Adaptive security level of wireless sensors

Abstract

To provide a method, apparatus and computer-readable medium for setting a security level of wireless sensors communicating with a switch.SOLUTION: The method includes, in a security device linked to the switch: collecting data frames sent from the wireless sensors to the switch and creating a dataset S1; identifying traffic patterns of the data frames S2; introducing traffic anomalies into the dataset S3; randomizing the dataset and dividing it into a testing dataset and a training dataset S4; training a machine learning model of traffic anomalies, and validating the machine learning model if it reaches a threshold of accuracy S5; detecting a traffic anomaly during operation of the wireless sensors by using the machine learning model S6; and triggering an alert and adapting the security level of the wireless sensor S7.SELECTED DRAWING: Figure 2

Description

Technical Field

[0001] The present invention generally relates to industrial automation systems, and more particularly to the security level of wireless sensors in industrial automation systems.

Background Art

[0002] The Internet of Things (IoT) is an essential element in the digital development of enterprises. In many markets, connected objects acquire valuable information. Industrial IoT devices are mainly sensors linked to machines in various industrial sites, which measure, record, and analyze operating data and transmit it to a data center. These sensors are mainly wireless devices powered by built-in batteries.

[0003] When a new wireless sensor is added to the network of an industrial automation system, it is commissioned with advanced cyber security protection regardless of the actual threats existing in the network. Using advanced cyber security protection may induce battery consumption of the wireless sensor.

Summary of the Invention

Problems to be Solved by the Invention

[0004] Therefore, it is necessary to adapt the cyber security level of wireless sensors in industrial automation systems.

Means for Solving the Problems

[0005] This summary is provided to introduce concepts related to the subject matter of the present invention. This summary is neither intended to identify essential features of the subject matter according to the claims nor intended to be used in determining or limiting the scope of the subject matter according to the claims.

[0006] One implementation provides a method for setting the security level of a wireless sensor communicating with a switch, the method being provided in a security device linked to the switch, The steps include: collecting data frames transmitted from a wireless sensor to a switch, and creating a dataset containing the collected data frames; A step of identifying patterns associated with a wireless sensor from collected data frames, wherein each pattern is based on a periodic time interval for the wireless sensor to transmit two consecutive data frames, or on the number of data frames transmitted by the wireless sensor within a usage time interval. Regarding traffic patterns, the steps involve introducing simulated traffic anomalies into the dataset, The steps include: randomizing the dataset, dividing the randomized dataset into a training dataset and a test dataset, wherein the training dataset contains more data frames than the test dataset; The process involves training a machine learning model configured to detect traffic anomalies using a training dataset, and then enabling the machine learning model once it reaches an accuracy threshold on the test dataset. The steps include detecting a given wireless sensor traffic anomaly during wireless sensor operation by analyzing the current data frame transmitted from the wireless sensor to the switch and using an enabled machine learning model, Steps to trigger a security alert based on detected traffic anomalies, The method comprises the step of adapting at least the security level of a given wireless sensor based on a triggered security alert.

[0007] Advantageously, this method allows for the commissioning of power limits for wireless sensors within an industrial network at an appropriate security level, based on a risk assessment of the existing network, instead of the conventional approach of commissioning wireless sensors with the highest level of cybersecurity protection, which significantly shortens the battery life of the wireless sensors.

[0008] In one embodiment, the wireless sensor is powered by a built-in battery.

[0009] Advantageously, adaptive security for wireless sensors based on machine learning for traffic anomaly detection allows for longer battery life of these wireless sensors, thus reducing maintenance costs.

[0010] In one embodiment, a traffic anomaly in a given wireless sensor corresponds to a frequency or number of data frames transmitted by the wireless sensor being greater than the traffic pattern associated with the given wireless sensor.

[0011] In one embodiment, the pattern associated with a wireless sensor is based on a periodic time interval for the wireless sensor to transmit two consecutive data frames, when the wireless sensor is a periodic wireless sensor that transmits operational data at periodic time intervals.

[0012] In one embodiment, the pattern associated with a wireless sensor is based on the number of data frames transmitted by the wireless sensor during an operating time interval, when the wireless sensor is a non-periodic wireless sensor that transmits operational data in event time.

[0013] In one embodiment, the security level is applied to a given wireless sensor of the same type, or to all wireless sensors, based on the triggered security alert.

[0014] In one embodiment, a traffic anomaly of a given wireless sensor is detected when the data frames transmitted by the given wireless sensor correspond to an increase in traffic with respect to a pattern associated with the given wireless sensor.

[0015] In one embodiment, the machine learning model is based on a supervised random forest model.

[0016] In another implementation, a device is provided for setting the security level of a wireless sensor communicating with a switch, and this security device is linked to the switch, A means for collecting data frames transmitted from a wireless sensor to a switch and creating a dataset containing the collected data frames, Means for identifying patterns associated with a wireless sensor from collected data frames, wherein each pattern is based on a periodic time interval for the wireless sensor to transmit two consecutive data frames, or on the number of data frames transmitted by the wireless sensor during a usage time interval. Regarding traffic patterns, means for introducing simulated traffic anomalies into the dataset, A means for randomizing a dataset and dividing the randomized dataset into a training dataset and a test dataset, wherein the training dataset contains more data frames than the test dataset. By using the training dataset, a machine learning model configured to detect traffic anomalies is trained, and if the trained machine learning model reaches an accuracy threshold on the test dataset, a means is provided to enable the machine learning model. A means for detecting a given wireless sensor traffic anomaly during wireless sensor operation by analyzing the current data frame transmitted from the wireless sensor to the switch and using an enabled machine learning model, A means for triggering security alerts based on detected traffic anomalies, The system comprises means for adapting at least the security level of a given wireless sensor based on a triggered security alert.

[0017] In another implementation, a device is provided for setting the security level of a wireless sensor communicating with a switch, the device being linked to the switch, and One or more network interfaces for communicating with a telecommunications network, A processor coupled to a network interface and configured to run one or more processes, The processor has memory configured to store executable processes, and when a process is executed, This involves collecting data frames transmitted from wireless sensors to a switch, and creating a dataset containing the collected data frames. Identifying patterns associated with wireless sensors from collected data frames, where each pattern is based on a periodic time interval for the wireless sensor to transmit two consecutive data frames, or on the number of data frames transmitted by the wireless sensor within a usage time interval. introducing simulated traffic anomalies into the dataset with respect to the traffic pattern, and randomizing the dataset and dividing the randomized dataset into a training dataset and a test dataset, where the training dataset contains more data frames than the test dataset, training a machine learning model configured to detect traffic anomalies by using the training dataset, and enabling the machine learning model if the trained machine learning model reaches a threshold of accuracy with the test dataset, detecting traffic anomalies of a given wireless sensor during operation of the wireless sensor by analyzing the current data frame transmitted from the wireless sensor to the switch and by using the enabled machine learning model, triggering a security alert based on the detected traffic anomaly, and being operable to adapt at least the security level of the given wireless sensor based on the triggered security alert.

[0018] In another implementation, a computer-readable medium in which a computer program for implementing a method for setting the security level of a wireless sensor communicating with a switch is embodied is provided. The computer program comprises instructions for performing the steps by the method according to the present invention.

[0019] The detailed description will be described with reference to the accompanying drawings. In the figures, the leftmost digit of the reference number identifies the figure in which the reference number first appears. The same numbers are used throughout the figures to refer to like features and components. Some embodiments of the system and / or method according to the embodiments of the present subject matter are described by way of example only and with reference to the accompanying drawings.

Brief Description of the Drawings

[0020] [Figure 1] Fig. 1 shows a schematic block diagram of a communication system according to an embodiment of the present invention for adapting the security level of a wireless sensor. [Figure 2] Fig. 2 shows a flowchart explaining a method for adapting the security level of a wireless sensor according to an embodiment of the present invention. Embodiments of the Invention

[0021] The same reference numerals represent the same elements or elements of the same type in all the drawings.

[0022] It should be recognized by those skilled in the art that any block diagrams in this specification represent conceptual diagrams of exemplary systems embodying the principles of the subject matter. Similarly, any flowcharts, flow diagrams, state transition diagrams, pseudocode, etc. are substantially represented on a computer-readable medium and thus represent various processes that can be executed by a computer or processor, regardless of whether the computer or processor is explicitly shown.

[0023] The figures and the following description illustrate specific exemplary embodiments of the invention. Accordingly, it will be recognized that those skilled in the art can devise various configurations that embody the principles of the invention and are within the scope of the invention, although not explicitly described or shown in this specification. Further, any examples described in this specification are intended to be helpful in understanding the principles of the invention and are to be construed as being such specific examples and conditions, but not limited thereto. As a result, the invention is not limited to the specific embodiments or examples described below, but is limited by the claims and their equivalents.

[0024] Referring to Figure 1, the communication system comprises a security device SD, a switch SW, and a set of wireless sensors WS. The security device SD is connected to the switch, and the switch can communicate with the set of wireless sensors WS via the telecommunications network TN.

[0025] The switch may be connected to a communication device via a wireless link, for example, based on ZigBee or ZigBee Green Power, or Bluetooth Low Energy or other short-range technologies. In another embodiment, the switch may be part of a limited-range public wireless network, such as a WLAN (Wireless Local Area Network), or a medium-range telecommunications network conforming to the 802.1x standard or the WiMAX (World Wide Interoperability Microwave Access) protocol.

[0026] Additionally, telecommunications networks can operate in accordance with fourth-generation or fifth-generation wireless communication protocols, or similar wireless communication protocols that may be developed in the future.

[0027] The wireless sensor (WS) is powered by an internal battery and can measure and transmit operational data to a data center for analysis. The wireless sensor (WS) transmits operational data to the data center via a telecommunications network and a switch (SW).

[0028] The wireless sensor WS can be any type of sensor, such as a pressure sensor, fluid level detector, ammeter / voltmeter, pH meter, leak / strain detector, incident / occurrence counter, speed / accelerometer, etc. Therefore, any sensor capable of measuring a specific sensor value can be connected to the switch SW.

[0029] Furthermore, the wireless sensor WS may be a sensor capable of measuring temperature, humidity, and energy measurement results, etc.

[0030] Wireless sensors (WS) may be configured with different predefined security levels. For example, a low security level provides minimal cyber protection by activating only the minimum encryption elements required by the service associated with the wireless sensor. For example, a medium security level provides average cyber protection by activating more encryption elements. For example, a high security level provides maximum cyber protection by activating all encryption elements. Different security levels may be set depending on the encryption elements or the strength level of the encryption algorithms to be activated.

[0031] A higher security level is thought to correspond to situations that consume the most power to use the associated cryptographic elements. Conversely, a lower security level corresponds to situations that consume less power to use the associated cryptographic elements.

[0032] The switch (SW) is a wireless hub paired with the wireless sensor (WS). Once the switch is paired with the wireless sensor (WS), the gateway allocates a dedicated channel for communication with the wireless sensor. This dedicated channel reserves a memory zone for storing operational data coming from the wireless sensor.

[0033] A switch SW includes memory for systematically storing operational data by reserving memory addresses for specific wireless sensors. For example, when a switch receives a data frame from a wireless sensor, the switch extracts the wireless sensor identifier and stores the operational data of the frame in the memory zone corresponding to the address associated with the wireless sensor identifier. The switch SW may also store a correspondence table for each wireless sensor, associating the wireless sensor identifier with the type of wireless sensor and the location of the wireless sensor data within the switch memory.

[0034] The security device SD can analyze the contents of operational data transmitted by a wireless sensor and read by a switch SW. The security device SD is linked to the switch SW. In one embodiment, the security device SD is an external entity to the switch and can communicate directly with the switch, or the security device SD is integrated into the switch.

[0035] The security device SD includes a collector module COL, a learning module LEA, and a detection module DET.

[0036] The collector module COL collects traffic information related to the exchange between the wireless sensor and the switch. The collector module COL creates a log file of all data frames transmitted by the wireless sensor. The log file contains a timestamp for each data frame transmitted by the wireless sensor.

[0037] If the sensor is a periodic sensor, i.e., a sensor that transmits operational data at periodic time intervals, the collector module COL can calculate the measured period P by performing an on-the-fly calculation of the difference between the timestamps of two consecutive frames received by the switch: P = TimestampFrame(n) - TimestampFrame(n-1). In another embodiment, the periodic time interval is already known by the security device SD.

[0038] The collector module COL determines the minimum time between two consecutive frames from the same communication device, and this minimum time is used to build the criteria for intrusion alerts. The minimum time is determined after a predefined period for collecting traffic information, for example, a predefined period of several days (sufficient to obtain a substantial dataset of 50,000 frames).

[0039] If the sensor is a non-periodic sensor, i.e., a sensor that transmits operational data at non-periodic or variable time intervals when an event occurs, the collector module COL may implement a counter that determines the number of data frames received during a defined usage time interval. The usage time interval may be defined after an observation period long enough to detect patterns in the sensor's behavior. For example, there may be different patterns corresponding to different sensor behaviors depending on the time or date. On each day of the week, the sensor may have different behaviors, and therefore different patterns for each day, while at night or on weekends, the sensor may have different specific behaviors.

[0040] In one embodiment, the collector module COL can implement a counter for each hour of the day to determine the total number of data frames received within an hour, and thus the total number of data frames received on that day. Thus, the collector module COL can create a daily sensor traffic pattern corresponding to the sensor's behavior for transmitting data frames during the day.

[0041] In all cases of the sensor, the collector module COL creates the sensor's traffic pattern, which is based on a periodic time interval for the wireless sensor to transmit two consecutive data frames if the wireless sensor is a periodic sensor, or on the number of frames received during a given time interval corresponding to a specific usage period of the wireless sensor.

[0042] The log files created by the collector module COL may be enhanced with other data to create a dataset that can be used to train algorithms for learning the normal and abnormal behavior of the sensor.

[0043] The LEA learning module can introduce simulations of traffic anomalies, such as anomalous traffic or intrusions, and can augment datasets with expected anomalies by, for example, tagging each entry in the dataset with an expected output, regardless of whether it is anomalous or not. The introduction of simulated anomalies can be efficiently used by a supervised random forest model. That is, by giving each data in the dataset a predicted output, the algorithm trains a highly accurate model. Advantageously, because traffic anomalies are simulated, it is easy to tag them, for example, as "suspicious intrusion" or "anomalous traffic."

[0044] To help the algorithm train more accurately, if the frequency or number of data frames transmitted by the wireless sensor is higher than a given pattern, a traffic anomaly is simulated for each given pattern of the wireless sensor, for example, in the form of a replay attack.

[0045] The Random Forest algorithm is trained using the dataset collected during the data collection phase to construct a valid model. The collected dataset is shuffled and divided into two random datasets: a training dataset consisting of most of the data (e.g., 80% of the data) and a test dataset consisting of the remaining data (e.g., 20% of the data).

[0046] The learning module LEA defines various input parameters related to the wireless sensor used to train the random forest algorithm. In one embodiment with a periodic wireless sensor, the input parameters may be the location of the wireless sensor in switch memory, the type of wireless sensor, and the period between two consecutive frames transmitted by the wireless sensor. The output of the random forest algorithm is the detection of traffic anomalies. In another embodiment with a non-periodic wireless sensor, the input parameters may be the location of the wireless sensor in switch memory, the day of the week, 24 inputs of a counter for each hour of the day if the wireless sensor is operating on that day, and the total number of data frames received during the day. In this case, the sum of the 24 counters represents the pattern. Generally, the pattern is represented by the number of data frames received during a defined usage time interval (in this example, 24 inputs of a counter for each hour of the day).

[0047] During the learning phase, the algorithm is trained using the training dataset, then tested for accuracy using the test dataset, and both outputs are compared. The test dataset includes a mixture of traffic anomaly simulations to test the accuracy of the trained algorithm. A threshold is used to validate the model. For example, a 95% accuracy rate between the expected result and the trained algorithm is considered acceptable.

[0048] When enabled, the machine learning model may be used with the current data frame sent from the wireless sensor to the switch.

[0049] The detection module DET can read the state of the switch memory at a higher frequency (e.g., 5 times higher with respect to accuracy and determinism) than the highest rate used by any wireless sensor. In one embodiment with a periodic sensor, the detection module DET classifies the data collected by the switch by the location of the wireless sensor in the switch memory, the type of wireless sensor, and the periodic time interval between two consecutive data frames transmitted by the wireless sensor. In another embodiment with a non-periodic sensor, the detection module DET classifies the data collected by the switch by the location of the wireless sensor in the switch memory and the number of data frames received during a defined usage time interval.

[0050] During the detection phase, the criterion for detecting traffic anomalies is an increase in traffic detected by wireless sensors, as learned through simulated traffic anomalies during the learning phase.

[0051] In the case of periodic wireless sensors, if the wireless sensor transmits two consecutive data frames at a time interval shorter than the periodic time interval defined in the enabled model pattern, a traffic anomaly can be detected.

[0052] In the case of aperiodic wireless sensors, if the wireless sensor transmits data frames more times during the usage time interval than the number defined in the enabled model pattern, it is possible to detect a traffic anomaly.

[0053] The detection module DET creates two files: an operational file that stores normal traffic with input parameter values, and an anomaly file that stores anomaly traffic with detected traffic anomalies, recording previous and subsequent data from suspicious data for reference. The anomaly file is kept up-to-date, and security thresholds can be set based on the number of suspicious traffic anomalies to a) trigger a system administrator alert, and b) send a request to the switch to re-establish commissioning procedures at a higher security level, and / or a channel change request (if the payload is already encrypted, a channel change request may be an option to further mitigate adversary intrusion and give system administrators more time to find the source of the suspicious intrusion).

[0054] The security status may be automatically updated after detecting traffic anomalies or a predefined number of traffic anomalies.

[0055] In one embodiment, the machine learning model is based on a RANDOM FORESTS® model or random decision forest model, for example, utilizing state transition elements (STEs) of an automaton or automata processor. In fact, in certain embodiments, an automata processor can transform a tree-based ensemble model (e.g., a RANDOM FORESTS® or random decision forest model) from memory of a tree traversal algorithm constrained by the decision tree depth into a pipelining design that computes thresholds independently of the model computation. For example, a processor or automata processor can implement and compute a RANDOM FORESTS® model or random decision forest model by transforming each path to the leaves of the decision tree into a feature identification chain based, for example, on feature values, more specifically, on a range of feature values. In certain embodiments, instead of using floating-point numbers and / or floating-point arithmetic to represent feature values, the processor may perform labeling techniques to represent floating-point values ​​and utilize the symbol sets and arithmetic available to the automata processor. In some embodiments, each STE or automaton of the automata processor may be designed to process feature values ​​in the same order.

[0056] One embodiment comprises a security device SD in the form of a device having one or more processors, an I / O interface, and memory coupled to the processors. The processors can be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuits, and / or any device that manipulates signals based on operational instructions. The processors may be one processing unit or several units, all of which may include multiple computing units. Among other capabilities, the processors are configured to fetch and execute computer-readable instructions stored in memory.

[0057] The functions realized by a processor can be provided not only through dedicated hardware, but also through the use of software-executable hardware in conjunction with appropriate software. Where provided by a processor, the functions can be provided by a single dedicated processor, a single shared processor, or multiple separate processors (some of which may be shared). Furthermore, the explicit use of the term “processor” should not be interpreted as exclusively referring to software-executable hardware, and may implicitly include, but are not limited to, digital signal processor (DSP) hardware, network processors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), read-only memory (ROM), random-access memory (RAM), and non-volatile storage for storing software. Other hardware, whether conventional or custom, may also be included.

[0058] Memory may include any computer-readable media known in the art, including volatile memory such as static random-access memory (SRAM) and dynamic random-access memory (DRAM), and / or non-volatile memory such as read-only memory (ROM), erasable programmable ROM, flash memory, hard disks, optical disks, and magnetic tape. Memory includes modules and data. Modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. Data, in particular, serves as a repository for storing data processed, received, and generated by one or more of the modules.

[0059] Those skilled in the art will readily recognize that the steps of the above method may be performed by a programmed computer. Some embodiments herein are intended to also cover program storage devices, for example, digital data storage media, which are machine- or computer-readable and encode machine-executable or computer-executable programs of instructions, which perform some or all of the steps of the described method. Program storage devices may be, for example, digital memory, magnetic storage media (such as magnetic disks and magnetic tapes), hard drives, or optically readable digital data storage media.

[0060] Referring to Figure 2, a method for setting the security level of a wireless sensor communicating with a switch, according to one embodiment of the present invention, comprises steps S1 to S7. The wireless sensor is powered by a built-in battery and set to a given security level.

[0061] In step S1, the wireless sensor transmits data frames to the switch. The collector module COL collects the data frames transmitted from the wireless sensor to the switch, for example by interrogating the switch's memory or by receiving reports from the switch. The collector module COL creates a dataset containing the collected data frames.

[0062] In step S2, the collector module COL analyzes the collected data frames to identify patterns of wireless sensors that transmit data frames. The collector module COL distinguishes between periodic wireless sensors (e.g., those that transmit data frames at periodic time intervals) and aperiodic wireless sensors (e.g., those that transmit data frames on an event) by extracting wireless sensor identifiers from the data frames. Each pattern is associated with a wireless sensor and is based on a periodic time interval for transmitting two consecutive data frames if the wireless sensor is a periodic wireless sensor, or on the number of data frames received within a given time interval frame if the wireless sensor is an aperiodic wireless sensor.

[0063] In one embodiment, a dataset is considered complete when a sufficient number of data frames have been collected to identify all possible patterns.

[0064] In step S3, the learning module LEA introduces simulated traffic anomalies into the dataset with respect to traffic patterns. By nature, a traffic anomaly for a given wireless sensor deviates from the pattern associated with that given wireless sensor. For each pattern, one or more traffic anomalies may be defined. For example, a traffic anomaly corresponds to a frequency or number of data frames transmitted by a wireless sensor that is greater than the traffic pattern associated with that wireless sensor.

[0065] When simulated traffic anomalies are added to the dataset, it becomes an augmented dataset with data composed of data frames and traffic anomalies, and this augmented dataset is ready to be used by machine learning algorithms that depend on identified patterns.

[0066] In one embodiment, several simulated traffic anomalies may be introduced during the collection phase, particularly for periodic wireless sensors, as the period for transmitting data frames may be known in advance.

[0067] In step S4, the learning module LEA randomizes the dataset, for example, by shuffling the contents of the enhanced dataset, i.e., the collected data frames and simulated traffic anomalies. Next, the learning module LEA divides the randomized dataset into a training dataset and a test dataset, with the training dataset containing more data than the test dataset. For example, the training dataset contains the majority of the data (e.g., 80% of the enhanced dataset), while the test dataset contains the remaining data (e.g., 20% of the enhanced dataset).

[0068] In step S5, the learning module LEA uses the training dataset to train a machine learning model configured to detect traffic anomalies. For example, the machine learning model is based on a supervised random forest model. The trained machine learning model is then tested using the test dataset by comparing the output obtained from the training dataset with the output obtained from the test dataset.

[0069] When the trained machine learning model reaches an accuracy threshold on the test dataset (for example, a 95% accuracy rate between the expected output from the test dataset and the output from the training dataset), the LEA learning module activates the machine learning model.

[0070] In step S6, the wireless sensor is operational and transmits a data frame to the switch. The detection module DET analyzes the data frame read from the switch. The detection module DET can detect traffic anomalies in the wireless sensor's data frame by using the enabled machine learning model. The enabled machine learning model outputs a traffic anomaly in the wireless sensor's data frame when the input parameters of the data frame induce a traffic anomaly.

[0071] In step S7, the detection module DET triggers a security alert based on the detected traffic anomaly. In one embodiment, the detection module DET saves and updates a traffic anomaly file that lists the data frames identified as traffic anomalies.

[0072] In one embodiment, the detection module DET triggers a security alert when a given number of traffic anomalies are detected.

[0073] The detection module DET adapts the security level of at least the wireless sensor based on a security alert triggered in response to a data frame transmitted by the wireless sensor. In other embodiments, the detection module DET adapts the security level of the same type of wireless sensor, or all wireless sensors, based on the triggered security alert.

[0074] Although the present invention has been described above with reference to specific embodiments, it is not intended to be limited to the specific forms described herein. Rather, the present invention is limited only by the appended claims, and other embodiments other than those described above are equally possible within the scope of these appended claims.

[0075] Furthermore, while exemplary embodiments are described above in several exemplary combinations of components and / or functions, it should be understood that alternative embodiments may be provided by different combinations of components and / or functions without departing from the scope of this disclosure. Moreover, it is specifically intended that certain features described individually or as part of one embodiment may be combined with other individually described features or parts of other embodiments. [Explanation of symbols]

[0076] SD Security Device SW Switch WS Wireless Sensor TN Telecommunications Network COL Collector Module LEA Learning Module DET detection module

Claims

1. A method for setting a security level of a wireless sensor (WS) communicating with a switch, the method comprising the steps of: collecting data frames transmitted from the wireless sensors to the switch and creating a data set including the collected data frames (S1); identifying (S2) a pattern associated with the wireless sensor from the collected data frames, each pattern being based on a periodic time interval for transmitting two successive data frames by the wireless sensor or based on a number of data frames transmitted by the wireless sensor during a usage time interval; - introducing simulated traffic anomalies into said data set with respect to traffic patterns (S3); randomizing the data set and dividing the randomized data set into a training data set and a test data set, the training data set including more data frames than the test data set; training a machine learning model configured to detect traffic anomalies by using the training dataset, and enabling the trained machine learning model if the trained machine learning model reaches a threshold accuracy on the test dataset (S5); Detecting traffic anomalies for a given wireless sensor during operation of the wireless sensor by analyzing current data frames transmitted from the wireless sensor to the switch and by using the enabled machine learning model (S6); triggering a security alert based on the detected traffic anomaly (S7); adapting (S7) a security level of at least the given wireless sensor based on the triggered security alert; A method comprising:

2. The method of claim 1 , wherein the wireless sensor is powered by an internal battery.

3. 2. The method of claim 1, wherein a traffic anomaly for a given wireless sensor corresponds to a frequency or number of data frames transmitted by the wireless sensor being greater than the traffic pattern associated with the given wireless sensor.

4. 2. The method of claim 1, wherein the pattern associated with a wireless sensor is based on a periodic time interval for transmitting two consecutive data frames by the wireless sensor when the wireless sensor is a periodic wireless sensor that transmits operational data at periodic time intervals.

5. 2. The method of claim 1, wherein the pattern associated with a wireless sensor is based on a number of data frames transmitted by the wireless sensor during a usage time interval when the wireless sensor is an aperiodic wireless sensor that transmits operational data upon an event.

6. The method of claim 1 , wherein the security level is adapted for wireless sensors of the same type as the given wireless sensor or for all the wireless sensors based on the triggered security alert.

7. 2. The method of claim 1, wherein a traffic anomaly for a given wireless sensor is detected when a data frame transmitted by the given wireless sensor corresponds to an increase in traffic for the pattern associated with the given wireless sensor.

8. The method of claim 1 , wherein the machine learning model is based on a supervised random forest model.

9. A security device (SD) for setting a security level of a wireless sensor (WS) communicating with a switch, said security device (SD) being linked to said switch (SW); means (COL) for collecting data frames transmitted from said wireless sensors to said switch and for creating a data set comprising said collected data frames; a means for identifying a pattern associated with the wireless sensor from the collected data frames, each pattern being based on a periodic time interval for transmitting two successive data frames by the wireless sensor or based on a number of data frames transmitted by the wireless sensor during a usage time interval; - means for introducing simulated traffic anomalies in said data set with respect to traffic patterns (LEA); a means for randomizing the data set and splitting the randomized data set into a training data set and a test data set, the training data set including more data frames than the test data set; a means for training a machine learning model configured to detect traffic anomalies by using the training dataset, and validating the machine learning model when the trained machine learning model reaches a threshold accuracy on the test dataset; means for detecting traffic anomalies of a given wireless sensor during operation of the wireless sensor by analyzing current data frames transmitted from the wireless sensor to the switch and by using the enabled machine learning model; means for triggering a security alert based on said detected traffic anomaly (DET); means for adapting a security level of at least said given wireless sensor based on said triggered security alert (DET); A security device (SD) comprising:

10. A computer readable medium having embodied thereon a computer program for performing a method for setting a security level of a wireless sensor (WS) in communication with a switch according to any one of claims 1 to 8.

Images