Huawei Technologies Co., Limited

Washington State University

Siemens Aktiengesellschaft

Yinghui Wu

Xin Wang

Leandro Pfleger De Aguiar

Dong Wei

Wenfei Fan

Yonghua Ding

Jiaxing Pi

Xin Zhang

Mohammad Hossein Namaki

Methods and systems are disclosed for security management in an industrial control system (ICS). An event entity detection and linking module generates a model for a plurality of event entities extracted from a plurality of different data sources including one ICS data source and one IT data source. The model encodes a set of linked event entities and their relationships, each event entity associated with a vector of attribute value pairs. A data standardization of domain knowledge includes translating, by a machine learning application, extracted knowledge base information to rules for the constraints and using the rules to validate the constraints and to add new constraints. A fusion module performs temporal correlation detection across data streams of the different data sources for establishing causality between triplets of association models within a defined time span.

Knowledge graph for real time industrial control system security event monitoring and management

A query suggestion to expand an initial query is calculated whereby the cost of the expanded initial query is bounded in both time and quality. The user validates a subset of the top-n answers Q(G) to a query Q and provides adjusted configuration parameters. The top-n diversified &#x3b4;-expansion terms Q' are calculated from the validated subset of answers Q(G) to the query Q and are provided to an interactive user interface for selection. Answers Q&#x2032;(G) for the top-n diversified &#x3b4;-expansion terms Q&#x2032; are cost bounded by cost threshold &#x3b4; and exploration range r specified by the user. The user selects a new term of terms Q&#x2032; and an incremental query evaluation of the new term is invoked to compute expanded query answers Q&#x2032;(G) by incrementally updating the validated subset of answers Q(G), without re-evaluating an expanded query Q&#x2032; including the new term from scratch.

Quality-aware keyword query suggestion and evaluation

A graph data search method and apparatus, where the method includes obtaining a query request including a query condition that carries a start graph node, the query request queries a first to-be-queried graph node matching the query condition from a graph data set, and the graph data set includes the start graph node, a plurality of to-be-queried graph nodes, an association relationship between the start graph node and the plurality of graph nodes, and an association relationship between each to-be-queried graph node and another graph node, filtering out, according to the query condition and a preset available resource condition, a second to-be-queried graph node that does not meet the query condition and an association relationship in the graph data set that includes the second to-be-queried graph node, and performing a query in the reduction subgraph using the query condition.

Graph data search method and apparatus

Growing community of inventors

Pullman, WA, United States of America

Yinghui Wu