Method for mitigation of cyber attacks on industrial control systems

• US 10,681,079 B2
• Filed: 07/02/2018
• Issued: 06/09/2020
• Est. Priority Date: 08/20/2015
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Cyberx Israel Limited
• Inventors: Schneider, Omer, Giller, Nir
• Primary Examiner(s): Wright, Bryan F
• Application Number:
  US16/024,924
• Publication Number:
  US 20180316719A1
• Time in Patent Office: 708 Days
• Field of Search: 726 23
• CPC Class Codes: G05B 23/0254 based on a quantitative model, e.g. mathematical relationships between inputs and outputs; functions: observer, Kalman filter, residual calculation, Neural Networks
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Abstract

Methods and systems for detecting a potential compromise of cyber security in an industrial network are disclosed. These methods and systems comprise elements of hardware and software for generating and analyzing vectors indicative of network behavioral states to establish thresholds for anomalous behavior in the industrial network.

Claims

1. A method for detecting a potential compromise of cyber security in an industrial network utilizing a protocol for controlling an industrial process, comprising:

polling specific fields of packet data, obtained from packets, at a fixed frequency, for a plurality of programmable logic controllers (PLCs), to establish network behavior;

determining a protocol type from the specific packet data fields;

deriving a vector based on the specific packet data fields, wherein the specific packet data fields represent the protocol which signifies particular network communications, including communications using a stateful protocol as the determined protocol type;

generating a value based on the vector indicative of a network behavioral state;

maintaining a network behavior state machine comprising a list of network states and transition counts in accordance with the stateful protocol, wherein the transition count is maintained in accordance to the value;

determining a transition probability corresponding to the transition counts, wherein the transition probability denotes an estimated probability of a first network state being followed temporally by a second network state, during normal network operation;

establishing, for the network behavior state machine, a threshold representing the probability below which a sequence of network states is anomalous;

determining, by the network behavior state machine, a probability for the occurrence of a sequence of network states, according to the derived vector; and

,

taking protective action according to whether the determined probability is below the established threshold.