Distributed software-defined industrial systems

Patent metadata

Field	Value
Publication number	US-12034827-B2
Application number	US-202318226588-A
Country	US
Kind code	B2
Filing date	Jul 26, 2023
Priority date	Nov 16, 2017
Publication date	Jul 9, 2024
Grant date	Jul 9, 2024

Abstract

Various systems and methods for implementing a software defined industrial system are described herein. For example, an orchestrated system of distributed nodes may run an application, including modules implemented on the distributed nodes. In response to a node failing, a module may be redeployed to a replacement node. In an example, self-descriptive control applications and software modules are provided in the context of orchestratable distributed systems. The self-descriptive control applications may be executed by an orchestrator or like control device and use a module manifest to generate a control system application. For example, an edge control node of the industrial system may include a system on a chip including a microcontroller (MCU) to convert IO data. The system on a chip includes a central processing unit (CPU) in an initial inactive state, which may be changed to an activated state in response an activation signal.

First claim

What is claimed is:

1. At least one non-transitory machine-readable medium including instructions, which when executed by processing circuitry, cause the processing circuitry to perform operations to:
identify information indicative of a plurality of detection rules for triggering a corresponding plurality of alerts of an enterprise system;
analyze the information to determine at least one correlation among the plurality of detection rules;
detect an incident triggering two or more detection rules;
prevent two or more alerts corresponding to the two or more detection rules from issuing;
generate a clustered alert for the two or more alerts prevented from issuing based on the at least one correlation corresponding to the two or more alerts prevented from issuing; and
output the clustered alert.

2. The at least one machine-readable medium of claim 1 , wherein the operations further cause the processing circuitry to recommend a change to one or more of the two or more alerts or recommend a new alert based on the clustered alert and the at least one correlation.

3. The at least one machine-readable medium of claim 1 , wherein alerts in the plurality of alerts in the enterprise system correspond to at least one of a safety alert, an equipment integrity alert, or a quality control alert.

4. The at least one machine-readable medium of claim 1 , wherein to generate the cluster alert, the operations further cause the processing circuitry to generate the cluster alert using data similarity or common causality.

5. The at least one machine-readable medium of claim 4 , wherein the data similarity includes data from a specified time period.

6. The at least one machine-readable medium of claim 1 , wherein one alert of the two or more alerts is caused by a cascading from another alert of the two or more alerts.

7. The at least one machine-readable medium of claim 1 , wherein one of the plurality alerts is user created, and wherein to analyze the information, the operations further cause the processing circuitry to determine an additional alert recommendation based on the user created alert.

8. The at least one machine-readable medium of claim 1 , wherein the at least one correlation includes a number or type of events associated with network activity.

9. The at least one machine-readable medium of claim 1 , wherein to output the clustered alert, the operations further cause the processing circuitry to:
provide a remediation action for an underlying cause of the clustered alert, or
automatically remediate an underlying cause of the clustered alert.

10. The at least one machine-readable medium of claim 1 , wherein the operations further cause the processing circuitry to predict that a set of alerts of the plurality of alerts are about to be triggered, and output a second clustered alert for the set of alerts before the set of alerts trigger.

11. The at least one machine-readable medium of claim 1 , wherein the operations further cause the processing circuitry to determine that a set of alerts of the plurality of alerts have been ignored a threshold number of times, and in response, preemptively suppress the set of alerts.

12. A dynamic smart alert system for clustering alerts, the dynamic smart alert system comprising:
alert generator circuitry to:
identify information indicative of a plurality of detection rules for triggering a corresponding plurality of alerts of an enterprise system; and
analyze the information to determine at least one correlation among the plurality of detection rules;

alert management and clustering circuitry to:
detect an incident triggering two or more detection rules;
prevent two or more alerts corresponding to the two or more detection rules from issuing; and
generate a clustered alert for the two or more alerts prevented from issuing based on the at least one correlation corresponding to the two or more alerts prevented from issuing; and

alert output manager circuitry to output the clustered alert.

13. The dynamic smart alert system of claim 12 , wherein alerts in the plurality of alerts in the enterprise system correspond to at least one of a safety alert, an equipment integrity alert, or a quality control alert.

14. The dynamic smart alert system of claim 12 , wherein to generate the cluster alert, the alert management and clustering circuitry is further to generate the cluster alert using data similarity or common causality.

15. The dynamic smart alert system of claim 12 , wherein the at least one correlation includes a number or type of events associated with network activity.

16. The dynamic smart alert system of claim 12 , wherein to output the clustered alert, the alert output manager circuitry is further to:
provide a remediation action for an underlying cause of the clustered alert, or
automatically remediate an underlying cause of the clustered alert.

17. The dynamic smart alert system of claim 12 , wherein the alert management and clustering circuitry is further to predict that a set of alerts of the plurality of alerts are about to be triggered, and wherein the alert output manager circuitry is further to output a second clustered alert for the set of alerts before the set of alerts trigger.

18. The dynamic smart alert system of claim 12 , wherein the alert management and clustering circuitry is further to determine that a set of alerts of the plurality of alerts have been ignored a threshold number of times, and in response, preemptively suppress the set of alerts.

19. An apparatus comprising:
means for identifying information indicative of a plurality of detection rules for triggering a corresponding plurality of alerts of an enterprise system;
means for analyzing the information to determine at least one correlation among the plurality of detection rules;
means for detecting an incident triggering two or more detection rules;
means for preventing two or more alerts corresponding to the two or more detection rules from issuing;
means for predicting a clustered alert for the two or more alerts prevented from issuing based on the at least one correlation corresponding to the two or more alerts prevented from issuing; and
means for outputting the predicted clustered alert.

20. The apparatus of claim 19 , wherein the means for outputting the predicted clustered alert includes means for outputting the predicted clustered alert for display on a user interface, the user interface including a selectable indication to cluster the two or more alerts.

Assignees

• Intel Corp

Inventors

• Wouhaybi Rita H
• Vicente John
• Smith Kirk
• Chavez Robert
• Yarvis Mark
• Brown Steven M
• Ouillette Jeremy
• Kronschnabel Roderick E
• Schneider Matthew J
• Lucero Chris D
• Hatalkar Atul N
• Garg Sharad K
• Rathbone Casey
• Berck Aaron R
• Zhang Xubo
• Thomas Ron Kuruvilla
• Shetty Mandeep
• Negi Ansuya

Classifications

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L69/40 Primary

  for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection (management of faults, events, alarms or notifications in data switching networks H04L41/06) · CPC title

• H04L41/0668

  by dynamic selection of recovery network elements, e.g. replacement by the most appropriate element after failure · CPC title

• G06F11/2023

  Failover techniques · CPC title

• H04L67/565

  Conversion or adaptation of application format or content (adding application control or application functional data H04L67/561) · CPC title