Assessing trust of components in systems

Patent metadata

Field	Value
Publication number	US-10587639-B2
Application number	US-201514642882-A
Country	US
Kind code	B2
Filing date	Mar 10, 2015
Priority date	Mar 10, 2015
Publication date	Mar 10, 2020
Grant date	Mar 10, 2020

Abstract

Systems and methods may include receiving performance data of components in a system. The performance data may include data for parameters for each of the components. The systems and methods may include determining aggregate data for each group of similar components of the components. The aggregate data for each group of similar components may include a group characteristic for each of the parameters. The systems and methods may include, for each group of similar components, determining whether the data for each of the parameters for each component is consistent with the group characteristic for the respective parameter. The systems and methods may include, for each component of the respective group determining that the component is anomalous in response to determining that the data for a parameter for the component is not consistent with the group characteristic for the parameter.

First claim

What is claimed is:

1. A method comprising:
receiving performance data of a plurality of components in a system, the performance data comprising data for a plurality of parameters for each component of the plurality of components;
using the performance data to identify a plurality of groups of similar components;
determining aggregate data for each group of the plurality of groups of similar components;
using the aggregate data to generate a respective model for each group of the plurality of groups of similar components, the respective model comprising a group characteristic for each parameter of the plurality of parameters; and
for each group of the plurality of groups of similar components:
determining whether the data for each parameter of the plurality of parameters for each component of a group of similar components is consistent with the group characteristic for a respective parameter by:
generating a virtual model of the respective parameter based on the performance data of the plurality of components; and
determining whether a difference between the data for the respective parameter for a respective component and one or more values for the respective parameter is statistically significant based upon a predetermined level of significance;

in response to determining that the difference between the data for the respective parameter for the respective component and the one or more values for the respective parameter is not statistically significant, determining that the data for the respective parameter for the respective component is reasonable in view of the one or more values for the respective parameter;
in response to determining that the difference between the data for the respective parameter for the respective component and the one or more values for the respective parameter is statistically significant, determining that the data for the respective parameter for the respective component is not reasonable in view of the one or more values for the respective parameter; and
for each component of a respective group of similar components, in response to determining that the data for a parameter of the plurality of parameters for a component is not consistent with the group characteristic for the parameter, determining that the component is anomalous; and
in response to determining that the component is anomalous, isolating the component by allowing it to transmit only limited telemetry data to other components of the respective group.

2. The method of claim 1 ,
wherein the group characteristic identifies the one or more values for the respective parameter that is common for similar components within the respective group,
wherein determining whether the data for each parameter of the plurality of parameters for each component of the plurality of components is consistent with the group characteristic for the respective parameter comprises:
determining whether the data for the respective parameter for the respective component is reasonable in view of the one or more values for the respective parameter identified by the group characteristic;
in response to determining that the data for the respective parameter for the respective component is not reasonable in view of the one or more values for the respective parameter identified by the group characteristic, determining that the data for the respective parameter for the respective component is not consistent with the group characteristic for the parameter; and
in response to determining that the data for the respective parameter for the respective component is reasonable in view of the one or more values for the respective parameter identified by the group characteristic, determining that the data for the respective parameter for the respective component is consistent with the group characteristic for the parameter.

3. The method of claim 1 , wherein each group of the plurality of groups of similar components comprises one or more of: components associated with the same owner; and components with historically matching performance data.

4. The method of claim 1 , wherein the plurality of parameters for each component of the plurality of components comprises one or more of: a location of the component; an identity that controls the component; and an identifier for another component that the component has involved in an interaction with the component.

5. The method of claim 1 , further comprising: for each component of the plurality of components for each group of the plurality of groups of similar components, in response to determining that the component is anomalous, generating a notice indicating that the component is anomalous.

6. The method of claim 1 , further comprising: for each component of the plurality of components for each group of the plurality of groups of similar components, in response to determining that the component is anomalous, restricting access to the system by the component.

7. A system comprising:
a processor;
a memory;
instructions stored in the memory that, when executed by the processor, cause the system to:
receive performance data of a plurality of components in a system operating in a first environment, the performance data comprising data for a plurality of parameters for each component of the plurality of components;
using the performance data to allocate the plurality of components into separate groups of similar components; and
for each group of the groups of similar components:
determine aggregate data;
using the aggregate data to generate a respective model for each group of the groups of similar components, the respective model comprising a group characteristic for each parameter of the plurality of parameters;
determine whether the data for each parameter of the plurality of parameters for each component of a group of similar components is consistent with the group characteristic for a respective parameter by:
generating a virtual model of the respective parameter based on the performance data of the plurality of components; and
determining whether a difference between the data for the respective parameter for a respective component and one or more values for the respective parameter is statistically significant based upon a predetermined level of significance;
in response to determining that the difference between the data for the respective parameter for the respective component and the one or more values for the respective parameter is not statistically significant, determine that the data for the respective parameter for the respective component is reasonable in view of the one or more values for the respective parameter;
in response to determining that the difference between the data for the respective parameter for the respective component and the one or more values for the respective parameter is statistically significant, determine that the data for the respective parameter for the respective component is not reasonable in view of the one or more values for the respective parameter;

for each component of a respective group of similar components, in response to determining that the data for a parameter of the plurality of parameters for a component is not consistent with the group characteristic for the parameter, determining that the component is anomalous; and
in response to determining the component is anomalous, isolating the component by limiting the amount of telemetry data that the component is allowed to transmit to other components of the respective group.

8. The system according to claim 7 ,
wherein the group characteristic identifies the one or more values for the respective parameter that is common for similar components within the respective group,
wherein, when determining whether the data for each parameter

Assignees

• Danielson Debra J
• Greenspan Steven L
• Reno James D
• Parikh Prashant
• Ca Inc

Inventors

• Danielson Debra J
• Greenspan Steven L
• Reno James D
• Parikh Prashant

Classifications

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title