Protecting industrial production from sophisticated attacks

Abstract

A manufacturing system is disclosed herein. The manufacturing system includes one or more workstations, a monitoring platform, and a control module. Each of the one or more workstations is configured to perform at least one step in a multi-step manufacturing process of a component. The monitoring platform is configured to monitor the progress of the component throughout the multi-step manufacturing process. The control module is configured to detect a cyber attack on the manufacturing system. The control module is configured to perform an operation. The operation includes receiving a control value of a first workstation in the one or more workstations. The operation further includes determining the presence of a cyber attack based on the control value of the first workstation using one or more machine learning algorithms. The operation further includes generating an alarm to terminate the processing of the component. In some embodiments, the operation also includes correcting errors caused by the cyber attack.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. Provisional Patent Application Serial No. 62 / 938,158, filed on November 20, 2019, the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present disclosure generally relates to systems, methods, and media for use in manufacturing processes. Background Art

[0004] Cyberattacks over the past few decades have experienced astonishing levels of proliferation, adaptation, specificity, and sophistication. Industrial and military security is the study of physical and digital walls that limit malicious insertion or removal of information. For highly secure factories and military facilities, this means creating systems that are removed from global computer networks and often from internal networks. Summary of the invention

[0005] In some embodiments, a manufacturing system is disclosed herein. The manufacturing system includes one or more workstations, a monitoring platform, and a control module. Each of the one or more workstations is configured to perform at least one step in a multi-step manufacturing process of a component. The monitoring platform is configured to monitor the progress of the component throughout the multi-step manufacturing process. The control module is configured to detect a cyber attack on the manufacturing system, and the control module is configured to perform an operation. The operation includes receiving a control value of a first workstation in the one or more workstations. The control value includes an attribute of a first processing workstation. The operation further includes determining the presence of a cyber attack based on the control value of the first workstation using one or more machine learning algorithms. The operation further includes generating an alarm to terminate the processing of the component based on the determination.

[0006] In some embodiments, a computer-implemented method is disclosed herein. A computing system receives a control value of a first station of one or more stations of a manufacturing system configured to process a component. The control value includes an attribute of the first station. The computing system determines the presence of a cyber attack based on the control value of the first station using one or more machine learning algorithms. The computing system generates an alert to terminate processing of the component based on the determination. The computing system generates an action set to correct an error caused by the cyber attack. The action set is associated with a downstream station of the manufacturing system.

[0007] In some embodiments, a manufacturing system is disclosed herein. The manufacturing system includes one or more workstations, a monitoring platform, and a control module. Each of the one or more workstations is configured to perform at least one step in a multi-step manufacturing process of a component. The monitoring platform is configured to monitor the progress of the component throughout the multi-step manufacturing process. The control module is configured to detect a cyber attack on the manufacturing system, and the control module is configured to perform an operation. The operation includes receiving a control value of a first workstation in the one or more workstations. The control value includes an attribute of the first workstation. The operation further includes determining the presence of a cyber attack based on the control value of the first workstation using one or more machine learning algorithms. The operation further includes generating an alarm to terminate the processing of the component based on the determination. The operation further includes generating an action set using one or more second machine learning algorithms to correct errors caused by the cyber attack. The action set is associated with a downstream workstation of the manufacturing system. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] In order to be able to understand in detail the manner in which the above-mentioned features of the present disclosure are achieved, a more specific description of the present disclosure briefly summarized above may be obtained by reference to the embodiments, some of which are illustrated in the accompanying drawings. However, it should be noted that the accompanying drawings only illustrate typical embodiments of the present disclosure and are therefore not to be considered as limiting the scope thereof, as the present disclosure may admit of other equally effective embodiments.

[0009] Figure 1 is a block diagram illustrating a manufacturing environment according to an example embodiment.

[0010] Figure 2 is a block diagram illustrating the architecture of a single-input, single-output system implementing a Kalman filter according to an example embodiment.

[0011] Figure 3 is a block diagram illustrating the architecture of a system implementing an autoencoder according to an example embodiment.

[0012] Figure 4 is a block diagram illustrating a system architecture for implementing a reinforcement learning method using a machine learning module according to an example embodiment.

[0013] Figure 5 is a flow chart illustrating a method of managing a cyber attack on a manufacturing process according to an example embodiment.

[0014] Fig. 6A A system bus computing system architecture is shown according to an example embodiment.

[0015] Figure 6B A computer system having a chipset architecture according to an example embodiment is shown.

[0016] To facilitate understanding, identical reference numerals have been used, where possible, to designate identical elements that are common to the figures. It is contemplated that elements disclosed in one embodiment may be beneficially utilized on other embodiments without specific recitation. DETAILED DESCRIPTION

[0017] The manufacturing process may be complex, involving raw materials being processed by different processing stations (or "stations") until a final product is produced. In some embodiments, each processing station receives input for processing and may output an intermediate output that may be passed to a subsequent (downstream) processing station for additional processing. In some embodiments, a final processing station may receive input for processing and may output a final product or, more generally, a final output.

[0018] In some embodiments, each station may include one or more tools / equipment that can perform a set of process steps. Exemplary processing stations may include, but are not limited to, conveyor belts, injection molding machines, cutting machines, molding machines, extruders, computer numerical control (CNC) mills, grinders, assembly stations, three-dimensional printers, quality control stations, verification stations, etc.

[0019] In some embodiments, the operation of each processing station may depend on one or more process controllers. In some embodiments, each processing station may include one or more process controllers, which can be programmed to control the operation of the processing station. In some embodiments, an operator or a control algorithm can provide a station controller set point to the station controller, and the station controller set point can represent the expected value or range of values ​​of each control value. In some embodiments, the value used for feedback or feedforward in the manufacturing process can be referred to as a control value. Exemplary control values ​​may include, but are not limited to: speed, temperature, pressure, vacuum, rotation, current, voltage, power, viscosity, materials / resources used at the station, throughput, downtime, toxic fumes, pH, light absorption, particle density and geometric conformation, etc.

[0020] Statistical process control (SPC) is a quality control method that uses statistical methods to monitor and control processes. Typically, SPC requires that processing standards be established for each step in the manufacturing process and monitored throughout the production life cycle. The goal of SPC is to continuously improve the process throughout the life cycle.

[0021] For the purposes of SPC, it is assumed that as long as each node operates within specification, the end product will also be within specification. Specifications can be set based on subject matter expertise and historical performance. The reliability and impact of one node on the next or subsequent nodes is not directly regulated in SPC; instead, each subprocess can be examined as an independent entity. This approach results in a greater variance in the operating conditions of each node, even preventing the system from operating at its absolute highest efficiency or stability. From a security perspective, this variance can become a target for sophisticated process cyberattacks. If a single node or multiple nodes in the system begin to operate at the upper (or lower) limit of their specification, individual alarms will not be triggered, but the overall process quality will be affected. This is particularly true for man-in-the-middle cyberattacks, for example, where the reported sensor signal is falsified by malicious code. The life cycle of the node will also be affected, requiring increased downtime for repair. Several layers of downstream nodes will also be affected, and the system will continue to drift towards non-compliance over time. At that point, the corrections required to restore the system will be large-scale and cost-prohibitive.

[0022] One or more of the techniques provided herein target a new approach to industrial security by treating suspected malicious activity as a process change and correcting it by proactively adjusting the system's operating parameters. As threats to industrial systems increase in number and sophistication, traditional security approaches need to be overlaid with improvements in process control to strengthen the overall system.

[0023] Figure 1 1 is a block diagram illustrating a manufacturing environment 100 according to an example embodiment. The manufacturing environment 100 may include a manufacturing system 102, a monitoring platform 104, and a control module 106. The manufacturing system 102 may broadly represent a multi-step manufacturing system. In some embodiments, the manufacturing system 102 may represent an assembly line system, wherein each processing station may represent a human worker. In some embodiments, the manufacturing system 102 may represent a manufacturing system for additive manufacturing (e.g., a 3D printing system). In some embodiments, the manufacturing system 102 may represent a manufacturing system for subtractive manufacturing (e.g., a CNC machine tool). In some embodiments, the manufacturing system 102 may represent a manufacturing system used in a combination of additive manufacturing and subtractive manufacturing. More generally, in some embodiments, the manufacturing system 102 may represent a manufacturing system for a general manufacturing process.

[0024] The manufacturing system 102 may include one or more workstations 1081-108 n(Generally, "station 108"). Each station 108 may represent a step and / or station in a multi-step manufacturing process. For example, each station 108 may represent a layer deposition operation in a 3D printing process (e.g., station 1081 may correspond to layer 1, station 1082 may correspond to layer 2, etc.). In another example, each station 108 may correspond to a specific processing station. In another example, each station 108 may correspond to a specific human operator who performs a specific task in an assembly line manufacturing process.

[0025] Each station 108 may include a process controller 114 and control logic 116. Each process controller 1141-114 n The control logic 116 may be programmed to control the operation of each respective workstation 108. In some embodiments, the control module 106 may provide a workstation controller setpoint for each process controller 114, which may represent a desired value or range of values ​​for each control value. The control logic 116 may reference properties / parameters associated with a process step at the workstation 108. In operation, the control logic 116 of each workstation 108 may be dynamically updated throughout the manufacturing process by the control module 106, depending on the current trajectory of the final quality metric.

[0026] The monitoring platform 104 can be configured to monitor each workstation 108 of the manufacturing system 102. In some embodiments, the monitoring platform 104 can be a component of the manufacturing system 102. For example, the monitoring platform 104 can be a component of a 3D printing system. In some embodiments, the monitoring platform 104 can be independent of the manufacturing system 102. For example, the monitoring platform 104 can be retrofitted to an existing manufacturing system 102. In some embodiments, the monitoring platform 104 can represent an imaging device configured to capture images of a product or tool (e.g., a worker or a process tool) at each step of a multi-step process. For example, the monitoring platform 104 can be configured to capture images of components at each workstation 108 and / or capture images of components of a developed product at each workstation 108 (e.g., tools, humans, etc.). In general, the monitoring platform 104 can be configured to capture information related to the production of products (e.g., images, voltage readings, speed readings, etc.) and / or tools (e.g., hand positions, tool positions, etc.) and provide the information as input to the control module 106 for evaluation.

[0027] The control module 106 can communicate with the manufacturing system 102 and the monitoring platform 104 through one or more communication channels. In some embodiments, the one or more communication channels can represent a separate connection via the Internet, such as a cellular or Wi-Fi network. In some embodiments, the one or more communication channels can use a wireless network such as radio frequency identification (RFID), near field communication (NFC), Bluetooth, etc. TM , Bluetooth Low EnergyTM (BLE), Wi-Fi TM 、ZigBee TM , Ambient Backscatter Communication (ABC) protocol, USB, direct connection to WAN or LAN to connect terminals, services and mobile devices.

[0028] The control module 106 may be configured to control each process controller of the manufacturing system 102. For example, based on information captured by the monitoring platform 104, the control module 106 may be configured to adjust a process control associated with a particular workstation 108. In some embodiments, the control module 106 may be configured to adjust a process control of a particular workstation 108 based on a projected final quality metric.

[0029] As mentioned above, traditional methods of inspecting processes attack various SPC techniques. SPC is a static, non-interventional approach to process control, where well-defined statistical characteristics are passively observed to pass or fail at each node. Only after the last node is processed do these traditional systems decide whether to keep or discard the manufactured product.

[0030] To improve the conventional process, the control module 106 includes an error detection module 130. The error detection module 130 can be configured to detect errors at a given station 108 or node of the manufacturing system 102. For example, the error detection module 130 is used as part of a dynamic intervention method of process control, where each node subsequent to the node that caused the damage to be detected is woven into an optimization problem (e.g., a damage recovery problem) and actively controlled to instantiate a solution. In some embodiments, this process can be completed in real time or near real time, and while each cycle is ongoing, rather than at the end of a given cycle.

[0031] In order to understand the one or more techniques implemented by the error detection module 130, it is important to understand how the control module 106 defines a manufacturing system (e.g., the manufacturing system 102). A variety of topological schemes can be used to define a manufacturing system, including feedback and feedforward organizations. In some embodiments, the manufacturing system F can be defined as a linear sequence of n process nodes (or stations 108), labeled 1,...,N, connected in a feedforward chain of links. For example:

[0032] F:→1→2→…→i→…→n

[0033] Similarly, in some embodiments, a manufacturing system F may be defined as a nonlinear sequence of n process nodes (or workstations 108), labeled 1, ..., N. In some embodiments, the processing performed by each node i may have two attribute distributions: the expected distribution Q i ; and the observed distribution P i .Qi Can be used and To characterize. Q i can be fully characterized. i Can be used and To characterize. Then P i can be fully characterized.

[0034] In some embodiments, the damage caused by node i can be defined as P i About Q i The Kullback-Leibler divergence of

[0035]

[0036] In some embodiments, the damage may be cumulative, or increase across F. For example:

[0037]

[0038] Returning to the error detection module 130, the error detection module 130 can be configured to detect damage or errors at a given node k of the manufacturing system 102. For example, if the error detection module 130 detects that the node k has caused damage (i.e., has produced a damaged or distorted distribution), the error detection module 130 can adopt a control strategy that changes from P k Sampling and generating all subsequent resulting distributions P k+1 ,...,P n , thereby reducing or minimizing the remaining accumulated damage d k+1 ,...,d k Therefore, the damage recovery problem of the error detection module 130 can be expressed as:

[0039]

[0040] In some embodiments, the error detection module 130 may implement one or more techniques to identify or correct damage detected at a given node. In some embodiments, the error detection module 130 may use a Kalman filter 132 to detect damage or errors at a given processing node. In some embodiments, the error detection module 130 may include an autoencoder 134 to detect damage or errors at a given processing node. In some embodiments, the error detection module 130 may use a machine learning module 136 deep reinforcement learning technique to detect damage or errors at a given processing node and correct detected changes caused by damage or errors at a downstream node or station 108. In some embodiments, the error detection module 130 may use one or more of a Kalman filter 132, an autoencoder 134, or a machine learning module 136 to detect damage or errors at a given processing node and / or correct detected changes caused by damage or errors at a downstream node or station 108.

[0041] In some embodiments, the error detection module 130 may implement a Kalman filter 132 to detect errors at processing nodes. To summarize the above distribution description, d i , the single-input single-output system can be formulated in state space as:

[0042]

[0043]

[0044] is defined as any state of the system, y is defined as the output of the system, and A, B, C can be the system matrices that define the ordinary differential equations underlying the dynamics. The input u of the system ε The input signal may be noisy, defined as:

[0045] u ε,i =u i (t)+ε t

[0046] where ∈ t It may be caused by In some embodiments, the observed output It can be a function output by the system, such as:

[0047]

[0048] For a noisy signal measurement like In some embodiments, this can be accomplished by establishing for a given node i of the process to coordinate the symbol. In an unaffected system, the average value of the noise contribution is likely to be zero, so However, in malicious cyber attacks, biases may appear as non-zero mean input noise.

[0049] Typically, the Kalman filter 132 may rely on zero mean noise; however, in the case of a malicious network attack, the offset of the input command may appear as non-zero mean additive noise. Therefore, the Kalman filter 132 can be interpreted as an assumed time-invariant system:

[0050]

[0051]

[0052] In some embodiments, Kalman filter 132 may use the output measurement of a node or process and the canonical, untouched input instruction u i (t) is constructed. If the process is properly calibrated, the input / output sensor measurements of the station 108 or node should have zero mean noise. However, in the case of a malicious network attack, there will be a non-zero bias.

[0053] In some embodiments, Kalman filter 132 may be interpreted as:

[0054]

[0055]

[0056]

[0057]

[0058]

[0059] For the kth sample of process node i, It may be the measurement update sign, Σ i,k It may be the covariance of the state prediction, R i may be the covariance of the input noise, ε t and K i,k It may be the Kalman gain. With a large enough sample, the innovation distribution It should be However, for malicious network attacks This may happen naturally with very few samples. Once the sample threshold satisfies k>k min , you can create an alarm for where γ i It can be adjusted for process nodes. If the innovation error is non-zero and above a threshold γ i, the error detection module 130 can determine that a malicious network attack may be occurring.

[0060] Figure 2 is a block diagram illustrating the architecture of a single-input, single-output system (hereinafter referred to as “system 200 ”) implementing Kalman filter 132 according to an example embodiment.

[0061] As shown, system 200 may include controller 202 (e.g., C(s)), instrument 204 (e.g., G(s)), measurement 206 (e.g., H(s)), attack 208 (e.g., A(s)), and Kalman filter 132 (e.g., KF). In some embodiments, system 200 may include a second controller 202. In some embodiments, controller 202, instrument 204, and measurement 206 may represent the basic components of node control, while Kalman filter 132 generates innovation errors.

[0062] In some embodiments, for example Figure 2 In the embodiment shown in , the dual controllers can be used as an unbiased reference for the Kalman filter 132.

[0063] Back to Figure 1 In some embodiments, the error detection module 130 may use the autoencoder 134 to detect anomalies corresponding to a network attack. We can instantiate unsupervised autoencoder training to map the entropy of output observations to a parameter set θ AE , so that

[0064]

[0065] In some embodiments, the error of the autoencoder 134 may be defined as:

[0066]

[0067] For normal operation in and The distribution can be fitted using the maximum likelihood method. Subsequently, the anomaly score a of the sequence i , can be defined as:

[0068]

[0069] Similar to the Kalman filter 132, when the anomaly score a i >γ i When, the error detection module 130 can use the autoencoder 134 to detect anomalies.

[0070] Figure 31 is a block diagram illustrating the architecture of a system 300 implementing an autoencoder 134 according to some embodiments. As shown, the system 300 may include a controller 302 (e.g., C(s)), an instrument 304 (e.g., G(s)), a measurement 306 (e.g., H(s)), an attack 308 (e.g., A(s)), an autoencoder 134 (e.g., AE), and an alarm 312 (e.g., ). The controller 302, the instrument 304, and the measurement 306 may represent the basic components of the node control, and the autoencoder 134 may detect errors. In some embodiments, the error detection module 130 may trigger an alarm 312 based on a sufficient anomaly score.

[0071] Return to reference Figure 1 In some embodiments, the error detection module 130 may use one or more deep reinforcement learning techniques to identify errors or anomalies in the processing corresponding to a cyber attack. As described above, given the definition of damage d i , we can construct a set of distributions P k+1 ,...,P n A reinforcement learning agent with delayed reward function to solve the damage recovery problem

[0072]

[0073] Through its actions For i=k+1,...,n, in some iterations j=1,...,m:

[0074]

[0075] therefore

[0076]

[0077] In some embodiments, the error detection module 130 can train an agent in an actor-critic mode, such that a network can generate an action α i,k , the state of the kth sample of the ith node of a given process And another network can be parameterized by θ Q,i Learning to generate predictions for Q values in It may be through the parameter θ π,i In some embodiments, the reward can be calculated using the Bellman formula such that:

[0078]

[0079] In some embodiments, the update law associated with the reinforcement learning technique may be:

[0080]

[0081] In some embodiments, the update rule can reduce or minimize the Q value, thereby minimizing the damage, and can be expressed in actions aimed at returning the distribution to its canonical shape. In some embodiments, the expression of the action can be:

[0082] In some embodiments, the action may be expressed as:

[0083]

[0084] where u i,k Can be and The input, α i,k can be a directive modifier, and can be the instruction read for a particular sample k of node i. If the instruction is corrupted and the corruption is reflected in the state, then the policy π i,k Action may be taken to correct it.

[0085] By utilizing reinforcement learning methods, the error detection module 130 can provide new ways to address system security by tying process-based malicious cyber attacks to nominal process changes and providing direct control and correction for these changes. These methods are not just a detection or passive prevention method; instead, it can be assumed that cyber attacks manifest as routine (e.g., possible) system changes, such as machines being out of standard or raw material inventory being out of strict specifications.

[0086] Figure 4 400 is a block diagram illustrating the architecture of a system 400 for implementing a reinforcement learning method using a machine learning module 136 according to some embodiments. As shown, the system 400 may represent a multi-node system i=0,...,N. For each node i, there may be controllers 4020, 4021, and 402 N (For example, C0(s),C i (s),...C N (s)), equipment 4040, 404 i and 404 N (For example, G0(s),G i (s),G N (s)), and measure 4060, 406 i and 406 N (For example, H0(s),H i (s),H N(s)). Together, these nodes can be embedded in a policy learning feedback loop governed by the state of the system 400, which is the state S of the system at time k sampled from the data store 408 (e.g., Y). k , and the strategy takes the current state 410 as input π(S k ). The attack 412 against a single node i can be represented by block A(s).

[0087] In some embodiments, in order to identify a set of actions to be taken to correct the error caused by the network attack, the state S of the time sample k may be k The input is to a nonlinear filter, the weights of which may be selected to minimize subsequent corruption of time sample k+n given the observed artifact or component. In some embodiments, the output of the filter may be a scalar or vector used to modify a specified process set point or control value. The transition from state to action may be referred to as a strategy.

[0088] Figure 5 is a flow chart illustrating a method 500 of managing a cyber attack on a manufacturing process according to an example embodiment. The method 500 may begin at step 502 .

[0089] At step 502, the control module 106 may receive control values ​​from a workstation 108 of the manufacturing system 102. In some embodiments, the control module 106 may receive control values ​​from a process controller associated with a given workstation 108. The process controller may generally be programmed to control the operation of the workstation 108. Exemplary control values ​​may include, but are not limited to: speed, temperature, pressure, vacuum, rotation, current, voltage, power, viscosity, materials / resources used at the workstation, throughput rate, downtime, hazardous fumes, etc. More generally, the control values ​​may refer to properties of the workstation 108 rather than to properties of the component being processed by the workstation 108.

[0090] At step 504, the control module 106 may determine that a cyber attack exists based on the control value received from the workstation 108. For example, in some embodiments, the error detection module 130 may generate an anomaly score for the workstation 108 using the Kalman filter 132 given the control value. For example, if the anomaly score is greater than a predetermined threshold, the control module 106 may determine that a cyber attack is currently ongoing. In another example, the error detection module 130 may generate an anomaly score for the workstation 108 using the autoencoder 134 given the control value. For example, if the anomaly score is greater than a predetermined threshold, the control module 106 may determine that a cyber attack is currently ongoing. In another example, the error detection module 130 may use the machine learning module 136 to predict a Q value corresponding to the workstation 108. For example, if the Q value is outside a range of acceptable values, the control module 106 may determine that a cyber attack is currently ongoing.

[0091] In some embodiments, the method 500 may include step 506. In step 506, in response to determining that a cyber attack is occurring, the control module 106 may trigger an alarm or siren. In some embodiments, the alarm or siren may be a notification to a user overseeing the manufacturing system 102. In some embodiments, the alarm or siren may be a notification to stop or terminate each workstation 1081-108 of the manufacturing system 102. n The processed signal.

[0092] In some embodiments, method 500 may include steps 508-510. In step 508, in response to determining that a cyber attack is occurring, control module 106 may generate one or more actions to correct the damage caused by the cyber attack. For example, error detection module 130 may train an agent in an actor-critic mode, where the state of the kth sample at the i-th node of the process In the case of , a network can generate action α i,k , and the other network can be Q,i Learning to generate predictions for Q values in It may be through the parameter θ π,i In some embodiments, the reward can be calculated using the Bellman formula such that:

[0093]

[0094] In some embodiments, the update law associated with the reinforcement learning technique may be:

[0095]

[0096] In some embodiments, the update rule can reduce or minimize the Q value, thereby minimizing the damage, and can be expressed in actions aimed at returning the distribution to its canonical shape. In some embodiments, the expression of the action can be:

[0097] In some embodiments, the action may be expressed as:

[0098]

[0099] where u i,k Can be and The input, α i,k can be a directive modifier, and can be the instruction read for a particular sample k of node i. If the instruction is corrupted and the corruption is reflected in the state, then the policy π i,k Action may be taken to correct it.

[0100] At step 510, the control module 106 may provide the updated actions generated by the machine learning module 136 to the downstream workstation 108. In some embodiments, the control module 106 may transmit the updated instructions to the process controller of each downstream workstation 108.

[0101] Fig. 6AA system bus computing system architecture 600 according to an example embodiment is shown. One or more components of the system 600 may communicate electrically with each other using a bus 605. The system 600 may include a processor (e.g., one or more CPUs, GPUs, or other types of processors) 610 and a system bus 605 that couples various system components to the processor 610, including a system memory 615, such as a read-only memory (ROM) 620 and a random access memory (RAM) 625. The system 600 may include a cache of high-speed memory that is directly connected, close to, or integrated as part of the processor 610. The system 600 may copy data from the memory 615 and / or storage device 630 to the cache 612 for fast access by the processor 610. In this way, the cache 612 may provide a performance boost to avoid delays in the processor 610 while waiting for data. These and other modules may control or be configured to control the processor 610 to perform various actions. Other system memories 615 may also be used. The memory 615 may include a variety of different types of memory with different performance characteristics. The processor 610 may represent a single processor or multiple processors. The processor 610 may include one or more general purpose processors or hardware modules or software modules, such as service 1 632, service 2 634, and service 3 636, stored in a storage device 630 configured to control the processor 610, and a dedicated processor, where the software instructions are programmed into the actual processor design. The processor 610 may essentially be a completely independent computing system, including multiple cores or processors, buses, memory controllers, caches, etc. Multi-core processors may be symmetric or asymmetric.

[0102] To enable user interaction with computing device 600, input device 645 may be any number of input mechanisms, such as a microphone for voice, a touch-sensitive screen for gesture or graphic input, a keyboard, a mouse, motion input, speech, and the like. Output device 635 may also be one or more of a variety of output mechanisms known to those skilled in the art. In some cases, a multimodal system may enable a user to provide multiple types of input to communicate with computing device 600. Communication interface 640 may generally govern and manage user input and system output. There is no limitation on operation on any particular hardware configuration, so the basic features here may be easily replaced with improved hardware or firmware configurations as they are developed.

[0103] The storage device 630 may be a non-volatile memory and may be a hard disk or other type of computer-readable medium that can store data accessible by a computer, such as a magnetic tape cartridge, a flash memory card, a solid-state storage device, a digital versatile disk, a cassette, a random access memory (RAM) 625, a read-only memory (ROM) 620, and a mixture thereof.

[0104] The storage device 630 may include services 632, 634, and 636 for controlling the processor 610. Other hardware or software modules are contemplated. The storage device 630 may be connected to the system bus 605. In one aspect, a hardware module that performs a particular function may include software components stored in a computer-readable medium that are related to the necessary hardware components, such as the processor 610, bus 605, display 635, etc., to perform the function.

[0105] Figure 6B A computer system 650 with a chipset architecture according to an example embodiment is shown. The computer system 650 can be an example of computer hardware, software, and firmware that can be used to implement the disclosed technology. The system 650 may include one or more processors 655, which represent any number of physically and / or logically different resources that can execute software, firmware, and hardware configured to perform recognized calculations. One or more processors 655 can communicate with a chipset 660, which can control the input and output of one or more processors 655. In this example, the chipset 660 outputs information to an output 665, such as a display, and can read and write information to a storage device 670, which can include, for example, magnetic media and solid-state media. The chipset 660 can also read data from and write data to RAM 675. A bridge 680 for interfacing with various user interface components 685 can be provided for interfacing with the chipset 660. Such user interface components 685 may include a keyboard, a microphone, touch detection and processing circuits, a pointer device, such as a mouse, etc. In general, input to system 650 may come from any of a variety of sources, machine-generated and / or human-generated.

[0106] Chipset 660 may also interface with one or more communication interfaces 690, which may have different physical interfaces. Such communication interfaces may include interfaces for wired and wireless local area networks, broadband wireless networks, and personal area networks. Some applications of the methods for generating, displaying, and using the GUI disclosed herein may include receiving an ordered data set through a physical interface, or generated by the machine itself by analyzing data stored in memory 670 or 675 through one or more processors 655. Further, the machine may receive input from a user through a user interface component 685 and perform appropriate functions, such as browsing functions, by interpreting these inputs using one or more processors 655.

[0107] It will be appreciated that example systems 600 and 650 may have more than one processor 610 or be part of a group or cluster of networked computing devices to provide greater processing capabilities.

[0108] Although the foregoing is directed to the embodiments described herein, other and further embodiments may be devised without departing from the basic scope thereof. For example, aspects of the present disclosure may be implemented in hardware or software or a combination of hardware and software. One embodiment described herein may be implemented as a program product for use with a computer system. The program of the program product defines the functions of the embodiments (including the methods described herein) and may be contained on various computer-readable storage media. Illustrative computer-readable storage media include, but are not limited to: (i) non-writable storage media (e.g., a read-only memory (ROM) device within a computer, such as a CD-ROM disk that can be read by a CD-ROM drive), flash memory, ROM chip, or any type of solid-state non-volatile memory), on which information is permanently stored; (ii) writable storage media that stores variable information (e.g., a floppy disk in a floppy disk drive or hard drive or any type of solid-state random access memory). Such a computer-readable storage medium, when carrying computer-readable instructions that direct the functions of the disclosed embodiments, is an embodiment of the present disclosure.

[0109] Those skilled in the art will appreciate that the foregoing examples are illustrative and not restrictive. It will be clear to those skilled in the art after reading the specification and studying the drawings that all arrangements, enhancements, equivalents and improvements thereto are included within the true spirit and scope of the present disclosure. Therefore, the following appended claims are intended to include all such modifications, arrangements and equivalents that fall within the true spirit and scope of these teachings.

Claims

1. A manufacturing system for determining a cyber attack and generating an alert, comprising: one or more workstations, each workstation configured to perform at least one step in a multi-step manufacturing process for the component; a monitoring platform configured to monitor the progress of the component throughout the multi-step manufacturing process; as well as A control module is configured to detect a network attack on the manufacturing system, and the control module is configured to perform operations including: receiving a control value for a first workstation of the one or more workstations, the control value comprising a property of the first workstation; Determining the presence of a cyber attack based on the control value for the first station using one or more machine learning algorithms by: generating an anomaly score for the first station based on the control value, and determining that the anomaly score exceeds a threshold indicating a cyber attack; based on the determination, generating an alert to terminate processing of the component; generating a set of actions to correct errors caused by the cyber attack by determining a modified set of control values ​​to minimize damage caused by the cyber attack; and The set of actions is provided to at least one process controller associated with at least one downstream workstation of the manufacturing system.

2. The manufacturing system according to claim 1, wherein: The one or more machine learning algorithms include a Kalman filter.

3. The manufacturing system according to claim 2, wherein: Generating an abnormality score of the first workstation based on the control value includes: An anomaly score for the first workstation is generated based on the control value using the Kalman filter.

4. The manufacturing system according to claim 1, wherein: The one or more machine learning algorithms include an autoencoder.

5. The manufacturing system according to claim 4, wherein: Generating an abnormality score of the first workstation based on the control value includes: An anomaly score for the first station is generated based on the control value using the autoencoder.

6. The manufacturing system according to claim 1, wherein: The one or more machine learning algorithms include a deep learning algorithm.

7. The manufacturing system according to claim 6, wherein: Determining the presence of a cyber attack based on the control value for the first station using the one or more machine learning algorithms further includes: generating a predicted quality metric for the component based on the control value; and It is determined that the prediction quality metric falls outside of a range of acceptable values.

8. A computer-implemented method for determining a network attack and generating an alert, comprising: receiving, by a computing system, a control value for a first workstation of one or more workstations of a manufacturing system configured to process a component, the control value comprising an attribute of the first workstation; The computing system determines the presence of a cyber attack based on the control value for the first station using one or more machine learning algorithms by: generating an anomaly score for the first station based on the control value, and determining that the anomaly score exceeds a threshold indicating a cyber attack; generating, by the computing system, an alert to terminate processing of the component based on the determination; generating, by the computing system, a set of actions to correct errors caused by the cyber attack by determining a modified set of control values ​​to minimize damage caused by the cyber attack; as well as The computing system causes at least one downstream workstation of the manufacturing system to perform the set of actions by causing at least one process controller associated with the at least one downstream workstation to adjust a set of properties of the at least one downstream workstation based on the modified set of control values.

9. The computer-implemented method of claim 8, wherein: The one or more machine learning algorithms include a Kalman filter.

10. The computer-implemented method of claim 9, wherein: Generating an abnormality score of the first workstation based on the control value includes: An anomaly score for the first workstation is generated based on the control value using the Kalman filter.

11. The computer-implemented method of claim 8, wherein: The one or more machine learning algorithms include an autoencoder.

12. The computer-implemented method of claim 11, wherein: Generating an abnormality score of the first workstation based on the control value includes: An anomaly score for the first station is generated based on the control value using the autoencoder.

13. The computer-implemented method of claim 8, wherein: The one or more machine learning algorithms include a deep learning algorithm.

14. The computer-implemented method of claim 13, wherein: Determining the presence of a cyber attack based on the control value for the first station using the one or more machine learning algorithms further includes: generating a predicted quality metric for the component based on the control value; and It is determined that the prediction quality metric falls outside of a range of acceptable values.

15. A manufacturing system for determining a cyber attack and generating an alert, comprising: one or more workstations, each workstation configured to perform at least one step in a multi-step manufacturing process for the component; as well as A control module is configured to detect a network attack on the manufacturing system, and the control module is configured to perform operations including: receiving a control value for a first processing station of the one or more processing stations, the control value comprising an attribute of the first processing station; determining, using one or more machine learning algorithms, that a cyber attack exists based on control values ​​for the first station; based on the determination, generating an alert to terminate processing of the component; generating a set of actions using one or more second machine learning algorithms to correct errors caused by the cyber-attack by determining a modified set of control values ​​to minimize damage caused by the cyber-attack; and At least one downstream workstation of the manufacturing system is caused to perform the set of actions by causing at least one process controller associated with the at least one downstream workstation to adjust a set of properties of the at least one downstream workstation based on the modified set of control values.

16. The manufacturing system according to claim 15, wherein: The one or more machine learning algorithms include a Kalman filter and the one or more second machine learning algorithms include a deep learning algorithm.

17. The manufacturing system according to claim 16, wherein: Determining the presence of a cyber attack based on the control value for the first station using the one or more machine learning algorithms includes: generating an anomaly score for the first station based on the control value using the Kalman filter; and It is determined that the anomaly score exceeds a threshold indicating a network attack.

18. The manufacturing system according to claim 15, wherein: The one or more machine learning algorithms include an autoencoder.

19. The manufacturing system according to claim 18, wherein: Determining the presence of a cyber attack based on the control value for the first station using the one or more machine learning algorithms includes: generating an anomaly score for the first station based on the control value using the autoencoder; and It is determined that the anomaly score exceeds a threshold indicating a network attack.

20. The manufacturing system of claim 15, wherein: The one or more machine learning algorithms include a deep learning algorithm.

Images