Ao Kaspersky Lab

Andrey B Lavrentyev

Nikolay N Demidov

Dmitry A Ivanov

Artem M Vorontsov

Vyacheslav I Shkulev

Andrey P Doukhvalov

Pavel V Filonov

Dmitry K Shalyga

Sergey V Gordeychik

Sergey G Zagorsky

Artyom M Nechiporuk

Alexander V Travov

Maxim A Mamaev

A method for diagnostics and monitoring of anomalies in a cyber-physical system (CPS) includes obtaining information related to anomalies identified in the CPS. The obtained information includes at least one value of one or more CPS variables. One or more classifying features of the identified anomalies in the CPS are generated based on the obtained information. Classification of the identified anomalies in the CPS into two or more anomaly classes is performed based on the generated classifying features. Each of the two or more anomaly classes is associated with one or more anomaly characteristics. Diagnostics of anomalies are performed in each of the two or more anomaly classes by calculating values of the anomaly characteristics associated with each of the two or more anomaly classes. Anomalies of each of the two or more anomaly classes are monitored based on the calculated values of the anomaly characteristics associated with each of the two or more anomaly classes.

System and method for diagnostics and monitoring of anomalies of a cyber-physical system

Systems and methods for determining a source of anomaly in a cyber-physical system (CPS). A forecasting tool can obtain a plurality of CPS feature values during an input window and forecast the plurality of CPS feature values for a forecast window. An anomaly identification tool can determine a total forecast error for the plurality of CPS features in the forecast window, identify an anomaly in the cyber-physical system when the total forecast error exceeds a total error threshold, and identify at least one CPS feature as the source of the anomaly.

System and method for detecting anomalies in cyber-physical system with determined characteristics

The present disclosure provides systems and methods of early determination of anomalies using a graphical user interface. In one aspect such a method comprises: receiving information about one or more features of a cyber-physical system, receiving information about a period of time for monitoring the one or more features, generating a forecast of values of the one or more features of the cyber-physical system over the period of time based on a forecasting model for graphing in a graphical user interface, determining a total error of the forecast for all of the one or more features and determining an error for each of the one or more features over the period of time, determining that the error for one feature of the one or more features is greater than a predetermined threshold and identifying the one feature as a source of an anomaly in the cyber-physical system.

System and method of generating data for monitoring of a cyber-physical system for early determination of anomalies

Disclosed are systems and methods for protection of a technological system (TS) from cyber attacks. An exemplary method comprises: obtaining a real state of the TS; initializing a cybernetic control system (CCS) by synchronizing the CCS with the TS; comparing, by the CCS, the real state of the TS with an ideal state of the TS; based on the comparison, identifying a deviation of the real state of the TS from the ideal state of the TS; when the deviation is identified, checking an integrity of at least functional interconnections of the states of one or more elements of the TS; determining whether the ideal state of the TS is a modeling error based on one or more confirmed sustained functional interconnections between elements of the TS; and identifying anomalies in the TS based on one or more disturbed functional interconnections between elements of the TS.

System and method of protection of technological systems from cyber attacks

Disclosed are systems, methods and computer program product for determining information security level for an enterprise. An example method comprising: collecting information relating to a structure of the enterprise, including a plurality of elements of the enterprise; creating a model to correspond to each element of the enterprise based on at least one function of each element; identifying criteria to evaluate an effectiveness of the at least one function of each element; simulating operation of the elements and determining effectiveness of the at least one function of each simulated element, wherein simulating includes determining different sequences of events and actions in response to the events for one or more simulation iterations based on the effectiveness of the at least one function of each element; and determining an information security level for the enterprise by maximizing the effectiveness of functions of the elements in response to events.

Growing community of inventors

Moscow, Russia

Andrey B Lavrentyev