BAS Network Monitoring for Anomaly Detection and Access Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security measures for building automation systems (BAS) are inadequate in protecting against malicious attacks, making them vulnerable to unauthorized access and potential network flooding, Denial of Service (DoS), and other threats.
Innovation Solution
A network monitor system integrated with a server that monitors and analyzes network traffic for anomalies, performs geo-location-based assessments of incoming communications, and implements geo-location-based and security-centric assessments to authenticate and authorize devices, block unauthorized access, and provide real-time security alerts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If commonly available network security measures are employed, then basic network protection is provided, but the building automation system remains vulnerable to malicious attacks and unauthorized access
Solution Approach 1:
The system performs preliminary actions by continuously monitoring network traffic patterns and establishing baseline communication behaviors before attacks occur. This enables the detection of anomalies that deviate from normal operation, allowing proactive identification of potential threats before they can compromise the building automation system.
Solution Approach 2:
The patent introduces an intermediary monitoring layer that sits between network traffic sources and the building automation system. This intermediary component analyzes incoming communications, assesses server geo-location information, and filters malicious traffic before it reaches vulnerable devices, thereby enhancing security without requiring modifications to the core BAS infrastructure.
2Difficulty of detecting and measuring
If comprehensive network monitoring and server assessment are implemented, then security detection capability is improved, but system complexity increases
Solution Approach 1:
The system applies local quality by focusing monitoring efforts on specific critical parameters rather than analyzing all network traffic uniformly. It prioritizes assessment of geo-location information for incoming servers and monitors communication patterns directed at specific BAS devices, thereby achieving effective anomaly detection with reduced computational overhead and simplified system architecture.
Solution Approach 2:
The patent utilizes parameter changes by dynamically adjusting monitoring thresholds and assessment criteria based on established baseline behaviors. The system changes its detection parameters adaptively, comparing current traffic patterns against historical norms to identify anomalies, which simplifies the monitoring logic while maintaining high detection accuracy.
3Reliability
If real-time security assessment and blocking mechanisms are deployed, then protection against unauthorized access is enhanced, but network traffic flow may be affected
Solution Approach 1:
The system applies partial action by implementing security blocking selectively rather than universally. It blocks only those communications that fail security assessments or exhibit malicious characteristics, while allowing legitimate traffic to flow unimpeded. This approach provides strong unauthorized access protection while minimizing impact on overall network productivity and traffic flow.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A network monitor or method provide network security specific to equipment of a building automation system (BAS) and server assessment of network communication directed thereto. A server couples to a building management network of the building automation system. The server monitors communication that is on the building management network, and determines whether such communication is directed to specific devices of the building automation system. The server determines a security assessment, a security-centric assessment, and/or a geo-location-based server assessment of a server that originated the incoming communication directed to specific device(s) of the building automation system.