Dynamic monitoring and securing of factory processes, equipment and automated systems

Patent metadata

Field	Value
Publication number	US-2021103654-A1
Application number	US-202016904984-A
Country	US
Kind code	A1
Filing date	Jun 18, 2020
Priority date	Oct 8, 2019
Publication date	Apr 8, 2021
Grant date	—

Abstract

A system including a deep learning processor receives one or more control signals from one or more of a factory's process, equipment and control (P/E/C) systems during a manufacturing process. The processor generates expected response data and expected behavioral pattern data for the control signals. The processor receives production response data from the one or more of the factory's P/E/C systems and generates production behavioral pattern data for the production response data. The process compares at least one of: the production response data to the expected response data, and the production behavioral pattern data to the expected behavioral pattern data to detect anomalous activity. As a result of detecting anomalous activity, the processor performs one or more operations to provide notice or cause one or more of the factory's P/E/C systems to address the anomalous activity.

First claim

What is claimed is:

1 . A computer-implemented method, comprising:
receiving, by a deep learning processor, one or more control signals from one or more of a factory's process, equipment and control (P/E/C) systems during a manufacturing process; generating, by a deep learning processor, expected response data and expected behavioral pattern data for the control signals; receiving, by the deep learning processor, production response data, from the one or more of the factory's P/E/C systems; generating, by the deep learning processor, production behavioral pattern data for the production response data; comparing at least one of: (i) the production response data to the expected response data, and (ii) the production behavioral pattern data to the expected behavioral pattern data to detect anomalous activity; and as a result of detecting the anomalous activity, performing one or more operations to provide notice or cause one of the factory's P/E/C systems to address the anomalous activity in the manufacturing process.

2 . The computer-implemented method of claim 1 , wherein the one or more operations include:
determining whether the anomalous activity is a malware attack; and as a result of a determination that the anomalous activity is the malware attack, initiating an alert protocol to provide notice or cause one or more of the factory's P/E/C systems to address the anomalous activity in the manufacturing process.

3 . The computer-implemented method of claim 1 , wherein the one or more operations include shutting down the manufacturing process.

4 . The computer-implemented method of claim 1 , wherein the production response data is derived by adjusting setpoints associated with one or more process stations associated with the one or more of the factory's P/E/C systems.

5 . The computer-implemented method of claim 1 , wherein the anomalous activity is detected as a result of the production response data and the expected response data indicating a deviation.

6 . The computer-implemented method of claim 1 , wherein the anomalous activity is detected as a result of the production behavioral pattern data and the expected behavioral pattern data indicating a deviation.

7 . The computer-implemented method of claim 1 , wherein the one or more operations include transmitting a notification to an operator of the manufacturing process to review the anomalous activity.

8 . The computer-implemented method of claim 1 , further comprising:
determining, based on a comparison of the production response data to the expected response data, a confidence level associated with an identification of the anomalous activity; and identifying, based on the confidence level, the one or more operations to be performed to provide notice or cause one or more of the factory's P/E/C systems to address the anomalous activity in the manufacturing process.

9 . The computer-implemented method of claim 1 , further comprising:
determining, based on the comparison of production behavioral pattern data to the expected behavioral pattern data, a confidence level associated with an identification of the anomalous activity; and identifying, based on the confidence level, the one or more operations to be performed to provide notice or cause one or more of the factory's P/E/C systems to address the anomalous activity in the manufacturing process.

10 . A system, comprising:
one or more processors; and memory storing thereon instructions that, as a result of being executed by the one or more processors, cause the system to:
receive one or more control signals from one or more of a factory's process, equipment and control (P/E/C) systems during a manufacturing process;
generate expected response data and expected behavioral pattern data for the control signals;
receive production response data from the one or more of the factory's P/E/C systems;
generate production behavioral pattern data for the production response data;
detect, based on a comparison at least one of: (i) the production response data to the expected response data, and (ii) the production behavioral pattern data to the expected behavioral pattern data, anomalous activity; and
as a result of detecting the anomalous activity, perform one or more operations to provide notice or cause one or more of the factory's P/E/C systems to address the anomalous activity in the manufacturing process.

11 . The system of claim 10 , wherein the instructions further cause the system to:
determine a type of anomalous activity and an associated confidence level; and determine the one or more operations based on the type of the anomalous activity and the associated confidence level.

12 . The system of claim 10 , wherein the one or more operations include shutting down the manufacturing process.

13 . The system of claim 10 , wherein the one or more operations include transmitting a notification to an operator of the manufacturing process to review the anomalous activity.

14 . The system of claim 10 , wherein the one or more operations include:
determining whether the anomalous activity is a malware attack; and as a result of a determination that the anomalous activity is the malware attack, initiating an alert protocol to provide the notice or cause one or more of the factory's P/E/C systems to address the anomalous activity in the manufacturing process.

15 . The system of claim 14 , wherein the alert protocol is a digital activation of individual relays communicated to one or more devices associated with the factory's P/E/C systems to provide the notice or cause one or more of the factory's P/E/C systems to address the anomalous activity in the manufacturing process.

16 . A non-transitory, computer-readable storage medium storing thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to:
receive one or more control signals from one or more of a factory's process, equipment and control (P/E/C) systems during a manufacturing process; generate expected response data and expected behavioral pattern data for the control signals; receive production response data from the one or more of the factory's P/E/C systems; generate production behavioral pattern data for the production response data; detect, based on a comparison at least one of: (i) the production response data to the expected response data, and (ii) the production behavioral pattern data to the expected behavioral pattern data, anomalous activity; and as a result of detecting the anomalous activity, perform one or more operations to provide notice or cause one or more of the factory's P/E/C systems to address the anomalous activity in the manufacturing process.

17 . The non-transitory, computer-readable storage medium of claim 16 , wherein the one or more operations include transmitting a notification to an operator of the manufacturing process to review the anomalous activity.

18 . The non-transitory, computer-readable storage medium of claim 16 , wherein the one or more operations include:
determining whether the anomalous activity is a malware attack; and as a result of a determination that the anomalous activity is the malware attack, initiating an alert protocol to provide the notice or cause one or more of the factory's P/E/C systems to address the anomalous activity in the manufacturing process.

19 . The non-transitory, computer-readable storage medium of claim 16 , wherein the one or more operations include shutting

Assignees

• Nanotronics Imaging Inc

Inventors

• Putman Matthew C
• Putman John B
• Pinskiy Vadim
• Limoge Domos
• Sundstrom Andrew
• Williams Iii James

Classifications

• G06N3/047

  Probabilistic or stochastic networks · CPC title

• G06N3/045

  Combinations of networks · CPC title

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title

• G06N3/044

  Recurrent networks, e.g. Hopfield networks · CPC title

• G06N3/092

  Reinforcement learning · CPC title