Smart Infrastructure Control System (SICS) Security Monitoring and Defense

Abstract

A control application generates log files that provide information about the management of multiple devices it is responsible for. The information in the log files depends on messages received from the devices or commands issued to the devices. For example, in the case of a smart meter, the generated log files may include meter readings, firmware changes, firmware updates, instructions on whether the meter is open or not, and instructions for overheating in the meter. A software agent extracts information from the log files that can be analyzed in order to determine anomalies that may be related to an attack on the system. The analysis performed may include pattern matching of the information obtained from the log files, performing AI analysis of the information obtained from the log files, and identifying signatures.

Description

Technical Field

[0001] Technical Field The present disclosure relates to a computer system including at least one processor and at least one memory, and particularly to a computer system that provides a control application for controlling a plurality of devices accessible via a network.

Background Art

[0002] Background Some devices are subject to centralized control by a computer system that provides a control application. The control application executes control over a plurality of devices by both receiving messages from the devices and issuing commands for controlling the operations of the devices. As an example, as a type of device subject to centralized control, there is a smart meter that monitors information such as the consumption amount of electricity and / or gas, reports the information to the computer system, and enables an energy provider to monitor the consumption and bill the consumer. There may be a huge number (e.g., millions) of smart meters that provide data to a centralized computer system via a network.

[0003] Smart meters not only report energy consumption but also increasingly receive commands from the control application to cut off power over the entire area assigned to the smart meter, such as a cut-off command.

Summary of the Invention

Problems to be Solved by the Invention

[0004] Assuming that a centralized control system targets a large number of smart meters, a threat actor (i.e., a cyber attacker) could cause significant damage by attacking the centralized control system. For example, if a cyber attacker has the ability to seize control of the centralized control system, they could cause the system to issue shut-off commands to a large number of smart meters, resulting in a large-scale power outage. [Means for solving the problem]

[0005] overview It is desirable to mitigate the threat posed by attacks on centralized control systems.

[0006] According to a first aspect, a computer system is provided, comprising at least one processor and at least one memory, wherein at least one memory stores computer-readable instructions, one or more log files, and sets of conditions; at least one processor provides a control application configured to exchange messages via at least one network, which include commands causing multiple devices to control multiple devices; a software agent configured to generate log data about the control application, which is generated depending on messages exchanged by the control application via at least one network, and store it in one or more log files held in at least one memory; and to extract from at least one memory a set of information including a subset of log data from one or more log files; and an analysis engine configured to analyze the extracted subset of log data to determine whether any of the conditions are met; and to execute instructions to perform an action to notify the user in response to a determination that one of the conditions is met.

[0007] A control application generates log files that provide information about the management of multiple devices it is responsible for. The information in the log files depends on messages received from the devices or commands issued to the devices. For example, in the case of a smart meter, the generated log files may include meter readings, firmware changes, firmware updates, instructions on whether the meter is open or not, and instructions for overheating in the meter. A software agent extracts data from the log files that can be analyzed to determine anomalies that may be associated with an attack on the system (and may also extract additional configuration data). The analysis performed may include pattern matching on the information obtained from the log files, performing AI analysis on the information obtained from the log files, and identifying signatures in the log data.

[0008] According to a second aspect, a computer implementation method is provided, the method comprising: providing a control application configured to exchange messages via at least one network containing commands causing multiple devices to control multiple devices; generating log data about the control application and storing it in one or more log files held in at least one memory, wherein the log data is generated depending on messages exchanged by the control application via at least one network; extracting a set of information from at least one memory, wherein the set of information includes a subset of log data from one or more log files; parsing the extracted subset of log data to determine whether any of a set of conditions is met; and performing an action to notify the user in response to determining that one of the conditions is met.

[0009] In some embodiments, the set of information further includes configuration data extracted from a configuration file stored in at least one memory, and the method includes determining whether any of a set of conditions is met by parsing the configuration data.

[0010] In some embodiments, this includes determining whether one of the conditions is met in response to identifying a pattern or signature within an extracted subset of log data and configuration data.

[0011] In some embodiments, the step of analyzing an extracted subset of log data includes providing a set of input values ​​to one or more machine learning modes configured to obtain an output depending on the extracted subset of log data, and comparing the output to a threshold indicated by one of the conditions in order to determine if one of the conditions is met.

[0012] In some embodiments, the method includes generating multiple input values ​​from an extracted subset of log data.

[0013] In some embodiments, the set of information further includes configuration data extracted from a configuration file stored in at least one memory, and the method includes determining whether any of a set of conditions is met by analyzing the configuration data, and providing a plurality of further input values ​​to one or more machine learning modes configured to obtain an output depending on the configuration data.

[0014] In some embodiments, one or more machine learning models include a neural network configured to receive input values.

[0015] In some embodiments, the step of analyzing an extracted subset of log data includes identifying a pattern or signature within the extracted subset of log data specified by one of a set of conditions in order to determine whether one of the conditions is met.

[0016] In some embodiments, the action includes controlling the user interface to display statistical information relating to at least one condition.

[0017] In some embodiments, the plurality of devices includes a plurality of smart meters, and the step of providing the control application is performed by a head-end system.

[0018] In some embodiments, the action includes generating an alert.

[0019] In some embodiments, the computer system includes a first computing device and a second computing device. The first computing device includes a first processor of at least one processor, and the first processor is configured to execute a first set of computer-readable instructions to provide a control application and a software agent and transmit a set of extracted information to the second computing device via at least one network. The second computing device includes a second processor of at least one processor configured to execute a second set of computer-readable instructions to provide an analysis engine.

[0020] According to a third aspect, there is provided a computer program comprising computer-readable instructions which, when executed by at least one processor, cause the method according to the second aspect or any embodiment thereof to be performed.

[0021] According to a fourth aspect, there is provided a non-transitory computer-readable medium storing a computer program comprising computer-readable instructions which, when executed by at least one processor, cause the method according to the second aspect or any embodiment thereof to be performed.

[0022] Brief Description of the Drawings The configuration of the present invention will be more fully understood and evaluated from the following detailed description, which is described by way of example only in conjunction with the drawings.

Brief Description of the Drawings

[0023] [Figure 1]An example of a computer system including at least one processor and at least one memory is shown. [Figure 2] An example of a computer system including at least one processor and at least one memory is shown. [Figure 3] An example of a computer system including a plurality of devices connected to a smart infrastructure control system is shown. [Figure 4] An example of a smart infrastructure control system and a security monitoring and defense system in a communication state with each other is shown. [Figure 5] An example of a computer system providing both a control application and an analysis engine is shown. [Figure 6] A simplified example of a neural network is shown. [Figure 7] An example of a process of deriving from a neural network an output indicating an event that occurred in a system based on log entries is shown. [Figure 8] An example of a process of training a machine learning model to derive an output indicating an event that occurred in a system is shown. [Figure 9] An example of different event types and actions that can be executed in response to the detection of each event type is shown [Figure 10] Exemplary methods according to multiple embodiments are shown.

Mode for Carrying Out the Invention

[0024] Detailed Description of the Invention Multiple embodiments of the present application are implemented in a computer system that may include a single device or multiple devices that communicate with each other via a network.

[0025] Referring to Figure 1, an exemplary computer system 100 capable of providing a control application for controlling multiple devices such as smart meters is shown. System 100 may include a server, a backend system, etc. System 100 may also be referred to as computing device 100.

[0026] System 100 includes at least one memory 110, 120, at least one data processing unit 130, 140, and an input / output interface 150. At least one memory 110, 120 includes a random access memory 110 and at least one hard drive 120. Memories 110, 120 store computer executable code that performs steps described as being performed by System 100 when performed by at least one data processing unit 130, 140. Memories 110, 120 may be used to store data associated with a control application. In particular, memories 110, 120 may be used to store log files containing data logged by the control application.

[0027] At least one processor 130, 140 communicates with memory 110, 120 to load execution instructions, load data to be processed, and save the results of data processing. The system 100 sends and receives messages at interface 150. Messages received at interface 150 contain data to be processed by at least one processor 130, 140. Messages sent from interface 150 are generated by at least one processor 130, 140.

[0028] In addition to the server-type system 100 that provides the control application, a further computer system can be provided to analyze the log data received from system 100 and determine whether one or more conditions are met. Referring to Figure 2, an example of such a further system 200 is shown, which may take the form of a user device 200. The device 200 may be a mobile user device (UE), a personal computer (PC), a terminal or workstation, a server, or any other form of device.

[0029] The device 200 includes an interface 240 for transmitting and receiving signals. The interface 240 may be a wired or wireless interface. For example, the interface 240 may include a wired interface for connecting to a wired network (e.g., a local area network and / or the Internet). Alternatively or additionally, the interface 240 may include a transceiver configured to transmit and receive communications via a wireless interface. The transceiver can be provided, for example, by wireless components and an accompanying antenna configuration. The antenna configuration may be located inside or outside the system 200.

[0030] System 200 includes at least one data processing entity 215, at least one random access memory 220, at least one read-only memory 225, and other possible components 230 used for software and hardware-assisted execution of tasks designed to be performed (including control, access, and communication with access systems and other communication devices). At least one random access memory 220 and a hard drive 225 are in communication with the data processing entity 215, which may be a data processor. Data processing, storage, and other related control devices may be provided on a suitable circuit board and / or within a chipset. The user controls the operation of System 200 by a suitable user interface such as a keypad 210 or by voice commands. A display 205 for displaying visual content to the user is included in System 200. System 200 may also include a speaker for providing audio content.

[0031] The memory of system 200 (i.e., random access memory 220 and hard drive 225) is configured to store computer-readable instructions that are executed by the data processor 215 to perform data processing functions described herein as being performed by system 200.

[0032] Referring to Figure 3, a system 300 is shown, which includes a computer system 305 and a number of devices 310 operating under the control of system 305. System 305 may also be referred to as a Smart Infrastructure Control System (SICS) 305. System 305 can be provided by the exemplary system 100 shown in Figure 1. Any operation to be performed by system 305 as described herein should be understood to mean an operation performed by at least one processor of system 305 that executes computer-readable instructions to perform the operation to be performed by system 305 as described herein.

[0033] Each of the multiple devices 310 includes at least one processor that executes a set of software stored in the memory of each device to perform a specific set of operations. Each of the devices 310 exchanges messages with a control application 330 running on the system 305 side via the network 320. Such messages include status reports that the device 310 provides to the control application 330 and commands that the control application 330 provides to control the operation of the device 310.

[0034] Each of the devices 310 may include a smart meter that monitors energy (e.g., electricity) usage. For this purpose, each smart meter 310 sends messages containing meter readings to the system 305 via the network 320. In response to the system 305 receiving these messages, the control application 330 causes a log of the meter readings to be recorded in a log file. Each of the smart meters 310 also responds to commands issued by the control application 330. Such commands include shut-off commands that cause the power supply to the area assigned to the smart meter 310 to be cut off.

[0035] In addition to exchanging messages with device 310, system 305 can exchange further messages with one or more remote systems (either via the same network 310 or a further network). These further messages may be exchanged over the Internet and may include, for example, requests for remote login to system 305 that allow a user to send information to control application 330 and receive information from control application 330. Exposing system 305 to Internet traffic increases the risk that a threat actor could remotely access system 305 and launch one or more attacks on device 310. For example, a threat actor could send malicious firmware to system 305 and cause control application 330 to send and install this malicious firmware on device 310. A threat actor could remotely log into system 305 and cause control application 330 to send control messages (e.g., blocking commands) to several devices 310.

[0036] Referring to Figure 4, a smart infrastructure control system 305 is shown in communication with a further system 400. The further system 400 may also be referred to as a security monitoring and defense (SMAD) system 400. The two systems 305 and 400 communicate with each other via a network 410. Network 410 may be the same as or different from network 320.

[0037] As described above, system 305 corresponds to a control application 330 that outputs one or more log files to be stored in the system 305's memory 350. The log files contain log entries that describe the details of events associated with the control application 330 that occurred. Each log entry includes a timestamp indicating the date and time of the event, a description of the event, and may include an indication of the device 310 to which the event is associated. Additional details may be included in the log files based on the type of device 310 being controlled.

[0038] As an example, the type of event that generates a log entry is a status indication received in a reporting packet from one of the devices 310. Such a status indication could be, for example, a meter reading or an indication of power usage level if device 310 is a smart meter. The status indication could indicate the thermal level in device 310. The status indication could indicate a physical change in device 310, for example, that the door of device 310 is open. If device 310 is a battery pack, the status indication could be an indication of the remaining charge level. The status indication is received in a message from one of the devices 310 on the system 305 side, and in response, the control application 330 generates a log entry that includes the status indication, a timestamp associated with the status indication, and an indication of the device 310 that sent the status indication.

[0039] A further example of the types of events that generate log entries is a firmware update on a device 310. Such a firmware update is provided by the control application 330 in a message sent to one or more devices 310 to update the firmware running on those devices 310. In addition to providing the firmware update, the control application 330 causes one or more log entries to be generated in connection with the firmware update, and these log entries provide details of the firmware update, a timestamp associated with the firmware update, and the device 310 on which the firmware update was performed.

[0040] A further example of the types of events that generate log entries is a command generated by the control application 330 and sent from the system 305 to one or more devices 310. The command may be one that starts or stops a device 310, changes the operating mode of a device 310, or performs some other action. In addition to generating and sending commands, the control application 330 causes a log file associated with the command to be generated. Such a log file may contain an indication of the type of command sent (e.g., a termination command), along with an indication of the device 310 to which the command was sent.

[0041] Further examples of event types that generate log entries include the generation and sending of commands by system 305 in response to configuration changes being made to system 305 (e.g., password reset). These configuration changes generate log files containing details of the changes.

[0042] As shown in Figure 4, in addition to the control application 330, a software agent 340 operates on the system 305 side. The software agent 340 accesses memory 350 and retrieves a subset of log information from memory 350. The software agent 340 is programmed to retrieve information from memory 350 that is useful for analysis to determine the occurrence of specific events in the operation of the system 300 as a whole. Such events include anomalies that indicate a potential security threat that may have occurred in system 300. The retrieved information is transmitted via the interface of system 305 and via network 410 and received on the system 400 side. The information extracted from the log file by the software agent 340 and transmitted via network 410 may include multiple log entries from the log file or information extracted from one or more entries in the log file. In either case, the information extracted from the log file is referred to herein as log data.

[0043] In addition to saving log files, the memory 350 of system 305 also saves configuration files. The configuration files contain configuration data for system 305 and may also contain configuration data for device 310. The configuration data includes information such as the password for system 305 (which enables remote access via network 320), the IP address of system 305, and the reporting frequency of device 310 (for example, meter reading reports). The software agent 340 also transmits the configuration data extracted from the configuration files to system 400 via network 410.

[0044] Processor 405 is configured to execute instructions that provide an analysis engine configured to perform processing on log data to determine whether the log contents satisfy one or more conditions indicating one or more events that have occurred. Processing may include performing pattern matching according to a set of rules stored in storage 410 to identify whether any patterns indicating a particular event are present in the log data. Patterns identified by processor 405 when analyzing the log data may include previously recorded patterns that have been found to be malicious or considered to be part of a previous attack. Processing may include analyzing the log data to identify whether one or more signatures are present in the log data. Processing may include applying one or more machine learning models to the log data or data derived from the log data to identify whether any patterns indicating a particular event are present in the data. In this case, the analysis engine obtains output values ​​from the machine learning models and compares the output values ​​to a threshold to determine whether an event has occurred.

[0045] The analysis engine may determine whether conditions are met based on the analysis of configuration data in addition to the analysis of log data. The analysis of configuration data may also include performing pattern matching according to rules stored in storage 410 to identify whether there is a pattern in the configuration data or log data indicating a particular event. The process may include analyzing the configuration data to identify whether one or more signatures exist in the configuration data. The process may include applying one or more machine learning models to input values ​​derived from log entries and configuration data to identify whether a pattern indicating a particular event exists in the data.

[0046] As an example, one type of event that the analysis engine 500 may be configured to detect is a replay attack. Storage 410 may contain a set of rules that indicate one or more conditions that log data may satisfy and that indicate a potential replay attack. Log data acquired by the software agent 340 and provided to system 400 may contain timestamps derived from packets received on the system 305 side, which indicate the time the packets were generated. Such timestamps are stored in storage 350 as part of a log file. Log data acquired by the software agent 340 may also contain timestamps indicating the time the packets were received on the system 305 side via network 410, which system 305 generates and stores in storage 350 as part of a log file. The analysis engine receives from the software agent 340 one or more timestamps indicating the time the packets were sent, and one or more timestamps indicating the time the packets were received on the system 305 side. Storage 410 stores rules that define conditions under which a potential replay attack is detected if the difference between two timestamps of one or more packets exceeds a given amount. The condition may be defined in relation to a single packet (i.e., the difference in timestamps must exceed a predetermined amount in at least one packet to satisfy the condition) or in relation to multiple packets (i.e., the difference in timestamps must exceed a predetermined amount in each of the multiple packets to satisfy the condition). For each packet that receives a pair of timestamps (i.e., the timestamp of packet creation of the timestamp of packet reception), the analysis engine compares the associated pair of timestamps and, in response to determining that the difference between the timestamps exceeds a predetermined amount, determines that the conditions for a potential replay attack are met. In response, the processor 405 may notify the user accordingly.

[0047] As a further example, the analysis engine can detect replay attacks based on packet checksums. System 330 can log the checksums of packets received via network 320 to a log file in storage 350. The software engine 340 extracts these checksums as part of the log data and sends them to system 400 via network 410. The analysis engine can analyze the checksums according to one or more conditions defined by rules held in storage 410 and identify patterns within the checksums. For example, if several checksums match, it may indicate that a replay attack is occurring on multiple instances of the same packet being sent to system 305. In response to a determination that such conditions are met, processor 405 can notify the user accordingly.

[0048] As described above, the analysis engine can identify events based on configuration data in addition to log data. For example, the analysis engine can receive instructions for the reporting frequency of device 310 from software agent 340 as part of the configuration data. The analysis engine also receives log data from software agent 340 indicating the packet arrival time (i.e., timestamp) of reports received from device 310 and the IP address of device 310 that sent the report packets. Storage 410 stores rules that identify the conditions that the reporting frequency and packet arrival time must satisfy. These conditions may indicate a reporting frequency in which the pattern of the packet arrival time and IP address does not match the reporting frequency derived from the configuration data. The analysis engine analyzes the packet arrival time and IP address received from software agent 340 to determine the reporting frequency and compares this determined reporting frequency with the reporting frequency in the received configuration data. In response to a mismatch, the analysis engine takes action to notify the user.

[0049] As a further example, the analysis engine can detect an incorrect configuration based on information describing a predetermined configuration defined and stored in storage 410. In this case, the analysis engine receives configuration data from the software agent 340, compares it with the configuration information stored in storage 410, and determines whether there is a deviation from the configuration described by the configuration information. In response to the determination of a mismatch between the configuration of system 300 (defined by the configuration data received from the software agent) and the predetermined configuration (defined by the configuration information stored in storage 410), the processor 405 performs an action to notify the user.

[0050] In addition to the above examples of how the analysis engine can analyze log data and optionally configuration data, many other types of analysis can be performed on different types of log and / or configuration data to determine whether conditions indicating different types of events are met.

[0051] When using one or more machine learning models, these models may include one or more neural networks.

[0052] Figure 6 shows a simplified version of neural network 600. Neural network 600 includes an input layer of nodes, a hidden layer of nodes, and an output layer of nodes. In reality, there are likely to be far more nodes and hidden layers than those shown. Each node in the input layer Ni receives a single value of the input data and generates an activation or node value at its output end by performing an activation function (e.g., sigmoid) on its own input value. Each node in the input layer N i This is each node N in the hidden layer. h It is connected to the input layer. The vector of node values ​​from the input layer is scaled by the respective weight vectors at the input end of each node in the hidden layer, and each weight defines the connectivity between a particular node and the connected nodes in the hidden layer. Node N h The weights applied to one of the input terminals are shown as w0....w3 in Figure 6. Each node N in the hidden layerh In this case, the input value at a node is given by the inner product of the weight vector connecting it to the input layer and the output value of the input node. Then the activation function is given by node N h The input values ​​in the hidden layer are applied to obtain the output values ​​of those nodes. The output vector of the hidden layer is the node of the next layer of the network (i.e., in this case, the output layer N). O Node N O It is supplied to each of the ) and used in a similar manner to generate the output value of the next layer.

[0053] Network 600 can be trained through various different methods, such as supervised or unsupervised learning. In one embodiment, Network 600 is trained through supervised learning by determining at least one set of output values ​​and comparing the output values ​​to known labels representing ground truth values ​​to calculate an error or loss associated with Network 600 (for example, based on the difference between the output values ​​and the ground truth values). The loss is then backpropagated through Network 600 to update the weights in order to fit Network 600 to better approximate the labels from the input values. The updates allow the weights to be optimized according to the objective function (for example, by adjusting the weights to reduce the error in the output values). In the next cycle, the updated weights are used with further training data to modify the weights further. In this way, the network can be trained to perform the desired operation.

[0054] Referring to Figure 7, we see how the analysis engine provided by processor 405 can process log data and (optionally) configuration data to obtain an indication that one or more events have occurred. Figure 7 shows LogEntry1~LogEntry n-1Several data items are shown as follows. Each of these data items may include a log entry or a subset of data from a log entry. Figure 7 also shows items of configuration data provided by the software agent 340. The processor 405 performs a process (shown by the score generation processing block 700) that processes the items (i.e., log data and configuration data) to derive a set of scores suitable to be provided as input to the first layer of the neural network 600. The scores may represent, for example, the date and time when a user logged into the system. The scores may represent how often a user logged into the system. The scores may indicate whether a log of a particular type of event was recorded within a given period. In Figure 7, n scores are derived from n-1 log entries and one configuration file, but the correspondence does not have to be one-to-one, and in some embodiments there may be more scores than the number of input items (i.e., log entries and configuration data) from which these scores are derived, and in other embodiments there may be more input items than the number of scores derived from these input items.

[0055] Once the scores are derived, the processor 405 provides these scores as input to the neural network 600. The neural network 600 derives one or more sets of output values ​​(represented as output1 to output5) from these scores, each output value indicating whether a particular type of event has occurred. Each output value can be compared by an analysis engine to a predetermined threshold to determine whether a particular type of event has occurred. For example, output1 may indicate whether a replay attack has occurred in system 300. At least one processor 405 compares output1 to a threshold (e.g., 0.5) and, in response to the determination that the value of output1 exceeds the threshold, takes action (e.g., issues an alert).

[0056] To apply a machine learning model such as neural network 600 to derive indications for anomalies or events that have occurred, such a machine learning model is first trained on a set of input values ​​derived from log entries along with a set of labels. The labels indicate events that have been determined to have occurred in system 300.

[0057] Referring to Figure 8, we see a system 800 in which a machine learning model 810 is trained based on log data and event instructions. System 800 may be provided according to either system 100 or 200.

[0058] As illustrated, a set of log data, configuration data, and an indication of the event that occurred are provided to the score generation module 805. The set of log data is derived from data collected by the smart infrastructure control system 305 during operation at the time the event occurred. For example, after an incident, it can be determined that a specific attack (e.g., a replay attack or spoofing) occurred at a given time. The event indication is an indication of the occurrence of the attack. The log data associated with the event indication represents the data stored in the log file 350 by the control application 330 during the period in which the event occurred. Similarly, the configuration data associated with the event indication represents the configuration data during that period. Based on this data, the machine learning model 810 can be trained to generate an event indication based on the log data collected during the period and the configuration data during that period.

[0059] As shown in Figure 8, the log data and configuration data collected by system 305 are provided by system 800 to the score generation module 805, which generates a set of scores suitable as input to the machine learning model 810 based on the log data. The score generation module 805 may also generate scores based on configuration data received from the software agent 340. The machine learning model 810 may be a neural network 600 as shown in Figure 7, or a different type of model. The score generation module 805 may be identical to the score generation module 700 if the model 810 is a neural network 600. Once scores are generated, system 800 provides the scores as input to the machine learning model 810, which provides one or more sets of output values ​​depending on these inputs. System 800 then compares one or more output values ​​with one or more sets of target values ​​(i.e., labels) that indicate events. By comparing the outputs with the target values, system 800 generates a loss or error, which is applied to update the machine learning model 810. For example, if the machine learning model 810 is a neural network 600, the system 800 applies the loss to the neural network 600 and performs backpropagation through the neural network 600 to obtain updates to the weights of the neural network 600. The system 800 then applies these updates to update the weights of the neural network 600. The system 800 updates the weights of the neural network 600 by performing many training iterations in this manner.

[0060] Referring again to Figure 4, the processor 405 is configured to identify events that have occurred in system 300 by performing one or more of the following: inspecting log data, pattern matching on log data, identifying signatures within log data, or applying one or more machine learning models to scores derived from log entries. The processor 405 takes action in response to the identification of an event. This may be the issuance of an alarm. The action may include displaying information related to the event on the user interface 205. The information related to the event may include statistical information derived by the analysis engine when performing analysis of the log data. The action may include sending a message, such as a text message or email, to a further device (e.g., a device owned by the user responsible for system 305).

[0061] In Figure 4, the control application 330 and the analysis engine are provided by separate systems 305 and 400. However, in some embodiments, the functionality may be provided by a single system. Referring to Figure 5, at least one processor in system 200 executes computer-readable instructions and provides the control application 330, the software agent 340, and the analysis engine 500. The analysis engine 500 performs the same operations as the analysis engine provided by at least one processor 405 in device 400. As described above, the analysis engine 500 performs these operations according to one or more rules or machine learning models 510. The output of the analysis engine 500 controls the user interface 205 to display information associated with identified events to the user.

[0062] Referring to Figure 9, several examples of certain types of events that may be detected depending on the log data are given. One of the examples presented is a password change, which involves remotely logging into the smart infrastructure control system 305 using a password. The control application 330 may generate log entries that record password changes and save them as part of one of the log files 350 in response to receiving an authenticated message requesting a password change over the network. The software agent 340 is configured to provide the analysis engine with any log entries that record password changes, and the analysis engine detects the password change in response to receiving such log entries. In response, at least one processor 405 may generate an alert or display an advisory message on the user interface 205.

[0063] One other exemplary event that can be detected is a replay attack. A replay attack can be detected by identifying patterns in log data provided by the software agent 340 to the analysis engine. Such patterns are defined according to rules stored in storage 410. Alternatively, a replay attack can be detected by applying a machine learning model to a score derived from the log data. Multiple log data provided by the software agent 340 to the analysis engine and used to detect a replay attack include log data that identifies the time of receipt of different messages on the system 305 side or addresses (e.g., IP addresses) contained in those messages.

[0064] One other exemplary event that can be detected is a spoofing attack. A spoofing attack is an attack in which an individual or program impersonates another person / thing by tampering with data. Analysis engines can detect spoofing attacks based on log data that includes addressing information (e.g., IP addresses) or based on other information identifiers of the sender.

[0065] Further examples of detectable events, as shown in Figure 9, include the opening of a door (i.e., one of the doors of device 310), decryption failure, system restart, and incorrect password threshold.

[0066] Referring to Figure 10, we will show Method 1000 according to several embodiments of this application.

[0067] In S1010, the control application 330 exchanges messages over at least one network. These messages contain commands that cause multiple devices 310 to control multiple devices 310.

[0068] In S1020, system 305 generates log data associated with the control application 330 and stores it in one or more log files in at least one memory location. The log data is generated based on messages exchanged by the control application via at least one network 320.

[0069] In S1030, the software agent 330 extracts a set of information from at least one memory location that includes a subset of data from the logs of the control application 330.

[0070] In S1040, the analysis engine 500 analyzes a subset of the extracted data to determine whether any of the set of conditions are met.

[0071] In S1050, in response to the determination that one of the conditions is met, the processor 405 performs an action to notify the user.

[0072] Implementations of the subject matter and operations described herein can be implemented in digital electronic circuits, computer software, firmware, or hardware, including the structures disclosed herein and their structural equivalents, or one or more combinations thereof. For example, hardware may include processors, microprocessors, electronic circuits, electronic components, integrated circuits, etc. Implementations of the subject matter described herein can be implemented using one or more computer programs, i.e., one or more modules of computer program instructions encoded on a computer storage medium to be executed by a data processing device or to control the operation of a data processing device. Alternatively or additionally, artificially generated propagating signals may be, for example, machine-generated electrical, optical, or electromagnetic signals generated to encode information for transmission to a suitable receiving device to be executed by a data processing device. Computer storage mediums may be computer-readable storage devices, computer-readable storage boards, random or serial access memory arrays or devices, or one or more combinations thereof. Furthermore, although computer storage mediums are not propagating signals, computer storage mediums may be the source or destination of computer program instructions encoded into artificially generated propagating signals. Computer storage media may also be one or more separate physical components or media (e.g., multiple CDs, disks, or other storage devices), or contained within them.

[0073] While specific configurations have been described, these configurations are presented only as examples and are not intended to limit the scope of protection. The concepts of the invention described herein can be implemented in various other forms. Furthermore, various omissions, substitutions, and modifications of the specific implementations described herein can be made without departing from the scope of protection as defined in the following claims.

[0074] Appendix A A.1 A computer system comprising at least one processor and at least one memory, wherein at least one memory stores computer-readable instructions, one or more log files, and sets of conditions, and at least one processor, The system provides a control application configured to exchange messages containing commands that cause multiple devices to control multiple other devices, via at least one network. Log data about a control application, which is generated depending on messages exchanged by the control application over at least one network, is generated and stored in one or more log files held in at least one memory. We provide a software agent configured to extract a set of information containing a subset of log data from one or more log files from at least one memory location. We provide an analysis engine configured to analyze an extracted subset of log data to determine whether any of the conditions are met. In response to a determination that one of the conditions is met, an action is taken to notify the user. A system configured to execute instructions.

[0075] A.2 The computer system described in paragraph A.1, wherein the set of information further includes configuration data extracted from a configuration file stored in at least one memory, and the analysis engine is further configured to determine whether any of the set of conditions is met by analyzing the configuration data.

[0076] A.3 The computer system described in paragraph A.2, wherein the analysis engine is configured to determine that one of the conditions is met in response to the identification of a pattern or signature in an extracted subset of log data and configuration data.

[0077] A.4 The step of analyzing the extracted subset of log data is: The steps include providing multiple input values ​​to one or more machine learning modes configured to obtain output, depending on an extracted subset of log data, To determine if one of the conditions is met, the output is compared to a threshold indicated by one of the conditions. A computer system that includes any one of the following, described in paragraphs A.1 to A.3.

[0078] A.5 At least one processor processes instructions. Generate multiple input values ​​from an extracted subset of log data. A computer system, as described in paragraph A.4, configured to run for the purpose of:

[0079] A.6 The set of information further includes configuration data extracted from a configuration file stored in at least one memory location. The analysis engine is further configured to determine whether any of the set of conditions is met by analyzing the configuration data. The computer system described in paragraph A.4 or A.5, wherein at least one processor is configured to execute instructions to provide multiple further input values ​​to one or more machine learning modes configured to obtain outputs, depending on configuration data.

[0080] A.7 A computer system described in any one of paragraphs A.4 to A.6, comprising a neural network configured to receive input values, in which one or more machine learning models are present.

[0081] A.8 The step of analyzing the extracted subset of log data is, A computer system as described in any one of paragraphs A.1 to A.7, comprising the step of identifying a pattern or signature within an extracted subset of log data specified by one of the set of conditions in order to determine whether one of the conditions is met.

[0082] A.9 A computer as described in any one of paragraphs A.1 to A.8, wherein the action includes controlling the user interface to display statistical information relating to at least one condition.

[0083] A.10 A computer system as described in any one of paragraphs A.1 to A.9, wherein the multiple devices include multiple smart meters, and the computer system includes a head-end system that provides control applications.

[0084] A.11 A computer system described in any one of paragraphs A.1 to A.10, in which the action includes generating an alert.

[0085] A.12 Including a first computing device and a second computing device, The first computing device includes a first processor of at least one processor, and the first processor generates a first set of computer-readable instructions. We provide control applications and software agents. The extracted set of information is transmitted to a second computing device via at least one network. Configured to run for, The computer system according to any one of paragraphs A.1 to A.11, comprising a second processor of at least one processor, the second computing device configured to execute a second set of computer-readable instructions to provide an analysis engine.

[0086] A.13 Computer implementation method, To provide a control application configured to exchange messages containing commands that cause multiple devices to control multiple devices via at least one network, The method involves generating log data about a control application and storing it in one or more log files held in at least one memory location, wherein the log data is generated based on messages exchanged by the control application over at least one network. Extracting a set of information from at least one memory location, wherein the set of information includes a subset of log data from one or more log files. To determine whether any of the conditions in the set are met, we analyze an extracted subset of the log data, In response to determining that one of the conditions is met, the system will take action to notify the user. Methods that include...

[0087] A.14 The computer implementation method described in paragraph A.13, wherein the set of information further includes configuration data extracted from a configuration file stored in at least one memory, and the method includes determining whether any of a set of conditions is met by analyzing the configuration data.

[0088] A.15 A computer implementation method according to paragraph A.13 or A.14, which includes determining that one of the conditions is met in response to identifying a pattern or signature in an extracted subset of log data and configuration data.

[0089] A.16 The step of analyzing the extracted subset of log data is: The steps include providing multiple input values ​​to one or more machine learning modes configured to obtain output, depending on an extracted subset of log data, To determine if one of the conditions is met, the output is compared to a threshold value indicated by one of the conditions. A computer implementation method described in any one of paragraphs A.13 to A.15, including the above.

[0090] A.17 A computer implementation method described in paragraph A.16, which includes generating multiple input values ​​from an extracted subset of log data.

[0091] A.18 The set of information further includes configuration data extracted from a configuration file stored in at least one memory, and the method is By analyzing the configuration data, it is possible to determine whether any of the conditions in the set are met, Depending on the configuration data, provide multiple additional input values ​​to one or more machine learning modes configured to obtain an output. A computer implementation method as described in paragraph A.16 or A.17, including the method described in paragraph A.16 or A.17.

[0092] A.19 A computer implementation of any one of paragraphs A.16 to A.18, comprising one or more machine learning models, including a neural network configured to receive input values.

[0093] A.20 A computer program that includes computer-readable instructions, wherein when the computer-readable instructions are executed by at least one processor, To provide a control application configured to exchange messages over at least one network, wherein the messages include commands that cause multiple devices to control multiple devices, The method involves generating log data about a control application and storing it in one or more log files held in at least one memory, wherein the log data is generated depending on messages exchanged by the control application over at least one network. Extracting a set of information from at least one memory location, wherein the information includes a subset of log data from one or more log files. To determine whether any of the conditions in the set are met, we analyze an extracted subset of the log data, In response to determining that one of the conditions is met, an action is taken to notify the user. A computer program that causes a computer to perform a method that includes such a method.

Claims

1. A computer system comprising at least one processor and at least one memory, wherein the at least one memory stores computer-readable instructions, one or more log files, and sets of conditions, and the at least one processor, A control application is provided which is configured to exchange messages containing commands that cause multiple devices to control the multiple devices via at least one network, Log data for the control application, which is generated depending on the messages exchanged by the control application via the at least one network, is generated and stored in one or more log files held in the at least one memory. A software agent is provided which is configured to extract from at least one memory a set of information including a subset of the log data from one or more log files. An analysis engine is provided which is configured to analyze the extracted subset of the log data in order to determine whether any of the above conditions are met. In response to a determination that one of the above conditions is met, perform an action to notify the user. A system configured to execute the aforementioned instructions.

2. The computer system according to claim 1, wherein the set of information further includes configuration data extracted from a configuration file stored in at least one memory, and the analysis engine is further configured to determine whether any of the set of conditions is satisfied by analyzing the configuration data.

3. The computer system according to claim 2, wherein the analysis engine is configured to determine that one of the conditions is met in response to the identification of a pattern or signature in the extracted subset of the log data and the configuration data.

4. The step of analyzing the extracted subset of the log data is: The steps include providing multiple input values ​​to one or more machine learning modes configured to obtain output depending on the extracted subset of the log data, In order to determine that one of the above conditions is met, the output is compared with a threshold value indicated by one of the above conditions. The computer system according to claim 1, including the above.

5. The at least one processor executes the instruction, The plurality of input values ​​are generated from the extracted subset of the log data. The computer system according to claim 4, configured to perform for the purpose of:

6. The set of information further includes configuration data extracted from the configuration file stored in at least one memory, The analysis engine is further configured to determine whether any of the set of conditions is met by analyzing the configuration data. The at least one processor is configured to execute the instructions to provide a plurality of further input values ​​to the one or more machine learning modes configured to acquire the output, depending on the configuration data. The computer system according to claim 4.

7. The computing system according to claim 4, wherein one or more machine learning models include a neural network configured to receive the input values.

8. The step of analyzing the extracted subset of the log data is: In order to determine that one of the above conditions is met, the step of identifying a pattern or signature within the extracted subset of the log data specified by one of the set of conditions. The computer system according to claim 1, including the above.

9. The computer according to claim 1, wherein the action includes controlling the user interface to display statistical information relating to the at least one condition.

10. The computer system according to claim 1, wherein the plurality of devices include a plurality of smart meters, and the computer system includes a head-end system that provides the control application.

11. The computer system according to claim 1, wherein the action includes generating an alert.

12. It includes a first computing device and a second computing device, The first computing device includes a first processor of at least one processor, and the first processor processes a first set of computer-readable instructions. The control application and the software agent are provided. The extracted set of information is transmitted to the second computing device via the at least one network. Configured to run for, The second computing device includes a second processor of the at least one processor configured to execute a second set of computer-readable instructions in order to provide the analysis engine, The computer system according to claim 1.

13. A computer implementation method, To provide a control application configured to exchange messages containing commands for controlling multiple devices over at least one network, The method involves generating log data for the control application and saving it to one or more log files held in at least one memory, wherein the log data is generated depending on the messages exchanged by the control application via at least one network. Extracting a set of information from at least one memory, wherein the set of information includes a subset of the log data from one or more log files; To determine whether any of the conditions in the set are met, the extracted subset of the log data is analyzed, In response to determining that one of the above conditions is met, an action is taken to notify the user. Methods that include...

14. The computer implementation method according to claim 13, wherein the set of information further includes configuration data extracted from a configuration file stored in at least one memory, and the method includes determining whether any of the set of conditions is satisfied by analyzing the configuration data.

15. The computer implementation method according to claim 13, comprising determining that one of the conditions is met in response to identifying a pattern or signature in the extracted subset of the log data and the configuration data.

16. The step of analyzing the extracted subset of the log data is: The steps include providing multiple input values ​​to one or more machine learning modes configured to obtain output depending on the extracted subset of the log data, In order to determine that one of the above conditions is met, the output is compared with a threshold value indicated by one of the above conditions. The computer implementation method according to claim 13, including the method described in claim 13.

17. The computer implementation method according to claim 16, comprising generating the plurality of input values ​​from the extracted subset of the log data.

18. The set of information further includes configuration data extracted from the configuration file stored in at least one memory, and the method By analyzing the aforementioned configuration data, it is determined whether or not any of the aforementioned set of conditions is met. Depending on the configuration data, provide a plurality of further input values ​​to one or more machine learning modes configured to acquire the output. The computer implementation method according to claim 16, including the method described in claim 16.

19. The computer implementation method according to claim 16, wherein the one or more machine learning models include a neural network configured to receive the input values.

20. A computer program that includes computer-readable instructions, wherein when the computer-readable instructions are executed by at least one processor, To provide a control application configured to exchange messages over at least one network, wherein the messages include commands that cause a plurality of devices to control the plurality of devices, The method involves generating log data for the control application and saving it to one or more log files held in at least one memory, wherein the log data is generated depending on the messages exchanged by the control application via at least one network. Extracting a set of information from at least one memory, wherein the information includes a subset of the log data from one or more log files; To determine whether any of the conditions in the set are met, the extracted subset of the log data is analyzed, In response to a determination that one of the above conditions is met, the system will perform an action to notify the user. A computer program that causes a computer to perform a method that includes such a method.

Images