Infrastructure Anomaly Detection via Packet-Based Virtual Modeling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial automation systems face high management costs and inefficiencies due to the need for frequent data polling in SCADA systems, especially in systems with small or infrequent variations, leading to exorbitant costs and computational demands.
Innovation Solution
A method and apparatus that analyze data packets exchanged in a telecommunication system to generate a virtual representation of the infrastructure, allowing for anomaly detection using a 'push' logic, which minimizes computational costs by only analyzing data packets when exchanged, and compares these representations against predefined critical states to identify anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the SCADA system uses frequent data polling to monitor infrastructure components, then the monitoring reliability is improved, but the management costs and computational demands become exorbitant
Solution Approach 1:
The system transitions from continuous periodic polling to event-triggered periodic action, where data collection occurs only when changes are detected or events occur in the infrastructure, thereby maintaining monitoring reliability while significantly reducing computational overhead and management costs
Solution Approach 2:
The infrastructure components perform self-service by autonomously generating and transmitting data packets when they detect changes in their state or when events occur, eliminating the need for external polling mechanisms and reducing the computational burden on the SCADA system
2Ease of operation
If RTUs are provided for each component or physical subsystem to enable distributed control, then the control capability is improved, but the system complexity and costs increase considerably
Solution Approach 1:
The system employs a universal communication protocol and standardized data packet format that can be applied across different infrastructure components and subsystems, allowing a single SCADA architecture to manage diverse assets without requiring specialized RTUs for each component, thereby reducing system complexity while maintaining control capability
Solution Approach 2:
The patent introduces an intermediary layer of standardized communication protocols and data formats that mediate between diverse infrastructure components and the SCADA system, allowing components to communicate their state and receive commands without requiring dedicated RTUs, thus simplifying the overall system architecture
3Loss of time
If the SCADA system polls RTUs regularly to obtain real-time data, then the data freshness is improved, but the computational costs become very demanding
Solution Approach 1:
Infrastructure components autonomously determine when to transmit data based on actual changes in their state or occurrence of events, eliminating the need for continuous polling and reducing computational costs while maintaining data freshness by ensuring immediate transmission of relevant information
Solution Approach 2:
The system monitors changes in critical parameters and triggers data transmission only when parameter values change or exceed thresholds, rather than polling at fixed intervals, thereby maintaining data freshness for critical information while reducing overall computational burden
Data Source
AI summary
The present invention relates to a method for detecting anomalies in an infrastructure comprising the step of analyzing each of the data packets (PD) exchanged in the telecommunication system; identifying for each of the analysed data packets (PD) all the network protocols used and at least one field of each of the protocols; generating a virtual representation of the infrastructure (1) for each of the exchanged data packets (PD) and on the basis of the identified protocols and fields; storing the virtual representation generated for each of the exchanged data packets (PD); comparing the virtual representation stored with at least one comparison element, identifying at least one critical state of the infrastructure from the differences and/or similarities between the stored virtual representation and the comparison elements; signaling, by means of the computerized data processing means, an anomaly of the infrastructure when at least one of the critical states is identified in the virtual representation.