Industrial asset cyber-attack detection algorithm verification using secure, distributed ledger

Patent metadata

Field	Value
Publication number	US-11627151-B2
Application number	US-201816176293-A
Country	US
Kind code	B2
Filing date	Oct 31, 2018
Priority date	Oct 31, 2018
Publication date	Apr 11, 2023
Grant date	Apr 11, 2023

Abstract

A verification platform may include a data connection to receive a stream of industrial asset cyber-attack detection algorithm data, including a subset of the industrial asset cyber-attack detection algorithm data. The verification platform may store the subset into a data store (the subset of industrial asset cyber-attack detection algorithm data being marked as invalid) and record a hash value associated with a compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata in a secure, distributed ledger. The verification platform may then receive a transaction identifier from the secure, distributed ledger and mark the subset of industrial asset cyber-attack detection algorithm data in the data store as being valid after using the transaction identifier to verify that the recorded hash value matches a hash value of an independently created version of the compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata.

First claim

The invention claimed is:

1. A system to facilitate industrial asset cyber-attack detection algorithm verification, comprising:
a verification platform, including:
a data connection to receive a stream of industrial asset cyber-attack detection algorithm data, the industrial asset cyber-attacked detection algorithm data comprising at least time-series sensor data from one or more monitoring nodes of an industrial asset and including a subset of the industrial asset cyber-attack detection algorithm data, and
at least one verification platform computer processor coupled to the data connection and adapted to:
mark the subset of industrial asset cyber-attack detection algorithm data as invalid,
store the subset of industrial asset cyber-attack detection algorithm data and the corresponding marking as being invalid into a data store,
record a hash value associated with a compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata in a secure, distributed ledger,
receive a transaction identifier from the secure, distributed ledger,
independently create a version of the compressed representation of the subset of the industrial asset cyber-attack detection algorithm data combined with the metadata based on raw trie data received from a verification client, the raw trie data comprising a time series stream of sensor data output,
mark the subset of industrial asset cyber-attack detection algorithm data in the data store as being valid after using the transaction identifier to verify that the recorded hash value matches a hash value of the independently created version of the compressed representation of the subset of the industrial asset cyber-attack detection algorithm data combined with the metadata;
receive decision boundary information from an abnormal detection model, the decision boundary information representing a boundary between normal operating values and abnormal operating values, the abnormal operating values occurring during a cyber-attack, the abnormal detection algorithm receiving a stream of industrial data generated by a monitoring node;
compare data points of the stream of industrial data to the decision boundary information; and
generate at least one of a global alert signal or a local alert signal based on the result of the comparison.

2. The system of claim 1 , wherein the industrial asset cyber-attack detection algorithm data includes at least one feature-based classification boundary.

3. The system of claim 1 , the stream of industrial asset data including a subset of the industrial asset data,
the verification platform computer is further adapted to:
store the subset of industrial asset data into the data store, the subset of industrial asset data being marked as invalid,
record a hash value associated with a compressed representation of the subset of industrial asset data combined with metadata in the secure, distributed ledger,
receive a transaction identifier from the secure, distributed ledger, and
mark the subset of industrial asset data in the data store as being valid after using the transaction identifier to verify that the recorded hash value matches a hash value of an independently created version of the compressed representation of the subset of industrial asset data combined with metadata.

4. The system of claim 3 , wherein the industrial asset sensors are associated with at least one of: (i) an engine, (ii) an aircraft, (iii) a locomotive, (iv) power generation, and (v) a wind turbine.

5. The system of claim 1 , further comprising:
the data store, wherein the data store is adapted to provide information marked as being valid to a consuming platform.

6. The system of claim 1 , wherein the compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata comprises a trie.

7. The system of claim 6 , wherein the compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata comprises a Patricia-Merkle trie.

8. The system of claim 1 , wherein the metadata includes at least one of: (i) a pseudo identifier, (ii) a time stamp, (iii) a unique client identifier, and (iv) data shape information.

9. The system of claim 1 , wherein the verification platform is associated with at least one of: (i) a single network cloud-hosted topology, (ii) a multiple network cloud-hosted topology, and (iii) a participant hosted intranet environment.

10. The system of claim 1 , wherein the secure, distributed ledger comprises blockchain technology.

11. A method associated with industrial asset cyber-attack detection algorithm verification, comprising:
receiving, at a computer processor of a verification platform, a stream of industrial asset cyber-attack detection algorithm data, the industrial asset cyber-attacked detection algorithm data comprising at least time-series sensor data from one or more monitoring nodes of an industrial asset and including a subset of the industrial asset cyber-attack detection algorithm data;
marking, by the verification platform, the subset of industrial asset cyber-attack detection algorithm data as invalid;
storing, by the verification platform, the subset of industrial asset cyber-attack detection algorithm data and the corresponding marking as being invalid into a data store;
recording, by the verification platform, a hash value associated with a compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata in a secure, distributed ledger;
receiving, at the verification platform, a transaction identifier from the secure, distributed ledger;
independently create, by the verification platform, a version of the compressed representation of the subset of the industrial asset cyber-attack detection algorithm data combined with the metadata based on raw trie data received from a verification client, the raw trie data comprising a time series stream of sensor data output,
marking the subset of industrial asset cyber-attack detection algorithm data in the data store as being valid after using the transaction identifier to verify, at the verification platform, that the recorded hash value matches a hash value associated with the independently created version of the compressed representation of the subset of industrial asset cyber-attack detection algorithm data combined with metadata;
receiving decision boundary information from an abnormal detection model, the decision boundary information representing a boundary between normal operating values and abnormal operating values, the abnormal operating values occurring during a cyber-attack, the abnormal detection algorithm receiving a stream of industrial data generated by a monitoring node;
comparing data points of the stream of industrial data to the decision boundary information; and
generating at least one of a global alert signal or a local alert signal based on the result of the comparison.

12. The method of claim 11 , wherein the compressed representation of the subset of industrial data combined with metadata comprises a Patricia-Merkle trie.

13. The method of claim 11 , wherein the metadata comprises at least one of: (i) a pseudo identifier, (ii) a time stamp, (iii) a unique client identifier, and (iv) data shape information.

14. The method of claim 11 , wherein the secure, distributed ledger comprises blockchain technology.

15. A system to facilitate industrial asset cyber-attack detection algorithm verification, comprising:
a verification client, including:
a data connection

Assignees

• Gen Electric

Inventors

• Holzhauer Daniel Francis
• Mestha Lalit
• John Justin

Classifications

• H04L9/3236

  using cryptographic hash functions · CPC title

• H04W12/009

  specially adapted for networks, e.g. wireless sensor networks, ad-hoc networks, RFID networks or cloud networks · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• Y04S40/20

  Information technology specific aspects, e.g. CAD, simulation, modelling, system security · CPC title

• H04L9/50

  using hash chains, e.g. blockchains or hash trees · CPC title