Configurable robustness agent in a plant security system

Abstract

A communications network security system includes a robustness agent that operates within a communications interface of a device at one or more nodes of the network to analyze and filter messages coming from or going onto the network. At each of the nodes, the robustness agent determines one or more sets of message characteristics associated with each of the messages passing through the agent, and the agent is configured to allow certain types of messages (e.g., messages with certain predetermined sets of characteristics) to be passed through the agent, prevent messages with other predetermined characteristics from being passed through the agent, such as by halting (discarding or filtering) these messages, and/or passes still other messages having other sets of message characteristics to a volume filter to be counted. The volume filter counts the number of messages with a particular set of message characteristics and passes these messages if the number of these detected messages over a particular period of time is less than a particular threshold, and filters these messages if the number of counted messages is greater than a particular threshold over a particular period of time.