Method, computer program, and computer for determining system situation

Patent metadata

Field	Value
Publication number	US-9857775-B2
Application number	US-201113976491-A
Country	US
Kind code	B2
Filing date	Dec 15, 2011
Priority date	Dec 28, 2010
Publication date	Jan 2, 2018
Grant date	Jan 2, 2018

Abstract

A method applied to a computer that determines a situation of a system includes the steps of: receiving measurement data from each of a plurality of measurement targets in the system; computing a plurality of sets of anomaly values based on the measurement data and a predetermined computation algorithm according to a plurality of classifications corresponding to a plurality of properties of each measurement target; and determining the situation of the system based on the sets of anomaly values and a predetermined determination algorithm.

First claim

The invention claimed is:

1. A computer-implemented method comprising:
receiving, by a processor, measurement data from each of a plurality of measurement targets in a system comprising a plurality of industrial control systems;
computing, by the processor, a plurality of sets of anomaly values based on the measurement data and a computation algorithm according to a plurality of classifications corresponding to a plurality of properties of each measurement target;
computing, by the processor, an anomaly pattern using the plurality of sets of anomaly values computed based on the measurement data and the computation algorithm according to the plurality of classifications corresponding to the plurality of properties of each measurement target;
determining, by the processor, a situation of the system based on the anomaly pattern, wherein a determination of the situation of the system is made by comparing the anomaly pattern with previously stored anomaly; and
implementing a countermeasure action based at least in part on the situation of the system,
wherein the computation algorithm is selected from a plurality of computation algorithms based on a type of the measurement data.

2. The method according to claim 1 , wherein at least one of the classifications is a hierarchical classification.

3. The method according to claim 1 , wherein determining further comprises:
determining the situation of the system by comparing predetermined patterns of the sets of anomaly values corresponding to each situation of the system with the computed sets of anomaly values.

4. The method according to claim 1 , wherein determining further comprises:
determining the situation of the system by comparing predetermined patterns of the sets of anomaly values corresponding to each situation of the system with simplified forms of the computed sets of anomaly values.

5. The method according to claim 1 , wherein determining further comprises:
comparing predetermined patterns of the sets of anomaly values corresponding to each situation of the system with simplified forms of the computed sets of anomaly values and determining a situation corresponding to patterns with highest degrees of similarity as the situation of the system.

6. The method according to claim 1 , wherein determining further comprises:
determining the situation of the system based on changes over time in the sets of anomaly values.

7. The method according to claim 1 , wherein the plurality of properties is at least one of: a function, a network configuration, a type, or an installation location of each measurement target, a management organization of the installation location, or a security level of the installation location.

8. The method according to claim 1 , wherein computing further comprises:
computing a first set of anomaly values based on the measurement data and the computation algorithm according to a first classification corresponding to a first property of each measurement target, and computing a second set of anomaly values based on the measurement data and the computation algorithm according to a second classification corresponding to a second property of each measurement target;
and wherein determining further comprises:
determining the situation of the system based on the first set of anomaly values, the second set of anomaly values, and a predetermined determination algorithm.

9. The method according to claim 8 , wherein computing further comprises:
computing a set of network anomaly values based on the measurement data and the computation algorithm according to a network hierarchical structure corresponding to a network configuration of the measurement targets, and computing a set of location anomaly values based on the measurement data and the computation algorithm according to a location hierarchical structure corresponding to installation locations of the measurement targets;
and wherein determining further comprises:
determining the situation of the system based on the set of network anomaly values, the set of location anomaly values, and a predetermined determination algorithm.

10. The method according to claim 8 , wherein computing further comprises:
computing a third set of anomaly values based on the measurement data and the computation algorithm according to a third classification corresponding to a third property of each measurement target;
and wherein determining further comprises:
determining the situation of the system based on the first set of anomaly values, the second set of anomaly values, the third set of anomaly values, and a predetermined determination algorithm.

11. The method according to claim 10 , wherein computing further comprises:
computing a set of type anomaly values based on the measurement data the computation algorithm according to a hierarchical structure corresponding to types of the measurement targets, computing a set of location anomaly values based on the measurement data and the computation algorithm according to a hierarchical structure corresponding to installation locations of the measurement targets, and computing a set of security anomaly values based on the measurement data and the computation algorithm according to a structure corresponding to security levels of the installation locations of the measurement targets;
and wherein determining further comprises:
determining the situation of the system based on the set of type anomaly values, the set of location anomaly values, the set of security anomaly values, and a predetermined determination algorithm.

12. The method according to claim 1 , further comprising:
displaying a determination result of the situation of the system to a user.

13. The method according to claim 1 , further comprising:
displaying the sets of anomaly values and a determination result of the situation of the system to a user.

14. The method according to claim 1 , wherein the plurality of industrial control systems each comprise different device types or are located in different geographic locations.

15. The method according to claim 1 , wherein the type of the measurement data is one of numerical data and event data.

16. The method according to claim 15 , wherein, when the type of the measurement data is numerical data, the plurality of computation algorithms is selected from the group consisting of a Hotelling's T 2 algorithm, a one-class support vector machine (SVM) algorithm, and a local outliner factor algorithm.

17. The method according to claim 15 , wherein, when the type of the measurement data is event data, the plurality of computation algorithms is selected from the group consisting of an infrequent pattern mining algorithm, a Naive Bayes algorithm, and a hidden Markov algorithm.

18. A computer program product comprising a non-transitory storage medium readable by a processing circuit and storage instructions for execution by the processing circuit for performing a method comprising:
receiving measurement data from each of a plurality of measurement targets in a system comprising a plurality of industrial control systems;
computing a plurality of sets of anomaly values based on the measurement data and a computation algorithm according to a plurality of classifications corresponding to a plurality of properties of each measurement target;
computing an anomaly pattern using the plurality of sets of anomaly values computed based on the measurement data and the computation algorithm according to the plurality of classifications corresponding to the plurality of properties of each measurement tar

Assignees

• Hamzaoui Karim
• Hido Shohei
• Suzuki Shoko
• Takahashi Rikiya
• Yoshihama Sachiko
• IBM

Inventors

• Hamzaoui Karim
• Hido Shohei
• Suzuki Shoko
• Takahashi Rikiya
• Yoshihama Sachiko

Classifications

• G05B9/02 Primary

  electric · CPC title

• G05B23/0281 Primary

  Quantitative, e.g. mathematical distance; Clustering; Neural networks; Statistical analysis · CPC title

• Y02E30/40

  Cross-Sectional Technologies · mapped topic

• G21D3/001

  Computer implemented control · CPC title

• Y02E30/00

  Energy generation of nuclear origin · CPC title