Proactive intrusion detection and mitigation system

Abstract

A proactive intrusion detection and mitigation system (PIDMS) and method based upon both physical system data and cyber data is disclosed. The physical system data corresponds to one or more aspects of a device that can be measured. These aspects of the device may be controlled, either directly or indirectly, by cyber commands sent over a network. The cyber data corresponds not only to the cyber commands, but virtually any aspect of the cyber command. The PIDMS monitors both the physical system data and the cyber data for anomalies, including anomalies that can only be detected through the combination of physical system and cyber data, i.e., cyber-physical anomalies, as well as monitoring peer-to-peer communication between PIDMSs. These anomalies are detected using signature-based and behavioral-based approaches. Upon detecting an anomaly, the PIDMS undertakes preventative or mitigative action to counter the detected anomaly.