Siemens Aktiengesellschaft

Rutgers, the State University of New Jersey

Washington State University

Siemens Mobility Gmbh

Jiaxing Pi

Leandro Pfleger De Aguiar

Dong Wei

Sindhu Suresh

Yinghui Wu

Stefan Woronka

Phan Minh Nguyen

Honggang Wang

Saman Zonouz

Philipp SCHÄFER

Methods and systems are disclosed for security management in an industrial control system (ICS). An event entity detection and linking module generates a model for a plurality of event entities extracted from a plurality of different data sources including one ICS data source and one IT data source. The model encodes a set of linked event entities and their relationships, each event entity associated with a vector of attribute value pairs. A data standardization of domain knowledge includes translating, by a machine learning application, extracted knowledge base information to rules for the constraints and using the rules to validate the constraints and to add new constraints. A fusion module performs temporal correlation detection across data streams of the different data sources for establishing causality between triplets of association models within a defined time span.

Knowledge graph for real time industrial control system security event monitoring and management

A system for monitoring an industrial system for cyberattacks includes an industrial control system including a plurality of actuators, a plurality of sensors each arranged to measure one of a plurality of operating parameters, and an edge device and a computer including a data storage device having stored thereon a program that includes each of a time-series database including expected operating ranges for each operating parameter, a clustering-based database that includes clusters of operating parameters having similarities, and a correlation database that includes pairs of operating parameters that show a correlation. An alarm system is operable to initiate an alarm in response to current operating data including a measurement from one of the plurality of sensors falling outside of an expected range, a change in the expected clustering of one of the plurality of sensors based on the current operating data from each of the plurality of sensors, and a variation in the current operating data between two of the plurality of sensors that falls outside of an expected correlation of the two of the plurality of sensors.

Hybrid unsupervised machine learning framework for industrial control system intrusion detection

A computer-implemented method for power grid anomaly detection using a convolutional neural network (CNN) trained to detect anomalies in electricity demand data and electricity supply data includes receiving (i) electricity demand data comprising time series measurements of consumption of electricity by a plurality of consumers, and (ii) electricity supply data comprising time series measurements of availability of electricity by one or more producers. An input matrix is generated that comprises the electricity demand data and the electricity supply data. The CNN is applied to the input matrix to yield a probability of anomaly in the electricity demand data and the electricity supply data. If the probability of anomaly is above a threshold value, an alert message is generated for one or more system operators.

Deep convolutional neural network based anomaly detection for transactive energy systems

Growing community of inventors

Weehawken, NJ, United States of America

Jiaxing Pi