Ut-battelle, Inc.

Michael D Iannacone

Milton Nance Ericson

Ali Passian

Erik M Ferragut

Robert A Bridges

Kiren E Verma

Jason A Laska

Samuel C Hollifield

Joel A Dawson

Gavin B Long

Robert C Jordan

Pablo Moriano

Jordan Sosnowski

John R Goodall

Joel M Asiamah

Varisara Tansakul

Lane T Harrison

Srikanth B Yoginath

Additive manufacturing's reliance on embedded computing renders it vulnerable to tampering through cyber-attacks. Sensor instrumentation of additive manufacturing devices allows for rigorous process and security monitoring, but also results in a massive volume of noisy data for each run. As such, in-situ, near-real-time anomaly detection is challenging. A probabilistic-model-based approach addresses this challenge.

Stealthy process attack detection for automated manufacturing

A system and method for intrusion detection on automotive controller area networks. The system and method can detect various CAN attacks, such as attacks that cause unintended acceleration, deactivation of vehicle's brakes, or steering the vehicle. The system and method detects changes in nuanced correlations of CAN timeseries signals and how they cluster together. The system reverse engineers CAN signals and detect masquerade attacks by analyzing timeseries extracted from raw CAN frames. Specifically, anomalies in the CAN data can be detected by computing timeseries clustering similarity using hierarchical clustering on the vehicle's CAN signals and comparing the clustering similarity across CAN captures with and without attacks.

Universally applicable signal-based controller area network (CAN) intrusion detection system

A system is described for receiving a stream of events and scoring the events based on anomalousness and maliciousness (or other classification). The events can be displayed to a user in user-defined groupings in an animated fashion. The system can include a plurality of anomaly detectors that together implement an algorithm to identify low probability events and detect atypical traffic patterns. The atypical traffic patterns can then be classified as being of interest or not. In one particular example, in a network environment, the classification can be whether the network traffic is malicious or not.

Real-time detection and classification of anomalous events in streaming data

Growing community of inventors

Oak Ridge, TN, United States of America

Michael D Iannacone