Cybernetic Control System for Technological System Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for protecting critical infrastructure technological systems from cyber attacks do not effectively monitor and control the operation of different subsystems and levels in real-time, failing to detect anomalies and ensure the integrity of functional interconnections between elements.
Innovation Solution
A system and method that involves obtaining the real state of a technological system using software, hardware, or firmware agents, initializing a cybernetic control system synchronized with the system's elements, comparing the real state to an ideal state, identifying deviations, checking the integrity of functional interconnections, and detecting anomalies based on disturbed connections, using cybernetic blocks that model the system's behavior through mathematical, logic, numerical, or simulation models.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If known methods for detecting anomalies in critical infrastructure are used, then anomalies can be detected based on modeling of normal activity, but real-time monitoring and control of different subsystems and levels at specified time is not possible
Solution Approach 1:
The technological system is divided into multiple elements across different subsystems and levels, with each element monitored independently by the cybernetic control system. This segmentation enables simultaneous monitoring of multiple components at specified times, resolving the contradiction between detection precision and real-time capability.
Solution Approach 2:
The cybernetic control system continuously receives feedback from the technological system elements and compares actual states with expected states in real-time. This feedback mechanism enables both precise anomaly detection and real-time monitoring of different subsystems simultaneously.
2Productivity
If a cybernetic control system is initialized by synchronizing with the technological system in terms of time or state, then real-time comparison between real state and ideal state becomes possible, but the complexity of the system increases
Solution Approach 1:
The cybernetic control system creates simplified copies (models) of the technological system elements and their interconnections. These digital models replicate the essential behavior of the physical system, enabling real-time analysis without requiring complex physical instrumentation throughout the system.
Solution Approach 2:
The cybernetic control system serves multiple functions: it models normal activity patterns, detects anomalies, verifies functional interconnections, and provides real-time monitoring across different subsystems. This multi-functionality reduces the need for separate specialized systems, managing complexity while maintaining productivity.
3Reliability
If functional interconnections between elements of the technological system are monitored, then integrity checking can be performed, but the difficulty of detecting and measuring disturbances increases
Solution Approach 1:
The cybernetic control system acts as an intermediary that indirectly observes and measures the functional interconnections between elements. Rather than directly measuring complex interactions, the system uses the digital model to infer the state of interconnections by comparing expected versus actual behavior, simplifying the detection and measurement process.
Data Source
AI summary
Disclosed are systems and methods for protection of a technological system (TS) from cyber attacks. An exemplary method comprises: obtaining a real state of the TS; initializing a cybernetic control system (CCS) by synchronizing the CCS with the TS; comparing, by the CCS, the real state of the TS with an ideal state of the TS; based on the comparison, identifying a deviation of the real state of the TS from the ideal state of the TS; when the deviation is identified, checking an integrity of at least functional interconnections of the states of one or more elements of the TS; determining whether the ideal state of the TS is a modeling error based on one or more confirmed sustained functional interconnections between elements of the TS; and identifying anomalies in the TS based on one or more disturbed functional interconnections between elements of the TS.