Cyber-physical system evaluation via network traffic analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cyber-physical systems (CPS) face challenges in deriving a model of computation due to reliance on high-level node information, which can be inaccurate and vulnerable to malfunctioning or hacked nodes, especially in networks lacking explicit device addresses and featuring overlapping processes and broadcast communication protocols.
Innovation Solution
A method to derive a model of computation by parsing network traffic into events, generating event logs, and constructing directed graphs based on group IDs, calculating complexity scores using graph metrics like density, reciprocity, radius, and diameter to identify associated group IDs without relying on specific node information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If CPS tools rely on high-level information provided by specific CPS nodes to evaluate the system, then the evaluation process becomes simpler and more direct, but the tools become vulnerable to malfunctioning or hacked nodes that may produce false or erroneous data
Solution Approach 1:
The patent introduces a new intermediary component - a CPS evaluation tool that operates at the network level rather than relying on node-provided information. This intermediary analyzes raw network traffic directly, acting as a mediator between the CPS nodes and the evaluation process, thereby eliminating dependence on potentially compromised node data while maintaining evaluation simplicity
Solution Approach 2:
The patent creates a virtual copy of the CPS evaluation process that operates independently from actual CPS nodes. By capturing and analyzing network traffic packets rather than relying on node-provided state information, the system creates a parallel evaluation path that is immune to node malfunctions or hacking, thus improving reliability without complicating the evaluation process
2Productivity
If CPS tools rely on a priori knowledge of application processes to assess the CPS, then the evaluation can be more targeted and efficient, but the knowledge may not be available or may be inaccurate
Solution Approach 1:
The patent enables the CPS evaluation tool to be self-sufficient by directly analyzing network traffic packets to automatically derive process information. Instead of requiring external provision of a priori process knowledge, the system extracts necessary information from the network traffic itself, making the evaluation process independent of unavailable or inaccurate external knowledge sources while maintaining efficiency
Solution Approach 2:
The patent performs preliminary analysis of network traffic patterns to establish baseline process behavior before actual evaluation begins. By pre-processing and understanding the structure of network communications, the system can efficiently evaluate CPS operations without requiring external process knowledge, thus improving both productivity and information independence
3Measurement precision
If the CPS generates many hundreds or thousands of network messages during a process, then detailed information about the process is captured, but deriving the underlying model of computation becomes difficult due to overlapping processes
Solution Approach 1:
The patent segments the complex stream of network messages by filtering for specific group IDs that correspond to particular processes or functions. This segmentation divides the overwhelming volume of thousands of messages into manageable, process-specific subsets, allowing detailed analysis of individual processes while reducing the overall complexity of model derivation through targeted filtering and separate handling of each process stream
Data Source
AI summary
Described are methods, systems, and computer-program product embodiments for deriving a model of computation of a cyber-physical system (CPS). In some embodiments, a method includes receiving, from the CPS network, network-events data corresponding to a process performed by the CPS and including network events and associated group IDs. A plurality of events logs for a plurality of selections of group IDs are generated with each events log including a sequence of network events selected from the network events based on the selection of group IDs for that events log. A plurality of directed graphs for the plurality of events logs are generated with each directed graph generated based on the sequence of network events in the events log. A plurality of group IDs can be determined based on a directed graph selected from the plurality of directed graphs based on a complexity score calculated for each directed graph.