Virtual DCS Security Operator for Correlated IT-OT Incident Response
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Security incident detection in cloud-native distributed control systems (DCS) is challenging due to the vast amounts of data to process and the isolated treatment of IT and OT data, necessitating improved automatic security incident responses.
Innovation Solution
A Virtual DCS Security Operator that monitors and correlates IT-related and OT-related data, applying domain-specific detection and response rules to autonomously detect and respond to security incidents, utilizing Kubernetes and OPC UA for system interaction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If IT-related data and OT-related data are processed separately in isolated systems, then system complexity is reduced and ease of operation is improved, but security incident detection precision deteriorates due to inability to correlate cross-domain attack patterns
Solution Approach 1:
The patent merges IT and OT data processing into a unified security monitoring system that correlates events across both domains. The system ingests IT data (user logs, authentication events) and OT data (process control events, device status) simultaneously, enabling detection of cross-domain attack patterns that would be invisible in isolated systems. This combining of previously separate data streams directly improves security incident detection precision.
Solution Approach 2:
The security monitoring system is designed with multi-functionality to handle diverse data types from both IT and OT domains through a single unified platform. It performs multiple functions including data ingestion from heterogeneous sources, correlation analysis across domains, pattern recognition for security threats, and automated response coordination. This universal approach manages complexity through standardized interfaces while enabling comprehensive security monitoring.
2Productivity
If manual analysis and response to security incidents is performed, then false positives can be investigated and false negatives can be reviewed, but response time increases and productivity decreases
Solution Approach 1:
The system implements feedback mechanisms where detection results and automated responses are continuously monitored and used to refine detection algorithms. False positives and negatives are fed back into the system to improve pattern recognition accuracy over time. This feedback loop maintains high detection accuracy while reducing the need for manual review, thereby improving response speed without sacrificing reliability.
Solution Approach 2:
The security monitoring system performs self-service through automated incident detection, classification, and response execution. It autonomously analyzes security events, determines threat levels, and executes predefined response actions without requiring constant human intervention. This self-service capability dramatically improves response speed while maintaining accuracy through sophisticated automated analysis algorithms.
3Measurement precision
If comprehensive security monitoring of all IT and OT data is implemented, then security detection coverage is improved, but data processing time increases and loss of time worsens
Solution Approach 1:
The system applies partial monitoring strategies by focusing computational resources on high-risk areas and events with higher detection probabilities. Instead of uniformly processing all data at maximum depth, it dynamically adjusts analysis intensity based on threat indicators, event severity, and historical patterns. This approach maintains comprehensive coverage while reducing overall processing time by applying less intensive analysis to low-risk events.
Solution Approach 2:
The data processing system is segmented into multiple parallel processing streams that handle different data types and analysis tasks independently. IT data and OT data are processed through separate but coordinated pipelines, allowing concurrent processing without bottlenecks. Critical security events are routed to priority processing queues, while routine events use standard processing paths. This segmentation enables comprehensive monitoring coverage while minimizing total processing time through parallel execution.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
There is disclosed a method for security incident detection in a cloud-native distributed control system, DCS, in industrial process automation. The method comprises monitoring information technology, IT -related data and operation technology, OT, -related data at a production process and at a containerized DCS associated with the production process. The method further comprises joint analysing of first data indicative of first monitoring data from the monitoring of the IT-related data and of second data indicative of second monitoring data from the monitoring of the OT-related data. The joint analysing is based on correlating at least part of the first data with at least part of the second data and/or based on correlating at least part of the second data with at least part of the first data. The method further comprises, based on the joint analysing, detecting a security incident under consideration of predetermined security incident detection rules: The method further comprises, based on a result of the detecting, responding on a detected security incident for handling of the detected security incident under consideration of predetermined security incident response rules.