and configured to: receiving diagnostic messages generated by technical objects of technical equipment and analyzing the diagnostic messages in order to identify diagnostic messages relevant to the safety of the operation of the technical equipment, wherein the computer-implemented analysis module (11) is designed and arranged to use, within the scope of the analysis of the diagnostic messages, a machine learning network for evaluating the safety relevance of the diagnostic messages, the machine learning network being trained in advance by specific inputs from an operator of the technical system, and to classify the diagnostic messages according to a rule for classifying the individual diagnostic messages with respect to the operational safety of the technical system, the operator evaluating past diagnostic messages with respect to their safety relevance; And wherein the computer-implemented analysis module (11) is designed and arranged to forward the diagnostic message that has been identified as relevant in advance to the computer-implemented adaptation module (12), and wherein the computer-implemented adaptation module (12) is designed and arranged to adapt the diagnostic message previously identified as relevant by the computer-implemented analysis module (11) to the requirements of the computer-implemented security module (15), And wherein the adaptation module (12) implemented by a computer is designed and arranged to forward the diagnostic message previously received by the analysis module (11) implemented by a computer to the safety module (15) implemented by a computer.

9. The control system (1) according to claim 8, wherein: The technical equipment is manufacturing or process equipment.

10. The control system (1) according to claim 8, wherein: The machine learning network is a neural network.

11. The control system (1) according to any one of claims 8 to 10, further comprising an operator station client (3), which is designed and arranged to receive diagnostic messages from the operator station server (2) and present the diagnostic messages to an operator of the technical device.

Images