SYSTEM AND METHODOLOGY PROVIDING AUTOMATION SECURITY ANALYSIS AND NETWORK INTRUSION PROTECTION IN AN INDUSTRIAL ENVIRONMENT

• US 20130031037A1
• Filed: 08/23/2012
• Published: 01/31/2013
• Est. Priority Date: 10/21/2002
• Status: Active Grant

• Current Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Original Assignee: Rockwell Automation Technologies Incorporated (Allen-Bradley Co., Inc.)
• Inventors: Brandt, David D., Hall, Kenwood, Anderson, Mark Burton, Anderson, Craig D., Collins, George Bradford
• Granted Patent: US 9,009,084 B2
• Time in Patent Office: Days
• US Class Current: 706/12
• CPC Class Codes: G05B 15/02 electric
• CPC Class Codes: G05B 19/4185 characterised by the network communication
• CPC Class Codes: G05B 2219/31151 Lan local area network
• CPC Class Codes: G05B 2219/45103 Security, surveillance applications
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/047 Pattern matching networks; Rete networks
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

The present invention relates to a system and methodology facilitating automation security in a networked-based industrial controller environment. Various components, systems and methodologies are provided to facilitate varying levels of automation security in accordance with security analysis tools, security validation tools and/or security learning systems. The security analysis tool receives abstract factory models or descriptions for input and generates an output that can include security guidelines, components, topologies, procedures, rules, policies, and the like for deployment in an automation security network. The validation tools are operative in the automation security network, wherein the tools perform security checking and/or auditing functions, for example, to determine if security components are in place and/or in suitable working order. The security learning system monitors/learns network traffic patterns during a learning phase, fires alarms or events based upon detected deviations from the learned patterns, and/or causes other automated actions to occur.

Claims

1. A system for detecting and correcting industrial network security issues, comprising:

a pattern monitoring component configured to monitor data traffic on the industrial network during a training period;

a pattern analysis component configured to generate at least one learned profile characterizing at least one learned pattern of data traffic determined based on data traffic information collected by the pattern monitoring component during the training period; and

a comparison analyzer configured to detect a deviation of a current pattern of data traffic from the at least one learned pattern of data traffic in excess of a threshold subsequent to the training period, and to initiate one or more automated countermeasures in response to detecting the deviation.

2. The system of claim 1, wherein the pattern monitoring component is configured to monitor the data traffic between an industrial controller and one or more I/O modules, and the at least one learned pattern of data traffic comprises a learned average cycle time of data transfers between the industrial controller and the one or more I/O modules.

3. The system of claim 2, wherein the pattern analysis component is configured to calculate the threshold based in part on cycle time variations of the data transfers observed by the pattern monitoring component, and to encode the threshold in the at least one learned profile.

4. The system of claim 1, wherein the pattern analysis component is configured to detect a source of allowable data traffic during the training period and to record the source in the at least one learned profile.

5. The system of claim 1, wherein the pattern monitoring component is configured to monitor at least one network statistic for at least one automation asset on the industrial network during the training period, and the pattern analysis component is configured to record a learned pattern of network activity for the at least one automation asset based thereon.

6. The system of claim 5, wherein the at least one network statistic includes at least one of a number of network connection retry attempts performed by the at least one automation asset, a number of access requests received by the at least one automation asset, a type of access request received by the at least one automation asset, an error code associated with the at least one automation asset, a number of times a controller is forced to re-open a connection to an I/O module or to another controller, a number of unrecognized messages received by the controller or the I/O module, a number of connections opened to the I/O module, an instance of a device closing a first connection to a first source and opening a second connection to a second source, or a number of packets on the network that alter controller inputs or outputs.

7. The system of claim 1, wherein the one or more automated countermeasures comprise at least one of blocking an unlearned source of data traffic detected by the comparison analyzer, applying a rate limiting rule to unlearned data traffic detected by the comparison analyzer, increasing a priority of learned data traffic relative to the unlearned data traffic, instructing at least one automation asset on the industrial network to use an alternate communication channel for data communication, switching between a wireless communication channel and a wired communication channel, or changing a virtual local area network number for a group of assets.

8. The system of claim 2, wherein the one or more automated countermeasures comprise at least instructing the industrial controller and the one or more I/O modules to employ an alternate addressing for exchange of input data and output data.

9. The system of claim 1, wherein the one or more automation countermeasures comprises at least one of instructing an industrial controller to execute an alternative control routine, instructing at least one controlled automation asset to operate in a safe mode, initiating an emergency stop of the at least one controlled automation asset, or instructing the at least one controlled automation asset to move to a predefined home position.

10. The system of claim 1, wherein the response component is configured to select the one or more automated countermeasures in response to the detected deviation in accordance with one or more rules defining an association between the one or more automated countermeasures and the detected deviation.

11. The system of claim 10, further comprising a user interface configured to receive configuration input that defines the one or more rules.

12. The system of claim 10, wherein the response component is configured to apply the one or more automated countermeasures at least until the comparison analyzer determines that the detected deviation has been mitigated.

13. A method for mitigating detected network security issues in an automation environment, comprising:

monitoring data traffic on an automation network during a training period;

generating at least one learned profile encoding at least one learned data traffic pattern determined based on the monitoring;

detecting a deviation of a current data traffic pattern from the learned data traffic pattern in excess of a threshold subsequent to the training period; and

initiating a security countermeasure in response to the detecting.

14. The method of claim 13, wherein the monitoring comprises monitoring the data traffic between an industrial controller and one or more I/O modules associated therewith, and the generating comprises recording at least a learned average cycle time of data transfers between the industrial controllers and the one or more I/O modules.

15. The method of claim 14, further comprising calculating the threshold based at least in part on variations in the average cycle time of the data transfers observed by the monitoring.

16. The method of claim 13, further comprising:

monitoring at least one network statistic for at least one automation asset during the training period; and

recording a learned pattern of network activity for the at least one automation asset based on the monitoring.

17. The method of claim 13, wherein the initiating the security countermeasure comprises at least one of blocking an unlearned source of data traffic detected by the detecting, applying a rate limiting rule to unlearned data traffic detected by the detecting, increasing a priority of learned data traffic relative to the unlearned data traffic, or instructing at least one automation asset to use an alternate communication channel for data communication.

18. The method of claim 14, wherein the initiating the security countermeasure comprises at least instructing the industrial controller and the one or more I/O modules to change from a first I/O addressing scheme to a second I/O addressing scheme.

19. The method of claim 13, wherein the initiating the security countermeasure comprises at least one of instructing an industrial controller to execute an alternative control program, instructing at least one controlled automation asset to operate in a safe operation mode, initiating an emergency stop of the at least one controlled automation asset, or instructing the at least one controlled automation asset to move to a predetermined safe position.

20. A computer-readable medium having stored thereon computer-executable instructions that, in response to execution, direct a computer system to perform operations, including:

monitoring data traffic on an industrial network during a training period;

creating at least one learned data traffic profile characterizing at least one learned pattern of data traffic observed during the training period; and

initiating a security countermeasure on the industrial network in response to detecting a deviation of a present data traffic pattern from the at least one learned pattern of data traffic in excess of a threshold subsequent to the training period.