Siemens Aktiengesellschaft

Rutgers, the State University of New Jersey

Washington State University

Siemens Corporation

Dong Wei

Leandro Pfleger De Aguiar

Arquimedes Martinez Canedo

George Lo

Livio Dalloro

Yan Lu

Kun Ji

Florin Darie

Jiaxing Pi

Lingyun Wang

Sanjeev Srivastava

Zhen Song

Sindhu Suresh

Kurt Dirk Bettenhausen

Benjamin Collar

Paul J Bruschi

Yaosuo Xue

Yinghui Wu

Parag Patre

Honggang Wang

Saman Zonouz

Methods and systems are disclosed for security management in an industrial control system (ICS). An event entity detection and linking module generates a model for a plurality of event entities extracted from a plurality of different data sources including one ICS data source and one IT data source. The model encodes a set of linked event entities and their relationships, each event entity associated with a vector of attribute value pairs. A data standardization of domain knowledge includes translating, by a machine learning application, extracted knowledge base information to rules for the constraints and using the rules to validate the constraints and to add new constraints. A fusion module performs temporal correlation detection across data streams of the different data sources for establishing causality between triplets of association models within a defined time span.

Knowledge graph for real time industrial control system security event monitoring and management

A system for monitoring an industrial system for cyberattacks includes an industrial control system including a plurality of actuators, a plurality of sensors each arranged to measure one of a plurality of operating parameters, and an edge device and a computer including a data storage device having stored thereon a program that includes each of a time-series database including expected operating ranges for each operating parameter, a clustering-based database that includes clusters of operating parameters having similarities, and a correlation database that includes pairs of operating parameters that show a correlation. An alarm system is operable to initiate an alarm in response to current operating data including a measurement from one of the plurality of sensors falling outside of an expected range, a change in the expected clustering of one of the plurality of sensors based on the current operating data from each of the plurality of sensors, and a variation in the current operating data between two of the plurality of sensors that falls outside of an expected correlation of the two of the plurality of sensors.

Hybrid unsupervised machine learning framework for industrial control system intrusion detection

An intelligent workpiece system includes a workpiece comprising a portion of a product; and an embedded computing system attached to the workpiece. The embedded computing system is configured to communicate with machines in a manufacturing environment to facilitate assembly of the workpiece into the product at a plurality of assembling areas.

Intelligent workpieces

A method for performing security failover in an industrial production environment includes a programmable logic controller (PLC) receiving notification that a function block (FB) or a function (FC) on the programmable logic controller has been maliciously revised. The PLC next determines whether the function block or the function is also maliciously revised on a failover computing device. If the failover computing device is not maliciously revised, a failover operation is performed by the PLC. This operation includes sending a data block comprising one or more input parameters to the function block or the function and receiving an output data resulting from executing the function block or the function with the data block on the failover computing device.

Cyberattack-resilient control system design

A system for virtual patching of security vulnerabilities in an industrial production environment includes an industrial automation device (e.g., a PLC). The industrial automation device comprises an instance of a distributed database spanning a plurality of industrial automation devices and storing one or more virtual patches and an app container comprising a virtual patching engine security application. The app container is configured to collect system information generated by the industrial automation device during operation, and apply the one or more virtual patches to the system information to identify one or more security attacks.

PLC virtual patching and automated distribution of security context

A flexible control architecture for an electrical power microgrid provides resiliency when operating under varying threat levels. The architecture includes a microgrid control layer, an intermediate layer and a component control layer. A contingency level is computed based on conditions of the microgrid such as weather and system state. When the contingency level indicates a low degree of threat, the system operates in a centralized, top-down control configuration. When the contingency level indicates a high degree of threat, the system operates in a decentralized control configuration with the microgrid control layer performing only a monitoring function.

Flexible control architecture for microgrid resiliency

A system and method is provided that facilitates cyber-physical security. The system may comprise a controller including at least one first processor; a monitor system including at least one second processor; and a plurality of sensors configured to capture a plurality of measurements associated with at least one hardware component. The sensors may include both: at least one controller sensor that communicates with the controller; and at least one side-channel sensor that communicates with the monitor system and not with the at least one controller. The first processor of the controller may be configured to cause the controller to control the hardware component based at least in part on measurements from the controller sensor. The second processor of the monitor system may be configured to: receive the measurements from the sensors; determine whether the measurements are indicative of a possible cyberattack on the at least one hardware component; and generate at least one notification indicating a possible cyberattack based on the determination that the measurements are indicative of a possible cyberattack.

System and method for cyber-physical security

A system for threat detection in an industrial production environment comprises a programmable logic controller. This programmable logic controller includes a process image updated according to a scan cycle with process data associated with one or more field devices, a program configured to operate the one or more field devices using the process data, and one or more function blocks. These function blocks are configured to monitor the process data in the process image during each scan cycle, and identify a possible cyberattack based on the process data.

Production process knowledge-based intrusion detection for industrial control systems

A method for performing verification and validation of third party PLC code includes a marketplace computer receiving a program from a technology developer and identifying variables and operations included in the program. The marketplace computer performs (i) error handling testing on the program to yield error test results; (ii) vulnerability testing on the program to yield vulnerability test results; and (iii) performance testing of the program on target platforms to yield performance test results. Next, the marketplace computer generates a report based on the variables and operations included in the program, the error test results, the vulnerability test results, and the performance test results. This report may be sent by the marketplace computer to the technology developer.

Verification and validation of third party PLC code

A method of controlling energy consumption in a building. The method includes receiving occupant request data including a plurality of requests, wherein each of the plurality of requests corresponds to one of a plurality of zones in the building wherein the occupant request data is received via a cloud computing resource. The method also includes receiving weather data including at least one of current weather measurement data and weather forecast data wherein the weather data is received via a cloud computing resource. In addition, a facility management rule is received via a cloud computing resource. Further, the method includes generating a plurality of output control signals via cloud computing resource, wherein each of the plurality of output control signals is based on one of a plurality of requests and predicted occupant schedules, energy price data and the facility management rule. The control signals are generated by using simulation-based model predictive control method to determine a set of optimized control signals based on optimized energy use or optimized energy cost. The optimized control signals are transmitted to controllers.

Cloud enabled building automation system

A two-way voice interface allows communication by telephone between a supervisory control and data acquisition (SCADA) system and a human operator. A phone-HMI gateway communicates with the SCADA system through an application programming interface (API), composes messages to the operator in text format and interprets text derived from voice commands from the operator. A cloud telephone service is used to convert from voice to text and from text to voice, and to set up the telephone connection with the human operator.

Bidirectional remote user interface for HMI/SCADA using interactive voice phone calls

Embodiments provide an application layer security proxy that protects substation automation systems. The application layer security proxy inspects a received, inbound data packet at the application layer, and either drops the data packet, forwards the data packet, or processes the data packet rather than dropping it in order to maintain the communications network connection, the later two according to a predefined role-based access control policy. The application layer security proxy calculates a round trip time for each reply to a received, inbound data packet and observes the bandwidth usage from the amount of bytes transmitted. Round trip time and bandwidth usage are used to detect abnormal communication traffic.

Application layer security proxy for automation and control system networks

Methods and architectures are described that provide function block mobility between PLCs. Each PLC configured with Mobile Function Blocks (MFBs) may forward and execute MFBs from each other. To enable MFB mobility over a communication bus, each PLC having one or more configured MFBs requires a Communication Function Block (CFB) and an MFB directory data block. Each PLC maintains an MFB directory data block to store its MFB directory which is used when other PLCs send requests to check the availability of MFBs they need to run new tasks.

Growing community of inventors

Edison, NJ, United States of America

Dong Wei