Method For Intrusion Detection In Industrial Automation And Control System

Patent metadata

Field	Value
Publication number	US-2016149944-A1
Application number	US-201514945692-A
Country	US
Kind code	A1
Filing date	Nov 19, 2015
Priority date	Nov 21, 2014
Publication date	May 26, 2016
Grant date	—

Abstract

A method and system for automatic signalling an alert when a possible intrusion occurs in an industrial automation and control system, based on security events which occur in the industrial automation and control system or are externally fed into the system. The method includes the steps of: (a) determining a correlation of a first and second security event and storing the correlation in an event database, wherein the correlation includes a probability that the first security event is followed by the second security event within a normalised time period, (b) identifying a candidate event as the first security event, based on event information of the candidate event, upon occurrence of the candidate event, (c) classifying the candidate event as anomalous when the probability exceeds a predetermined threshold and no second security event follows the candidate event within the normalised time period, and (d) signalling the alert indicating the candidate event.

First claim

1 . A method for automatic signalling an alert when a possible intrusion occurs in an industrial automation and control system, comprising:
(a) determining a correlation of a first E 1 and second security event E 2 and storing the correlation in an event database, wherein the correlation includes a probability P E1,E2 that the first security event is directly followed by the second security event within a normalised time period, (b) identifying a candidate event as the first security event, based on event information of the candidate event, upon occurrence of the candidate event, (c) classifying the candidate event as anomalous when the probability P E1,E2 exceeds a predetermined threshold and no second security event follows the candidate event within the normalised time period, and (d) signalling the alert indicating the candidate event.

2 . The method according to claim 1 , further comprising:
accumulating the correlation of the first and second security event upon their re-occurrence, and updating the event database.

3 . The method according to claim 1 , wherein the predetermined threshold P thres is 0.8, preferably 0.9.

4 . The method according to claim 1 , wherein the probability P E1,E2 is a distributed probability.

5 . The method according to claim 1 , wherein the probability P E1,E2 increases with elapsed time since the occurrence of the first security event.

6 . The method according to claim 1 , wherein the event information comprises a provider identification and an event identification.

7 . A system for automatic signalling when a possible intrusion occurs in an industrial automation and control system, adapted to
(a) determine a correlation of a first E 1 and second security event E 2 and store the correlation in an event database, wherein the correlation includes a probability P E1,E2 that the first security event is followed by the second security event within a normalised time period, (b) identify a candidate event as the first security event, based on event information of the candidate event, upon occurrence of the candidate event, (c) classify the candidate event as anomalous when the probability P E1,E2 exceeds a predetermined threshold and no second security event follows the candidate event within the normalised time period, and (d) signal the alert indicating the candidate event.

8 . The system according to claim 7 , further adapted to
accumulate the correlation of the first and second security even upon their re-occurrence, and updating the event database.

9 . The system according to claim 7 , wherein the predetermined threshold P thres is 0.8, preferably 0.9.

10 . The system according to claim 7 , wherein the probability P E1,E2 is a distributed probability.

11 . The system according to claim 7 , wherein the probability P E1,E1 increases with elapsed time since the occurrence of the first security event.

12 . The system according to claim 7 , wherein the event information comprises a provider identification and an event identification.

Assignees

• Abb Technology Ag

Inventors

• Obermeier Sebastian
• Schlegel Roman
• Wahler Michael

Classifications

• G06F21/554

  involving event detection and direct action · CPC title

• H04L41/145

  involving simulating, designing, planning or modelling of a network · CPC title

• G05B2219/23317

  Safe mode, secure program, environment in case of error, intrusion · CPC title

• G06F16/23

  Updating · CPC title

• G06F9/542

  Event management; Broadcasting; Multicasting; Notifications · CPC title