Model-Based Equipment Monitoring for Cyber-Attack Abnormality Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing industrial management monitoring systems struggle to accurately identify the state of industrial plants, particularly under cyber-attack conditions, which hinders effective operation determination.
Innovation Solution
A management monitoring system comprising real-time detection devices and a management monitoring device with an analysis unit that simulates equipment states using models and compares results with actual data to determine abnormalities, including updating thresholds and accumulating previous data for enhanced accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the system controls operation by analyzing target load information, then the operation can be managed, but the state of the industrial plant cannot be identified accurately or in detail
Solution Approach 1:
The monitoring system is segmented into multiple functional components: real-time detection devices for data collection, analysis units for simulation and comparison, and determination units for abnormality detection. This segmentation allows each component to specialize in specific tasks, improving overall measurement precision without requiring a single complex system to handle all functions
Solution Approach 2:
The patent introduces an analysis unit as an intermediary between the real-time detection devices and the determination unit. This analysis unit simulates plant states using models and compares simulated results with actual detection data, serving as a mediator that enhances state identification accuracy by bridging raw data and abnormality determination
2Reliability
If the system uses basic load information analysis, then the operation can be monitored, but it cannot accurately determine whether the industrial plant is properly operated under cyber-attacks
Solution Approach 1:
The system performs preliminary actions by pre-establishing models of the industrial plant and its equipment before actual operation monitoring. These models are used by the analysis unit to simulate expected plant states under normal conditions, providing a baseline for comparison that enhances the reliability of cyber-attack detection
Solution Approach 2:
The determination unit continuously compares actual detection data with simulated plant states and provides feedback on discrepancies. This feedback mechanism allows the system to dynamically adjust its monitoring and improve abnormality detection precision by learning from the difference between expected and actual plant behavior
Data Source
AI summary
A monitoring system includes a real-time detection device configured to detect a state of target equipment and an instruction output from a central control device configured to input a control instruction to the target equipment; and a monitoring device configured to acquire information from the real-time detection device. The monitoring device includes an analysis unit configured to simulate the state of the target equipment, with models of the target equipment and the central control device, and a determination unit configured to determine whether an abnormality has occurred in the target equipment. The analysis unit is configured to simulate the state of the target equipment, using the latest information detected by the real-time detection device. The determination unit is configured to compare a result calculated by the analysis unit using the latest information detected by the real-time detection device.