Intelligent cyberphysical intrusion detection and prevention systems and methods for industrial control systems

Patent metadata

Field	Value
Publication number	US-9405900-B2
Application number	US-201313801496-A
Country	US
Kind code	B2
Filing date	Mar 13, 2013
Priority date	Mar 13, 2013
Publication date	Aug 2, 2016
Grant date	Aug 2, 2016

Abstract

The embodiments described herein include a system and a method. In one embodiment, a system includes a device monitoring component configured to measure control system behavior and an intrusion prevention system communicatively coupled to the device monitoring component and a communications network. The intrusion prevention system includes a control system analysis component configured to analyze the control system behavior measured by the device monitoring component against a first rule set to determine whether an anomaly, an intrusion, or both are present.

First claim

The invention claimed is:

1. A system comprising:
a device monitoring component configured to measure control system behavior; and
an intrusion prevention system communicatively coupled to the device monitoring component and a communications network, wherein the intrusion prevention system includes:
a control system analysis component configured to analyze the control system behavior measured by the device monitoring component against a first rule set;
a network analysis component configured to analyze network parameters of communication packets transmitted over the communications network against a second rule set by performing a comparison between the network parameters and data included in a first list and in a second list and classifying the communication packets as at least one of an anomaly and an intrusion based on a result of the comparison; and
a machine learning and correlated analysis component configured to:
correlate results from the control system analysis component and the network analysis component;
determine when the correlated results lead to a false positive or a false negative; and
modify the first rule set and the second rule set when a false positive or a false negative is detected.

2. The system of claim 1 , wherein the first rule set and the second rule set are modified when the intrusion prevention system is in a maintenance mode.

3. The system of claim 1 , wherein the control system behavior comprises behavior of a controller when the device monitoring component is communicatively coupled to the controller.

4. The system of claim 3 , wherein the controller behavior includes power usage of components in the controller, temperature of the components in the controller, timing of operations, input/output of the controller, telemetry data of devices coupled to the controller, or any combination thereof.

5. The system of claim 4 , wherein the component in the controller includes a processing unit, memory, a storage device, and a communication apparatus.

6. The system of claim 3 , wherein the device monitoring component is located in the controller.

7. The system of claim 3 , wherein the device monitoring component comprises a separate device from the controller.

8. The system of claim 1 , wherein the network parameters include network traffic, file system access/modifications, operating system/library calls, or any combination thereof.

9. The system of claim 1 , wherein the system is an industrial control system comprising a gas turbine system, a gasification system, a steam turbine system, a wind turbine system, a water turbine system, a power generation system, a power grid automation system, or any combination thereof.

10. A tangible, non-transitory, computer-readable medium storing instructions, that when executed by a processor, cause the processor to perform operations comprising:
executing a model that simulates operation of an industrial control system, wherein the model does not contain intrusions;
determining network parameters of communication packets transmitted when executing the model;
generating a network rule set based at least in part on the network parameters;
determining control system parameters measured when running the model;
generating a control system rule set based at least in part on the control system parameters, wherein the control system rule set and the network rule set are configured to be used to detect whether an intrusion is present during operation of the industrial control system;
performing a comparison between the network parameters and data included in a first list and in a second list; and
classifying the communication packets as an intrusion based on a result of the comparison.

11. The medium of claim 10 , wherein the operations further comprise testing control system measurements against the control system rule set.

12. The medium of claim 10 , wherein the communications packets include communication packets sent between a controller and a supervisory station.

13. The medium of claim 10 , wherein the industrial control system comprises a gas turbine system, a gasification system, a steam turbine system, a wind turbine system, a water turbine system, a power generation system, a power grid automation system, or any combination thereof.

14. The medium of claim 10 , wherein the operations further comprise:
operating the industrial control system;
receiving the communication packets from a communication network in the industrial control system;
receiving control system measurements from one or more sensors in the industrial control system; and
analyzing the control system measurements against the control system rule set.

15. The medium of claim 10 , wherein the operation further comprise:
operating the industrial control system;
determining when a false negative or a false positive is detected using the network rule set and the control system rule set; and
modifying the network rule set and the control system rule set to reduce possibility of future false negatives or false positives.

16. A system comprising:
an intrusion prevention system communicatively coupled to a controller and a supervisory station in an industrial system, wherein the intrusion prevention system is configured to:
receive network communications sent between the supervisory station and the controller; and
analyze network parameters of communication packets associated with the network communications against a rule set to determine whether an anomaly, an intrusion, or both are present based on a comparison between the network parameters and data included in a first list and in a second list and based on at least in part on a state of the controller, a state of the industrial control system, or both;
wherein possible states of the controller comprise a commissioned or operational state, a maintenance state, a configuration state, an emergency state, and a security response state and possible states of the industrial control system comprise a commissioned or operational state, a maintenance state, a configuration state, an energy state, and security response state.

17. The system of claim 16 , wherein, when the controller is in the commission or operational state, the intrusion prevention system is configured to detect an anomaly, an intrusion, or both when the network communications comprise instructions to adjust operation of the controller.

18. The system of claim 16 , wherein the intrusion system is configured to determine whether an anomaly, an intrusion, or both are present based at least in part on what devices are connected to the controller.

19. The system of claim 18 , wherein the devices connected to the controller includes turbine systems, sensors, pumps, actuators, valves, transformers, breakers, switches, motors, generators, or any combination thereof.

20. The system of claim 16 , wherein the system comprises the industrial control system comprising a gas turbine system, a gasification system, a steam turbine system, a wind turbine system, a water turbine system, a power generation system, a power grid automation system, or any combination thereof.

Assignees

• Gen Electric

Inventors

• Dixit Paritosh
• Thanos Daniel

Classifications

• Y02B70/346

  Cross-Sectional Technologies · mapped topic

• Y04S20/525

  Cross-Sectional Technologies · mapped topic

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• G06F21/55 Primary

  Detecting local intrusion or implementing counter-measures · CPC title

• Y04S40/20

  Information technology specific aspects, e.g. CAD, simulation, modelling, system security · CPC title