POWER GRID UNIVERSAL DETECTION AND COUNTERMEASURE OVERLAY INTELLIGENCE ULTRA LATENCY HYPERVISOR

• US 20150106934A1
• Filed: 10/16/2014
• Published: 04/16/2015
• Est. Priority Date: 10/16/2013
• Status: Active Grant

• Current Assignee: Remtcs Inc.
• Original Assignee: Remtcs Inc.
• Inventors: Xaypanya, Tommy, Malinowski, Richard E.
• Granted Patent: US 10,075,460 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

Any system with an interface may be attacked by a bad actor. If that interface is exposed to a network, the bad actor may launch a remote attack or cause other systems to attack the system. Many attacks exploit vulnerabilities that are unknown to the system operators (e.g., zero-day attacks). Power grid components, such as electricity meters, are increasingly networked and, therefore, increasingly attacked. By determining a pattern of behavior for a meter and then looking for a variation of the pattern, an attack may be identified. Once an attack is discovered, countermeasures may be launched to restore the system to normal operations, harden the system against future attack, and/or retaliate against the attacker.

Claims

1. A power grid information system infrastructure, comprising:

a network interface operable to receive data regarding operation of an electricity meter;

a processing unit operable to derive a usage profile from the received data;

an analysis engine operable to detect an anomaly in the usage profile; and

a response engine operable to respond or suggest a response to the anomaly.

2. The power grid information system infrastructure of claim 1, further comprising:

the network interface is operable to receive a security protocol; and

wherein the response engine is further operable to respond to the anomaly in accord with the security protocol.

3. The power grid information system infrastructure of claim 1, further comprising:

the network interface receives a security risk signature; and

wherein the analysis engine is further operable to detect the anomaly as associated with the security risk signature.

4. The power grid information system infrastructure of claim 1, further comprising:

the network interface receives security response updates; and

wherein the response engine is further operable to respond to the anomaly with the response update.

5. The power grid information system infrastructure of claim 1, further comprising:

the network interface receives a power saving indicator; and

wherein the response engine is further operable to signal a power generation controller of a power saving opportunity associated with the power saving indicator.

6. The power grid information system infrastructure of claim 1, wherein the response engine is operable to select a security update and cause the network interface to transmit the security update to the electricity meter for execution by the electricity meter.

7. The power grid information system infrastructure of claim 6, wherein the response engine performs the selection of the security update and causes the network interface to transmit the security update to the electricity meter for execution by the electricity meter, in response to the analysis engine detecting the anomaly and wherein the anomaly is determined by the analysis engine to be mitigated by the operation of the electricity meter executing a set of instructions comprising the security update.

8. The power grid information system infrastructure of claim 1, wherein the response engine is further configured to, in response to the anomaly being associated with an existing operational session of at least one component of the power grid information system infrastructure, launch a new operational session and transition the existing operational session to a virtual environment.

9. The power grid information system infrastructure of claim 8, wherein the response engine maintains the operation of the anomaly in the virtual environment and performs forensic analysis on the anomaly.

10. The power grid information system infrastructure of claim 1, wherein the analysis engine is further operable to determine a source of the anomaly, select a counterattack, and cause the response engine to launch the counterattack at the source.

11. The power grid information system infrastructure of claim 1, wherein the analysis engine is further operable to determine a physical improvement to the power grid information system infrastructure and cause a message comprising the physical improvement to be sent to a resource responsible for implementing the physical improvement.

12. A computer, comprising:

a network interface operable to receive data regarding operation of an electricity meter;

a processing unit operable to derive a usage profile from the received data;

an analysis engine operable to detect an anomaly in the usage profile; and

a response engine operable to respond or suggest a response to the anomaly.

13. The computer of claim 12, wherein:

the network interface is further operable to receive a power saving indicator; and

wherein the response engine is further operable to signal a power generation controller of a power saving opportunity associated with the power saving indicator.

14. The computer of claim 12, wherein:

the computer, via the network interface, is further operable to receive a security protocol; and

wherein the response engine is further operable to respond to the anomaly in accord with the security protocol.

15. The computer of claim 12, wherein:

the computer, via the network interface, is operable to receive a security risk signature; and

the analysis engine is further operable to detect the anomaly as associated with the security risk signature.

16. A non-transitory computer readable medium with instructions thereon that when read by a computer cause the computer to perform:

accessing data regarding an electricity meter;

derive a usage profile from the accessed data;

detect an anomaly in the usage profile; and

respond to the anomaly.

17. The non-transitory computer readable medium of claim 16, further comprising instructions to select a security update and transmit the security update to the electricity meter for execution by the electricity meter.

18. The non-transitory computer readable medium of claim 16, further comprising instruction to:

determine whether the anomaly is associated with an existing operational session of at least one component of the power grid information system infrastructure; and

upon determining that the anomaly is associated with the existing operational session of the at least one component of the power grid information system infrastructure,

launch a new operational session and transition the existing operational session to a virtual environment.

19. The non-transitory computer readable medium of claim 18, further comprising instruction to:

maintain the operation of the anomaly in the virtual environment and perform forensic analysis of the anomaly operating therein.

20. The non-transitory computer readable medium of claim 16, further comprising instructions to:

determine a source of the anomaly;

select a counterattack; and

launch the counterattack on the source.