LARGE-SCALE, TIME-SENSITIVE SECURE DISTRIBUTED CONTROL SYSTEMS AND METHODS

• US 20160117505A1
• Filed: 05/21/2014
• Published: 04/28/2016
• Est. Priority Date: 05/25/2013
• Status: Active Grant

• Current Assignee: North Carolina State University (University of North Carolina System)
• Original Assignee: North Carolina State University (University of North Carolina System)
• Inventors: CHOW, Mo-Yuen, ZENG, Wente
• Granted Patent: US 9,910,982 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/1057 involving pre-assessment of levels of reputation of peers
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Abstract

Large-scale, time-sensitive secure distributed control systems and methods are disclosed. According to an aspect, a method includes detecting an anomaly at a module among a plurality of modules in a network. The method also includes adjusting a reputation level of the module associated with the detected anomaly. Further, the method includes controlling interaction of the module associated with the detected anomaly within the network based on the adjusted reputation level.

Claims

1. A method comprising:

detecting an anomaly at a module among a plurality of modules in a network;

adjusting a reputation level of the module associated with the detected anomaly; and

controlling interaction of the module associated with the detected anomaly within the network based on the adjusted reputation level.

2. The method of claim 1, wherein detecting an anomaly comprises:

determining states of the modules; and

comparing the states of the modules to determine anomaly behavior of one of the modules.

3. The method of claim 1, wherein detecting an anomaly comprises detecting behaviors among the modules that are indicative of one of a cyber attack and a malicious operation among neighboring modules.

4. The method of claim 1, further comprising receiving information about availability of one of communication links and information flows with one or more neighboring modules, and

wherein detecting an anomaly comprises detecting the anomaly based on the one of the communication links and information flows.

5. The method of claim 1, wherein controlling interaction of the module comprises isolating the module from the network based on the reputation level.

6. The method of claim 1, further comprising controlling one or more of the modules without a detected anomaly to restore states.

7. The method of claim 1, further comprising determining whether the reputation level of the module associated with the detected anomaly is below a predetermined level, and

wherein controlling interaction of the module comprises rejecting information from the module in response to determining that the reputation level is below the predetermined level.

8. A system comprising:

at least a processor and memory configured to;

detect an anomaly at a module among a plurality of modules in a network;

adjust a reputation level of the module associated with the detected anomaly; and

control interaction of the module associated with the detected anomaly within the network based on the adjusted reputation level.

9. The system of claim 8, wherein the at least a processor and memory are configured to:

determine states of the modules; and

compare the states of the modules to determine anomaly behavior of one of the modules.

10. The system of claim 8, wherein the at least a processor and memory are configured to detect behaviors among the modules that are indicative of one of a cyber attack and a malicious operation among neighboring modules.

11. The system of claim 8, wherein the at least a processor and memory are configured to:

receive information about availability of one of communication links and information flows with one or more neighboring modules; and

detect the anomaly based on the one of the communication links and information flows.

12. The system of claim 8, wherein the at least a processor and memory are configured to isolate the module from the network based on the reputation level.

13. The system of claim 8, wherein the at least a processor and memory are configured to control one or more of the modules without a detected anomaly to restore states.

14. The system of claim 8, wherein the at least a processor and memory are configured to:

determine whether the reputation level of the module associated with the detected anomaly is below a predetermined level; and

reject information from the module in response to determining that the reputation level is below the predetermined level.

15. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions readable by a computing device to cause the computing device to:

detect, by the computing device, an anomaly at a module among a plurality of modules in a network;

adjust, by the computing device, a reputation level of the module associated with the detected anomaly; and

control, by the computing device, interaction of the module associated with the detected anomaly within the network based on the adjusted reputation level.

16. The computer program product of claim 15, wherein the program instructions are readable by the computing device to cause the computing device to:

determine, by the computing device, states of the modules; and

compare, by the computing device, the states of the modules to determine anomaly behavior of one of the modules.

17. The computer program product of claim 15, wherein the program instructions are readable by the computing device to cause the computing device to detect behaviors among the modules that are indicative of one of a cyber attack and a malicious operation among neighboring modules.

18. The computer program product of claim 15, wherein the program instructions are readable by the computing device to cause the computing device to:

receive information about availability of one of communication links and information flows with one or more neighboring modules; and

detect the anomaly based on the one of the communication links and information flows.

19. The computer program product of claim 15, wherein the program instructions are readable by the computing device to cause the computing device to isolate the module from the network based on the reputation level.

20. The computer program product of claim 15, wherein the program instructions are readable by the computing device to cause the computing device to:

determine whether the reputation level of the module associated with the detected anomaly is below a predetermined level; and

reject information from the module in response to determining that the reputation level is below the predetermined level.