Siemens Aktiengesellschaft

Marco Caselli

Jan Kissling

Josep Soler Garrido

A first mapping component produces observed triple statements from events received from a security tool monitoring an industrial system. A link-prediction component estimates a probability score for each observed triple statement by link prediction in a knowledge graph. A scoring component computes a priority score for an entity of the industrial system contained in the knowledge graph and/or events based on the probability scores. Priority scores can be computed for some or all possible events in the industrial system as a reference to prioritize alerts coming from the security tools. The system works in an unsupervised manner. In fact, the system does not directly try to infer (predict) maliciousness in entities or events on the knowledge graph. Instead, priority scores are used during operation to evaluate actual system observations and prioritize them. Therefore, a knowledge graph-based recommendation system for automated analysis of industrial cybersecurity events is provided.

Growing community of inventors

Munich, Germany

Marco Caselli