Siemens Aktiengesellschaft

Siemens Mobility Gmbh

Rutgers, the State University of New Jersey

Siemens Industry, Inc.

Washington State University

Siemens Corporation

Leandro Pfleger De Aguiar

Dong Wei

Omer Metel

David Hingos

Safia Rahmat

Arquimedes Martinez Canedo

Martin Wimmer

Heiko Patzlaff

Jiaxing Pi

Rainer Falk

Lingyun Wang

Sanjeev Srivastava

Alberto Avritzer

Thomas Gruenewald

John W Crawford

Ayse Parlak

Yinghui Wu

Christina Otto

Honggang Wang

Saman Zonouz

Stefan Woronka

Tzu-hsin Tsao

Ramamani Ramaraj

Philipp SCHÄFER

Tsao Tzu-Hsin

A transmission device for transmitting data between a first network and a second includes: a first unidirectional transmission unit which is coupled to the first network and is configured to exclusively receive data transmitted from the first network to the transmission device, a second unidirectional transmission unit which is coupled to the second network and is configured to exclusively send data from the transmission device to the second network, and an identification unit which is located between the first unidirectional unit and the second unidirectional unit and which is configured to receive the data received by the first unidirectional transmission unit and to identify anomalies in the received data. The provided transmission device achieves the reliable, optimized identification of anomalies in the first network and increases security in the identification unit against manipulation and against attacks or intrusion attempts from the second network.

Transmission device for transmitting data

System and method are disclosed for preserving privacy of shared data over a shared network. A vector encoder transforms received data into a feature vector. An autoencoder includes a neural network-based encoder transforms the feature vector into a fixed size latent space representation of the received data. A neural network-based decoder of the autoencoder is configured to reconstruct the feature vector from the latent space representation. The autoencoder is trained using training data with an objective to minimize reconstruction error. A vector decoder transforms the reconstructed feature vector into reconstructed data. The latent space representation of data from the trained autoencoder is shared as anonymized data with at least one trusted party over the shared network, decoded offline using a replica of the trained decoder.

Privacy preservation of data over a shared network

A micro data capture device can be configured to operate as a unidirectional connection from a first computing device to a second computing device. The micro data capture device can include a data capture side comprising a first universal serial bus (USB) interface configured to connect to the first computing device so as to extract data from the first computing device. The micro data capture device can further include a monitoring apparatus comprising an interceptor configured to copy data from the data capture side so as to define the unidirectional connection. Further, the micro data capture device can define a data storage side comprising a second USB interface configured to connect to the second computing device so as to transfer data to the second computing device. The data storage side can be configured to receive data from the data storage side via the monitoring apparatus. In some cases, the data capture side has only volatile memory, and the data storage side includes non-volatile memory. Further, the data capture side can be physically separate from the data storage side.

Secure data extraction from computing devices using unidirectional communication

An apparatus for monitoring a protected network using unidirectional communication includes a sending unit coupled to one or more devices of the protected network for obtaining network data related to protected network status. The apparatus further includes an eavesdropping unit with an interceptor configured to intercept the requested data within the sending unit via a loop connection between input and output interfaces of the sending unit. The interceptor and the loop connection are inductively coupled and configured for unidirectional communication from the sending unit to the receiving unit. A receiving unit is coupled to the eavesdropping unit for receiving the duplicated data and forwarding the duplicated data to an evaluation system located in a low security external network. A reconfigurable application layer includes at least one modular application configured to operate security related functions that support intrusion detection.

Data capture apparatus with embedded security applications and unidirectional communication

Methods and systems are disclosed for security management in an industrial control system (ICS). An event entity detection and linking module generates a model for a plurality of event entities extracted from a plurality of different data sources including one ICS data source and one IT data source. The model encodes a set of linked event entities and their relationships, each event entity associated with a vector of attribute value pairs. A data standardization of domain knowledge includes translating, by a machine learning application, extracted knowledge base information to rules for the constraints and using the rules to validate the constraints and to add new constraints. A fusion module performs temporal correlation detection across data streams of the different data sources for establishing causality between triplets of association models within a defined time span.

Knowledge graph for real time industrial control system security event monitoring and management

A system for monitoring an industrial system for cyberattacks includes an industrial control system including a plurality of actuators, a plurality of sensors each arranged to measure one of a plurality of operating parameters, and an edge device and a computer including a data storage device having stored thereon a program that includes each of a time-series database including expected operating ranges for each operating parameter, a clustering-based database that includes clusters of operating parameters having similarities, and a correlation database that includes pairs of operating parameters that show a correlation. An alarm system is operable to initiate an alarm in response to current operating data including a measurement from one of the plurality of sensors falling outside of an expected range, a change in the expected clustering of one of the plurality of sensors based on the current operating data from each of the plurality of sensors, and a variation in the current operating data between two of the plurality of sensors that falls outside of an expected correlation of the two of the plurality of sensors.

Hybrid unsupervised machine learning framework for industrial control system intrusion detection

In an industrial system, a data capture apparatus can be configured to operate as a unidirectional communication connection between a private network and a public network. The data capture apparatus can be further configured to collect raw data from the private network. The raw data can define a data distribution. The data capture apparatus can be further configured, based on the data distribution of the raw data, to generate anonymized or synthetic data that represents the raw data. The anonymized data can be transmitted over the unidirectional communication connection to a receiver machine of the data capture apparatus. In some cases, the receiver machine can send the anonymized data to an analysis system within the public network, such that the raw data can be analyzed by the analysis system, based on the anonymized data that represents the raw data, without the analysis system obtaining the raw data.

Privacy preserving uni-directional communication device

A system and method is provided that facilitates threat impact characterization. The system may include a replica programmable logic controller (PLC) that corresponds to a production PLC in a production system and that may be configured to operate at an accelerated processing speed that is at least two times faster than a processing speed of the production PLC. The system may also include a data processing system configured to communicate with the replica PLC when executing malware infected PLC firmware and generate a simulation of the production system based on a virtual model of the production system operating at an accelerated processing speed that is at least two times faster than a processing speed of the physical production system. The simulation may include accelerated simulation of the production PLC based on communication with the replica PLC using the malware infected PLC firmware. The data processing system may also monitor: outputs from the replica PLC and the simulation of the production system to determine a possible threat to a hardware component of the production system caused by the production PLC executing the infected PLC firmware rather than a non-infected PLC firmware; and output data indicative of the possible threat thorough a display device.

System and method for threat impact characterization

In an industrial system, a data capture apparatus can be configured to operate as a unidirectional communication connection between a private network and a public network. The data capture apparatus can be further configured to time stamp data, for instance digitally sign data with a time stamp, so as ensure data integrity over the unidirectional communication connection, while maintaining physical isolation between the private network and public network.

Time-stamping for industrial unidirectional communication device with data integrity management

A method for performing security failover in an industrial production environment includes a programmable logic controller (PLC) receiving notification that a function block (FB) or a function (FC) on the programmable logic controller has been maliciously revised. The PLC next determines whether the function block or the function is also maliciously revised on a failover computing device. If the failover computing device is not maliciously revised, a failover operation is performed by the PLC. This operation includes sending a data block comprising one or more input parameters to the function block or the function and receiving an output data resulting from executing the function block or the function with the data block on the failover computing device.

Cyberattack-resilient control system design

A system for virtual patching of security vulnerabilities in an industrial production environment includes an industrial automation device (e.g., a PLC). The industrial automation device comprises an instance of a distributed database spanning a plurality of industrial automation devices and storing one or more virtual patches and an app container comprising a virtual patching engine security application. The app container is configured to collect system information generated by the industrial automation device during operation, and apply the one or more virtual patches to the system information to identify one or more security attacks.

PLC virtual patching and automated distribution of security context

A computer-implemented method for assessing and managing network security for a network includes retrieving topology data and network traffic data with a processor, where the topology data is indicative of a topology of the network. The method may further include retrieving, via the processor, network flow data from a plurality of network data collectors, generating, via the processor, an attack tree based on the topology data and the network flow data, updating a customer model database with the attack tree and the topology data, and outputting a security assessment based on the attack tree and the topology data.

System and method for passive assessment of industrial perimeter security

An automation system comprises a local threat information server operating within automation plant and a plurality of field devices operating at a control layer of the automation plant. The local threat information server is configured to: receive threat information from one or more external sources, receive plant information from one or more internal sources, set a threat level according to one or more of the threat information and the plant information, and distribute an indication of the threat level to one or more control layer devices. Each respective field device is configured to: receive the indication of the threat level, identify one or more security operations corresponding to the threat level, and execute the one or more security operations.

Self-defending smart field device and architecture

For patch management of an industrial control system, predicted temporal evolution of risk due to vulnerability is provided to industrial control system operators to help schedule patching. A Markov chain representing the temporal evolution uses asset (e.g., industrial control system component) specific information to determine risk over time. This risk information may be used to prioritize and/or schedule patching. The operator is provided more information to help manage patching of the industrial control system, allowing better balancing of risk with manufacturing burden.

Patch management for industrial control systems

A system for threat detection in an industrial production environment comprises a programmable logic controller. This programmable logic controller includes a process image updated according to a scan cycle with process data associated with one or more field devices, a program configured to operate the one or more field devices using the process data, and one or more function blocks. These function blocks are configured to monitor the process data in the process image during each scan cycle, and identify a possible cyberattack based on the process data.

Growing community of inventors

Robbinsville, NJ, United States of America

Leandro Pfleger De Aguiar