Network traffic emulation for the preparation of a monitoring system to combat the effects of improper network traffic

Abstract

Disclosed are an emulation method and a system for preparing a monitoring device for monitoring a network. A system processor correlates a first set of transmissions across a network of a monitored system with a first set of responses from a first control routine logic executed in a first monitored device of the monitored system. The monitored system controls an industrial process carried out in an external system coupled to the monitored system. The system processor adjusts a first parameter that influences the execution speed of the first control routine logic within a first emulation of the first monitored device to achieve a response time of the first set of responses that matches the time between two transmissions of the first set of transmissions.The system processor uses at least the first emulation to prepare a monitoring device for monitoring the network in order to detect inappropriate network activities that affect the industrial process, while the monitored system controls the industrial process.

Description

RELATED APPLICATIONS

[0001] This application is a continuation-in-part of U.S. patent application 18 / 206,003, filed by Paul Williams on June 5, 2023, and also a continuation-in-part of U.S. patent application 18 / 206,008, also filed by Paul Williams on June 5, 2023; the disclosures of both applications are incorporated herein by reference for all purposes. Each of U.S. patent applications 18 / 206,003 and 18 / 206,008 is in turn a continuation-in-part of U.S. patent application 17 / 106,060, entitled “METHOD AND SYSTEM OF DEDUCING STATE LOGIC DATA WITHIN A DISTRIBUTED NETWORK,” filed by Paul Williams on November 27, 2020 (issued as U.S. Patent 11,711,382 on July 25, 2023; the disclosure of which is incorporated herein by reference for all purposes).

[0002] Each of U.S. patent applications 18 / 206,003 and 18 / 206,008 also claims the priority date of U.S. Provisional Application 63 / 445,654, entitled “SYSTEM AND METHOD FOR COUNTERACTING EFFECTS OF CYBER SECURITY BREACH OR OTHER DISRUPTION IN NETWORK COMMUNICATIONS,” filed on February 14, 2023 by Paul Williams; and the priority date of U.S. Provisional Application 63 / 445,663, entitled “SYSTEM AND METHOD FOR ENHANCING COMPUTER NETWORK RELIABILITY AND COUNTERACTING EFFECTS OF A CYBER SECURITY BREACH,” filed on February 14, 2023 by Paul Williams, the disclosures of which are also incorporated herein by reference for all purposes.

[0003] US patent application 17 / 106,060 also claims the priority date of US provisional application 62 / 941,576 entitled “METHOD AND SYSTEM OF DEDUCING STATE LOGIC DATA WITHIN A DISTRIBUTED NETWORK,” filed November 27, 2019 by Paul Williams, the disclosure of which is incorporated herein by reference for all purposes. BACKGROUND 1. Technical field

[0004] This disclosure relates to the field of cybersecurity, specifically to the use of monitored device emulations to prepare monitored devices to counteract the effects of an ongoing cybersecurity breach or other disruption of communications between monitored devices. 2. Description of the state of the art

[0005] The use of computing devices to control industrial processes, including but not limited to chemical processes, automated assembly lines, and the provision of various utilities, including electrical power, has become commonplace. Unfortunately, this has opened the door to a multitude of communication errors that can impact the control of industrial processes, creating a plethora of failure scenarios in information technology and industrial processes. This has also opened the door to cyberattacks on the control of industrial processes, thus raising the relatively new concern that cybersecurity breaches of computing devices can also lead to the impairment of industrial processes.This has given rise to a new form of malicious activity, in which cybersecurity breaches are committed precisely for the purpose of disrupting and / or otherwise compromising industrial processes. This can result in a variety of disruptions to the timing of communications and / or disruptions to the accuracy of the content of the communications.

[0006] An example of a communications failure is a computer server in an information technology network that, without warning, can no longer perform its normal functions due to a malfunction or a misconfigured hardware or software component. Alternatively, and as another example, a cyberattack technique such as a distributed denial-of-service (DDOS) attack may be directed against networked computing devices involved in controlling industrial processes. Such attacks can flood such computing devices with network traffic to such an extent that they are completely prevented from participating in communications related to industrial processes, so that necessary transmissions of operational commands are at least significantly delayed or simply do not occur.

[0007] As those skilled in the art will be aware, the timing of the transmission of a particular operational command from one device to another can be just as important for the correct execution of an industrial process as whether such transmission occurs at all. Failure to transmit information and / or commands at the expected time, or failure to transmit information and / or commands at all, can result in parts of an information technology network or an industrial process being executed too long, too late, or not at all.This can lead to a whole range of errors, including costly failures cascading throughout an enterprise's information technology network, failures in the successful manufacture of products or the successful provision of services, damage to equipment used in the manufacture of products or the provision of services, the creation of hazardous conditions at the site where industrial processes are carried out, injuries and / or deaths among personnel involved in the performance of industrial processes and / or reputational and / or financial damage to enterprises and / or other facilities connected to the information technology network or industrial processes.Where an industrial process is part of a chain of interconnected industrial processes, such impairment of the performance of one industrial process may adversely affect the ability to carry out one or more preceding industrial processes and / or one or more subsequent industrial processes.

[0008] As an example of faulty communication, a computer device involved in controlling an industrial process may be successfully compromised by malicious software, allowing it to be remotely controlled for the purpose of disrupting the industrial process. Such a compromised computer device may no longer issue proper operational commands in the correct sequence, with the correct timing and / or parameters, but instead issue incorrect operational commands, causing incorrect operation of robot arms / actuators, conveyor motors, power relays, welding equipment, valves, heating and / or cooling units, etc. Such devices may operate outside of device design limitations and / or with incorrect timing specifications, violating operational and / or safety requirements.This can not only affect the correct execution of an industrial process, but also lead to the waste of raw materials, the release and / or spillage of hazardous substances, the destruction of assemblies, damage to equipment and / or systems and / or endangerment of employees.

[0009] The malicious operational commands issued in this way may be modified versions of proper operational commands, so that the operational commands are actually issued when expected, but may contain false parameters that specify one or more incorrect values, such as an incorrect device identifier, temperature, pressure, movement direction, movement range, countdown time, upper or lower limit, etc. Alternatively or additionally, the malicious operational commands may actually be proper operational commands for the industrial processing being performed, but they may be issued at the wrong times and / or in the wrong order. Another alternative is that entirely new malicious operational commands are issued that bear no relation to the content and / or timing of the proper operational commands.

[0010] The use of cyberattack techniques in such attacks on industrial processes often leads to a focus on the use of long-standing cybersecurity measures to counter them. Such long-standing cybersecurity measures include, among others, the use of various digital signatures for malicious code to detect 1) the transmission, receipt, and / or storage of specific sequences of executable instructions from malicious software, 2) the transmission of specific malicious combinations of operational commands across a network by a computing device, and / or 3) the execution of specific malicious combinations of actions by a computing device. Such approaches have proven useful in preventing the introduction and / or execution of malware and / or preventing the further execution of malware.However, as those skilled in the art will be aware, such approaches often lead to a kind of “arms race” between the developers of malicious software and the developers of the signatures used for its detection.

[0011] There is an inevitable delay between the deployment of new malicious software and / or other types of attacks and the development of appropriate defenses (e.g., signatures), making it inevitable that at least some of these software and / or attacks will successfully cause damage before they are detected. As a result, such approaches typically do little to mitigate the damage caused to industrial processes in situations where malicious software or other unexpected and / or nefarious activities are not discovered until some time has passed since the damage was already inflicted.

[0012] An additional problem is the disruption of the normal operation of computer devices, including those used to control an industrial or other process, which is often caused by the implementation of various long-standing cybersecurity measures. Such measures typically require the installation of new cybersecurity software on existing computer devices, which places demands on these devices' resources. It is not uncommon for a computer device to require an upgrade of its processing and / or storage resources or to be replaced by another computer device with such upgrades to offset the resource consumption of the cybersecurity software.For this reason, it is not uncommon for the installation of cybersecurity software on computer devices to be viewed as a case where the proverbial cure is worse than the proverbial disease. Furthermore, it is not uncommon for the installation of cybersecurity software and / or the replacement of computer devices to result in changes in the behavior of a process's control. More specifically, it may result in minor changes in the timing and / or command of the transmission of operational commands and / or data that, while seemingly harmless, result in unforeseen harmful consequences because they trigger an unforeseen and / or unknown idiosyncrasy of the logic used to control a process.

[0013] Furthermore, such installations often require a degree of customization to distinguish between undesirable events resulting from failures and / or cybersecurity attacks and events that typically occur during normal operation related to process control. Such customizations to address undetected conditions and / or false alarms can exacerbate disruptions and become another avenue for triggering unforeseen harmful outcomes.

[0014] The present invention addresses these and other disadvantages of the prior art by providing a unique approach for detecting and mitigating the effects of such events on computing devices and / or on communication between computing devices involved in the execution of industrial processes and other repetitive loop processes. The present invention also addresses these and other disadvantages of the prior art by providing a unique approach for thoroughly preparing a monitoring system to perform such detection and mitigation prior to deployment. SHORT SUMMARY

[0015] Techniques are described for providing a system of one or more devices that implements a method to counteract the effects of an ongoing cybersecurity breach or other disruption of communication between devices.

[0016] In an exemplary emulation system, a system processor is configured to correlate a first set of transmissions through a network of a monitored system with a first set of responses of first control routine logic executing in a first monitored device of the monitored system, wherein the monitored system controls an industrial process performed in an external system coupled to the monitored system. The system processor adjusts a first parameter affecting an execution speed of the first control routine logic within a first emulation of the first monitored device to cause a response timing of the first set of responses to correspond to a timing between two transmissions of the first set of transmissions.The system processor uses at least the first emulation to prepare a monitoring device to monitor the network to detect inappropriate (illegal) network activities that affect the industrial process while the monitored system controls the industrial process.

[0017] In an exemplary method for preparing a monitoring device for monitoring a network, a system processor correlates a first set of transmissions through a network of a monitored system with a first set of responses of a first control routine logic executing in a first monitored device of the monitored system, wherein the monitored system controls an industrial process performed in an external system connected to the monitored system. The system processor adjusts a first parameter affecting an execution speed of the first control routine logic within a first emulation of the first monitored device to cause a response timing of the first set of responses to correspond to a timing between two transmissions of the first set of transmissions.The system processor uses at least the first emulation to prepare the monitoring device to monitor the network to detect inappropriate network activities that affect the industrial process while the monitored system controls the industrial process. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The disclosure will be better understood by considering the drawings and the following detailed description. Such description makes reference to the accompanying drawings, in which: The Fig. 1A, Fig. 1B, Fig. 1C, Fig. 1D, Fig. 1E and Fig. 1F show block diagrams of an exemplary combination of a monitored system for controlling an external system process, a monitoring system for monitoring the communication of the monitored system, and an emulation system for preparing the monitoring system. The Fig. 2A, Fig. 2B and Fig. 2C together provide a more detailed representation of the monitoring of communication within the monitored system by the monitoring system in the example combination of Fig. 1A-F. The Fig. 3A, Fig. 3B and Fig. 3C together provide a more detailed representation of the interactions between the communications and logic of the monitored system and the communications of the external system and the state machine. The Fig. 4A, Fig. 4B and Fig. 4C show a more detailed illustration of the aspects of an acquisition phase for preparing the monitoring system for use ---- Data is acquired that serves as part of the basis for emulating behaviors of the monitored system, the external system, and / or the process. The Fig. 5A, Fig. 5B, Fig. 5C, Fig. 5D, Fig. 5E and Fig. 5F shows a more detailed representation of aspects of a pre-training phase to prepare the monitoring system for deployment ---- the acquired data is used to define behaviors and / or timing of the emulations. The Fig. 6A and Fig. 6B show a more detailed illustration of aspects of a training phase for preparing the monitoring system for deployment --- the emulations are used to train, test, and / or demonstrate capabilities of the monitoring system. DETAILED DESCRIPTION

[0019] In the following detailed description, reference is made to the accompanying drawings, which form a part of this document. In the drawings, like symbols generally refer to like components unless the context dictates otherwise. The example embodiments described in the detailed description, drawings, and claims are not to be considered limiting. Other embodiments may be utilized and other changes may be made without departing from the spirit or scope of the subject matter presented herein. It is to be understood that the aspects of the present disclosure, as generally described herein and illustrated in the figures, may be arranged, substituted, combined, separated, and fashioned in a variety of different configurations, all of which are expressly contemplated herein.

[0020] Broadly speaking, emulations are created of parts of a monitored system and / or parts of a process controlled by the monitored system. Aspects of the emulations are based on at least a combination of samples of actual network traffic within the monitored system and information about the logic used by the monitored system to control the process. The emulations are then used to prepare one or more monitoring devices for monitoring the monitored system, at a minimum, to detect inappropriate network traffic that may occur due to malfunctions and / or cybersecurity breaches.

[0021] An emulation method and system for preparing a monitoring device for monitoring a network comprises a system processor that correlates a first set of transmissions through a network of a monitored system with a first set of responses of a first control routine logic executing in a first monitored device of the monitored system, wherein the monitored system controls an industrial process performed in an external system connected to the monitored system. The system processor adjusts a first parameter that affects an execution speed of the first control routine logic within a first emulation of the first monitored device to cause a response timing of the first set of responses to correspond to a timing between two transmissions of the first set of transmissions.The system processor uses at least the first emulation to prepare the monitoring device to monitor the network to detect inappropriate network activities that affect the industrial process while the monitored system controls the industrial process. Overview of the systems and their interaction

[0022] The Fig. 1A, Fig. 1B, Fig. 1C, Fig. 1D, Fig. 1E and Fig. 1F together represent an example of a monitoring system 1000 that is prepared and then deployed to monitor transmissions of operational commands and / or operational information within a monitored system 2000 for the purpose of controlling aspects of an industrial or other type of process performed within an external system 3000. The particular external system 3000 controlled in this manner may be one of several external systems 3000 that define an external domain 4000 through which products may be manufactured, utility services monitored, controlled, and / or provided, etc. An emulation system 5000 that emulates the behavior of the monitored system 2000 and / or the particular external system 3000 may be used in training and / or testing the monitoring system 1000 as part of the monitoring system 1000 for use therein. Fig. 1A, components of each of the systems 1000, 2000, 3000, 4000 and 5000 are presented; the Fig. 1B-D together illustrate aspects of the use of the monitoring system 1000 to monitor and / or correct the communication traffic of the monitored system 2000 after it has been prepared for such use; and the Fig. 1E-F together illustrate aspects of preparing the monitoring system 1000 for such use.

[0023] With a view to the Fig. 1A, in some embodiments, the monitored system 2000 may include a plurality of computing devices interconnected via a communications network 2999. These computing devices may include a plurality of monitored devices 2300 involved in controlling the industrial process or other type of process running in one of the external systems 3000, which is shown as being connected to one of the monitored devices 2300. As part of working together in a cooperative manner to control this process, various operational commands or information may be transmitted via the network 2999 between at least a subset of these monitored devices 2300.

[0024] For the purposes of this patent application, it is important to note that the use of terms such as "monitoring" and "monitored" refers to the monitoring by the monitoring system 1000 of communications within the network 2999 and between the monitored devices 2300 of the monitored system 2000 as part of providing reliability and / or cybersecurity services to the monitored system 2000. Thus, these terms do not refer to the use of the monitored system 2000 to control an industrial process or other type of process performed within an external system 3000.

[0025] Among the computing devices connected to the network 2999, there may also be one or more unmonitored devices 2100, none of whose communications over the network 2999 are monitored by the monitoring system 1000. At least a subset of the unmonitored device(s) 2100 may communicate with at least a subset of the plurality of monitored devices 2300 over the network 2999. However, none of these communications may be related to the control of an industrial process or other type of process performed in one of the external systems 3000, and therefore, it may be deemed unnecessary to monitor these communications.

[0026] As illustrated, network 2999 may include one or more exchange devices 2700. Each of these exchange devices 2700 may be any type of network device, including, but not limited to, a router, a network switch, a wireless network access point, a network bridge, etc. In network 2999, any transmission of commands and / or information between devices connected to network 2999 may occur via at least one exchange device 2700.

[0027] Also as part of the control of an external system 3000, and as illustrated, at least one of the monitored devices 2300 may be connected to that external system 3000 through one or more communication links 3999 to monitor and control various aspects of a process performed by that external system 3000. Thus, in controlling such a process, transmissions may occur between such a monitored device 2300 and such an external system 3000 via the one or more links 3999, in addition to transmissions between multiple monitored devices 2300 via the network 2999. Depending on the particular technologies employed in the link(s) 3999, one or more relay devices 3700 may be integrated into the one or more links 3999.

[0028] Given their central role in conveying transmissions through the network 2999, monitoring the transmissions of operational commands and / or operational information between the monitored devices 2300 may include monitoring the network traffic passing through each of the one or more exchange devices 2700. For this purpose, at least one of the one or more exchange devices 2700 may be coupled to the monitoring system 1000 via a connection 1992.

[0029] As illustrated, the monitoring system 1000 may include one or more monitoring devices 1500, and each of the one or more monitoring devices 1500 may be another data processing computer device. The monitoring system 1000 may be located remotely from the monitored system 2000, so that it may be considered entirely separate therefrom. Alternatively, the monitoring system 1000 may be co-located with at least a portion of the monitored system 2000 and / or otherwise integrated into the monitored system 2000, so that it may be considered contained therein.

[0030] The preparation of the one or more monitoring devices 1500 for use in monitoring the monitored system 2000 may comprise three distinct phases. In a capture phase, one or more capture devices 5700 of the emulation system 5000 may be temporarily coupled to the exchange device(s) 2700 via one or more connections 5992 to observe and capture communication activity occurring on the network 2999. Furthermore, at least one capture device 5700 may additionally be temporarily coupled to the relay device(s) 3700 and / or to at least one monitored device 2300 via one or more connections 5993 to observe and capture communication activity occurring on the connection(s) 3999.In this case, the detection device(s) 5700 may generate observation data that describe the detected activity at least from the network 2999, if not also from the connection(s) 3999.

[0031] Following the acquisition phase, the acquisition device(s) 5700 may be decoupled from the exchange device(s) 2700, the relay device(s) 3700, and / or the at least one monitored device 2300 in a pre-training phase, and the observation data generated by the acquisition device(s) 5700 may be provided to the one or more emulation devices 5500. While providing the observation data to the emulation device(s) 5500, the acquisition device(s) 5700 may be temporarily coupled to it via one or more connections of a network 5999.The emulation device(s) 5500 may be used to combine the observation data with other data relating to various aspects of the monitored device(s) 2300, the process to be controlled, and / or the external system 3000 in which the process is performed, to generate and / or adjust aspects of emulations of the monitored devices 2300, the external system 3000, and / or the process to be controlled.

[0032] Following the pre-training phase, the emulation device(s) 5500 may be temporarily coupled to the monitoring device(s) 1500 via one or more connections 5991 in an emulation training phase in a manner intended to mimic the manner in which the monitoring device(s) 1500 are intended to be coupled to the monitored system 2000 after the monitoring device(s) 1500 have been prepared for use. The emulation device(s) 5500 may then generate an emulation of behaviors of a combination of the monitored system 2000, the external system 3000 in which the process is performed, and / or the process as part of providing the monitoring device(s) 1500 with an emulation of the corresponding communication activity on the network 2999 for use in training and / or testing the monitoring device(s) 1500.

[0033] After preparing the monitoring device(s) 1500 through the three phases mentioned above, the monitoring device(s) 1500 may be uncoupled from the emulation device(s) 5500 and then connected to the one or more replacement devices 2700 of the monitored system 2000 via the one or more connections 1992. The monitoring device(s) 1500 may then begin monitoring communication activity over the network 2999 for instances of inappropriate network traffic and may respond to selected such instances in various ways, which are described in more detail below.

[0034] As will be explained in more detail below, such use of separate monitoring devices 1500 to detect anomalous network traffic on network 2999 may mitigate the effects of a cyberattack or malfunction on the control of an industrial or other process. Furthermore, this may be achieved without consuming processing, storage, and / or other resources of the monitored devices 2300, which could compromise the control of the process. However, as one skilled in the art will readily appreciate, such monitoring device(s) 1500 may not be effective if they are not used.

[0035] As will be explained in more detail below, by using emulations of such behaviors, the monitoring device(s) 1500 can be prepared for deployment in a manner that minimizes downtime and / or other interruptions in process control. Furthermore, after using the emulations to prepare the monitoring device(s) 1500 for deployment, the emulations can be used to test the effectiveness of the monitoring device(s) 1500 in various simulated scenarios to demonstrate their capabilities, provide confidence in their range of capabilities, and / or ensure that various specific needs of the operators of the monitored system 2000 are met.

[0036] Furthermore, such emulations can be used to simulate various conditions, which can additionally provide new insights into other aspects of the monitored system 2000 itself and / or other aspects of the process itself. In this way, weaknesses in the logic used in controlling the process can be uncovered, which can create vulnerability to one or more forms of attack and / or failure. Thus, such emulations may go beyond proving the usability of the monitoring devices 1500 and additionally reveal ways in which the monitored system 2000 and / or the process can be improved.

[0037] The Fig. 1B-D, taken together, illustrate aspects of using monitored system 2000 to control an example process 3003x performed in an external system 3000x, and illustrate aspects of using monitoring device(s) 1500 of monitoring system 1000 to monitor and / or actively remediate network activities in network 2999. More specifically, one monitored device 2300x of the plurality of monitored devices 2300 of monitored system 2000 may be coupled to external system 3000x via one or more connections 3999x, while at least one other monitored device 2300a may cooperate with monitored device 2300x via network 2999 to control process 3003x within external system 3000x.Additionally, at least one monitoring device 1500 of the monitoring system 1000 may be coupled to at least one exchange device 2700 of the network 2999 to monitor network traffic between at least the monitored devices 2300a and 2300x for instances of inappropriate network activity that may adversely affect the control of the process 3003x.

[0038] For the sake of clarity, it should be understood that what is stated in the Fig. 1B-D, includes using the monitoring device(s) 1500 of the monitoring system 1000 to monitor and / or correct the traffic through the network 2999 at a time after the monitoring device(s) 1500 have been prepared for use by performing the acquisition phase, the pre-training phase, and the emulation training phase. As already mentioned, the Fig. 1E-F, taken together, illustrate aspects of such preparation of the monitoring device(s) 1500 of the monitoring system 1000 for deployment. A more detailed discussion of such preparation will be provided later in this application.

[0039] As in the Fig. 1B-C, the external system 3000x in which an example process 3003x is performed may include a plurality of sensing devices 3200 for sensing various conditions and / or a plurality of executing devices 3800 that can be commanded to perform various functions.Depending on the type of illustrated process 3003x performed within the external system 3000x, each of the sensing devices 3200 may be any type of sensing device based on any technology to sense any condition, including, but not limited to, a temperature sensor, a pressure sensor, a light sensor, a vibration sensor, an accelerometer, a gyroscope, a spectrometer, a chemical release sensor, a particulate emission detector, a manually operable control, a manual data entry device, an air velocity sensor, a RADAR, a LIDAR, a SONAR, a rotational speed sensor, etc.Depending on the type of process 3003x performed within the external system 3000x, each of the executing devices 3800 may be any type of executing device based on any technology to perform any action, including, but not limited to, a robotic arm, gantry crane, remotely controllable mobile platform, welding fixture, metal press, valve, heater, cooler, power supply, magnet or magnet set, data storage, display system, wing or wing control surface, rudder, magnetron, radiation source, electric motor, internal combustion engine, turbine engine, etc.

[0040] Since the monitored device 2300x is coupled to the external system 3000x via the connection(s) 3999x, it can be coupled to the sensing devices 3200 and / or the executing devices 3800 of the external system 3000x via the connection(s) 3999x. As illustrated, and depending on the technologies used by the connection(s) 3999x, the connection(s) 3999x can include one or more relay devices 3700x. For example, the relay device(s) 3700x may serve to amplify the signal strength over relatively long electrical and / or optical conductors of the link(s) 3999x, serve as a transceiver for one or more wireless links upon which the link(s) 3999x may be based, and / or serve as a converter between portions of the link(s) 3999x that may use different signaling, protocols, transmission media, etc.

[0041] The process 3003x that can be performed within the external system 3000x can be any industrial process (e.g., a chemical process, the automatic manufacture of a product on a production line, the provision of electrical power, etc.) or any non-industrial process (e.g., data archiving and storage, data mining, etc.). Regardless of the process 3003x, the process 3003x can have multiple states in which certain actions are performed and / or in which certain events occur within each state. Thus, the execution of the process 3003x can progress through a tree of such states, with certain transitions between certain states occurring at certain times, in a certain order, and / or in response to certain conditions.

[0042] As illustrated, the monitored device 2300x may include one or more processors 2350x, a memory 2360x, a port 2390x for coupling the monitored device 2300x to the network 2999, and / or an interface 2393x for coupling the monitored device 2300x to the connection(s) 3999x. The memory 2360x, the port 2390x, and / or the interface 2393x may each be communicatively coupled to the processor(s) 2350x to exchange executable instructions and / or data therewith through the exchange of electrical, optical, magnetic, and / or other signals via one or more buses and / or other forms of connection within the monitored device 2300x. Further, the memory 2360x may store a control routine 2340x that may include instructions executable by the processor(s) 2350x to cause the processor(s) 2350x to perform various functions.In some embodiments, memory 2360x may also store log data 2330x, which may include indications of transmissions to and / or from external system 3000x over connection(s) 3999x and / or other information associated with those transmissions.

[0043] In various embodiments, control routine 2340x may implement logic 2345x for controlling at least some aspects of the performance of process 3003x within external system 3000x. Control routine 2340x may act on processor(s) 2350x of monitored device 2300x to cause processor(s) 2350x to monitor sensing devices 3200 of external system 3000x to monitor aspects of process 3003x performed within external system 3000x and / or to command executing devices 3800 of external system 3000x in a manner that causes processor(s) 2350x to place external system 3000x into at least a subset of the plurality of states of process 3003x.In this case, the executing devices 3800 of the external system 3000x may be operated by the monitored device 2300x in a concerted manner to perform various steps of the process 3003x while guided by data that the monitored device 2300x receives from the sensing devices 3200 of the external system 3000x. In other words, the control routine 2340x may be capable of causing the processor(s) 2350x to monitor and / or implement at least a subset of these multiple states of the process 3003x.

[0044] As illustrated, the monitored device 2300a may include one or more processors 2350a, a memory 2360a, and / or a port 2390a for connecting the monitored device 2300a to the network 2999. The memory 2360a and / or the port 2390a may each be communicatively coupled to the processor(s) 2350a to exchange executable instructions and / or data therewith through the exchange of electrical, optical, magnetic, and / or other signals via one or more buses and / or in another form of connection within the monitored device 2300a. Further, the memory 2360a may store a control routine 2340a, which may include instructions executable by the processor(s) 2350a to cause the processor(s) 2350a to perform various functions.

[0045] In various embodiments, the control routine 2340a may implement logic 2345a to also control at least some aspects of the performance of the process 3003x within the external system 3000x. The control routine 2340a may act on the processor(s) 2350a of the monitored device 2300a to cause the processor(s) 2350a to transmit operational commands to the monitored device 2300x to control the performance of the process of the external system 3000x based at least in part on operational information received from the monitored device 2300x. In other words, the control routine 2340a may cause the processor(s) 2350a to command the occurrence of transitions between at least a subset of the states of the process of the external system 3000x, thereby executing the process.

[0046] Thus, monitored devices 2300a and 2300x may together implement logic 2345a and 2345x that causes processors 2350a and 2350x, respectively, to cooperate to control process 3003x. While monitored device 2300x may be coupled to external system 3000x to directly monitor and / or implement states of process 3003x performed therein, the actual overall performance of process 3003x may be controlled by monitored device 2300a. In this manner, monitored devices 2300a and 2300x may cooperate to implement finite-state machine logic for the process performed in external system 3000x.

[0047] More specifically, the monitored device 2300a may issue transmissions 2922 to the network 2999 that convey operational commands and / or operational information to the monitored device 2300x to cause the monitored device 2300x to execute at least a subset of the transitions between states within the external system 3000x. In turn, the monitored device 2300x may issue corresponding transmissions 3933 on the connection(s) 3999x to various of the executing devices 3800 that convey commands to act in a manner that causes such transitions.The monitored device 2300x may also receive, via the connection(s) 3999x, transmissions 3933 from the executing devices 3800 acknowledging receipt and / or execution of such action instructions, and / or transmissions 3933 from the sensing devices 3200 providing data about sensed conditions. In turn, the monitored device 2300x may issue corresponding transmissions 2922 to the network 2999, which conveys operational information to the monitored device 2300a indicative of the data received from the sensing device(s) 3200 to enable the monitored device 2300a to determine when certain such transitions between the states of the process 3003x have occurred and / or should occur.

[0048] As in Fig. 1D, each exchange device 2700 of the network 2999 may include one or more processors 2750, a memory 2760, a plurality of bidirectional ports 2790, and / or a span port 2791. The memory 2760, the ports 2790, and / or the span port 2791 may each be communicatively coupled to the processor(s) 2750 to exchange executable commands and / or data therewith through the exchange of electrical, optical, magnetic, and / or other signals via one or more buses and / or via another form of connection within each exchange device 2700. Further, the memory 2760 may store a control routine 2740 that may include instructions executable by the processor(s) 2750 to cause the processor(s) 2750 to perform various functions. Alternatively or additionally, a portion of memory 2760 may be allocated to serve as buffer 2766.

[0049] As previously discussed, each exchange device 2700 may be any type of network device. Thus, in some embodiments, the illustrated exchange device 2700 may be a relatively simple hub device, in which execution of the control routine 2740 by the processor(s) 2750 may cause the processor(s) 2750, in response to receiving a transmission 2922 at one of the ports 2790, to issue the same transmission 2922 in a manner similar to broadcast to all other ports 2790.Alternatively, in other embodiments, the illustrated exchange device 2700 may be a relatively more sophisticated device in which execution of the control routine 2740 by the processor(s) 2750 may cause the processor(s) 2790 to use internally stored address information associated with each port 2790 to more selectively forward a transmission 2922 received at one port 2750 to only one other port 2750 or only a subset of the other ports 2750.

[0050] Regardless of the complexity of the illustrated exchange device 2700, received transmissions 2922 may be temporarily stored in buffer 2766 for a predetermined period of time and / or until an indication of successful forwarding by network 2999 is received. This may be done to allow one or more retransmission attempts to be made in response to a failure indication of an initial attempt at forwarding through network 2999.

[0051] Furthermore, the span port 2791 may be implemented as an output-only port that forwards a copy and / or an indication of each transmission 2922 received at any port 2790 of the exchange device 2700. Thus, as illustrated, the span port 2791 may be coupled to a monitoring device 1500 of the monitoring system 1000 to forward copies and / or indications of some or all of the traffic passing through the exchange device 2700 to the same monitoring device 1500. As will be explained in more detail shortly, this enables this monitoring device 1500 to detect a case in which a transmission 2922 of a particular operational command and / or operational information between the monitored devices 2300, which was expected within a certain time period, does not occur.This also enables the monitoring device 1500 to detect a case in which an improper transmission 2922 of an operational command and / or operational information occurs between the monitored devices 2300. As additionally illustrated, the same illustrated monitoring device 1500 may also be coupled to the illustrated replacement device 2700 via another of the ports 2790. As will be explained in more detail below, such an additional coupling may enable the monitoring device 1500 to respond to the absence of an expected transmission 2922 and / or the occurrence of an erroneous transmission 2922 by itself issuing a replacement transmission 2922.

[0052] In embodiments where the exchange device 2700 is of a more sophisticated type, execution of the control routine 2740 may cause its processor(s) 2750 to respond to commands received from such a monitoring device 1500 to limit the copies and / or indications of network traffic provided via the span port 2791 to transmissions 2922 of certain types and / or to transmissions 2922 associated with certain devices. In this way, the illustrated exchange device 2700 may be caused to cooperate with the illustrated monitoring device 1500 to limit the copies and / or indications of network traffic output to the monitoring device 1500 to operational commands and / or operational information transmitted between monitored devices 2300.

[0053] Alternatively or additionally, in embodiments where the exchange device 2700 is of a more sophisticated type, execution of the control routine 2740 may cause its processor(s) 2750 to respond to commands received from such a monitoring device 1500 to at least temporarily retain in buffer 2766 transmissions 2922 that satisfy one or more specified criteria.In this way, the illustrated exchange device 2700 may be caused to cooperate with the illustrated monitoring device 1500 to at least temporarily delay allowing the further movement of a transmission 2922 through the exchange device 2700 from one monitored device 2300 to another monitored device 2300, thereby providing the monitoring device 1500 with at least a period of time necessary to analyze aspects of the transmission 2922 to determine whether it is a proper transmission 2922, and thus to be able to determine whether the exchange device 2700 should be commanded to allow it to continue to the other monitored device 2300.

[0054] As also illustrated, each such monitoring device 1500 may include one or more processors 1550, a memory 1560, and / or one or more ports 1590 for connection to one or more exchange devices 2700 of the network 2999. The memory 1560 and / or the port(s) 1590 may each be communicatively coupled to the processor(s) 1550 for exchanging executable instructions and / or data through the exchange of electrical, optical, magnetic, and / or other signals via one or more buses and / or other forms of connection within each monitoring device 1500. Further, the memory 1560 may store a control routine 1540, which may include instructions executable by the processor(s) 1550 to cause the processor(s) 1550 to perform various functions.Alternatively or additionally, the memory 1560 may store a database 1533 with information about states, operational commands, and / or operational information associated with one or more processes that may be performed in an external system 3000 (e.g., the process 3003x performed in the external system 3000x), as well as information about actions to be taken in response to situations observed in the network 2999 that are at least apparently outside of what is expected during the performance of each of these one or more processes.

[0055] When the monitoring device(s) 1500 is (are) coupled to the exchange device(s) 2700 in this manner, monitoring for inappropriate traffic through the network 2999 may include, but is not limited to: 1) monitoring for instances of failure to transmit a particular operational command or information when expected within a particular time period; and / or 2) monitoring for instances of transmission of an inappropriate or invalid operational command.

[0056] If a particular operational command or piece of operational information is not transmitted as expected within a certain time period, such a transmission failure may occur for a variety of reasons. One of these reasons may be a variety of hardware and / or software malfunctions that may have occurred in a particular monitored device 2300, causing it to no longer function sufficiently to transmit the operational command or information as expected.Alternatively or additionally, one of these reasons may be a cyberattack in which a particular monitored device 2300 intended to transmit operational command or information over network 2999 has fallen victim to malicious software or some other form of internal cyberattack that prevents it from doing so and / or has been flooded with network activity over network 2999, thus preventing it from transmitting operational command or information.

[0057] Here too, there may be specific transmissions 2922 of operational commands and / or operational information over the network 2999 associated with various transfers between states of such a process within an external system 3000. For example, it may be that a specific operational command or a specific piece of operational information is to be transmitted over the network 2999 within a specific period of time in response to the occurrence of certain conditions, such as the transition to a specific state. Or, as a further example, it may be that a specific operational command or a specific piece of operational information is to be transmitted over the network 2999 within a specific period of time and / or as part of a specific sequence of operational commands and / or operational information in order to effect a transition to a specific state.Therefore, if one of these transmissions does not occur as expected within a certain time period, this may cause a transition between states that would normally occur not to occur and / or an erroneous transition to an incorrect state.

[0058] The monitoring device(s) 1500 of the monitoring system 1000 may be configured to respond to such a failure in the transmission of a particular operational command or information through the network 2999 with a variety of measures. In some embodiments, for example, the monitoring devices 1500 may simply issue a warning to designated personnel about such a failure (e.g., an audible and / or visual warning signal and / or the transmission of an electronic alert, such as a text message or telephone call). Alternatively or additionally, in other embodiments, the monitoring device(s) 1500 may store an indication of such a failure in a log or other similar data structure maintained in the memory 2760.Also alternatively or additionally, in still other embodiments, the monitoring device(s) 1500 may transmit the relevant operational command or operational information via the network 2999 itself via the exchange device(s) 2700, so that the relevant operational command or operational information is also made available to the other monitored device 2300 that is intended to receive it, whereby the associated industrial process or other type of process can be continued without interruption.

[0059] Regarding the transmission of an inappropriate or invalid operational command, such inappropriate (illegal) transmission may also occur for a variety of reasons. One of these reasons may be bona fide operator error or any of a variety of hardware and / or software malfunctions that may have occurred in a particular monitored device 2300, rendering it incapable of adequately selecting correct operational commands and / or information to be transmitted.Alternatively or additionally, one of these reasons may be that the monitored device 2300 transmitting the incorrect operational command or information has fallen victim to malicious software or some other form of cyberattack that either itself causes the particular monitored device 2300 to transmit the incorrect operational command or allows the monitored device 2300 to be remotely caused to do so. It should also be noted that such erroneous transmission may also occur elsewhere within and / or near the network 2999, e.g., due to disruptive electrical activity caused by a lightning strike, etc., so that the content of a proper transmission may be corrupted.

[0060] Here, too, there may be certain transmissions 2922 of operational commands and / or operational information across the network 2999 associated with various transitions between states of such a process within an external system 3000. Thus, the transmission of an inappropriate (illegible) operational command to perform an inappropriate action or to perform an action with inappropriate (illegible) parameters may result in a transition to another state that occurs out of sequence, or in a transition to an inappropriate state that lies entirely outside such a tree.

[0061] The monitoring device(s) 1500 of the monitoring system 1000 may be configured to respond to the transmission of such an inappropriate operational command over the network 2999 with a variety of measures. For example, in some embodiments, the monitoring device(s) 1500 may simply issue a warning to designated personnel via such a transmission (e.g., an audible and / or visual warning signal and / or the delivery of an electronic alert, such as a text message or telephone call). Alternatively or additionally, in other embodiments, the monitoring device(s) 1500 may store an indication of such a transmission in a log or similar data structure maintained in the memory 2760.Also alternatively or additionally, in still other embodiments, the monitoring device(s) 1500 may, via the replacement device(s) 2700, block the transmission of such an inappropriate operational command so that it is not received by a monitored device 2300, whatever the intended target, and / or cause the transmission of a proper operational command to replace and / or counteract the inappropriate operational command.

[0062] More specifically, in some embodiments, the monitoring device(s) 1500 may operate the exchange device(s) 2700 to cause the exchange device(s) 2700 to intercept any operational command transmitted by any of the monitored devices 2300 that meets various preselected parameters (e.g., type of operational command, protocol used, destination, etc.). Each such operational command may first be forwarded to the monitoring device(s) 1500 for analysis, rather than being forwarded to the intended destination. The analysis performed may be based on machine learning, wherein correct transmissions of operational commands related to the control of industrial processes over the network 2990 have been observed over time to build a knowledge base about which transmissions of operational commands to expect and when.If the analysis determines that the operational command is correct, the exchange device(s) 2700 can be instructed to forward the operational command to its intended destination. However, if the analysis determines that the operational command is inappropriate or invalid, the exchange device(s) 2700 can at least be instructed not to forward the operational command to its intended destination.

[0063] Further actions may be taken by the monitoring device(s) 1500 in response to an inappropriate operational command based on various factors. For example, if a transmitted inappropriate or invalid operational command is the type of operational command expected, delivered at the expected time, and to the expected destination, but contains incorrect parameters, then the monitoring device(s) 1500 may transmit a corrected version of this inappropriate operational command via the exchange device(s) 2700 and onward to the same destination to cause the correct operational command to be received at that destination at the expected time.

[0064] Alternatively, in other embodiments, the exchange device(s) 2700 may not intercept the operational commands transmitted through them in any way. Instead, for each operational command transmitted by one of the monitored devices 2300 that meets various preselected parameters (e.g., type of operational command, protocol used, destination, etc.), a copy is forwarded to the monitoring device(s) 1500 for analysis, while also being forwarded to its intended destination. Again, the analysis performed may be based on machine learning or on a comparison with a database of expected operational commands. If the analysis concludes that the operational command is correct, no further action can be taken.However, if the analysis determines that the operational command is improper, the monitoring device(s) 1500 may take further action, e.g., sending a warning or transmitting one or more additional operational commands via the exchange device(s) 2700 and onward to the same destination. The additional operational command(s) may be generated based on an analysis of the inappropriate or invalid operational command to revoke the action specified in the inappropriate operational command.

[0065] The Fig. 1E-F, taken together, illustrate aspects of the preparation of monitoring system 1000 for use in monitoring and / or correcting network communications occurring on network 2999 of monitored system 2000 and associated with the control of process 3003x performed on external system 3000x. More specifically, information collected about monitored system 2000 and / or external system 3000x is provided to one or more emulation devices 5500 of emulation system 5000 to enable the provision of a series of emulations of various portions of systems 2000 and / or 3000x. Emulation of network activity via network 2999 may also be provided, which may be used to train and / or test one or more monitoring devices 1500 as part of preparing such monitoring device(s) 1500 for such use.

[0066] To Fig. 1E: During a capture phase, one or more capture devices 5700 may be temporarily connected via at least one connection 5992 to one or more span ports 2791 of exchange devices 2700 of the network 2999 of the monitored system 2000. Via the connection(s) 5992 and in a similar manner as described with respect to Fig. 1D for the monitoring device(s) 1500, the detection device(s) 5700 may receive indications of transmissions 2922 taking place in the network 2999. Similarly as with respect to the Fig. 1D for the monitoring device(s) 1500, the information received from the sensing device(s) 5700 via the connection(s) 5992 may be limited to transmissions 2922 associated with the control of the process 3003x performed within the external system 3000x.

[0067] Additionally, in some embodiments, the sensing device(s) 5700 may also be temporarily coupled to either the relay device(s) 3700x (if present) or the monitored device 2300x via at least one connection 5993. As previously discussed, depending on the type of communication technology used by the connection(s) 3999x, the connection(s) 3999x may include the relay device(s) 3700x for amplifying the signals used to convey the transmissions 3933 and / or for converting between different protocols and / or different transmission media used by the connection(s) 3999x.In addition, the relay device(s) 3700x may also include one or more span ports to which the sensing device(s) 5700 may be easily temporarily coupled via the at least one connection 5993 in a similar manner to the span port(s) 2791 of the exchange device(s) 2700.

[0068] Alternatively, in other embodiments where the connection(s) 3999x does not include the relay device(s) 3700x, it may be considered desirable to avoid attempting to connect the sensing device(s) 5700 to the connection(s) 3999x at all. As one skilled in the art will readily appreciate, it may be considered desirable not to risk any disruption to the ability of the connection(s) 3999x to convey transmissions 3933 and to use an alternative approach to obtain information about these transmissions 3933 if an alternative approach is available. One such alternative approach may be to couple the sensing device(s) 5700 to the monitored device 2300x to obtain a copy of the log data 2330x generated therein, which may include various details of the transmissions 3933 to and from the external system 3000x.

[0069] As those skilled in the art will readily appreciate, each of the monitored devices 2300, including the monitored devices 2300a and 2300x, may be any of a variety of types of computing devices based on any of a variety of implementations of any of a variety of computer architectures. Among such a wide range of options for implementing the monitored device 2300x, a subset of these options may be configured and / or configurable to generate the log data 2330x containing any type of information about any type of events that may occur within the external device 3000x during the control of the process 3003x.For example, in some of these embodiments, the log data 2330x may be limited to recording anomalies and / or unsuitable conditions that may occur during individual operations of the process 3003x, such as exceeding temperature, pressure, speed, capacity, and time ranges, etc. In another example, however, the log data 2330x may be much more detailed, such that details of each transmission 3933 sent or received by the monitored device 2300x may be recorded therein, along with timestamps. In embodiments where such detailed log data 2330x is generated, it may be possible to use the log data 2330x instead of direct observations of the transmissions 3933 via the connection(s) 3999x.

[0070] Regardless of the precise manner in which information about transmissions 3933 is acquired via the connection(s) 3999x, or acquired or otherwise obtained in addition to the information about transmissions 2922 via the network 2999 (if possible), the acquired information about transmissions 2922 and / or 3933 may be stored in at least one acquisition device 5700 as the observation data 5730. As will be explained shortly, following this acquisition phase in which the observation data 5730 is generated to include information about such transmissions 2922 and / or 3933 occurring over a predetermined period of time, the observation data 5730 may then be provided to the one or more emulation devices 5500 of the emulation system 5000 as input for a pre-training phase.

[0071] As illustrated, each sensing device 5700 may include one or more processors 5750, a memory 5760, and / or one or more ports 5790 for temporarily connecting to at least one exchange device 2700 of the network 2999. The memory 5760 and / or the port(s) 5790 may each be communicatively coupled to the processor(s) 5750 for exchanging executable instructions and / or data therewith through the exchange of electrical, optical, magnetic, and / or other signals via one or more buses and / or other forms of interconnection within each monitoring device 1500. Furthermore, the memory 5760 may store the observation data 5730 and / or a control routine 5740, which may include instructions executable by the processor(s) 5750 to cause the processor(s) 5750 to perform various functions.

[0072] More specifically, upon execution of control routine 5740, the processor(s) 5750 of the sensing device(s) 5700 may be caused to monitor the port(s) 5790 for receipt of indications of transmissions 2922 occurring on the network 2999. Additionally, in some embodiments, the processor(s) 5750 may be caused to monitor the port(s) 5790 for receipt of either indications of transmissions 3933 occurring over the connection(s) 3999x or the protocol data 2330x. The processor(s) 5750 may then be caused to combine such received information about transmissions 2922 and / or 3933, along with information about when each of these transmissions occurred, to generate the observation data 5730.

[0073] In relation to Fig. 1A, and in addition to Fig. 1E, it should be noted that in an alternative embodiment, the emulation system 5000 may not include the sensing device(s) 5700, and the monitoring device(s) 1500 may be employed to perform the functions of the sensing device(s) 5700. More specifically, in such an alternative embodiment, and at a time before the monitoring device(s) 1500 are prepared for use in monitoring and / or correcting network traffic on the network 2999, the monitoring device(s) 1500 may be capable of operating in an acquisition mode during the acquisition phase to receive indications of transmissions 2922 occurring on the network 2999 and generate the observation data 5730 in a manner similar to that described with respect to the sensing device(s) 5700.In such an alternative embodiment, the monitoring device(s) 1500 may then be temporarily coupled to the emulation device(s) 5500 to both provide the observation data 5730 as part of completing the acquisition phase and to be trained and / or tested as part of the training phase, as described.

[0074] In another alternative embodiment, one or more of the monitored devices 2300 (e.g., one or both of the monitored devices 2300a and 2300x) may be employed to perform the functions of the sensing device(s) 5700. More specifically, the processor(s) 2350 in each such monitored device 2300 may be caused, by execution of a portion of the control routine 2340, to generate and store at least a portion of the observation data 5730 to contain information about the network traffic through the network 2999 that it has emitted and / or received. Such portions of the observation data 5730 may then be combined to form the complete observation data 5730, which may then be provided to the emulation device(s) 5500.

[0075] In another embodiment, the exchange device(s) 2700 of the network 2999 may be used to perform the functions of the capture device(s) 5700. More specifically, the processor(s) 2750 in each such exchange device 2700 may be caused, by execution of a portion of the control routine 2740, to generate and store at least a portion of the observation data 5730 to include information about the network traffic passing through it. These portions of the observation data 5730 may also subsequently be combined to form the complete observation data 5730, which may then be provided to the emulation device(s) 5500.

[0076] To Fig. 1F: After the acquisition phase and during a pre-training phase, the acquisition device(s) 5700, which was / were temporarily coupled to at least the monitored system 2000 to collect information about at least transmissions 2922 associated with the control of the process 3003x within the external system 3000x, may be decoupled therefrom and then temporarily coupled via a network 5999 to one or more emulation device(s) 5500. In this way, the observation data 5730 generated by the acquisition device(s) 5700 may be made available to the emulation device(s) 5500.

[0077] The emulation device(s) 5550 may also be provided with device data 5530 indicative of characteristics of various monitored devices 2300 (e.g., at least the monitored devices 2300a and 2300x) and / or of the logic used by these various monitored devices 2300 in controlling the process 3003x performed in an external system 3300x. In some embodiments, the device data 5530 may also include details of a state machine describing the process 3003x. In other embodiments, however, the details of such a state machine may not be available and provided to the emulation device(s) 5500, so they must be derived.

[0078] As illustrated, each such emulation device 5500 may include one or more processors 5550, a memory 5560, and / or one or more ports 5590 for connection to the network 5599. The memory 5560 and / or the port(s) 5590 may each be communicatively coupled to the processor(s) 5550 for exchanging executable instructions and / or data therewith through the exchange of electrical, optical, magnetic, and / or other signals via one or more buses and / or other forms of connection within each emulation device 5500. Further, the memory 5560 may store a control routine 5540 that may include instructions executable by the processor(s) 5550 to cause the processor(s) 5550 to perform various functions.Alternatively or additionally, the memory 5560 may store the observation data 5730, the device data 5530, and / or a database 5533. Also alternatively or additionally, portions of the memory 5560 may be allocated as virtual machines (VMs) or containers 5566 to provide emulations.

[0079] As will be explained in more detail below, execution of the instructions of control routine 5540 during the pre-training phase may cause the processor(s) 5550 of the emulation device(s) 5500 to use the information in observed data 1530 regarding observed transmissions 2922 and / or 3933, along with the information in device data 5530 regarding logic and / or state machines, to generate, in each VM or container 5566, an emulation of a separate device or other component present in the monitored system 2000 or the external system 3000x. This may include separate emulations for each of the monitored devices 2300a and 2300x and / or an emulation of the process 3003x and / or the external system 3000x in which the processor 3003x is executing.These VMs or containers 5566 may be linked so that the separate emulations within each VM or container 5566 can work together in a cooperative manner to provide an emulation of the monitored system 2000 and the external system 3000x interacting with each other. This may also emulate at least the communication activity that occurs over the network 2999, if not also over the connection(s) 3999x.

[0080] As will be explained in more detail below, these emulations may be used following the pre-training phase and during an emulation training phase to prepare the monitoring device(s) 1500 to distinguish between appropriate network activity on the network 2999 and inappropriate network activity indicating a malfunction and / or cyberattack for which the monitoring device(s) 1550 should take some form of action. As will be explained in more detail below, the monitoring device(s) 1500 may also be prepared to distinguish between network activity indicating a fault condition for which the monitoring device(s) 1550 should not take any action, and instead allow the logic of other devices (e.g., one or more monitored devices 2300) to take action.

[0081] At the beginning of the training phase, the monitoring device(s) 1500 may be temporarily connected to the port(s) 5590 of the emulation device(s) 5500 via at least one connection 5991. The processor(s) 5550 may be caused, by execution of the control routine 5540, to grant access to the port(s) 5590 to emulate at least the communication activity via the network 2999. In this way, the monitoring device(s) 1500 may be exposed to conditions that are at least relatively similar to the conditions that occur when connected to at least the actual exchange device(s) 2700 of the network 2999.

[0082] Following the emulation training phase, the monitoring device(s) 1500 may be decoupled from the emulation device(s) 5500 and may then be coupled via the connection(s) 1992 to the replacement device(s) 2700 of the network 2999 of the monitored system 2000 for use. As will be explained in more detail below, the training phase of the emulation is intended to at least minimize (if not eliminate) the need for further training of the monitoring device(s) 1500 after their coupling to the actual monitored system 2000. In this way, the potential for disruption to the normal operation of the monitored system 2000 for controlling the process 3003x may be minimized, if not eliminated.

[0083] Back to Fig. 1A: Although the monitored system 2000 has been described as consisting of multiple networked computing devices 2100, 2300, and / or 2700, in alternative embodiments, the monitored system 2000 may itself be a single computing device. In such alternative embodiments, the device(s) 2100, 2300, and / or 2700 may be components of this single computing device, interconnected by an internal network of buses 2999. In such alternative embodiments, each of the one or more exchange devices 2700 may be an integrated circuit that provides a type of crosspoint switch function for the network of buses 2999 over which commands and / or data are transferred between the other devices 2100 and / or 2300.

[0084] Furthermore, in such alternative embodiments, the monitoring system 1000 may additionally be implemented using one or more microcontrollers that may be physically integrated into the single computing device of the monitored system 2000. However, the monitoring system 1000 may also be otherwise isolated from the central processing units (CPUs) of that single computing device.

[0085] Furthermore, and regardless of whether the monitored system 2000 consists of multiple networked computing devices or is itself a computing device, the monitoring system 1000 may be implemented over public or private cloud-based network computing resources. Further details of network communication

[0086] In the Fig. 2A, Fig. 2B and Fig. 2C illustrates various aspects of example implementations of network 2999, including examples of implementations of switch(es) 2700.

[0087] With a view to Fig. 2A, each of the ports 2790 of a replacement device 2700 of the one or more replacement devices 2700 may be coupled by a separate connection 2990 to a separate unmonitored device 2100 or a monitored device 2300. As those skilled in the art will readily appreciate, this may create a form of hub-and-spoke topology or other electrically similar topology in which a replacement device 2700 may be at the center of a series of point-to-point connections to a corresponding series of multiple devices 2100 / 2300. Briefly, Fig. 2B: Together with Fig. 2A, in larger embodiments of the monitored system 2000, multiple exchange devices 2700 may be coupled together to form a larger version of such a hub-and-spoke topology.

[0088] Back to Fig. 2A: For each monitored system 2000, the span port 2791 of at least one exchange device 2700 may be coupled by a separate connection 1992 to at least one monitoring device 1500 of a monitoring system 1000. When the devices 2100 and / or 2300 of the monitored system 2000 communicate with each other via the network 2999, copies and / or indications of at least operational commands and / or operational information transmitted between at least the monitored devices 2300 may be forwarded to the one or more monitoring devices 1500 via the span port(s) 2791 and the connections 1992.In some embodiments, such a single monitoring device 1500 may additionally or alternatively be coupled through another connection 1992 to a bidirectional port 2790 of such a single replacement device 2700 to enable the single monitoring device 1500 to control one or more of the replacement devices 2700 and / or to transmit an operational command or operational information to a monitored device 2300.

[0089] Briefly again Fig. 2B, together with Fig. 2A, where there are multiple exchange devices 2700 incorporated into an embodiment of the monitored system 2000, each of the multiple exchange devices 2700 may include a separate span port 2791. The span port 2791 of each of these multiple exchange devices 2700 may then be separately coupled by a separate connection 1992 to one or more monitoring devices 1500 of the monitoring system 1000 of this embodiment, thereby enabling each of these multiple exchange devices 2700 to directly relay copies and / or indications of at least operational commands and / or operational information transferred thereto between at least the monitored devices 2300.Alternatively, only one of these multiple exchange devices 2700 may be coupled in this manner to a single monitoring device 1500, and this single exchange device 2700 may forward copies and / or indications of such operational commands and / or operational information transmitted by all of the multiple exchange devices 2700 via the one span port 2791 and the one connection 1992.

[0090] Regardless of the number of exchange devices 2700 and / or the precise manner in which these exchange devices 2700 are coupled to one or more monitoring devices 1500, the exchange devices 2700, as previously discussed, may offer the ability to be programmed to specify a particular subset of transmissions 2922 over the network 2999 for which copies and / or indications thereon are forwarded to the monitoring device(s) 1500. Such a subset may be specified by the identifiers of the devices involved, the type of transmission, the type of protocol used, the size of the data transferred, the time of day or day of the week of the transmission, etc.In some embodiments, the use of device identifiers in defining such a subset may actually determine which devices within the monitored system 2000 are the monitored devices 2300 and which devices are the unmonitored devices 2100.

[0091] In embodiments where the monitored system 2000 is formed from a number of networked computing devices, each connection 2990 and / or 1992 may be implemented using a variety of wireless and / or wired network technologies, including, but not limited to, Bluetooth, Wi-Fi, cellular signaling, electrical twisted pair cabling, electrical coaxial cabling, and fiber optic cabling. Such wireless and / or wired technologies may conform to a variety of specifications, including, but not limited to, Ethernet and / or TCP / IP. In embodiments where the monitored system 2000 is formed from a single computing device, each connection 2990 and / or 1992 may be implemented using a variety of widely used and accepted internal bus specifications, including, but not limited to, PCI Express bus and I 2 C-Bus.

[0092] To Fig. 2C: In some embodiments, a monitored device 2300 may include multiple components 2303, for which transmissions 2922 of operational commands or operational information to and / or from them via the connection 2990 by which the monitored device 2300 is coupled to an exchange device 2700 may at least be observed. More specifically, a single monitored device 2300 may include multiple components 2303, each of which may be separately addressed and communicated with via this connection 2990 in a manner almost as if they were entirely separate devices. Alternatively or additionally, transmissions 2922 of operational commands or operational information between multiple components 2303 within a single monitored device 2300 may also be reflected on this connection 2990.

[0093] Thus, for example, if the illustrated monitored component 2303A of the illustrated monitored device 2300 transmits an operational command or operational information to another illustrated monitored component 2303B within the same monitored device 2300, a copy of that transmission 2922 may also be transmitted onto the illustrated connection 2990, thereby enabling the illustrated exchange device 2700 to forward a copy and / or indication of that transmission 2922 to the illustrated monitoring device 1500.A further alternative is that such transmission 2922 between the illustrated monitored components 2303A and 2303B occurs by the monitored component 2303A sending the operational command or operational information to the illustrated exchange device 2700, followed by the exchange device 2700 returning these operational commands or operational information to the monitored component 2303B via the same connection 2990.

[0094] Regardless of the precise manner in which transmissions 2922 of operational commands or operational information are forwarded to the monitoring device(s) 1500 of the monitoring system 1000, the copies and / or indications of operational commands or operational information forwarded in this manner may be compared with information stored in the database 1533 about which transmissions 2922 of operational commands or operational information are expected (and when) as part of identifying instances in which observed transmissions 2922 of operational commands or operational information deviate from expectations. Details of the correlations between network communication and process states

[0095] In the Fig. 3A, Fig. 3B and Fig. 3C illustrates various aspects of how transmissions, a process state machine, and the logic used in the devices interact to control the performance of a process (e.g., the example process 3003x introduced previously).

[0096] Regarding the Fig. 3A, a process performed in one of the external systems 3000 may, as previously discussed and as illustrated, be defined as a multi-state tree traversed during its execution, such as the illustrated process states 3033p1, 3033p2, etc., of the illustrated process 3003x performed in the illustrated external system 3000x. As also previously discussed, such an external system, such as the illustrated external system 3000x, may include one or more sensing devices 3200 to monitor various aspects of the process 3003x performed therein and / or one or more executing devices 3800 to effect various aspects of performance of the process 3003x therein.

[0097] As also previously discussed, one or more transmissions 2922 over network 2999 and one or more corresponding transmissions 3933 over connection(s) 3999x may be associated with initiating execution of process 3003x. More specifically, in various embodiments, there may be one or more transmissions 2922np and / or 3933np that trigger the initiation of process 3003x. For example, there may be one or more transmissions 2922np that convey operational commands between monitored devices 2300 (e.g., the illustrated monitored devices 2300a and 2300x) over network 2999 to prepare for the initiation of process 3003x and / or to actually begin process 3003x.Such operational commands to the monitored device 2300x may in turn cause one or more executing devices 3800 with corresponding transmission(s) 3933np via the connection(s) 3999x to be instructed to perform operations that implement such preparations and / or actually begin the process 3003x, thereby causing a transition from a non-process state 3033n to the illustrated first process state 3033p1 of the process 3003x.

[0098] Alternatively, process 3003x may respond to external inputs, so that the start of execution of process 3003x may be triggered in a manner that is not based on such transmissions. Thus, from the perspective of network 2999 and connection(s) 3999x, the first transmission associated with the execution of process 3003x may be a transmission indicating that process 3003x has already begun. For example, there may initially be one or more transmissions 3933np via connection(s) 3999x that convey operational information that the preparations for starting process 3003x have been completed and / or that process 3003x has begun, so that the transition from the illustrated non-process state 3033n to the first process state 3033p1 has already occurred.Such operational information to the monitored device 2300x may, in turn, trigger corresponding transmissions 2922np between the monitored devices 2300a and 2300x to forward such operational information to the monitored device 2300a. Such operational information may include data acquired by one or more sensing devices 3200 at a time immediately before, during, and / or immediately after the transition to the process state 3033p1.

[0099] It should be noted that during the illustrated non-process state 3033n prior to initiating the process 3003x, there may be one or more transmissions 3400n not associated with performing the process 3003x, such as the illustrated transmission(s) 3933n. Such transmissions 3933n may be associated with maintaining the external system 3000x in the illustrated non-process state 3033n, such as a particular "off" state, a "sleep" state, or a "standby" state. As known to those skilled in the art, such a non-process state 3033n may be configured to minimize power consumption, maintain the device(s) in a known inactive state, and / or maintain the substance(s) in a known safe storage state.Such minimal power consumption may be directed to maintaining a cache of pre-loaded data ready for future execution of process 3003x, and / or such safe memory state may maintain substances in a state for use in future execution of process 3003x.

[0100] For example, there may be transmissions 2922n that convey operational commands between monitored devices 2300a and 2300x over network 2999 to achieve and / or maintain non-process state 3033n. Such operational commands may, in turn, cause one or more executing devices 3800 to be instructed via transmission(s) 3933n to perform operations that implement and / or maintain various aspects of non-process state 3033n. Alternatively or additionally, there may be one or more transmissions 3933n over connection(s) 3999x and corresponding transmissions 2922n over network 2999 that convey operational information to monitored device 2300a regarding aspects of maintaining non-process state 3033n.Such operational information may include data collected by one or more sensor devices 3200 about the ongoing preservation of data and / or about the ongoing preservation of stored substances.

[0101] For the purpose of monitoring transmissions traversing network 2999 as an approach to monitoring the performance of a process, such as example process 3003x, a particular transmission 2922n associated with non-process state 3033n, a particular transmission 2922np associated with the transition from non-process state 3033n to process state 3033p1, or a combination of multiple transmissions 2922n and / or 2922np may be selected to serve as an indication observable in network 2999 that process 3003x has begun.Thus, by monitoring transmissions 2922 occurring on network 2999 (through one or more exchange devices 2700), a monitoring device 1500 may identify instances where such particular transmissions 2922n and / or 3922np (or such combination thereof) have occurred on network 2999, and use such instances as an indication of when to begin monitoring network 2999 for transmissions 2922 associated with process 3003x.

[0102] Just as some transmissions 2922 and / or 3933 may be associated with the beginning of a process execution, others may be associated with the progression of execution between process states. Returning to the example process 3003x, there may be various transmissions 3933pp via connection(s) 3999x and / or transmissions 2922pp via network 2999 that may be associated with the transition between process states 3033p1 and 3033p2. More specifically, there may be transmissions 2922pp and / or 3933pp associated with process state 3033p1 ending (with the presumption that the next process state is beginning), and / or there may be transmissions 2922pp and / or 3933pp associated with process state 3033p2 beginning (with the presumption that the previous process state has ended).Similar to the previously described beginning of process 3003x, this may result from the fact that some transmissions 2922pp and / or 3933pp may trigger the end of process state 3033p1, some may be caused by the end of process state 3033p1, some may trigger the beginning of process state 3033p2, and some may be caused by the beginning of process state 3033p2. Similarly to the beginning of process 3003x, the transmissions 2922pp and / or 3933pp that trigger the beginning or end of a process state may do so by transmitting operational commands that cause the executing device(s) 3800 to perform operations that cause such beginning or end.Accordingly, transmissions triggered by the initiation or termination of a process state may convey operational information including data collected by one or more sensor devices 3200 in connection with such initiation or termination.

[0103] Additionally, during a process state (e.g., during one of the illustrated process states 3033p1 or 3033p2), there may be transmissions 2922p that convey operational commands and / or operational information between the monitored devices 2300a and 2300x, and / or corresponding transmissions 3933p between the monitored device 2300x and one or both of the sensor device(s) 3200 and / or the executing device(s) 3800. Again, such transmissions may convey operational information, which may include data collected by the sensor devices 3200 indicative of various measurements associated with a portion of the process 3003x occurring during a process state. Alternatively or additionally, such transmissions may convey operational commands that cause the executing device(s) 3800 to perform various operations during a process state.

[0104] As previously discussed, for the example process 3003x performed within the external system 3000x, the monitored devices 2300a and 2300x may together implement the logic for controlling the progression of these services through the various process states. As part of exercising such control, the logic implemented in each of the monitored devices 2300a and 2300x operates in a manner that is at least partially responsive to received inputs. While such inputs may include transmissions 2922 and / or 3933 originating from the monitored system 2000 and / or the external system 3000x, other such inputs may be external inputs originating entirely from outside of both the systems 2000 and 3000x.For example, monitored device 2300a may provide a user interface (not specifically shown) that can be used to manually control when execution of process 3003x begins and / or other aspects thereof. As another example, components and / or devices within external system 3000x may be subject to external influences (e.g., the availability of various external resources, weather conditions, etc.) that may limit, enable, and / or disable various aspects of process 3003x. Regardless of the nature of the external inputs, the timing of the external inputs may determine, at least in part, their impact on the performance of process 3003x.

[0105] The Fig. 3B and Fig. 3C show different examples of responses of logic 2345a and 2345x implemented in monitored devices 2300a and 2300x, respectively, to various combinations of such internal and external inputs. As each of these two figures illustrates, and as will be explained in more detail below, there are inherent time delays in implementing such logic that must be considered when providing emulations of computing devices implementing such logic, such as monitored devices 2300a and 2300x.

[0106] To Fig. 3B: The monitored device 2300a may implement a user interface (UI, not specifically shown) through which an operator of the monitored device 2300a may manually enter a command to cause the process 3003x performed within the external system 3000x to transition from process state 3033p1 to process state 3033p2. For example, such an operator may enter a command to perform an action such as heating a water-filled tank in the external system 3000x.

[0107] It is important to note that the timing of such manual operator input can be extremely difficult, if not impossible, to predict. This, in turn, can make the timing of the first transmission in the subsequent series of transmissions similarly difficult to predict. However, the timing of at least some of the subsequent transmissions relative to each other is much easier to predict, as will be explained in more detail below.

[0108] In response to receiving such a manually entered input from the operator, the logic 2345a implemented in the monitoring device 2300a may cause the monitored device 2300a to issue a transmission 2922cmd to the network 2999, which conveys an operational command to the monitored device 2300x to perform the commanded action (e.g., heating a tank). As will be explained in more detail below, such a response to such a manual input may be an example of a causal relationship implemented as part of the logic 2345a within the monitored device 2300a for controlling the process 3003x.

[0109] In response to receiving transmission 2922cmd, the monitored device 2300x may forward the operational command to perform the commanded action in a transmission 3933cmd1 to an executing device 3800 of the external system 3000x via the one or more communication links 3999x. As illustrated, there is a time delay within the monitored device 2300x between the time of receipt of transmission 2922cmd and the time of output of transmission 3933cmd1.

[0110] As will be explained in more detail below, this forwarding of the operational command through the monitored device 2300x and from the transmission 2922cmd to the transmission 3933cmd1 is an example of a causal relationship implemented as part of the logic 2345x within the monitored device 2300x for controlling the process 3003x. In other words, the logic 2345x implemented in the monitored device 2300x may include logic that causes such a forwarding of an operational command of this type through the monitored device 2300x and onward to the external system 3003x.

[0111] In response to receiving transmission 3933cmd1, the executing device 3800 can respond to the operational command contained therein to perform the commanded action (e.g., turning on a heater to heat a tank). The executing device 3800 can output a transmission 3933conf1 via links 3999x and back to the monitored device 2300x, conveying operational information confirming that the operational command is being executed by performing the commanded action.

[0112] In response to receiving transmission 3933conf1, monitored device 2300x can forward the operational information confirming that the operational command is being executed in a transmission 2922conf1 over network 2999 to monitored device 2300a. As shown, within monitored device 2300x, there is again a time delay between the time of receipt of transmission 3933conf1 and the time of output of transmission 2922conf1. The operator can be informed of this received confirmation via the user interface.

[0113] Within the external system 3000x, one or more sensor devices 3200 can output a series of transmissions indicating the results of the commanded action over time. More specifically, as the tank is heated, each transmission in a series of transmissions 3933sen1 through 3933senx can communicate operational information about the increasing temperature of the tank to the monitored device 2300x via the communication link(s) 3999x. The transmission 3933senx can communicate operational information indicating that the tank has reached a certain temperature associated with a transition to the process state 3033p2.

[0114] The time required to heat the tank to a specific temperature can depend on external influences, making it relatively difficult to predict. In particular, if the tank is part of a device exposed to the elements, the time required to heat the tank to a specific temperature can be affected by the weather. Thus, the number of transmissions within the range of transmissions 3933sen1 to 3933senx can be difficult, if not impossible, to predict, and this can make the time at which transmission 3933senx is output to connection(s) 3999x similarly difficult to predict.

[0115] In response to receiving transmission 3933senx, the monitored device 2300x can issue a transmission 3933cmd2, which conveys an operational command to the same executing device 3800 to stop executing the previous operational command in the previous transmission 3933cmd1. In this way, the executing device 3800 can be commanded to stop heating the tank. Again, there is a time delay within the monitored device 2300x between the time of receipt of transmission 3933senx and the time of output of transmission 3933cmd2.

[0116] In response to receiving transmission 3933cmd2, the executing device 3800 can respond to the operational command contained therein and stop executing the commanded action (e.g., stop heating the tank). The executing device 3800 can issue a transmission 3933conf2 via connection(s) 3999x and back to the monitored device 2300x, conveying operational information confirming that the previous operational command to heat the tank is no longer being executed.

[0117] In response to receiving transmission 3933conf2, the monitored device 2300x can forward the operational information confirming that the original operational command to heat the tank is no longer being executed in a transmission 2922conf2 via network 2999 to the monitored device 2300a. Again, there is a time delay within the monitored device 2300x between the time of receiving transmission 3933conf2 and the time of outputting transmission 2922conf2. The operator can be informed of this received confirmation via the user interface.

[0118] To Fig. 3C: During the execution of process 3003x, a condition may occur that requires stopping process 3003x as a safety measure. For example, the temperature of a device within external system 3000x may exceed a threshold detected by sensor device 3200, and logic 2345a and 2345x used by monitored devices 2300a and 2300x, respectively, may respond by automatically stopping process 3003x and communicating an alert to an operator.

[0119] Similar to the manual entry in the example above of Fig. 3B, the time at which a condition such as overheating occurs can be extremely difficult, if not impossible, to predict. This, in turn, can make the time at which a transmission responding to such an event is issued similarly difficult to predict. It should be noted, however, that the timing of at least some of the transmissions relative to each other can be predicted much more easily, as will be explained further below.

[0120] During a process state 3033p of process 3003x, one or more sensor devices 3200 of external system 3000x may output a series of transmissions 3933sen1 through 3933senx to communication link(s) 3999 and to monitored device 2300x. Each of these transmissions in this series may convey operational information about the status of one or more aspects of process 3003x, which may include the temperature of a device of external system 3003x.

[0121] As illustrated, the process 3003x may go awry, resulting in a transition from the illustrated process state 3033p, in which the process 3003x may run normally, to an unsuitable (illegible) state 3033i, in which the process 3003x no longer runs normally. For the purposes of this example, the temperature of the same device of the external system 3003x may have risen above a certain threshold.

[0122] In response to receiving transmission 3933senx, logic 2345x implemented in monitored device 2300x for controlling process 3003x may issue two transmissions. One of the two transmissions may be a transmission 2922alert issued over network 2999 to convey operational information to monitored device 2300a, including a warning that a condition, such as an excessive temperature level of a device, has occurred. Logic 2345a in monitored device 2300a for controlling process 3003x may display the warning to an operator via a user interface (not specifically shown).The other of the two transmissions may be a transmission 3933cmd issued over the connection(s) 3999x to convey an operational command to an executing device 3800 within the external system 3000x to perform an action that stops the process 3003x.

[0123] As shown, the issuance of each of the transmissions 2922alert and 3933cmd occurs with some delay after the receipt of the transmission 3933senx. As also shown, the delay in the issuance of the transmission 3933cmd may be somewhat longer because the logic 2345x implemented in the monitored device 2300x must determine whether the process 3003x should be stopped and, if so, what action(s) should be taken to stop the process 3003x.

[0124] In response to receiving transmission 3933cmd, an executing device 3800 of the external system 3000x may respond to the operational command contained therein to stop the process 3003x. The executing device 3800 may issue a transmission 3933conf over the connection(s) 3999x and back to the monitored device 2300x, conveying operational information confirming that the operational command to stop the process 3003x is now being executed.

[0125] In response to receiving transmission 3933conf, monitored device 2300x can forward the operational information confirming that process 3003x is stopped in a transmission 2922conf over network 2999 to monitored device 2300a. Again, there is a time delay within monitored device 2300x between the time of receipt of transmission 3933conf and the time of output of transmission 2922conf. The operator can be informed of this received confirmation via the user interface. Collecting data for creating emulations ---- Collection phase

[0126] In the Fig. 4A, Fig. 4B and Fig. 4C together, various aspects of the acquisition phase are illustrated, in which one or more monitoring devices 1500 are prepared for monitoring and / or correcting erroneous network traffic through the network 2999. Again, at a time prior to the pre-training phase (which is described with reference to Fig. 5A-F), one or more sensing devices 5700 may be temporarily coupled to one or more exchange devices 2700 and / or one or more relay devices 3700x of link(s) 3999x to generate observation data 5370, which is provided to one or more emulation devices 5500. Emulation device(s) 5500 may also be provided with device data 5530 describing aspects of at least monitored device 2300, such as monitored devices 2300a and 2300x.

[0127] To Fig. 4A: As already mentioned, the data required to generate such emulations of parts of the monitored system 2000, the external system 3000x, and / or the process 3003x includes the observation data 5730, which documents at least transmissions 2922 between the monitored devices 2300a and 2300x via the network 2999, which are associated with the control of the process 3003x within the external system 3000x. It may be considered advantageous for such documented transmissions 2922 to include entire sets of transmissions 2922 associated with the control of several complete outputs of the process 3003x. In this way, variations in transmission timing, parameters in transmissions of operational commands, and / or data values ​​of transmissions of operational information, which can be considered normal variations, can be taken into account in the generated emulations.This, in turn, may enable the monitoring device(s) 1500 to distinguish such normal fluctuations from anomalous fluctuations, which are at least more likely to be associated with a malfunction or a cyberattack.

[0128] As already discussed, it may also be desirable, if possible, to cause the observation data 5730 to similarly document entire sets of corresponding transmissions 3933 that are also associated with the same multiple complete performances of the process 3003x. The inclusion of information about the content and timing of the transmissions 3933 may enable a more accurate emulation of the progression of a process (e.g., the process 3003x) through its process states.

[0129] Here, too, great care is typically taken not to take any action that might impair the functionality of the one or more links 3999 that couple an external system 3000 to one of the monitored devices 2300. This arises from the fact that the link(s) 3999 often provide a direct connection between the sensing devices 3200 and the executing devices 3800 that most immediately cause changes in the process state, including changes to a preselected non-process state in response to an unexpected condition that may damage the equipment and / or pose a hazard. Therefore, attaching devices to the link(s) 3999x as part of capturing and documenting the transmissions 3933 that take place there may be considered an unacceptable risk.Consequently, at least in cases where components such as the relay device(s) 3700x are unavailable and / or cannot be coupled, it may be considered more desirable to obtain such information about such transmissions 3933 from log data that may be generated and maintained by the monitored device(s) 2300 directly involved in such communications (e.g., the illustrated log data 2330x of the monitored device 2300x).

[0130] To Fig. 4B: As previously discussed, each of the control routines 2340a and 2340x of the monitored devices 2300a and 2300x may implement logic 2345a and 2345x, respectively, which are part of the logic used to control the performance of the process 3003x. Therefore, the device data 5530 may be generated to include copies of the two control routines 2340a and 2340x, which are executed in execution environments generated as part of generating emulations of the monitored devices 2300a and 2300x, respectively.

[0131] As also illustrated, the device data 5530 may also include device specifications 2305a and 2305x, each of which may indicate various characteristics of the hardware and / or software of a corresponding one of the monitored devices 2300a and 2300x. These characteristics include, but are not limited to, the type and / or revision of the processor(s), the type and amount of volatile and / or non-volatile memory, the type and revision of the operational system and / or driver software being executed, the type and revision of other software being executed, the type and / or revision of the network interface(s), etc. Providing such information may enable more accurate emulation of each of the monitored devices 2300a and 2300x by enabling more accurate emulations of their components.

[0132] In some embodiments, the device data 5530 may additionally include a state machine definition 3005x describing various aspects of the process states of the process 3003x. It should be noted that embodiments are possible in which the device data 5530 is not available and therefore not included in the device data 5530. This may be the case for security and / or trade secret reasons, where information about details of the process 3005x is deemed too sensitive to be disclosed. Alternatively or additionally, a description of the process 3005x as a state machine may never have been created, so it simply does not exist.Therefore, in those embodiments where the state machine definition 3005x is not available for any reason, the state machine definition 3005x may be derived from other information included in the device data 5530 and / or in the observation data 5730 as part of the pre-training phase for preparing the monitoring device(s) 1500 for deployment.

[0133] To Fig. 4C: In embodiments where state machine definition 3005x is provided, state machine definition 3005x may include a separate state entry 3007 for each process state and / or an identification entry 3006 describing various aspects of the manner in which execution of process 3003x is caused to begin.

[0134] With regard to the illustrated ID entry 3006, various conditions and / or events that trigger and / or indicate the start of the process 3005x can be specified. For example, such a specification can specify one or more specific transmissions 2922 through the network 2999 and / or one or more specific transmissions 3933 through the connection(s) 3999x that can trigger and / or indicate the start of the process 3005x. Furthermore, for each transmission, the transmission type (e.g., transmission of an operational command or transmission of operational information), parameter values ​​for operational commands, and data values ​​for operational information can be specified. If multiple values ​​are possible for a parameter value or a data value, a group of discrete values ​​and / or a range of values ​​can be specified in various ways (e.g.,a maximum value or upper bound, a minimum value or lower bound, a median value, a mean value, an average value, a list of discrete values, a model / formula for deriving values, a probability distribution, etc.).

[0135] In some embodiments where upper and / or lower limits are specified for a value, such upper and / or lower limits may be selected to include values ​​associated with various error conditions that have been planned such that the state machine of process 3003x and / or logic 2345a and / or 2345x have been designed to include measures to address those conditions. Indeed, in some embodiments, ranges of values ​​and / or sets of discrete values ​​may be specified for parameter values ​​and / or data values ​​associated with performance of process 3003x without error conditions, and other ranges of values ​​and / or sets of discrete values ​​may be specified for parameter values ​​and / or data values ​​associated with performance of process 3003x in which one or more expected error conditions occur.

[0136] With respect to the exemplary state entry 3007, for each state entry 3007, various conditions and / or events that cause and / or indicate entry into the corresponding state, that cause and / or indicate exit from the corresponding state, and / or that cause and / or indicate selection of the next state can be specified. For example, such a specification can specify one or more specific transmissions 2922 via the network 2999 and / or one or more specific transmissions 3933 via the connection(s) 3999x that can trigger and / or indicate such entry into the corresponding state and / or such exit from the corresponding state and / or that can cause and / or indicate selection of the next state.Furthermore, for each transmission, the transmission type, parameter values ​​for operational commands, and data values ​​for operational information can be specified. If multiple values ​​are possible for a parameter value or a data value, a group of discrete values ​​and / or a range of values ​​can be specified in various ways (e.g., a maximum value or upper limit, a minimum value or lower limit, a median value, a mean value, an average value, a list of discrete values, a model / formula for deriving values, a probability distribution, etc.). In addition, each state entry 3007 can also specify upper and / or lower time limits for performing various actions during the corresponding state. Use of the collected data to define aspects of the emulations ---- Pre-training phase

[0137] The Fig. 5A, Fig. 5B, Fig. 5C, Fig. 5D, Fig. 5E and Fig. 5F taken together show various aspects of the pre-exercise phase of preparing one or more monitoring devices for use in monitoring and / or correcting inappropriate network traffic through the network 2999. At a time after the acquisition phase (previously described with reference to the Fig. 4A-C) and before the training phase (which was discussed with reference to the Fig. 6A-B), one or more emulation devices 5500 may use the observation data 5730 along with the device data 5530 to prepare for generating emulations of portions of the monitored system 2000, the external system 3000x, and / or the process 3003x. In this way, preparations are made to use such emulations together to prepare the one or more monitoring devices 1500.

[0138] With a view to the Fig. 5A, the control routine 5540 executed by the processor(s) 5550 of at least one of the emulation devices 5500 may include an interpretation component 5541 for parsing and / or analyzing the logic used by the monitored devices 2300, a correlation component 5542 for correlating portions of such logic and / or state machine definitions, and an augmentation component 5543 for initiating the generation of the database 5533.

[0139] As previously mentioned, each of the monitored devices 2300 (including the monitored devices 2300a and 2300x) may be a computing device. Therefore, it is contemplated that each monitored device 2300 may include a variety of processor types, memory components, peripheral components, etc. As a result, a variety of processor command sets, peripheral and / or memory addressing architectures, etc., may be used. The device specifications 2305a and 2305x in the device data 5530 may specify such aspects of each monitored device 2300a and 2300x, thereby enabling the selection of a version of the interpretation component 5541, which may include an appropriate instruction decompiler, analyzer, and / or interpreter to enable parsing of the logic 2345a and 2345x, respectively, when the interpretation component 5541 is executed by the processor(s) 5550 of at least one of the emulation devices 5500.

[0140] As also previously discussed, in some embodiments, a state machine definition 3005 (such as state machine definition 3005x) describing the set of process states 3033 of the process 3003 being controlled may be provided, while in other embodiments, such a state machine definition 3005 may not be provided.

[0141] In embodiments where state machine definition 3005x is provided, execution of correlation component 5542 may cause processor(s) 5550 to identify the process states 3033 of process 3003x that correspond to each of the various portions of logic 2345a and 2345x. Once such correlations are identified, execution of augmentation component 5543 may cause processor(s) 5550 to generate database 5533 containing the contents of state machine definition 3005x with extensions from the correlated portions of logic.

[0142] In embodiments where the state machine definition 3005x is not provided, execution of the correlation component 5542 may cause the processor(s) to identify portions of the logic 2345a with portions of 2345x. The processor(s) 5550 may then be caused to derive the set of process states 3033 of the process 3003x from the now correlated combination of the logic 2345a and the logic 2345x. Once such correlations are identified and the set of process states 3033 is derived, execution of the augmentation component 5543 may cause the processor(s) 5550 to generate the database 5533.

[0143] Thus, the database 5533 can be generated to have an internal structure similar to that of the state machine definition 3005x, which may or may not have been provided (see Fig. 4C). More specifically, the database 5533 may have an ID entry 5536 and a plurality of state entries 5537, which would correspond in organization and content to the ID entry 3006 and the plurality of state entries 3007, respectively, in the state machine definition 3005x (if any).

[0144] However, compared to ID entry 3006, ID entry 5536 of database 5533 may contain additional information extrapolated from correlations to portions of logic 2345a and 2345x associated with triggering the start of execution of process 3003x. Such additional information may include, among other things, upper and / or lower limits of parameter values ​​and / or data values ​​and / or upper and / or lower limits for the times at which each transmission should occur. Such information may be descriptive of both transmissions 2922 running over network 2999 and transmissions 3933 running over network 3999.

[0145] Additionally, each state entry 5537 of database 5533 may contain additional information compared to state entries 3007, extrapolated from correlations to portions of logic 2345a and 2345x associated with the corresponding process state 3033 of process 3003x. Again, such additional information may include, among other things, upper and / or lower limits for parameter values ​​and / or data values ​​and / or upper and / or lower limits for the times at which each transmission should occur. Again, such information may be descriptive of both transmissions 2922 passing through network 2999 and transmissions 3933 passing through network 3999.

[0146] With respect to such extrapolations from logic 2345a and 2345x, it should be noted that while state machine definition 3005x may have specified various constraints on timings, parameter values, and / or data values ​​based on various requirements for each state of process 3003x, logic 2345a and / or 2345x may impose additional constraints that must also be met. As a result, the specifications of the timings, parameter values, and / or data values ​​within ID entry 5536 and state entries 5537 may be more stringent than the corresponding specifications based solely on the state machine definition 3005x.

[0147] To Fig. 5B: The correlation component 5542 may be executed again to cause the processor(s) 5550 to correlate each of the observed transmissions 2922 / 3933 indicated in the observation data 5730 with one of the process states described in the database 5533 for the process 3003x. The augmentation component 5543 may also be executed again to cause the ID entry 5536 and each of the state entries 5537 to be augmented with information about times, operational commands, parameter values, and / or data values ​​actually observed for each of the observed transmissions 2922 / 3933.

[0148] As a result, entries 5536 and 5537 of database 5533 are caused to contain references to real observations for such information for each transmission 2922 / 3933 associated with each state, in addition to the ranges and / or sets of possible times, commands, and / or values ​​specified by state machine definition 3005x and / or extrapolated from logic 2345a and 2354x.

[0149] In some embodiments, a statistical analysis may be performed based on the observed times of the observed transmissions 2922 / 3933, taking into account any variations in the times that may be observed across multiple executions of process 3003x. Based on such an analysis for each transmission, a time range for the expected occurrence of the transmission may be specified in the database 5533, or a probability distribution for the expected occurrence of the transmission may be specified.

[0150] To Fig. 5C: The control routine 5540 may also include an emulation component 5544 and a timing component 5545. Execution of the emulation component 5544 may cause the processor(s) 5550 of one of the emulation devices 5500 to instantiate an execution environment in which the control routine 2340a of the monitored device 2300a may be executed. As depicted, such an execution environment may be a virtual machine (VM) or a container 5566. Regardless of the precise type and / or characteristics of the provided execution environment, further execution of the emulation component 5544 may cause the processor(s) 5550 to retrieve information about characteristics of the monitored device 2300a from the device specification 2305a in order to implement aspects of the provided execution environment (e.g.,the VM or container 5566), thereby providing an execution environment for the execution of the control routine 2340a that relatively closely mimics various aspects of the execution environment normally provided to the control routine 2340a within the monitored device 2300a.

[0151] With such an execution environment, execution of the timing component 5545 by the processor(s) 5550 may cause the retrieval of information about time periods between transmissions 2922 and / or 3933 that are causally connected by portions of the logic 2345a of the control routine 2340a. Briefly returning to the Fig. 3B-C: As discussed with respect to logic 2345x, there may be portions of this logic that are triggered to output a transmission 2922 / 3933 in response to receiving a transmission 2922 / 3933, and such a response may occur with some time delay. As also discussed (but not specifically illustrated), similar responses with time delays may also be exhibited by logic 2345a. As previously discussed, observation data 5730 includes timing information for each observed transmission 2922 and 3933, documenting the amount of time elapsed for each such delay.

[0152] Back to the Fig. 5C: During execution of the timing component 5545, the clock speed, the number of processing cycles per second assigned to the VM or container 5566, and / or another parameter that influences the execution speed of the control routine 2340a therein may be manipulated to cause the timing delays exhibited by the logic 2345a therein to at least relatively closely match those documented in the observation data 5730. In this way, a timing setting may be identified that causes the timing behavior of the logic 2345a within the VM or container 5566 to match the timing behavior of the logic 2345a within the monitored device 2300a. An indication of the timing setting that causes such timing behavior may then be added to the device data 5530 as the illustrated tuning specification 2307a.

[0153] To Fig. 5D: A similar use of information in the device specification 2305x, the emulation, and the timing may be performed to similarly identify a timing setting for the logic 2345x, and an indication thereof may be stored in the device data 5530 as the tuning specification 2307x.

[0154] Having identified such timing settings for use in emulating the monitored devices 2300a and 2300x, the monitored devices 2300a and 2300x can now be emulated with relatively accurate timing information.

[0155] To the Fig. 5E-F: The control routine 5540 may additionally include a test component 5546 to perform various tests of an emulated combination of the monitored devices 2300a and 2300x interacting with an emulation of the process 3003x based on the state machine definition 3005x. Upon execution of the emulation component 5544, the processor(s) 5550 of at least one of the emulation devices 5500 may be caused to instantiate VMs or containers 5566 in which the execution environments of the monitored devices 2300a and 2300x may be emulated so that the control routines 2340a and 2340x, respectively, may be executed therein. In addition, another VM or container 5566 may be instantiated in which the state machine of the process 3003x may be implemented.Upon further execution of the emulation component 5544, communication between these VMs or containers 5566 may be enabled to enable transmissions 2922 and 3933 between them in a manner that mimics the communication enabled by the network 2999 and the connection(s) 3999x.

[0156] When executing test component 5546, processor(s) 5550 may be caused to analyze database 5533 for lower and / or upper time limits for events that trigger the output of transmissions 2922 and / or 3933. Such events may include simulated operator inputs via a user interface to logic 2345a and / or simulated measurements taken by simulated sensor devices 3200 for process 3003x. Experiments may then be performed executing each of these simulated inputs, each timed to meet the corresponding lower and upper time limits. In this way, edge and / or corner cases may be tested based on corresponding upper and / or lower limits of transmissions 2922 and / or 3933 triggered by these inputs.

[0157] Further execution of test component 5546 can then cause the resulting test times of these transmissions 2922 and / or 3933 to be documented, and execution of augmentation component 5543 can then cause the information already present in database 5533 regarding the times of the transmissions to be expanded to include these observed test times. In this way, in addition to the timings actually observed during normal operation of the monitored system 2000 together with process 3003x, the upper and / or lower limits for timings at which transmissions 2922 and / or 3933 could actually occur in edge and / or corner cases can also be added to database 5533.

[0158] In some embodiments, the resulting combination of transmission timings extrapolated from the combination of logic 2345a and 2345x, actually observed during normal operation, and derived from such edge and / or corner case experiments as just described, may be combined to generate indications in database 5533. As a result, database 5533 may contain indications for each transmission regarding which timings are theoretically possible versus which timings are possible under unlikely extreme timing conditions and versus which timings have actually been observed.In some of these embodiments, each such indication of times for transmission may take the form of a probability distribution indicating the relative probabilities of theoretically possible times compared to unlikely times under extreme conditions and compared to times actually observed to occur.

[0159] Regardless of the precise manner in which such time information is represented in the database 5533, such comprehensive time information may, at least for transmissions 2922 through the network 2999, enable a better discrimination between suitable and unsuitable transmissions 2922 through the network 2999, as well as a more reliable identification of when a period of time has elapsed without an expected transmission 2922 having occurred. Alternatively or additionally, such comprehensive time information for transmissions 2922 and / or 3933 may enable the provision of emulations based on such time information for diagnostic, testing, and / or training purposes.

[0160] As in the Fig. 5F, after the database 5533 has been created as described above, execution of a generation component 5547 of the control routine 5540 may cause the processor(s) 5550 of an emulation device 5500 to generate the database 1533 therefrom. The database 1533 may have somewhat reduced content compared to the database 5533. For example, information about transmissions 3933 over the connection(s) 3999x may not be included in the database 1533 because the communication traffic over the connection(s) 3999x is not normally monitored by the monitoring device(s) 1500. Using the emulations ---- Training phase

[0161] In the Fig. 6A and Fig. 6B illustrates various aspects of the training phase in which one or more monitoring devices are prepared for monitoring and / or correcting inappropriate network traffic over the network 2999. Again, at a time after the pre-training phase (which has just been described with reference to the Fig. 5A-F) and prior to such actual use of the monitoring device(s) 1500 in monitoring and / or correcting inappropriate network traffic through the network 2999, the monitoring device may be temporarily connected to the emulation device(s) 5500 to be trained and / or tested using the emulated network traffic under the emulations of various monitored devices 2300 (e.g., emulations of the monitored devices 2300a and 2300x).

[0162] As in Fig. 6A, the database 5533 may be used as input to a UI component 5548 of the control routine 5540 to control the presentation of manual testing options to an operator via a user interface using an input device 5520 and / or a display 5580 of an emulation device 5500. More specifically, the database 5533 may be used to present an operator with options for defining one or more experiments based on the indications within the database 5533 of which parameter values, data values, time points, etc., have been determined to be possible as a result of the previously described interpretation, extrapolation, and experimentation processes.

[0163] To Fig.6B: As part of such a test, the monitoring device(s) 1500 may be placed in a training mode to enable the learning of new possible transmissions 2922 that may occur as part of normal network traffic on the network 2999, to enable the learning of new possible parameter values ​​and / or data values ​​for the contents of transmissions 2922 that may occur over the network 2999, and / or to enable the learning of new times for these transmissions 2922. Consequently, such new information about transmissions 2922 that may occur over the network 2999 may be added to the specifications of transmissions, transmission contents, and / or transmission times already stored in the database 1533 in the monitoring devices 1500.

[0164] The possible uses of the emulations provided by the emulation device(s) 5500 include, but are not limited to, the following: (a) Archival storage: A facility's support team may wish to save its network traffic captures for historical and future comparison purposes; (b) Device function validation: Checking and / or verifying the functioning of operational technology (OT) network equipment, industrial control system (ICS) processes, and on-site equipment; (c) Diagnostic troubleshooting: Troubleshooting the functioning of operational technology (OT) network equipment, ICS processes, and on-site equipment to find and resolve problems that are otherwise difficult to detect and / or resolve;d) Data mining (AI or otherwise): Uncovering tiny as well as large-scale patterns and trends in the control and utilization of production assets that could not otherwise be readily uncovered; (e) Cybersecurity malware and hacker analysis: Isolating and analyzing erratic, malicious, or detrimental OT network traffic sent or otherwise altered by nefarious attackers and / or their hardware / software equipment; (f) Monitoring and reporting: There are entire classes of critical and sophisticated asset reports that are practically impossible to produce by any other means; g) Cost-performance analysis and improvement: Conducting in-depth, real-time technical, production, and / or performance investigations on an entire ICS facility full of devices from different makes and models, all manufactured simultaneously;h) Product development and product improvement: ICS providers investigating the function and performance of their respective ICS hardware and software products, each for their own purposes of product improvement and new product development;

[0165] Although this disclosure has been described in connection with specific embodiments, it is evident that numerous alternatives, modifications, and variations will be apparent to those skilled in the art within the spirit and scope of the above disclosure. QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited patent literature

[0000] US 18 / 206,003 [0001, 0002] US 18 / 206,008

[0001] US 17 / 106,060 [0001, 0003] US 11,711,382

[0001] US 18 / 206,008

[0002] US 63 / 445,654

[0002] US 63 / 445,663

[0002] US 62 / 941,576

[0003]

Claims

[1] Emulation system comprising a processor configured to perform operations comprising: Correlating a first set of transmissions over a network of a monitored system with a first set of responses of a first control routine logic executing in a first monitored device of the monitored system, the monitored system controlling an industrial process performed in an external system coupled to the monitored system; Adjusting a first parameter that affects an execution speed of the first control routine logic within a first emulation of the first monitored device to effect a response time of the first set of responses with an adjustment to a time between two transmissions of the first set of transmissions; and Using at least the first emulation to prepare a monitoring device for monitoring the network to detect inappropriate network activities that affect the industrial process while the monitored system controls the industrial process. [2] The emulation system of claim 1, wherein the response of the first set of responses to receipt of a first transmission of the two transmissions at the first monitored device and from the network comprises: a response of the first control routine logic by outputting a second transmission of the two transmissions from the first monitored device and to the network. [3] Emulation system according to claim 1, wherein: the first set of transmissions between at least the first monitored device and a second monitored device of the monitored system runs through the network; and the processor is further configured to perform operations comprising: Correlating the first set of transmissions with a second set of responses of a second control routine logic executing in the second monitored device; Adjusting a second parameter that affects an execution speed of the second control routine logic within a second emulation of the second monitored device to cause a different response time of the first set of responses with an adjustment to a time between two other transmissions of the first set of transmissions; and Using the second emulation in conjunction with the first emulation to prepare the monitoring device to monitor the network to detect inappropriate network activities that affect the industrial process while the monitored system controls the industrial process. [4] The emulation system of claim 3, wherein at a time prior to preparing the monitoring device, the monitoring device is connected to the network to detect the first set of transmissions between the first monitored device and the second monitored device. [5] The emulation system of claim 3, wherein, at a time prior to preparation of the monitoring device, a separate detection device is connected to the network to detect the first set of transmissions between the first monitored device and the second monitored device. [6] The emulation system of claim 3, wherein at a time prior to the preparation of the monitoring device, either the first monitored device or an exchange device of the network is configured to detect, by executing instructions of an executable routine, the first set of transmissions traversing the network between the first monitored device and the second monitored device. [7] Emulation system according to claim 1, wherein: the first monitored device is connected to the external system via a communication link; and the processor is further configured to perform operations comprising: Correlating a second set of transmissions over the communication link with the first set of responses of the first control routine logic executing within the first monitored device; and Adjusting the first parameter that affects the execution speed of the first control routine logic within the first emulation to cause a different response time of the first set of responses with an adjustment to a time between two other transmissions of at least one of the first set of transmissions and the second set of transmissions. [8] The emulation system of claim 7, wherein the other response of the first set of responses to receiving a first transmission of the other two transmissions at the first monitored device and from one of the network and the communication link comprises: responding the first control routine logic by issuing a second transmission of the two transmissions from the first monitored device and to another of the network and the communication link. [9] The emulation system of claim 7, wherein the other response of the first set of responses to receiving a first transmission of the other two transmissions at the first monitored device and from the communication link comprises: responding the first control routine logic by outputting a second transmission of the two transmissions from the first monitored device and onto the communication link. [10] Emulation system according to claim 1, wherein: the external system has at least one of the following options: a sensor device for measuring an aspect of the industrial process within the external system; or an executive device for controlling an aspect of the industrial process within the external system; and the first set of transmissions has at least one of the following options: a transmission that transmits operational information indicating the action from the detection device to the first monitored device; or a transmission that conveys an operational command from the first monitored device to the executing device. [11] Emulation system according to claim 10, wherein: an output of the industrial process can be described as a state machine in which the output progresses, one state after another, through a set of states; and the processor is further configured to perform operations comprising: Analysis of at least one of the definitions of the state machine or the logic of the first control routine to identify one of the following characteristics: a time limit for a transmission from the first set of transmissions; a parameter limit value of a parameter operational command in a transmission; or a data value limit for operational information in a transmission; Use the identified boundary of the time, parameter, or data value boundary in the first emulation to test the preparation of the monitoring device to detect inappropriate network activities. [12] Emulation system according to claim 11, wherein: the time limit of the transmission indicates a time at which the transmission is expected to be fed into the network; the parameter limit of the parameter has at least one of an upper limit or a lower limit for a value range of the parameter; and the data value boundary of the operational information has at least one of an upper limit or a lower limit for a value range for the data value. [13] Emulation system according to claim 1, wherein the monitoring device is prepared to respond to an instance of inappropriate network activity by performing an operation comprising at least one of the following options: Providing a warning of the case; Recording a statement of the case; Issuing a transmission into the network to replace an expected transmission that did not occur in the network; and Issue a transmission to the network to undo or replace an inappropriate transmission. [14] A method for preparing a monitoring device for monitoring a network, comprising: by a processor of an emulation system, correlating a first set of transmissions over a network of a monitored system with a first set of responses of a first control routine logic executing in a first monitored device of the monitored system, the monitored system controlling an industrial process performed in an external system coupled to the monitored system; adjusting, by the processor, a first parameter that affects an execution speed of the first control routine logic within a first emulation of the first monitored device to effect a response time of the first set of responses with an adjustment to a time between two transmissions of the first set of transmissions; and by the processor using at least the first emulation to prepare the monitoring device to monitor the network to detect inappropriate network activities that affect the industrial process while the monitored system controls the industrial process. [15] The method of claim 14, wherein the response of the first set of responses to receipt of a first transmission of the two transmissions at the first monitored device and from the network comprises: responding the first control routine logic by outputting a second transmission of the two transmissions from the first monitored device and to the network. [16] The method of claim 14, wherein: the first set of transmissions between at least the first monitored device and a second monitored device of the monitored system passes through the network; and the procedure continues to have: correlating, by the processor, the first set of transmissions with a second set of responses from a second control routine logic executing in the second monitored device; adjusting, by the processor, a second parameter that affects an execution speed of the second control routine logic within a second emulation of the second monitored device to cause a different response time of the first set of responses with an adjustment to a time between two other transmissions of the first set of transmissions; and by the processor using the second emulation in conjunction with the first emulation to prepare the monitoring device to monitor the network to detect inappropriate network activities that affect the industrial process while the monitored system controls the industrial process. [17] The method of claim 16, wherein at a time prior to preparing the monitoring device, the monitoring device is connected to the network to detect the first set of transmissions between the first monitored device and the second monitored device. [18] The method of claim 16, wherein at a time prior to preparing the monitoring device, a separate detection device is connected to the network to detect the first set of transmissions between the first monitored device and the second monitored device. [19] The method of claim 16, wherein at a time prior to the preparation of the monitoring device, either the first monitored device or an exchange device of the network is configured to detect, by executing instructions of an executable routine, the first set of transmissions traversing the network between the first monitored device and the second monitored device. [20] The method according to claim 14, wherein: the first monitored device is connected to the external system via a communication link; and the procedure continues to have: by the processor correlating a second set of transmissions over the communication link with the first set of responses of the first control routine logic executing within the first monitored device; and by the processor adjusting the first parameter that affects the execution speed of the first control routine logic within the first emulation to cause a different response time of the first set of responses with an adjustment to a time between two other transmissions of at least one of the first set of transmissions and the second set of transmissions. [21] The method of claim 20, wherein the other response of the first set of responses to receiving a first transmission of the other two transmissions at the first monitored device and from one of the network and the communication link comprises: responding the first control routine logic by outputting a second transmission of the two transmissions from the first monitored device and to another of the network and the communication link. [22] The method of claim 20, wherein the other response of the first set of responses to receiving a first transmission of the other two transmissions at the first monitored device and from the communication link comprises: responding the first control routine logic by outputting a second transmission of the two transmissions from the first monitored device and onto the communication link. [23] A method according to claim 14, wherein: the external system has at least one of the following options: a sensor device for measuring an aspect of the industrial process within the external system; or an executive device for controlling an aspect of the industrial process within the external system; and the first set of transmissions has at least one of the following options: a transmission that transmits operational information indicating the action from the detection device to the first monitored device; or a transmission that conveys an operational command from the first monitored device to the executing device. [24] A method according to claim 23, wherein: an output of the industrial process can be described as a state machine in which the output progresses, one state after another, through a set of states; and the procedure continues to have: by the processor analyzing at least one of the definitions of the state machine or the logic of the first control routine to identify one of the following characteristics: a time limit for a transmission from the first set of transmissions; a parameter limit value of a parameter operational command in a transmission; or a data value limit for operational information in a transmission; by the processor using the identified boundary from the time, parameter, or data value boundary in the first emulation to test the preparation of the monitoring device to detect inappropriate network activities. [25] A method according to claim 24, wherein: the time limit of the transmission indicates a time at which the transmission is expected to be fed into the network; the parameter limit of the parameter has at least one of an upper limit or a lower limit for a value range of the parameter; and the data value boundary of the operational information has at least one of an upper limit or a lower limit for a value range for the data value. [26] A method according to claim 14, wherein the monitoring device is prepared to respond to an instance of inappropriate network activity by performing an operation comprising at least one of the following options: Providing a warning of the case; Records of a statement of the case; issuing a transmission into the network to replace an expected transmission that did not occur in the network; and Issue a transmission to the network to undo or replace an inappropriate transmission.

Images