Method, system and apparatus for intelligently simulating plant control systems and simulating response data

Abstract

A controller simulator coupled to an interface provides one or more control signals to a process simulator and a deep learning process, and the interface exposes the controller simulator to inputs from an external source. In response, the process simulator simulates response data, which is provided to a deep learning processor. The deep learning processor generates expected response data and expected behavior pattern data for one or more control signals, and generates actual behavior pattern data for the simulated response data. Perform a comparison of at least one of the following: the simulated response data with the expected response data, and the actual behavior pattern data with the expected behavior pattern data to determine whether abnormal activity is detected. Due to the detection of abnormal activity, one or more operations are performed to resolve the abnormal activity.

Description

[0001] Cross-references

[0002] This application claims the benefit of U.S. Provisional Application No. 62 / 983,510, filed on February 28, 2020, entitled “Method, Systems and Apparatus for Intelligently Emulating Factory Control Systems and Simulating Response Data,” which is incorporated herein by reference in its entirety. This application is related to U.S. Patent Application No. 16 / 663,245, filed on October 24, 2019, entitled “Predictive Process Control for a Manufacturing Process,” which is incorporated herein by reference in its entirety. In addition, this application is related to U.S. Patent Application No. 16 / 781,193, filed on February 4, 2020, entitled “Dynamic Monitoring and Securing of Factory Processes, Equipment and Automated Systems,” which is incorporated herein by reference in its entirety. In addition, this application is related to U.S. Patent Application No. 62 / 983,487, filed on February 28, 2020, entitled "Dynamic Monitoring and Securing of Factory Processes, Equipment and Automated Systems", which is incorporated herein by reference in its entirety. This application also claims the benefit of U.S. Patent Application No. 16 / 900,124, filed on June 12, 2020, entitled "Method, Systems and Apparatus for Intelligently Emulating Factory Control Systems and Simulating Response Data", which is incorporated herein by reference in its entirety. Technical Field

[0003] The present disclosure generally relates to systems, apparatus, and methods for intelligently emulating plant control systems and simulating response data to successfully attract malware attacks against the plant and analyze their behavior. Background Art

[0004] Malware attacks against factories are surging and becoming very complex. In addition, these malware attacks are usually able to penetrate isolated and closed computer networks and machines connected to external networks (e.g., 4G and 5G networks). Many such attacks are usually directed to the factory control system that controls the physical devices and processes of the factory. As used herein, malware refers to any hardware or software that, for example, damages, interrupts, or unauthorized access or manipulation to the quality or output of a computer, server, controller, computer network, computer control device, data, or final output. Malware may include computer viruses, worms, Trojan horses, spyware, backdoors, or any programs or files that may be harmful to a computer system. Malware can be designed to be directed to the control system of a factory, causing subtle changes to the operation of the physical devices and processes of the factory, which can usually circumvent conventional information technology (IT) security solutions or conventional process control systems.

[0005] To help identify threats to a plant's control systems, security mechanisms known as honeypots can be set up to mimic the plant's control systems, devices, and processors in order to attract the same malware that might target the plant's production control systems. In response, designers of malware attacks aware of the existence of honeypots to ferret out such attacks have increased the sophistication of their malware by designing malware to detect honeypots (e.g., by searching for specific identifiers associated with the target plant's control systems and by testing the expected responses of those systems). If the identifiers or responses do not appear authentic, the malware may be alerted that it has detected a honeypot and can hide its presence, defeating the purpose of the honeypot.

[0006] Furthermore, malware may be introduced on the control systems of a plant at many different locations, including but not limited to the following: computers, computer networks, process controllers, programmable logic controllers (PLCs), distributed control systems (DCSs), supervisory control and data acquisition systems (SCADAs), and other digital devices deployed in the plant. Therefore, it is very difficult to design a realistic honeypot that can mimic the control system of an entire plant and deceive sophisticated malware attacks.

[0007] Therefore, it is desirable to provide a new mechanism for intelligently simulating a plant's production control system and emulating response data similar to the response data generated by the plant's processes, devices, and control systems during production in order to successfully attract malware attacks against these systems and analyze their behavior. Summary of the invention

[0008] In one example, a computer-implemented method includes: providing one or more control signals by a controller simulator coupled to an interface to a process simulator and a deep learning processor, wherein the interface exposes the controller simulator to input from an external source; simulating response data by the process simulator in response to receiving the one or more control signals, and the response data is provided to the deep learning processor; generating expected response data and expected behavior pattern data for one or more control signals by the deep learning processor; generating actual behavior pattern data for the simulated response data by the deep learning processor; comparing at least one of: (i) the simulated response data with the expected response data, and (ii) the actual behavior pattern data with the expected behavior pattern data to determine whether abnormal activity is detected; and performing one or more operations to resolve the abnormal activity due to the detection of abnormal activity.

[0009] In some examples, the deep learning processor includes a conditioned machine learning model.

[0010] In some examples, the simulated response data includes control values ​​provided to a controller simulator.

[0011] In some examples, the one or more actions include shutting down one or more plant processes, equipment, and control (P / E / C) systems that are at risk due to the abnormal activity.

[0012] In some examples, the one or more operations include generating a notification, wherein the notification specifies the unusual activity, wherein the notification is provided to an operator to review the unusual activity.

[0013] In some examples, anomalous activity is detected due to a comparison of simulated response data to expected response data indicating a deviation.

[0014] In some examples, anomalous activity is detected due to a comparison of actual behavior pattern data to expected behavior pattern data indicating a deviation.

[0015] In some examples, one or more operations include determining whether the abnormal activity is a malware attack received by the controller emulator from the interface, wherein a determination that the abnormal activity is a malware attack is generated because a confidence level score of the abnormal activity satisfies a confidence level threshold corresponding to a detected malware attack.

[0016] In one example, a system includes: a memory and one or more processors; the memory has instructions stored thereon, which, when executed by the one or more processors, cause the system to: receive one or more control signals from a controller emulator coupled to an interface, wherein the interface exposes the controller emulator to input from an external source; simulate response data including control values ​​in response to receiving the one or more control signals; generate expected response data and expected behavior pattern data for the one or more control signals; generate behavior pattern data, wherein the behavior pattern data is generated using the simulated response data; compare at least one of: (i) the simulated response data with the expected response data, and (ii) the actual behavior pattern data with the expected behavior pattern data to determine whether abnormal activity is detected; and, due to the detection of abnormal activity, perform one or more operations to resolve the abnormal activity.

[0017] In some examples, one or more processors include a conditioned machine learning model.

[0018] In some examples, the one or more operations include transmitting an alarm protocol to cause the controller emulator to shut down one or more plant process, equipment, and control (P / E / C) systems at risk due to the abnormal activity.

[0019] In some examples, the instructions that cause one or more processors to perform one or more operations to address the abnormal activity further cause the system to: determine a confidence level associated with the abnormal activity based on the detected abnormal activity; and identify one or more operations based on the confidence level.

[0020] In one example, a non-transitory computer-readable storage medium having executable instructions stored thereon, the executable instructions causing the computer system, due to execution by a computer system, to: receive one or more control signals from a controller emulator coupled to an interface, wherein the interface exposes the controller emulator to input from an external source; in response to receiving the one or more control signals, simulate response data including control values; generate expected response data and expected behavior pattern data for the one or more control signals; generate behavior pattern data, wherein the behavior pattern data is generated using the simulated response data; compare at least one of: (i) the simulated response data with the expected response data, and (ii) the actual behavior pattern data with the expected behavior pattern data to determine whether abnormal activity is detected; and due to detecting the abnormal activity, perform one or more operations to address the abnormal activity.

[0021] In some examples, one or more operations include: determining whether the abnormal activity is a malware attack received by the controller emulator from an interface; and due to the determination that the abnormal activity is a malware attack, transmitting an alarm protocol to cause the controller emulator to shut down one or more plant processes, equipment, and control (P / E / C) systems that are at risk due to the malware attack. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to describe the manner in which the above and other advantages and features of the present disclosure can be obtained, a more particular description of the principles briefly described above will be presented by reference to specific embodiments shown in the accompanying drawings. It should be understood that these drawings depict only exemplary embodiments of the present disclosure and are therefore not to be considered as limiting the scope of the present disclosure. The principles of the present invention are described and explained with additional specificity and detail through the use of the accompanying drawings, in which:

[0023] Figure 1 An example method of providing input to a deep learning processor during operation and control of a factory process is shown;

[0024] Figure 2 Example methods for training a deep learning processor and a process simulator are shown;

[0025] Figure 2B shows an example behavior pattern for a subset of response data generated by a P / E / C system of a plant;

[0026] Figure 3 shows an example smart honeypot according to some embodiments;

[0027] Figure 4 An example method for running a simulation process to attract a malware attack is shown in accordance with various embodiments;

[0028] Figure 5 An example method for recording data is shown; and

[0029] Figure 6 Illustrative examples of computing system architectures including various components in electrical communication with each other using connections are shown in accordance with various embodiments. DETAILED DESCRIPTION

[0030] According to some embodiments of the disclosed subject matter, mechanisms are disclosed for intelligently simulating a plant control system and simulating response data similar to response data generated by the plant's production processes, devices, and control systems (the mechanisms may include systems, methods, devices, apparatuses, etc.) to successfully attract malware attacks against the plant and analyze their behavior.

[0031] The detailed description set forth below is intended as a description of various configurations of the present technology and is not intended to represent the only configuration in which the present technology can be practiced. The accompanying drawings are incorporated herein and constitute a part of the detailed description. The detailed description includes specific details in order to provide a more thorough understanding of the present technology. However, it will be apparent that the present technology is not limited to the specific details set forth herein and can be practiced without these details. In some cases, structures and components are shown in block diagram form to avoid blurring the concepts of the present technology.

[0032] The manufacturing process of a factory is complex and includes raw materials that are processed by different processing stations (or "stations") until a final product (referred to herein as "final output") is produced. Except for the final processing station, each processing station receives input for processing and outputs an intermediate output that is passed to a subsequent processing station for further processing. The final processing station receives input for processing and outputs a final output.

[0033] Factories rely on many processing stations, which include automatically controlled physical devices. These automatically controlled processing stations are vulnerable to attacks from malware, and if the malware is not detected early, it may cause interference or irreparable damage to the device and product output. Although the smart honeypot mechanism disclosed in the present invention involves simulating control systems and simulating devices and processes in a factory environment, the smart honeypot mechanism can also be applied to any industry or critical infrastructure that deploys industrial control systems, such as power plants, power grids, utilities, telecommunications, finance, health, and transportation facilities. The smart honeypot mechanism can also be applied to control systems of discrete Internet of Things (IoT) devices. Additional details of the factory environment including the process, device, and control system of the factory are described in U.S. Patent Application No. 16 / 781,193, entitled "Dynamic Monitoring and Securing of Factory Processes, Equipment and Automated Systems", which is incorporated herein by reference in its entirety.

[0034] The operation of each processing station can be dominated by one or more process controllers. In some embodiments, each processing station has one or more process controllers (referred to herein as "station controllers" or "process controllers"), and one or more process controllers are programmed to control the operation of the processing station (referred to herein as a programming algorithm of a "control algorithm"). However, in some aspects, a single process controller can be configured to control the operation of two or more processing stations. An example of a process controller is a programmable logic controller (PLC). The PLC can be programmed to operate the process and system of a factory. The PLC or other process controllers can receive information from connected sensors or input devices, process data and generate outputs (e.g., control signals for controlling related processing stations) based on pre-programmed parameters and instructions. Other examples of process controllers include distributed control systems (DCS) and supervisory control and data acquisition systems (SCADA).

[0035] An operator or control algorithm may provide a process controller with a process controller set point (or "set point" or "controller set point" or CSP), which represents a desired single value or range of values ​​for each control value. Values ​​that may be measured during operation of a device or process at a station may be classified as control values ​​or station values. Values ​​controlled by a process controller are classified herein as control values, and other measured values ​​are classified herein as station values. Examples of control and / or station values ​​include, but are not limited to: speed, temperature, pressure, vacuum, rotation.

[0036] The control algorithm may also include instructions for monitoring the control value, comparing the control value to a corresponding set point, and determining what action to take when the control value is not equal to the corresponding process controller set point or is not within a defined range of the corresponding process controller set point. For example, if the measured current temperature value of the workstation is below the set point, a signal may be sent by the process controller to increase the temperature of the heat source of the workstation until the current temperature value of the workstation is equal to the set point. Conventional process controllers used to control workstations in a manufacturing process are limited because they follow static algorithms (e.g., on / off control, PI control, PID control, lead / lag control) for specifying what action to take when the control value deviates from the set point.

[0037] One or more sensors may be included in or coupled to each processing station. These may be present in conjunction with the deep learning processor 118 (e.g. Figure 1The invention relates to physical or virtual sensors, analog or digital, in factory processes that are unrelated to the operation of the deep learning processor 118 (as shown), as well as any new sensors that can be added to perform any additional measurements required by the deep learning processor 118. Sensors can be used to measure values ​​generated by factory processes, such as: workstation values, control values, intermediate and final output values. Example sensors may include, but are not limited to: rotary encoders for detecting position and speed; sensors for detecting proximity, pressure, temperature, liquid level, flow, current and voltage; limit switches for detecting states (such as the presence or end of stroke limits). Sensors as used herein include both sensing devices and signal conditioning. For example, a sensing device reacts to a workstation value or a control value, and a signal conditioner converts the reaction into a signal that can be used and interpreted by a deep learning processor or a workstation controller. Examples of sensors that react to temperature are RTDs, thermocouples, and platinum resistance probes. Strain sensors react to pressure, vacuum, weight, distance changes, etc. Proximity sensors react to objects when they are within a certain distance from each other or within a specified distance. For all of these examples, the reaction must be converted into a signal that can be used by a workstation controller or a deep learning processor. In many cases, the sensor's signal conditioning function produces a digital signal that is interpreted by the station controller. Signal conditioners can also produce analog signals or TTL signals, etc. Virtual sensors (also called soft sensors, smart sensors, or estimators) include system models that are able to receive and process data from physical sensors.

[0038] As used herein, process values ​​refer to station values ​​or control values ​​that are aggregated or averaged over a whole series of stations (or a subset of stations) that are part of a factory process. Process values ​​may include, for example, total throughput time, total resources used, average temperature, average speed.

[0039] In addition to station and process values, various characteristics of the product output (i.e., intermediate output or final output) of the processing station can also be measured, such as: temperature, weight, product dimensions, mechanical, chemical, optical and / or electrical properties, number of design defects, presence or absence of defect types. The various characteristics that can be measured will generally be referred to as "intermediate output values" or "final output values." The intermediate / final output values ​​can reflect the characteristics of a single measurement of the intermediate / final output, or based on an overall score of a specified set of characteristics associated with the intermediate / final output measured and weighted according to a predefined formula.

[0040] Malware can be designed to disrupt the normal operation of the plant's process, equipment and control ("P / E / C") systems in a variety of ways. For example, malware executed on a computing device may cause a process controller to send control signals to its associated processing station to operate at a level that is harmful to the device itself or its output. In addition, such malware may cause control values ​​to fluctuate at harmful rates or in harmful increments. Further, a computing device executing malware or other malicious applications may provide false feedback to the process controller, so that the controller is unaware of the harmful conditions at the associated processing station and may not make the required adjustments. Malware can also be designed to target one or more sensors to manipulate or corrupt measurements generated by the plant's P / E / C system. Malware can also be designed to intercept or monitor data generated by the plant's P / E / C system or data communicated between components in the plant's P / E / C system (such as station processors, controllers, data processing servers, sensors). Because the plant's equipment and processes are controlled by control systems (e.g., PLCs, DCSs, SCADA), malware typically targets the plant's control system to affect the plant's processes and equipment.

[0041] To avoid being detected by any factory decoys (e.g., honeypots) set up to lure malware, the malware will search for specific identifiers associated with the target factory's control systems and test the expected responses of those systems. Only when the malware is satisfied that it has identified a real factory production controller will the malware unleash its attack.

[0042] Therefore, it is desirable to provide a new mechanism (referred to herein as a "smart honeypot") for intelligently simulating a plant's production control system and simulating response data similar to response data generated by the plant's processes, devices, and control systems during production in order to successfully attract malware attacks against these systems and analyze their behavior. As used herein, an emulator refers to hardware or software that mimics the exact behavior of another system and strictly adheres to the parameters and rules of the simulated system; a simulator refers to a computer program that can mimic the operation of another system in some respects, loosely adhering to other system rules and parameters. The smart honeypot may include: a conditioned deep learning processor 118 that has been trained based on a large amount of data from the plant's P / E / C system. In further embodiments, the deep learning processor may also be trained based on data from other plant's P / E / C systems and synthetic data. The smart honeypot may be coupled to an interface to receive external inputs and to expose the smart honeypot to malware attacks. A smart honeypot can be any device that is capable of executing commands, storing data, and inputting and outputting all signals associated with the actual process. Smart honeypots include computers, single-board computers, microprocessors, microcomputers, and microcomputer chip designs, etc.

[0043] A deep learning processor based on a machine learning (ML) or artificial intelligence (AI) model can be used to evaluate control values, station values, process values, data outputs, and / or intermediate and final output values ​​(collectively referred to as "response data"), and associated station controller set points, functional priors, empirical priors, and / or generic inputs to train the machine learning model to recognize any variation from typical plant control and operations. As will be appreciated by those skilled in the art, machine learning-based techniques can vary depending on the desired implementation without departing from the disclosed techniques. For example, machine learning techniques can utilize one or more of the following, alone or in combination: hidden Markov models; recursive neural networks; convolutional neural networks (CNNs); deep learning; Bayesian symbolic methods; reinforcement learning, general adversarial networks (GANs); support vector machines; image registration methods; long, short-term memory (LSTM); and the like.

[0044] The machine learning model can also be based on a clustering algorithm (e.g., a mini-batch K-means clustering algorithm), a recommendation algorithm (e.g., a Miniwise Hashing algorithm, or an Euclidean Locality-Sensitive Hashing (LSH) algorithm), and / or an anomaly detection algorithm (such as a Local outlier factor). The machine learning model can be based on supervised and / or unsupervised methods.

[0045] Figure 1 An example deep learning processor 118 is shown that can be configured to dynamically monitor the operation and control of any number (referred to herein as "N") of processing stations in a manufacturing process. Figure 1 , N processing stations of the fabrication process are represented by processing stations 122 and 142. The processing stations may operate in series or in parallel.

[0046] Set points, algorithms, initial inputs and operating instructions, system and process updates, and other control inputs to the station controllers 120 and 140 (steps 820 and 840, respectively) may be provided by a local or central data processing server 800. In some embodiments, the data processing server 800 may be one or more computers on a network. In some embodiments, steps 820 and 840 may be performed manually by an operator. In some embodiments, the data processing server 800 may also receive data outputs generated by the station controllers 120 and 140, as well as data generated by sensors coupled to the processing station 122 or 142, or by sensors within the processing station 122 or 142, or from independent sensors 127 and 137. Data outputs include, but are not limited to: (i) data generated during the manufacturing process (e.g., data logs coupled to physical sensors, processing station components, or station controller components); (ii) data received by or transmitted from each processing station or station controller; and (iii) data communications and data generation patterns (e.g., high data volume, low data volume, erratic data volume, unusual data communications, or data generation based on time of day, source or destination of the data) for a single or any number of processing stations or station controllers. In further embodiments, the data processing server 800 may receive all responsive data, such as in conjunction with Figure 2 In some embodiments, the data output may be provided to the deep learning processor 118 (step 830). In other embodiments, in order to isolate the deep learning processor 118, the data processing server will not provide any input to the deep learning processor 118. In some embodiments, the data processing server 800 may also receive data from related manufacturing processes occurring in remote geographic locations and provide such data to the deep learning processor 118. In further embodiments, data collected by the factory to perform analysis and analytical data (such as in a control room) may be collected by the data processing server 800. Figure 1 Not all data inputs to the data processing server 800 are shown.

[0047] The generic inputs 136, empirical priors 139, functional priors 138, and values ​​from each of the N stations (e.g., 122 and 142) may be provided to the deep learning processor 118. In other embodiments, any number of additional deep learning processors may be used and configured to train the deep learning processor 118 and the process simulator. In some embodiments, the generic inputs 136, empirical priors 139, functional priors 138 may include a spatial scan of the process controllers and other components of the plant's P / E / C system. The spatial scan may provide a source of product identification numbers and other information on the circuit board and may be combined or cross-referenced with information in the board log (bios).

[0048] As used herein, functional priors refer to information that is individually and collectively related to the functions and known limitations of each processing station in the manufacturing process. The specifications of the equipment used by the processing stations and all product models and identification information are considered functional priors. Example functional priors may include, but are not limited to: a screw-driven extruder having a minimum speed and a maximum speed at which the screw can rotate; a temperature control system having a maximum temperature and a minimum temperature that can be achieved based on its heating and cooling capabilities; a pressure vessel having a maximum pressure that it will contain before it explodes; a flammable liquid having a maximum temperature that can be reached before it burns. Functional priors may also include the order in which the various stations as part of the manufacturing process perform their functions. In addition, functional priors may include normal process variations and normal process noise. Normal process variations may include machine tolerances (e.g., temperature control variations + / -1 degree Celsius, conveyor speed variations + / -0.1 m / min, pressure variations + / -3 kPa); raw material variations, cooling water temperature variations, variations due to operator errors, and normal process noise may include, for example, jitter in electrical signals and rounding errors in data collection and recording.

[0049] As used herein, empirical priors refer to information obtained through previous experience, such as root cause analysis of defects or failures in the final output of the same or similar manufacturing process, operating the same or similar workstations, producing the same or similar intermediate / final outputs, manufacturing processes, and solutions. The empirical priors may also include log data from P / E / C systems of all factories, as well as data collected by the data processing server 800.

[0050] As used herein, generic inputs refer to values ​​that are not specific to a particular processing station, but rather to aspects of the entire manufacturing process (e.g., date, time of day, ambient temperature, humidity, or other environmental conditions that may affect the manufacturing process, operators, their skill level and the potential for error, raw materials used in the process, raw material specifications (such as color, viscosity, particle size, along with other characteristics specific to the raw materials), specific batches and costs of raw materials, age of equipment / tools at each station, identification information (such as production order number, batch number, lot, finished product number, finished product serial number)).

[0051] Note that the examples provided for each of the functional priors, empirical priors, and generic inputs represent one way to categorize these examples, and other suitable categorizations may be used. For example, another way to categorize the inputs provided to the deep learning processor 118 is: pre-process inputs (e.g., empirical priors, functional priors, material properties, scheduling requirements); in-process inputs (e.g., generic inputs, control values, station values, intermediate values, final output values, process values); post-process inputs (e.g., manufacturing performance metrics and other analyses). In addition, the functional priors and empirical priors may be dynamically updated throughout the manufacturing process.

[0052] Each processing station can be controlled by one or more associated station controllers (e.g., station controller 120 controls processing station 122, and station controller 140 controls processing station 142). In an embodiment, a single station controller can control multiple processing stations or control multiple control values ​​associated with a single processing station. In some embodiments, the deep learning processor 118 can provide control inputs (represented by 126 and 146) to each processing station controller based on predictive process control or pre-programmed algorithms. Predictive process control is described in U.S. Patent Application No. 16 / 663,245, entitled "Predictive Process Control for a Manufacturing Process", which is incorporated herein by reference in its entirety. In other embodiments, the deep learning processor does not provide any input to the station controller.

[0053] Signal conditioners 190, 191, 192, and 193 (e.g., signal separators, amplifiers, digital-to-analog converters, analog-to-digital converters, TTL) may be included to divide control signals (e.g., 121 is divided into 121a and 121b, 141 is divided into 141a and 141b) and control values ​​(e.g., 125 is divided into 125a and 125b, 145 is divided into 145a and 145b) so that both control signals and control values ​​are sent to the deep learning processor 118 and the associated station controller (e.g., 120 or 140). The control value may be an analog signal or a digital signal. Further, according to some embodiments, a signal conditioner may be included within the deep learning processor and may convert all analog values ​​into digital values ​​or perform other adjustments. Each station controller may provide one or more control signals (e.g., 121 and 141) that provide commands for adjusting the control value (e.g., control values ​​125 and 145) of the station. Each station outputs an intermediate output (e.g., 124 and 144) with intermediate output values ​​(134a and 144a, respectively). All intermediate output values ​​and the final output value (e.g., 144 if processing station 142 is the final processing station in the process) from the processing stations are provided to the deep learning processor 118. Each station also outputs a station value (e.g., 128 and 148) that can be provided to the deep learning processor 118. Figure 1 Also shown is that the intermediate output 124 is sent to one or more subsequent workstations (step 150), which may represent a single workstation or any number of multiple workstations. Figure 1 As shown, workstation 142 may receive intermediate inputs from any number of previous workstations (step 160). In some embodiments, setpoint values ​​used by workstation controllers (e.g., controllers 120 and 140) may be sent to deep learning controller 118. Further, values ​​related to the manufacturing process may be measured by independent sensors (e.g., independent sensors 127 and 137) and provided to deep learning controller 118.

[0054] It should be understood that the communication between the deep learning processor 118, the station controller, the processing station and the data processing server 800 can use any suitable communication technology, which provides the ability to communicate with one or more other devices and / or the ability to exchange data with a computer network. As an example, the communication technology implemented may include, but is not limited to: analog technology (e.g., relay logic), digital technology (e.g., RS232, Ethernet or wireless), network technology (e.g., local area network (LAN), wide area network (WAN), Internet, Bluetooth technology, near field communication technology, secure radio frequency technology) and / or any other suitable communication technology. In some embodiments, in order to isolate the deep learning processor 118 from being infected by any malware, the deep learning processor 118 may not receive any input from any process controller, data processing server 800 or from any computer connected to the network. In some embodiments, the input from the process controller or data processing server 800 can be manually entered into the deep learning processor 118, or entered via the memory device (e.g., thumb drive) after the memory device has been cleaned of any malware.

[0055] In some embodiments, operator input may be communicated to either the station controller or the processing station and / or the deep learning processor 118 using any suitable input device (e.g., keyboard, mouse, joystick, touch, touch screen, etc.).

[0056] According to some embodiments of the disclosed subject matter, Figure 2 A method 200 for adjusting (training) a machine learning model and creating a process simulator to be incorporated into a smart honeypot is provided. The method 200 may be performed by a control system or other computing system that may provide hardware and / or software configured to implement a deep learning processor 118. Figure 2 A P / E / C system of a plant is described. In some embodiments, a similar method can be used for a specific machine or process in a plant.

[0057] In step 205, the set points, algorithms, and other control inputs for each station controller in the manufacturing process may be initialized using conventional control methods. In addition, the control algorithm / operator may provide an initial control or station value. The control algorithm, initial set point value, and initial control or station value may be provided to the deep learning processor 118 (step 215). In other embodiments, the set points, algorithms, and other control inputs for each station controller in the manufacturing process may be provided to the station controller (step 245) using predictive process control as described in U.S. Patent Application No. 16 / 663,245 “Predictive Process Control for a Manufacturing Process”. It should be noted that the control values, control algorithms, set points, and any other information (e.g., process timing, device instructions, alarm alarms, emergency stops) provided to the station controller may be collectively referred to as “station controller inputs” or “control inputs”. Further, other inputs such as functional priors 138, empirical priors 139, and general inputs 136 may be provided to the deep learning processor 118.

[0058] In step 210, the manufacturing process traverses all processing stations using conventional or predictive process control methods within a predetermined time period and / or based on another suitable condition (e.g., creating a robust data set). The processing stations discussed herein can be operated in series or in parallel. In addition, a single station can: perform a single processing step multiple times (sequentially or non-sequentially), or perform different processing steps for a single iteration of the manufacturing process (sequentially or non-sequentially). The processing station generates an intermediate output or a final output (if the processing station is the final station). The intermediate output is transmitted to subsequent (downstream) stations in the manufacturing process until the final output is generated. In other embodiments, the manufacture of components for the final output can be asynchronous and geographically dispersed. In other words, the components for the final output can be manufactured at any time or any place, without having to be manufactured near the time or place where the components are assembled into the final output. For example, the headlights of a car can be manufactured several months before the car with the headlights is assembled.

[0059] As the process traverses each station, all values ​​associated with: a single station (e.g., control values); the output of a single station (e.g., station value, intermediate / final output value, data output), or multiple stations (e.g., process values) are measured or calculated, and all of these associated values ​​are provided to the deep learning processor 118 (steps 226, 227, 228, 229) to adjust the machine learning model. In some embodiments, manufacturing performance metrics for a manufacturing process under conventional control (e.g., production volume for a specified time period, production downtime for a specified time period, resources for a specified time period or a specified number of final outputs, percentage of non-conforming products for a specified time period, production volume of a specific operator, material costs associated with a specified number of final outputs) can be calculated and provided to the deep learning processor 118 (step 229).

[0060] Although not shown, any actions taken (or control signals generated) by the station controller in response to control values ​​or other control inputs received from the processing station may be provided to the deep learning processor 118. Such actions may include adjusting temperature, speed, etc.

[0061] Note that all inputs to the deep learning processor 118 may be entered electronically or manually by an operator. Further, inputs may be provided directly or indirectly via a memory device so that the memory device may be cleaned for any malware before providing data to the deep learning processor.

[0062] The adjustment of the machine learning model of the deep learning processor 118 (step 236-step 238) can be implemented by an unsupervised learning method. In addition to the functional prior 138, empirical prior 139, and universal input 136 input to the deep learning processor 118, the deep learning processor 118 simply draws inferences by analyzing the received data collected during the iteration of the manufacturing process (e.g., steps 226, 227, 228, and 229). In other embodiments, the adjustment of the machine learning model (steps 236-238) can be adjusted via a supervised learning method, or a combination of supervised and unsupervised methods, or a similar machine learning method. Further, the adjustment of the machine learning model can be enhanced by providing the deep learning processor 118 with simulated data or data from a similar manufacturing process. In one embodiment, the machine learning model can be adjusted by implementing the deep learning processor 118 in a similar manufacturing process and fine-tuning the deep learning processor during implementation in the target manufacturing process. That is, the training of the deep learning processor 118 can be performed using a training process performed before the deep learning processor 118 is deployed in the target manufacturing environment.

[0063] like Figure 2As shown, the deep learning processor 118 employs machine learning (ML) models (step 235). These machine learning models may be adjusted by analyzing factory operation and control data (step 236), generating behavioral pattern data for response data generated as the manufacturing process traverses the processing stations (step 237), and by determining normal process variation data and noise data (step 238).

[0064] The plant operation and control data (step 236) may include the following: (i) specific control values ​​corresponding to set points; (ii) other control values ​​(and their corresponding set points) generated by the identified process station; (iii) station values ​​generated by the identified process station; (iv) intermediate output values ​​generated by the identified process station; (v) control values ​​(and their corresponding set points), station values, intermediate and final outputs generated by other process stations; (vi) general inputs, functional priors, empirical priors; (vii) control signals and other instructions provided to each process station; (viii) control inputs provided to each station controller; (ix) data outputs; (x) measurements received from independent sensors related to plant control and operation. Independent sensors may refer to sensors that provide measurements in addition to sensors included in the normal manufacturing process. Because independent sensors are not part of the normal manufacturing process, they are generally protected from malware infiltration. In some embodiments, these independent sensors are not directly tied to a single machine or process step, and these independent sensors can be used to measure values ​​from any machine or process step (e.g., a handheld device randomly taking measurements during a manufacturing process). In some embodiments, in addition to or instead of the deep learning processor 118, the independent sensors can provide their output values ​​to a coupled monitor. According to some embodiments, the values ​​provided specifically to the monitor can be manually input into the deep learning processor 118.

[0065] Generating behavioral patterns (step 237) for response data for a single station and across stations, a single point in time, or over a period of time can include identifying: positive correlations; negative correlations; frequencies; amplitudes; upward or downward trends; rates of change for each control value or station value; for identified response data, other response data that will or will not be affected if the identified response data is changed. Response data 225 includes not only control values ​​associated with a particular set point for an identified process station, but also one or more of the following data types: (i) control values ​​associated with other set points for the identified process station; (ii) station values ​​associated with the identified process station; (iii) intermediate output values ​​associated with the identified process station; (iv) control values ​​associated with other process stations; (v) station values ​​associated with other process stations; (vi) intermediate output values ​​associated with other process stations; (vii) final output values; (viii) data outputs; (ix) measurements received from independent sensors related to plant control and operation.

[0066] Note that data is typically collected from the sensors at a predetermined rate. The frequency analysis can take this rate into account and adjust its output value accordingly so that the output value reflects the true frequency rate and does not reflect a rate that includes the time it takes to collect data from the sensors. In some embodiments, the frequency analysis can also show rapid changes in the control value after a ramp-up or ramp-down period and a brief stabilization period. The stabilization period may be so brief that it is barely noticeable. This may be an example of an attack. Instead of a control value that is stable at a high or low point, a malicious signal may be provided to keep increasing or decreasing the control value beyond an acceptable high or low point. By increasing or decreasing shortly after stabilization, the attack can appear normal and consistent with a previous increase or decrease in the control value.

[0067] Based on the analysis: plant operation and control data (step 235), generated behavior pattern data (step 236), and other inputs to the deep learning processor, the deep learning processor 118 can determine normal process variations and normal process noise to further adjust its machine learning model. Normal process variations may include machine tolerances (e.g., temperature control variations + / -1 degree Celsius, conveyor speed variations + / -0.1m / min, pressure variations + / -3kPa); raw material variations, cooling water temperature variations, variations due to operator errors, and normal process noise may include, for example, jitter in electrical signals and rounding errors in data collection and recording.

[0068] To create a robust data set for tuning the machine learning model, the set point (or other control input) corresponding to each control value for each process station may be adjusted in a systematic manner (e.g., from minimum to maximum) for each value (or subset of values) that will produce a final output within specification. In further embodiments, the set point (or other control input) corresponding to each control value for each process station may be adjusted in a systematic manner (e.g., from minimum to maximum) for each value (or subset of values) that each process station is capable of operating (i.e., the entire range of values ​​that a process station is capable of operating, not just the range that will produce a final output within specification). Further, for training purposes, any number and any combination of set points may be adjusted (step 205). The set points (or other control inputs) may be adjusted manually, either by a pre-programmed algorithm, or by predictive process control.

[0069] In some embodiments, one or more set points (or other control inputs) may be adjusted to values ​​that would occur during known plant disruptions (e.g., wear and tear of machinery, insertion of faulty components) that are not associated with a malware attack, even if those values ​​produce a final output that is not within specification.

[0070] In some embodiments, the deep learning processor 118 may be implemented with a conventional standard process control system associated with the operation and control of a plant process. Instead of using all data associated with the operation and control of a plant process, the deep learning processor 118 may train its machine learning algorithm using the same data provided to any standard process control system used in the operation and control of a plant process.

[0071] For each set point adjustment or set of set point adjustments (step 205), the manufacturing process may traverse the processing stations (step 210) at predetermined time periods, for predetermined set point adjustments, and / or when defined events (e.g., collecting a predefined amount of response data) occur, and provide the set points (step 215) and generated response data 225 (e.g., station values ​​and control values ​​(step 228), intermediate and final output values ​​(step 227), data outputs (step 226), process values, and manufacturing performance metrics (step 229)) to the deep learning processor 118. The deep learning processor 118 uses the different inputs received as the manufacturing process traverses the processing stations to adjust its machine learning model (steps 236-238).

[0072] After method 200 has completed traversing the processing stations (e.g., after a predetermined time period, after a predetermined set of setpoints are adjusted, and / or when a defined event occurs (e.g., generating a robust data set)), the adjustment of the machine learning model (steps 236-238) can be considered complete, and a process simulator can be created (step 239) that can simulate response data that accurately reflects the response data from the plant's production P / E / C system. Using a machine learning model to create a process simulator that can dynamically simulate production response data is more likely to deceive a sophisticated malware attack that the smart honeypot is a plant production system rather than a decoy.

[0073] The deep learning processor 118 with the tuned machine learning model and process simulator may be deployed to a smart honeypot (step 241). Figure 3 An example smart honeypot is shown in . According to some embodiments, the deep learning processor 118 is disconnected from any production system, can be cleaned of any malware, and incorporated into the smart honeypot. In other embodiments, the smart honeypot has its own deep learning processor, and only the adjusted machine learning model and the created process simulator (cleaned of any malware) are uploaded to the deep learning processor included in the smart honeypot.

[0074] Figure 2B An example behavior pattern for a subset of the response data is shown. The response data may be empirically derived by actually adjusting the set points associated with the processing stations, such as in combination with Figure 2 As described. The x-axis represents the set point value of station X, and the y-axis represents the response data value. The different lines shown in the curve chart 302 represent the normal behavior pattern of the response data of the value associated with station X, and the behavior pattern of the response data of the value associated with another station (station Y). In this example, the set points increasing along the x-axis represent speed. The response data shown in the curve chart 302 include: for station X: the control value 325 associated with the increasing set point (i.e., representing speed); the independent control value 323 that can represent power, for example; the station value 328 that can represent viscosity; and the intermediate output value 334 that can represent diameter. As shown in the curve chart 302, the response data of station Y includes the station value 348 and the final output value 344, the station value 348 can represent temperature, and the final output value 344 can represent weight. Figure 2The amplitude of each response is shown. It also shows how the response data behaves as the set point for speed increases: power at station increases (as represented by 323), diameter increases (as represented by 334), and viscosity decreases (as represented by 328). A change in the set point for station X also affects station Y, for example, an increase in temperature at station Y (as represented by 348) and an increase in weight (as represented by 344). The behavioral patterns can be quite complex, involving thousands of data points across different stations, and identifying unusual behavioral patterns cannot be performed by manual calculations. Therefore, machine learning analysis is needed to generate or learn behavioral patterns in the response data, and analyze those behavioral patterns for abnormal activity.

[0075] Figure 3 An example smart honeypot 300 is shown according to some embodiments. The smart honeypot includes a regulated deep learning processor 318, such as in combination with Figure 2 As described, the adjusted deep learning processor 318 has been trained over a predetermined time period or based on another suitable criterion. The smart honeypot is not connected to the factory production P / E / C system. In some embodiments, the deep learning processor may periodically receive updated data from the factory's production P / E / C system. In order to ensure that the updated data does not introduce malware - whether from the factory's production P / E / C system to the smart honeypot or from the smart honeypot to the factory's production P / E / C system, the smart honeypot is not updated directly from the factory's production P / E / C system. Instead, the data may first be uploaded to a memory device (e.g., a thumb drive), cleared of all malware, and then provided to the deep learning processor 318.

[0076] The deep learning processor 318 includes (e.g., in combination with Figure 2 A trained process simulator as described herein can be configured to receive control signals from a process controller or simulator and to generate simulated response data in response to similar control signals, the simulated response data being similar to response data generated in production during operation and control of the plant's P / E / C system.

[0077] The trained model of the deep learning processor 318 and the process simulator can be in continuous two-way communication with each other. Part of the smart honeypot is also one or more process controllers, which can be programmed to generate control signals similar to those generated by the process controller during the operation of the P / E / C system of the factory. The process controller can be a PLC or other process controller of the same type used in the production P / E / C system of the factory, or the process controller can be a simulated process controller (collectively referred to as a "controller simulator"). The actual or simulated process controller can be coupled to the deep learning processor 318 (as represented by 310) to provide control signals to the process simulator and receive control values ​​from the process simulator. A simulator refers to hardware or software that mimics the exact behavior of the system it simulates and strictly adheres to the parameters and rules of the simulated system. The simulator will include all identification information from the log (bios) serial number, model, manufacturing date or other related to the system being simulated.

[0078] Further, the smart honeypot 300 is coupled to an interface that allows the smart honeypot (via a process controller or controller emulator) to connect to a network technology (e.g., a local area network (LAN), a wide area network (WAN), the Internet, Bluetooth technology, near field communication technology, secure radio frequency technology, and / or any other suitable communication technology) or a data device (e.g., a thumb drive, a flash drive, a USB drive) to receive input. The interface may expose the smart honeypot to malware attacks.

[0079] Figure 4 shows a method for implementing (such as Figure 3 Example method 400 of a smart honeypot described in .

[0080] In step 1, the controller emulator may receive external input from an interface coupled to a network technology or other data device. In some embodiments, malware attacks may be introduced into the smart honeypot via external input.

[0081] In step 2, the simulation process is activated. The process simulator can run at a predetermined time or when a predefined event occurs.

[0082] In step 3, the controller simulator outputs one or more control signals to the process simulator and the deep learning processor.

[0083] At step 4, the process simulator receives one or more control signals and simulates response data including control values. The process simulator outputs the control values ​​to the controller emulator and outputs the simulated response data to the deep learning processor.

[0084] In step 5, the deep learning processor employs the conditioned machine learning model and analyzes the control signal received from the controller simulator to predict and generate expected response data and behavior pattern data. Based on the understanding of the plant operation and control data and the correlation of such data with specific control signals, the deep learning processor can predict the expected response data and corresponding behavior pattern for the received control signal.

[0085] In step 6, the deep learning processor generates actual behavior pattern data based on the received simulation data, and compares the simulated response data with the expected response data and / or compares the actual behavior pattern data with the expected behavior pattern data. The actual behavior pattern data refers to the behavior pattern data generated for the received simulation response data, and the actual behavior pattern data is distinguished from the expected behavior pattern data based on the predicted response data.

[0086] By incorporating the conditioned machine learning model into the deep learning processor 318, such as incorporating Figure 2 As discussed, including (1) capturing extensive and diverse data across the P / E / C system of the plant during production and (2) analyzing changes and normal process variations and noise data in the P / E / C system of the plant during operation of the plant, and how the components in the P / E / C system respond to those changes and variations, the deep learning processor 318 can learn to identify any deviations in the simulated response data and actual behavior pattern data, even minor deviations from expected response data and behavior patterns in a single component or across many components in the P / E / C system of the plant. The deep learning processor 318 can identify abnormal activity and malware attacks, and generate a confidence level (step 7). In some aspects, the confidence level can be expressed as a numerical probability of the accuracy of the prediction, and in other aspects, the confidence level can be expressed as an interval or probability range.

[0087] An operator or algorithm may assign a threshold to the confidence level associated with the abnormal activity, and may also determine the type of abnormal activity based on the generated confidence level. Based on the type of abnormal activity, one or more operations (referred to herein as "alarm protocols") are run to resolve the abnormal activity (step 8). For example, for abnormal activities that receive high confidence level scores, an alarm protocol may be initiated by the deep learning processor 318 and transmitted to the controller simulator to run the initiated alarm protocol, while for abnormal activities that receive lower confidence level scores, an operator may be prompted to view the abnormal activity before initiating the alarm protocol. In one embodiment, the confidence level may be divided into three intervals: high, medium, and low, and a threshold may be assigned to each interval. Further, an action to be performed may be assigned to each interval. For example, for confidence levels that fall within a high confidence interval, an alarm protocol may be initiated; for confidence levels that fall within a medium confidence interval, an operator may be prompted to view abnormal activities; for confidence levels that fall within a low confidence level interval, abnormal activities may be marked and occasionally checked. Thresholds and interval ranges may be viewed and adjusted to minimize false positives or false negatives. In other embodiments, the confidence level may be divided into two or more intervals.

[0088] In some embodiments, different alarm protocols can be assigned to different intervals. For example, if the abnormal activity has a confidence level corresponding to a high interval, the alarm protocol can trigger strong actions, such as shutting down the P / E / C system of the associated plant that may be at risk, or in some cases shutting down a smart honeypot. However, if the abnormal activity has a confidence level corresponding to a lower interval, the alarm protocol can trigger a milder action, such as generating a report, email, or other notification. In another embodiment, different alarm protocols can be assigned to different types of abnormalities detected that meet a predefined confidence level threshold. The initiated alarm protocol can be a set of actions designed to compensate for or correct the type of abnormal activity detected.

[0089] The alarm protocol can be mechanical (e.g., an alarm signal is sent through a siren, flashing light, or other indicator), digital (e.g., printing a report, sending an email to a supervisor, notifying a control panel), functional (e.g., stopping any or all processes or controller simulators, adjusting the settings of the process simulator or controller simulator), or any combination of the above. The alarm protocol can be initiated by the deep learning processor 318 and transmitted to the controller simulator to run the alarm protocol. The functional protocol can be implemented by communication with the controller simulator (e.g., sending a control signal to the process simulator). The protocol can be a digital activation of a single relay, controlled by other programmable commands, TTL logic, or ladder logic that communicates with an external device (such as a station controller, PLC, or other). The protocol and command structure are incorporated into the deep learning processor 318. The deep learning processor 318 may include programming to allow any of these. In some embodiments, input to the deep learning processor 318 can be performed via manual input via keyboard input. This helps maintain the integrity of the deep learning processor 318. In other embodiments, digital input such as using a thumb drive or network connection may also be allowed.

[0090] Further, the deep learning processor 318 can identify whether the abnormal activity is a malware attack, and the confidence level of its identification. For example, when the behavior pattern data indicates a significant, sudden, rapid or unexpected change in the response data that is different from the expected behavior data. In one embodiment, the deep learning processor 318 can analyze whether the behavior pattern data is consistent with the behavior pattern data for known destructive activities that are not malware attacks. In some embodiments, the deep learning processor 318 uses data output generated during the manufacturing process and / or data from the data logging module to determine whether the abnormal activity is caused by an attack or by some other failure (e.g., the materials used are defective, a defective component is installed).

[0091] An operator or algorithm may assign a threshold to the confidence level associated with an activity identified as a malware attack, and may predefine actions to be initiated when the threshold is met (referred to herein as an "alert protocol"). For example, for a detected malware attack that receives a high confidence level score, an alert protocol may be initiated by the deep learning processor 318 and transmitted to the controller simulator to run the alert protocol, while for a detected malware attack that receives a lower confidence level score, an operator may be prompted to view the detected malware attack before initiating the alert protocol. In one embodiment, the confidence level may be divided into three intervals: high, medium, and low, and a threshold may be assigned to each interval. In other embodiments, the confidence level may be divided into two or more intervals. Further, actions to be performed may be assigned to each interval. For example, for a confidence level that falls within a high confidence interval, an alert protocol may be initiated; for a confidence level that falls within a medium confidence interval, an operator may be prompted to view the detected malware attack; for a confidence level that falls within a low confidence level interval, the detected malware attack may be marked and occasionally checked. Thresholds and ranges can be viewed and adjusted to minimize false positives or negatives.

[0092] In some embodiments, different alarm protocols may be assigned to different intervals. For example, if the detected malware attack has a confidence level corresponding to a high interval, the alarm protocol may trigger a strong action, such as shutting down the P / E / C system of the associated plant that may be at risk, or in some cases shutting down the smart honeypot itself. However, if the detected malware attack has a confidence level corresponding to a lower interval, the alarm protocol may trigger a more gentle action, such as generating a report, an email, or other notifications that can identify the malware attack and suggest immediate corrective actions to combat the attack. In another embodiment, different alarm protocols may be assigned to different types of malware attacks detected that meet a predefined confidence level threshold, and when the detected attack exceeds the predefined confidence level, the appropriate alarm protocol is initiated by the deep learning processor 318 for the detected attack. The alarm protocol may be a set of actions designed to compensate for or correct the type of malware attack detected.

[0093] In some embodiments, when the confidence level exceeds a predefined limit indicating a malware attack, the deep learning processor 1318 can automatically run a generative adversarial network or a second artificial intelligence model (collectively referred to as a confirmation test) to confirm or reject the attack. If the confirmation test is confirmed, the malware attack level can be raised to the highest alert. If the confirmation test is rejected, the confidence level of the original model can be assumed and the confidence level can be restored to the second highest alert level. As previously indicated, a separate alert protocol can be specified for each alert level.

[0094] In some embodiments, the deep learning processor 318 can be configured to communicate with an existing IT security system to notify the system of abnormal activity. In another embodiment, the deep learning processor 318 can be configured to communicate with a data logging module. Such communication can provide an alert specifying the exact source of the malware attack, and can also be used to reconfigure firewalls and other IT infrastructure to better defend factory processes and devices. In some embodiments, the deep learning processor 318 can be configured to communicate with a computer system in the factory's production P / E / C system to execute an alarm protocol to correct vulnerabilities or anomalies to divert or offset the identified malware attack and / or shut down one or more of the factory's production P / E / C systems.

[0095] The machine learning model of the deep learning processor 318 may continue to be adjusted through the operation of the smart honeypot 300 .

[0096] Figure 5 An example data logging and output module 510 is shown, which can be configured to receive data from the deep learning processor 318 and the data processing server 800 to analyze the data and generate reports, emails, alarms, log files, or other data compilations (step 515). For example, the data logging module 510 can be programmed to search the received data for predefined triggering events and generate reports, emails, alarms, log files, updates to monitoring panels, or other data compilations showing relevant data associated with these triggering events (step 515). For example, the identification of abnormal activity can be defined as a triggering event, and the following data can be reported: behavioral patterns of response data compared to expected behavioral patterns; workstations, controllers, or sensors affected by abnormal activity; sensors that generated triggering events; identification of specific response data that was not expected; the date and time when the abnormal activity occurred; the confidence level associated with the triggering event; the impact of the abnormal activity on other workstations and intermediate or final outputs. Other suitable triggers can be defined, and other suitable data can be reported. In some embodiments, the data logging module 510 can be included in the deep learning processor 118. In some embodiments, as combined Figure 2 and Figure 4 The data from the data logging module in question may be provided to the deep learning processor 118 as part of the response data, or to initiate an alert protocol.

[0097] like Figure 6As shown in , the deep learning processor 118 may include a processing unit (e.g., a CPU and / or processor) 610 and a bus 605 that couples various system components including a system memory 615 (such as a read-only memory (ROM) 620 and a random access memory (RAM) 625) to the processing unit 610. The processing unit 610 may include one or more processors, such as processors from the Motorola microprocessor family or the MIPS microprocessor family. In alternative embodiments, the processing unit 610 may be specially designed hardware for controlling the operation of the deep learning processor 118 and performing predictive process control. When operating under the control of appropriate software or firmware, the processing module 610 can perform the various machine learning algorithms and calculations described herein.

[0098] Memory 615 may include various memory types with different performance characteristics, such as memory cache 612. Processor 610 may be coupled to storage device 630, which may be configured to store software and instructions required to implement one or more functional modules and / or database systems. Each of these modules and / or database systems may be configured to control processor 610 as well as a dedicated processor, where the software instructions are incorporated into the actual processor design.

[0099] To enable the operator to interact deeply with the learning processor, the input device 645 can represent any number of input mechanisms, such as a microphone for voice, a touch-sensitive screen for gesture or graphic input, a keyboard, a mouse, motion input, and the like. The output device 635 can also be one or more of a plurality of output mechanisms known to those skilled in the art (e.g., a printer, a monitor). In some cases, a multi-mode system can enable an operator to provide multiple types of input to communicate with the deep learning processor. The communication interface 640 can generally govern and manage operator input and system output, as well as all electronic inputs received and sent to other components as part of the manufacturing process (such as station controllers, processing stations, data logging modules, and all associated sensors and image capture devices). There is no limitation on the operation on any particular hardware device, so the basic features here can easily replace improved hardware or firmware devices as they are developed. The data output from the deep learning processor can be generated, visually displayed or printed in the form of a file, and can be stored in the storage device 630 or transmitted to other components for further processing.

[0100] The communication interface 640 may be provided as an interface card (sometimes referred to as a "line card"). Typically, they control the sending and receiving of data packets through the network, and sometimes support other peripheral devices used with the router. Interfaces that may be provided include Ethernet interfaces, frame relay interfaces, cable interfaces, DSL interfaces, token ring interfaces, and the like. In addition, various ultra-high-speed interfaces such as fast token ring interfaces, wireless interfaces, Ethernet interfaces, Gigabit Ethernet interfaces, ATM interfaces, HSSI interfaces, POS interfaces, FDDI interfaces, and the like may be provided. Typically, these interfaces may include ports suitable for communicating with appropriate media. In some cases, they may also include independent processors, including volatile RAM in some cases. Independent processors may control communication-intensive tasks such as packet switching, media control, and management. By providing separate processors for communication-intensive tasks, these interfaces allow the processing unit 610 to effectively perform machine learning and other calculations necessary to achieve predictive process control. The communication interface 640 may be configured to communicate with other components that are part of the manufacturing process (such as station controllers, processing stations, data logging modules, and all associated sensors and image capture devices).

[0101] In some embodiments, the deep learning processor may include an imaging processing device 670 that processes images received by various image capture devices (such as cameras) that are coupled to one or more processing stations and are capable of monitoring and capturing images of intermediate and final outputs. These images may be transmitted to the deep learning processor via the communication interface 640 and processed by the image processing device 670. The images may be processed to provide data such as the number and type of defects, output size, throughput, which may be used by the deep learning processor to calculate intermediate and final output values. In some embodiments, the image processing device may be external to the deep learning processor and provide information to the deep learning processor via the communication interface 640.

[0102] The storage device 630 is a non-temporary memory and may be a hard disk or other type of computer-readable medium that can store data accessible by a computer, such as a magnetic tape, a flash memory card, a solid-state memory device, a digital versatile disk, a cassette, a random access memory (RAM) 625, a read-only memory (ROM) 620, and hybrids thereof.

[0103] In practice, the storage device 630 may be configured to receive, store, and update input data to and output data from the deep learning processor, such as functional priors, empirical priors, general inputs; pre-processed inputs; in-process inputs, and post-processed inputs.

[0104] In some embodiments, in addition to a communication interface coupled to an interface that allows the smart honeypot (via a process controller or controller emulator) to connect to a network technology (e.g., a local area network (LAN), a wide area network (WAN), the Internet, Bluetooth technology, near field communication technology, secure radio frequency technology, and / or any other suitable communication technology) or a data device (e.g., a thumb drive, a flash drive, a USB drive) to receive input, the deep learning processor 318 may include Figure 6 The same components for deep learning processor 118 shown in FIG. 1 are used. The interface may expose the smart honeypot to malware attacks. Further, the communication interface is not coupled to any manufacturing process components.

[0105] In some embodiments, any suitable computer-readable medium may be used to store instructions for performing the functions and / or processes described herein. For example, in some embodiments, the computer-readable medium may be temporary or non-temporary. For example, a non-temporary computer-readable medium may include a medium such as a non-temporary magnetic medium (such as a hard disk, a floppy disk, etc.), a non-temporary optical medium (such as a compact disk, a digital video disk, a Blu-ray disk, etc.), a non-temporary semiconductor medium (such as a flash memory, an electrically programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc.), any suitable medium that is not transient or has any permanent appearance during transmission, and / or any suitable tangible medium. As another example, a temporary computer-readable medium may include a signal on a network, in a wire, a conductor, an optical fiber, a circuit, and any suitable medium that is transient and does not have any permanent appearance during transmission, and / or any suitable intangible medium.

[0106] Various systems, methods and computer-readable media described herein can be implemented as part of a cloud network environment. As used herein, a cloud-based computing system is a system that provides virtualized computing resources, software and / or information to client devices. Computing resources, software and / or information can be virtualized by maintaining centralized services and resources, and edge devices can access centralized services and resources through communication interfaces (such as networks). The cloud can provide various cloud computing services via cloud elements, such as software as a service (SaaS) (e.g., collaboration services, email services, enterprise resource planning services, content services, communication services, etc.), infrastructure as a service (IaaS) (e.g., security services, networking services, system management services, etc.), platform as a service (PaaS) (e.g., web services, streaming services, application development services, etc.) and other types of services (such as desktop as a service (DaaS), information technology management as a service (ITaaS), management software as a service (MSaaS), mobile backend as a service (MBaaS), etc.).

[0107] The provision of examples described herein (and clauses with phrases such as "such as," "for example," "including," etc.) should not be construed as limiting the claimed subject matter to the specific examples; rather, these examples are intended to illustrate only some of the many possible aspects. One of ordinary skill in the art will understand that the term mechanism may encompass hardware, software, firmware, or any suitable combination thereof.

[0108] Unless otherwise specifically noted, as is apparent from the above discussion, it should be understood that throughout the description, discussions utilizing terms such as "determining," "providing," "identifying," "comparing," and the like refer to actions and processes of a computer system or similar electronic computing device that manipulates and transforms data represented as physical (electronic) quantities within a computer system memory or register or other such information storage, transmission, or display device. Certain aspects of the present disclosure include processing steps and instructions described herein in the form of algorithms. It should be noted that the processing steps and instructions of the present disclosure may be implemented in software, firmware, or hardware, and when implemented in software, may be downloaded to reside on and operate from different platforms used by a real-time network operating system.

[0109] The present disclosure also relates to a device for performing the operations herein. The device may be specially constructed for the desired purpose, or it may include a general-purpose computer selectively activated or reconfigured by a computer program stored on a computer-readable medium, which may be accessed by a computer. Such a computer program may be stored in a computer-readable storage medium, such as, but not limited to, any type of disk (including a floppy disk, an optical disk, a CD-ROM, a magneto-optical disk, a read-only memory (ROM), a random access memory (RAM), an EPROM, an EEPROM, a magnetic card or an optical card, an application-specific integrated circuit (ASIC), or any type of non-transient computer-readable storage medium suitable for storing electronic instructions). In addition, the computer mentioned in this specification may include a single processor or may be an architecture that uses multiple processors to increase computing power.

[0110] The algorithms and operations presented herein are not inherently related to any particular computer or other device. According to the teachings herein, various general-purpose systems can also be used together with programs, or it can be proved that it is convenient to construct more specialized devices to perform the required method steps and system-related actions. For those skilled in the art, the required structures of various these systems and equivalent variations will be apparent. In addition, the present disclosure is not described with reference to any specific programming language. It should be understood that various programming languages ​​can be used to implement the teachings of the present disclosure as described herein, and any reference to a specific language is provided for the disclosure of the enabling and best mode of the present disclosure.

[0111] The logical operations of the various embodiments are implemented as: (1) a sequence of computer-implemented steps, operations, or processes running on programmable circuits within a general-purpose computer, (2) a sequence of computer-implemented steps, operations, or processes running on special-purpose programmable circuits; and / or (3) interconnected machine modules or program engines within programmable circuits. The system may implement all or part of the method, may be part of a system, and / or may operate according to instructions in a non-transitory computer-readable storage medium. Such logical operations may be implemented as modules configured to control a processor to perform specific functions according to the programming of the modules.

[0112] It should be understood that any specific order or hierarchy of steps in the disclosed process is an illustration of an exemplary method. It is to be understood that the specific order or hierarchy of steps in the process can be rearranged based on design preferences, or only a portion of the steps shown can be performed. Some of these steps can be performed simultaneously. For example, in some cases, multitasking and parallel processing may be advantageous. In addition, the separation of various system components in the above-mentioned embodiments should not be understood as requiring such separation in all embodiments, but it should be understood that the described program components and systems can generally be integrated in a single software product or packaged into multiple software products. The apparatus, method and system for intelligently simulating plant control systems and simulating response data have been described in detail with specific reference to these illustrated embodiments. However, it will be apparent that various modifications and changes can be made within the spirit and scope of the present disclosure as described in the foregoing specification, and such modifications and changes will be considered equivalents and parts of the present disclosure.

Claims

1. A computer-implemented method comprising: Initiating a smart honeypot executing on a computing device, the smart honeypot comprising a controller emulator, a process simulator, and a deep learning processor, the controller emulator being configured to mimic the behavior of the manufacturing system by complying with parameters and rules of the manufacturing system; receiving, by the controller emulator, an external input from an interface coupled to a remote data device, the external input comprising an indication of a malware attack; providing generation of one or more control signals based on the external input by the controller emulator coupled to the interface; providing the one or more control signals to the process simulator and the deep learning processor by the controller simulator, the process simulator being configured to generate simulated response data similar to response data generated by the manufacturing system during an operating process, wherein the interface exposes the controller simulator to inputs from an external source; In response to receiving the one or more control signals, simulating generation of simulated response data by the process simulator based on the one or more control signals, the simulated response data being provided to the deep learning processor; generating, by the deep learning processor, expected response data and expected behavior pattern data based on the one or more control signals; generating, by the deep learning processor, actual behavior pattern data based on the simulated response data; comparing at least one of: (i) the simulated response data to the expected response data, and (ii) the actual behavior pattern data to the expected behavior pattern data to determine whether abnormal activity is detected; as well as As a result of detecting the abnormal activity, one or more operations are performed to resolve the abnormal activity.

2. The computer-implemented method of claim 1 , wherein: The deep learning processor includes a conditioned machine learning model.

3. The computer-implemented method of claim 1 , wherein: The simulated response data includes control values, which are provided to the controller simulator.

4. The computer-implemented method of claim 1 , wherein: The one or more operations include shutting down one or more plant processes, equipment, and control (P / E / C) systems at risk due to the abnormal activity.

5. The computer-implemented method of claim 1 , wherein: The one or more operations include generating a notification, wherein the notification specifies the unusual activity, wherein the notification is provided to an operator to review the unusual activity.

6. The computer-implemented method of claim 1 , wherein: The abnormal activity is detected due to a comparison of the simulated response data with the expected response data indicating a deviation.

7. The computer-implemented method of claim 1 , wherein: The abnormal activity is detected due to a comparison of the actual behavior pattern data with the expected behavior pattern data indicating a deviation.

8. The computer-implemented method of claim 1 , wherein: The one or more operations include determining whether the abnormal activity is a malware attack received by the controller emulator from the interface, wherein a determination that the abnormal activity is the malware attack is generated because a confidence level score of the abnormal activity satisfies a confidence level threshold corresponding to detection of the malware attack.

9. A system comprising: one or more processors; as well as a memory having instructions stored thereon, the instructions, when executed by the one or more processors, causing the system to: Initiating a smart honeypot executing on the system, the smart honeypot comprising a controller emulator, a process simulator, and a deep learning processor, the controller emulator being configured to mimic the behavior of the manufacturing system by complying with parameters and rules of the manufacturing system; receiving, by the controller emulator, an external input from an interface coupled to a remote data device, the external input comprising an indication of a malware attack; receiving one or more control signals generated by the controller emulator coupled to an interface based on the external input, wherein the interface exposes the controller emulator to inputs from an external source; providing, by the controller emulator, the one or more control signals to the process simulator and the deep learning processor, the process simulator being configured to generate simulated response data similar to response data generated by the manufacturing system during an operating process; In response to receiving the one or more control signals, simulating generation by the process simulator of simulated response data based on the one or more control signals, the simulated response data comprising a control value; generating, by the deep learning processor, expected response data and expected behavior pattern data based on the one or more control signals; generating, by the deep learning processor, actual behavior pattern data based on the simulated response data, wherein the actual behavior pattern data is generated using the simulated response data; comparing at least one of: (i) the simulated response data to the expected response data, and (ii) the actual behavior pattern data to the expected behavior pattern data to determine whether abnormal activity is detected; as well as As a result of detecting the abnormal activity, one or more operations are performed to resolve the abnormal activity.

10. The system according to claim 9, wherein: The one or more processors include a conditioned machine learning model.

11. The system according to claim 9, wherein: The one or more operations include transmitting an alarm protocol to cause the controller emulator to shut down one or more plant process, equipment, and control (P / E / C) systems at risk due to the abnormal activity.

12. The system according to claim 9, wherein: The instructions causing the one or more processors to perform the one or more operations to resolve the abnormal activity further cause the system to: Based on the detected abnormal activity, determining a confidence level associated with the abnormal activity; and Based on the confidence level, the one or more operations are identified.

13. The system according to claim 12, wherein: The one or more operations include determining whether the abnormal activity is a malware attack received by the controller emulator from the interface, wherein a determination that the abnormal activity is the malware attack is generated because the confidence level satisfies a confidence level threshold corresponding to detecting the malware attack.

14. The system according to claim 9, wherein: The one or more operations include generating a notification, wherein the notification specifies the unusual activity, wherein the notification is provided to an operator to review the unusual activity.

15. The system according to claim 9, wherein: The abnormal activity is detected due to a comparison of the simulated response data indicating a deviation with the expected response data indicating a deviation.

16. The system of claim 9, wherein: The abnormal activity is detected due to a comparison of the actual behavior pattern data with the expected behavior pattern data indicating a deviation.

17. A non-transitory computer-readable storage medium having executable instructions stored thereon, wherein the executable instructions, when executed by a computer system, cause the computer system to: Initiating a smart honeypot executing on the computer system, the smart honeypot comprising a controller emulator, a process simulator, and a deep learning processor, the controller emulator being configured to mimic the behavior of the manufacturing system by complying with parameters and rules of the manufacturing system; receiving, by the controller emulator, an external input from an interface coupled to a remote data device, the external input comprising an indication of a malware attack; receiving one or more control signals generated by the controller emulator coupled to an interface based on the external input, wherein the interface exposes the controller emulator to inputs from an external source; providing, by the controller emulator, the one or more control signals to the process simulator and the deep learning processor, the process simulator being configured to generate simulated response data similar to response data generated by the manufacturing system during an operating process; In response to receiving the one or more control signals, simulating generation by the process simulator of simulated response data based on the one or more control signals, the simulated response data comprising a control value; generating, by the deep learning processor, expected response data and expected behavior pattern data based on the one or more control signals; generating, by the deep learning processor, actual behavior pattern data based on the simulated response data, wherein the actual behavior pattern data is generated using the simulated response data; comparing at least one of: (i) the simulated response data to the expected response data, and (ii) the actual behavior pattern data to the expected behavior pattern data to determine whether abnormal activity is detected; as well as As a result of detecting the abnormal activity, one or more operations are performed to resolve the abnormal activity.

18. The non-transitory computer-readable storage medium of claim 17, wherein: The one or more operations include: Identify the type of unusual activity detected; and A set of actions is performed to compensate for the type of abnormal activity detected.

19. The non-transitory computer-readable storage medium of claim 17, wherein: The one or more operations include: determining whether the abnormal activity is a malware attack received by the controller emulator from the interface; and Since the abnormal activity is a determination of the malware attack, an alert protocol is transmitted to cause the controller emulator to shut down one or more plant process, equipment, and control (P / E / C) systems that are at risk due to the malware attack.

20. The non-transitory computer-readable storage medium of claim 17, wherein: The one or more operations include generating a notification, wherein the notification specifies the unusual activity, wherein the notification is provided to an operator to review the unusual activity.

Images