Disambiguation Engine for Industrial Cyber-Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial control systems connected to the Internet are vulnerable to cyber-attacks that can disrupt operations, with existing methods failing to detect such threats automatically and accurately, especially when multiple attacks occur simultaneously, and distinguishing between attacks and faults is challenging.
Innovation Solution
A system using multiple monitoring nodes that generate current values, a node classification computer to determine normal or abnormal states, and a disambiguation engine employing Hidden Markov Models (HMMs) to differentiate between attacks and faults, providing real-time output on node status.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple monitoring nodes are used to detect attacks, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The system segments the monitoring function into multiple independent monitoring nodes, each responsible for specific parameters or assets. This segmentation enables parallel detection across different nodes, improving overall detection accuracy while maintaining manageable complexity through modular design. Each node can independently analyze its assigned parameters and contribute to the collective attack detection capability.
Solution Approach 2:
The monitoring nodes are designed with multi-functionality, capable of detecting both faults and cyber-attacks simultaneously using the same infrastructure. By making the monitoring system universal in its detection capabilities, the patent avoids the need for separate specialized systems, thereby improving detection accuracy without proportionally increasing system complexity.
2Measurement precision
If Hidden Markov Models are used to differentiate attacks from faults, then distinction accuracy is improved, but computational requirements increase
Solution Approach 1:
The Hidden Markov Models are pre-trained offline with extensive fault and attack data before deployment. This preliminary action prepares the models in advance, allowing them to perform rapid classification during actual monitoring operations. The heavy computational work is shifted to the training phase, enabling accurate real-time distinction between attacks and faults with minimal online computational requirements.
Solution Approach 2:
The patent uses simplified representations and pre-computed probability distributions from the HMMs to make classification decisions. Instead of performing complex real-time model calculations, the system uses pre-generated probability tables and simplified inference mechanisms that replicate the full model's decision-making capability with reduced computational overhead.
3Loss of time
If real-time monitoring of multiple parameters is implemented, then detection timeliness is improved, but data processing load increases
Solution Approach 1:
The system extracts and monitors only the most critical parameters that are most indicative of attacks or faults, rather than processing all available data. By selectively extracting key indicators from the full parameter set, the patent maintains timely detection capability while significantly reducing the data processing load. Each monitoring node focuses on its specific assigned parameters, avoiding redundant processing.
Solution Approach 2:
The patent implements monitoring at multiple levels of detail, using partial monitoring for routine operations and enabling more comprehensive monitoring only when anomalies are detected. This approach ensures timely detection of significant events while minimizing unnecessary processing during normal operations, balancing detection timeliness with data processing load.
Data Source
AI summary
According to some embodiments, a plurality of monitoring nodes may each generate a series of current monitoring node values over time that represent a current operation of the industrial asset. A node classification computer may determine, for each monitoring node, a classification result indicating whether each monitoring node is in a normal or abnormal state. A disambiguation engine may receive the classification results from the node classification computer and associate a Hidden Markov Model (“HMM”) with each monitoring node. For each node in an abnormal state, the disambiguation engine may execute the HMM associated with that monitoring node to determine a disambiguation result indicating if the abnormal state is a result of an attack or a fault and output a current status of each monitoring node based on the associated classification result and the disambiguation result.