State-Aware Alarm Processing for False Alarm Reduction in OT
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Alarm providing systems, particularly SIEM systems, face a high risk of false alarms in OT environments due to the similarity between attack signatures and normal operational patterns, making it difficult to distinguish between operator interventions and malicious activities.
Innovation Solution
The method involves receiving plant data from industrial plants, selecting states based on this data, and using these states to configure alarm rules, which are then applied to detect alarm events, thereby reducing the risk of false alarms by integrating contextual information into the rule processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rule-based incident identification is used in OT environments, then security incidents can be detected based on event patterns, but the number of false alarms increases due to similarity between attack signatures and normal operational patterns
Solution Approach 1:
The system dynamically adapts alarm rules based on learned normal operational patterns. Instead of using static rules, the system continuously updates its understanding of what constitutes normal behavior in different operational contexts, allowing it to distinguish between legitimate operations and actual security threats more accurately
Solution Approach 2:
The system changes the parameters of alarm detection by incorporating contextual information about operational states. By adjusting detection thresholds and criteria based on the current operational context, the system reduces false alarms while maintaining security detection effectiveness
2Measurement precision
If stable rules are applied to detect security incidents, then attack signatures can be identified in IT systems, but the system fails to account for operational variations in OT systems
Solution Approach 1:
The system transitions from static detection rules to dynamic pattern learning that adapts to changing operational conditions. Machine learning models continuously learn what constitutes normal behavior in different operational contexts, enabling the system to maintain high detection precision while adapting to operational variations
Solution Approach 2:
The system performs preliminary learning of normal operational patterns before attempting to detect security incidents. By establishing a baseline understanding of legitimate operations in advance, the system can more accurately distinguish between normal variations and actual threats
3Productivity
If operator interventions are monitored using event patterns, then operational efficiency can be tracked, but malicious interventions cannot be distinguished from legitimate operations
Solution Approach 1:
The system changes how operational data is analyzed by incorporating contextual parameters about operational states and patterns. Instead of treating all events uniformly, the system adjusts its analysis based on the operational context, preserving important information about why certain events occur
Solution Approach 2:
The system introduces an intermediary layer of contextual analysis between raw events and security detection. This intermediary layer enriches event data with operational context, enabling more accurate distinction between legitimate and malicious activities
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for providing an alarm by an alarm providing system, comprising: receiving plant data from at least one industrial plant by a state providing system; providing state data indicating at least one state of the at least one industrial plant by the state providing system; selecting at least one state in the provided state data based on the received plant data by the state providing system; providing an alarm by the event monitoring system, wherein the providing of an alarm, comprises: receiving the selected states in the provided state data and the plant data; detecting an alarm event in the received plant data; providing at least one rule; providing at least one alarm rule based on the selected states in the provided state data and the provided rules; and providing the alarm based on the detected alarm event and the provided at least one alarm rule.