Reconstructing User-Level Operations from Industrial Protocol Primitives
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial control systems face challenges in monitoring and tracking user-level operations in communication networks, as network traffic primarily consists of request-response transactions that cannot directly identify abstract entities like scenarios and tasks, leading to difficulties in reconstructing meaningful user-level information from intercepted primitives.
Innovation Solution
A method and apparatus that define multiple scenarios and parsing rules to derive sequences of primitives, intercept and reconstruct scenarios from intercepted sequences, and extract user-level information by assigning probability values and handling nuisance primitives, allowing for the reconstruction of user-level operations even with partial or reordered sequences.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network traffic monitoring is performed at the primitive level, then detailed communication data is captured, but the ability to identify abstract user-level operations is lost
Solution Approach 1:
The patent introduces an intermediary reconstruction system that sits between the captured primitives and the user-level operation identification. This system uses stored scenario templates and probabilistic matching to translate low-level primitives back into meaningful user-level operations, effectively mediating between the detailed data capture and the high-level information needs
Solution Approach 2:
The patent creates copies of expected communication patterns in the form of stored scenario templates. These templates represent ideal sequences of primitives for various user-level operations. By comparing intercepted primitives against these copied patterns, the system can identify user-level operations even when the actual traffic deviates slightly from expected patterns
2Measurement precision
If strict sequence matching is used for scenario reconstruction, then accuracy is improved, but robustness to packet loss and reordering is reduced
Solution Approach 1:
The patent makes the matching process dynamic by introducing probability values and flexible matching criteria. Instead of requiring exact sequence matches, the system dynamically adjusts matching thresholds and uses probabilistic scoring to determine scenario correspondence. This allows the system to accommodate packet loss, reordering, and variations in communication patterns while maintaining reliable reconstruction
Solution Approach 2:
The patent changes the parameters of the matching process from binary (match/no match) to probabilistic (degree of match). By assigning probability values to different matching outcomes and using aggregate scoring, the system can tolerate deviations in sequence order and missing packets while still achieving accurate scenario reconstruction
3Loss of information
If all intercepted primitives are processed, then complete information is obtained, but processing complexity and time increase
Solution Approach 1:
The patent extracts and removes nuisance primitives from the intercepted sequence before processing. By identifying and filtering out primitives that do not contribute to user-level operation identification, the system reduces the amount of data that needs to be processed while maintaining the completeness of relevant information. This extraction step simplifies subsequent matching operations
Solution Approach 2:
The patent segments the processing into distinct stages: capturing all primitives, filtering nuisance primitives, matching against scenario templates, and reconstructing user-level operations. This segmentation allows the system to maintain information completeness while managing processing complexity through organized, modular processing steps
Data Source
AI summary
A method includes holding multiple primitives of a communication protocol, which is used for managing a controller that controls one or more field devices in an industrial control network. Multiple scenarios are defined, each corresponding to one or more respective sequences of primitives exchanged with the controller over the industrial control network for achieving a respective user-level operation. Multiple parsing rules for deriving the sequences of primitives from the respective scenarios are further defined. A sequence of primitives that were exchanged with the controller over the industrial control network is intercepted. An attempt to reconstruct from the intercepted sequence of primitives, using the parsing rules, one or more scenarios that each corresponds to the intercepted sequence of primitives is carried out, and, in response to succeeding in reconstructing one or more scenarios, extracting user-level information from the reconstructed scenarios.