Dynamic normalization of monitoring node data for threat detection in industrial asset control system

• US 10,678,912 B2
• Filed: 11/15/2016
• Issued: 06/09/2020
• Est. Priority Date: 11/15/2016
• Status: Active Grant

• Current Assignee: GE Infrastructure Technology, LLC (General Electric Company)
• Original Assignee: General Electric Company
• Inventors: Mestha, Lalit Keshav, Bushey, Cody Joe, Holzhauer, Daniel Francis
• Primary Examiner(s): Arani, Taghi T
• Assistant Examiner(s): Chang, Lin
• Application Number:
  US15/351,809
• Publication Number:
  US 20180137277A1
• Time in Patent Office: 1,302 Days
• CPC Class Codes: G05B 2219/45103 Security, surveillance applications
• CPC Class Codes: G05B 23/0205 by means of a monitoring system capable of detecting and responding to faults
• CPC Class Codes: G05B 23/0227 Qualitative history assessment, whereby the type of data acted upon, e.g. waveforms, images or patterns, is not relevant, e.g. rule based assessment; if-then decisions
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Abstract

Operation of an industrial asset control system may be simulated or monitored under various operating conditions to generate a set of operating results. Subsets of the operating results may be used to calculate a normalization function for each of a plurality of operating conditions. Streams of monitoring node signal values over time may be received that represent a current operation of the industrial asset control system. A threat detection platform may then dynamically calculate normalized monitoring node signal values based at least in part on a normalization function in an operating mode database. For each stream of normalized monitoring node signal values, a current monitoring node feature vector may be generated and compared with a corresponding decision boundary for that monitoring node, the decision boundary separating normal and abnormal states for that monitoring node. A threat alert signal may then be automatically transmitted based on results of those comparisons.

Claims

1. A system to protect an industrial asset control system, comprising:

a high fidelity model to simulate operation of the industrial asset control system under various operating conditions to generate a set of operating results;

a normalization platform coupled to the high fidelity model to calculate a normalization function for each of a plurality of operating conditions, wherein normalization is performed as follows;

2. The system of claim 1, wherein current monitoring node feature vectors are associated with dynamic temporal normalization.

3. The system of claim 1, wherein current monitoring node feature vectors are associated with dynamic spatial normalization.

4. The system of claim 1, wherein the industrial asset control system is associated with a gas turbine and the operating conditions are associated with at least one of:

(i) gas turbine loads, and (ii) gas turbine temperatures.

5. The system of claim 4, wherein the operating conditions are further associated with at least one of:

(i) an operating mode, (ii) an external condition, (iii) a system degradation factor, (iv) fuel input, (v) a turbine inlet temperature, (vi) a turbine inlet pressure, (vii) a turbine power, (viii) a turbine speed, (ix) compressor discharge pressure, (x) compressor discharge temperature, (xi) fuel flow, and (xii) turbine exhaust temperature.

6. The system of claim 1, wherein the industrial asset control system is associated with a computer network and the operating conditions are associated with information packet transmission characteristics.

7. The system of claim 1, wherein the normalized output S_normalized is expressed as a weighted linear combination of basis functions as follows:

8. The system of claim 1, wherein at least one monitoring node is associated with a plurality of decision boundaries and said comparison is performed in connection with each of those boundaries.

9. The system of claim 1, wherein the threat alert signal transmission is performed using at least one of:

(i) a cloud-based system, (ii) an edge-based system, (iii) a wireless system, (iv) a wired system, (v) a secured network, and (vi) a communication system.

10. The system of claim 1, wherein the threat is associated with at least one of:

an actuator attack, a controller attack, a monitoring node attack, a plant state attack, spoofing, financial damage, unit availability, a unit trip, a loss of unit life, and asset damage requiring at least one new part.

11. A computerized method to protect an industrial asset control system, comprising:

simulating, by a high fidelity model, operation of the industrial asset control system under various operating conditions to generate a set of operating results;

calculating, by a normalization platform, a normalization function for each of a plurality of operating conditions, wherein normalization is performed as follows;

12. The method of claim 11, wherein the industrial asset control system is associated with a gas turbine and the operating conditions are associated with at least one of:

(i) gas turbine loads, and (ii) gas turbine temperatures.

13. A non-transient, computer-readable medium storing instructions to be executed by a processor to perform a method of protecting a gas turbine, the method comprising:

simulating operation of the industrial asset control system under various gas turbine loads and gas turbine temperatures to generate a set of operating results;

calculating a normalization function for each of a plurality of gas turbine loads and gas turbine temperatures, wherein normalization is performed as follows;

14. The medium of claim 13, wherein current monitoring node feature vectors are associated with at least one of:

(i) dynamic temporal normalization, and (ii) dynamic spatial normalization.

15. The medium of claim 13, wherein at least one monitoring node is associated with a plurality of decision boundaries and said comparison is performed in connection with each of those boundaries.