Industrial Control Safety Monitoring for Unknown Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing safety monitoring methods for industrial control systems are limited in detecting unknown and abnormal behaviors, as they rely on preset rules and have poor real-time performance in analyzing large amounts of network flow data.
Innovation Solution
A safety monitoring method and apparatus that perform time statistics on data generated during industrial control system operations, allowing users to identify abnormal behaviors without relying on preset rules, by distinguishing between first and second characteristics and selecting data ranges for further analysis, combining user judgment with automatic analysis for accurate and efficient results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If rule-based automatic analysis engine is used to analyze abnormal behavior, then known attacks and abnormal behaviors can be identified, but unknown attacks and abnormal behaviors cannot be identified
Solution Approach 1:
The patent segments the analysis process into two distinct stages: first statistics (initial screening) and second statistics (detailed analysis). This segmentation allows the system to handle different types of attacks appropriately - using efficient preset rules for known threats and flexible user-defined analysis for unknown threats, thereby resolving the contradiction between detection accuracy and detection coverage
Solution Approach 2:
The patent applies partial action by performing detailed second statistics only on selected time periods and characteristics that are suspected of containing abnormal behavior, rather than analyzing all data comprehensively. This approach maintains high detection coverage while managing computational resources efficiently
2Measurement precision
If analysis is performed on a large amount of network flow data, then abnormal behavior can be detected, but the detection speed decreases and real-time performance deteriorates
Solution Approach 1:
The patent divides the large-scale data analysis into two phases: first statistics that quickly screens obvious abnormalities using preset rules, and second statistics that perform detailed analysis only on selected suspicious time periods and characteristics. This segmentation dramatically improves detection speed while maintaining accuracy by avoiding comprehensive analysis of all data
Solution Approach 2:
The system performs partial analysis by focusing computational resources only on selected time periods and characteristics that show abnormal patterns, rather than analyzing the entire dataset. This approach maintains high detection accuracy while significantly improving detection speed and real-time performance
3Measurement precision
If preset rules are used for safety monitoring, then known attacks can be identified, but the system complexity increases and flexibility decreases
Solution Approach 1:
The patent segments the monitoring system into a rule-based first statistics component and a flexible second statistics component. This segmentation allows the system to use simple preset rules for common threats while providing users with the capability to perform customized analysis when needed, thereby reducing overall system complexity while maintaining flexibility
Solution Approach 2:
The system enables users to perform their own analysis using the second statistics function, allowing them to define their own analysis criteria and time periods. This self-service approach reduces the need for complex automated rule sets while maintaining detection accuracy for unknown threats
Data Source
AI summary
A safety monitoring method and apparatus for an industrial control system include an advantage of quick and accurate detection of an abnormal behavior in the industrial control system. An embodiment of the method includes: providing the first data generated during the process of operating of an industrial control system and performing the first statistics on the first data; providing a result of the first statistics to a user; obtaining an operation performed by the user on the result of the first statistics; determining, based on the operation, a target time period related to the first statistics and the second data satisfying a preset condition in the first data; and obtaining a result of second statistics in the target time period, and based on the result thereof, performing the safety analysis on the industrial control system.