Method and computer program product for monitoring an industrial network

• US 7,246,156 B2
• Filed: 03/31/2004
• Issued: 07/17/2007
• Est. Priority Date: 06/09/2003
• Status: Active Grant

• Current Assignee: Idefender, LLC
• Original Assignee: Industrial Defender, Inc. (Capgemini SE)
• Inventors: Kawano, Kegan, Muegge, Adam, Hope, Erik P., Mah, Andy G., Ginter, Andrew, McMillan, Brad, Jensen, Brett, Lopes, Rui Manuel Martins, Hutchinson, Tom
• Primary Examiner(s): VU, VIET DUY
• Application Number:
  US10/815,222
• Publication Number:
  US 20050015624A1
• Time in Patent Office: 1,203 Days
• Field of Search: 709/217, 709/219, 709/224, 719/317, 719/318
• US Class Current: 709/217
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Described are techniques used in monitoring the performance, security and health of a system used in an industrial application. Agents included in the industrial network report data to an appliance or server. The appliance stores the data and determines when an alarm condition has occurred. Notifications are sent upon detecting an alarm condition. The alarm thresholds may be user defined. A threat thermostat controller determines a threat level used to control the connectivity of a network used in the industrial application.

Claims

1. A method for monitoring an industrial network comprising:

reporting first data about a first computer system by a first agent executing on said first computer system in said industrial network, said first computer system performing at least one of;

monitoring or controlling a physical process of said industrial network, said first data including information about software used in connection with said physical process, wherein said agent sends said first data over a one way communication connection, wherein said one way communication connection is one way with respect to communications from said first agent reporting said first data at an application level, and wherein two-way communications at a network level lower than said application level are used to set up said one-way communication connection.

2. The method of claim 1, further comprising:

reporting second data about communications on a connection between said industrial network and another network by a second agent executing on a second computer system.

3. The method of claim 2, wherein said second data reported by said second agent is included in an appliance to which said first data is sent.

4. The method of claim 1, wherein said first agent reports on at least one of:

critical file monitoring, log file for said first computer system, hardware and operating system of said first computer system, password and login, a specific application executing on said computer system wherein said application is in accordance with a particular industrial application of said industrial network.

5. The method of claim 4, wherein a plurality of agents execute on said first computer system monitoring said first computer system.

6. The method of claim 5, wherein said plurality of agents execute on said first computer system being monitored and said plurality of agents includes a master agent and other agents performing a predetermined set of monitoring tasks, said master agent controlling execution of said other agents.

7. The method of claim 6, wherein said plurality of agents report data at predetermined intervals to one of:

an appliance and said second computer system.

8. The method of claim 7, further comprising performing, by at least one of said plurality of agents:

obtaining data from a data source;

parsing said data;

performing pattern matching on said parsed data to determine events of interest;

recording any events of interest;

reporting any events of interest in accordance with occurrences of selected events in a time interval;

creating a message including said summary at predetermined time intervals; and

encrypting at least one of;

said message and a checksum of said message.

9. The method of claim 1, wherein said first data includes at least one of the following metrics:

a number of open listen connections and a number of abnormal process terminations.

10. The method of claim 9, wherein, when a number of open listen connections falls below a first level, an event corresponding to a component failure is determined.

11. The method of claim 9, wherein, when a number of open listen connections is above a second level, an event corresponding to a new component or unauthorized component is determined.

12. The method of claim 2, wherein said second agent reports on network activity in accordance with a set of rules, said rules including at least one rule indicating events that are normal activity in a business network are flagged as suspicious in said industrial network.

13. The method of claim 12, wherein said events include at least one of:

an event associated with a web browser, and an event associated with e-mail.

14. The method of claim 2, wherein said second agent reports on an address binding of a physical device identifier to a network address if the physical device identifier of a component was not previously known, or said network address in the address binding is a reassignment of said network address within a predetermined time period since said network address was last included in an address binding.

15. The method of claim 2, wherein said second agent reports second data about a firewall, and said second data includes at least one of:

a change to a saved firewall configuration corresponding to a predetermined threat level, a change to a current set of firewall configuration rules currently controlling operations between said industrial network and said other network.

16. The method of claim 15, wherein log files associated with said firewall are stored remotely at a location on said second computer system with log files for said second computer system activity.

17. The method of claim 2, wherein said second data includes at least one threat assessment from a source external to said industrial network.

18. The method of claim 17, wherein said second data includes at least one of:

a threat level indicator from a corporate network connected to said industrial network, a threat level indicator from a public network source, and a threat level indicator that is manually input.

19. The method of claim 1, further comprising:

receiving at least said first data by a receiver;

authenticating said first data as being sent by said first agent; and

processing, in response to said authenticating, said first data by said receiver.

20. The method of claim 19, wherein said authenticating includes at least one of:

verifying use of said first agent'"'"'s encryption key, and checking validity of a message checksum, and using a timestamp or sequence number to detect invalid reports received by said receiver as being sent from said first agent.

21. The method of claim 1, wherein said reporting is performed in accordance with a threshold size indicates an amount of data that said first agent is permitted to transmit in a fixed periodic reporting interval.

43. The method of claim 1, wherein a second agent reports about communications within said industrial network, said second agent reporting on network activity in said industrial network in accordance with a set of rules, said rules including at least one rule defining an acceptable message, and the method further comprising:

receiving, by said second agent, a message;

determining if said message is undesirable in accordance with said at least one rule; and

reporting said message as undesirable if said message is not determined to be in accordance with said at least one rule.

44. The method of claim 43, further comprising:

defining another rule for use in said determining if an additional message type is determined to be acceptable in said network.

47. The method of claim 9, wherein said number of open listen connections are the number of open listen connection with respect to all open listen connections of said first computer system.

49. The method of claim 1, wherein a plurality of agents execute on said first computer system and perform monitoring of said first computer system, said plurality of agents including a master agent executing on said first computer system, said master agent controlling execution of one or more others of said plurality of agents executing on said first computer system.

50. The method of claim 1, wherein said first agent performs reporting of said first data over said one way communication connection at an application level.

51. The method of claim 50, wherein said first computer system sends and receives messages at a network level lower than said application level to set up said one way communication connection.

55. The method of claim 1, wherein said first agent reports said first data to a server component, and the method further comprising:

reporting second data by a second agent to said server component, said second agent monitoring said server component and executing on a same system as said server component.

56. The method of claim 1, wherein said first agent reports said first data to a server, and the method further comprising:

reporting second data by a second agent to said server, said second agent monitoring said server and executing on said server;

processing said first data and said second data at said server; and

generating one or more notifications in accordance with said first and said second data.

22. A computer program product for monitoring an industrial network comprising code that:

reports first data about a first computer system by a first agent executing on said first computer system in said industrial network, said first computer system performing at least one of;

monitoring or controlling a physical process of said industrial network, said first data including information about software used in connection with said physical process, wherein said agent sends said first data over a one way communication connection wherein said one way communication connection is one way with respect to communications from said first agent reporting said first data at an application level, and wherein two-way communications at a network level lower than said application level are used to set up said one-way communication connection.

23. The computer program product of claim 22, further comprising code that:

reports second data about communications on a connection between said industrial network and another network by a second agent executing on a second computer system.

24. The computer program product of claim 23, wherein said second data reported by said second agent is included in an appliance to which said first data is sent.

25. The computer program product of claim 22, wherein said first agent reports on at least one of:

critical file monitoring, log file for said first computer system, hardware and operating system of said first computer system, password and login, a specific application executing on said computer system wherein said application is in accordance with a particular industrial application of said industrial network.

26. The computer program product of claim 25, wherein a plurality of agents execute on said first computer system monitoring said first computer system.

27. The computer program product of claim 26, wherein said plurality of agents execute on said first computer system being monitored and said plurality of agents includes a master agent and other agents performing a predetermined set of monitoring tasks, said master agent controlling execution of said other agents.

28. The computer program product of claim 27, wherein said plurality of agents report data at predetermined intervals to one of:

an appliance and said second computer system.

29. The computer program product of claim 28, further comprising code for performing, by at least one of said plurality of agents:

obtaining data from a data source;

parsing said data;

performing pattern matching on said parsed data to determine events of interest;

recording any events of interest;

reporting any events of interest in accordance with occurrences of selected events in a time interval;

creating a message including said summary at predetermined time intervals; and

encrypting at least one of;

said message and a checksum of said message.

30. The computer program product of claim 22, wherein said first data includes at least one of the following metrics:

a number of open listen connections and a number of abnormal process terminations.

31. The computer program product of claim 30, wherein, when a number of open listen connections falls below a first level, an event corresponding to a component failure is determined.

32. The computer program product of claim 30, wherein, when a number of open listen connections is above a second level, an event corresponding to a new component or unauthorized component is determined.

33. The computer program product of claim 23, wherein said second agent reports on network activity in accordance with a set of rules, said rules including at least one rule indicating events that are normal activity in a business network are flagged as suspicious in said industrial network.

34. The computer program product of claim 33, wherein said events include at least one of:

an event associated with a web browser, and an event associated with e-mail.

35. The computer program product of claim 23, wherein said second agent reports on an address binding of a physical device identifier to a network address if the physical device identifier of a component was not previously known, or said network address in the address binding is a reassignment of said network address within a predetermined time period since said network address was last included in an address binding.

36. The computer program product of claim 23, wherein said second agent reports second data about a firewall, and said second data includes at least one of:

a change to a saved firewall configuration corresponding to a predetermined threat level, a change to a current set of firewall configuration rules currently controlling operations between said industrial network and said other network.

37. The computer program product of claim 36, wherein log files associated with said firewall are stored remotely at a location on said second computer system with log files for said second computer system activity.

38. The computer program product of claim 23, wherein said second data includes at least one threat assessment from a source external to said industrial network.

39. The computer program product of claim 38, wherein said second data includes at least one of:

a threat level indicator from a corporate network connected to said industrial network, a threat level indicator from a public network source, and a threat level indicator that is manually input.

40. The computer program product of claim 22, further comprising code that:

receives at least said first data by a receiver;

authenticates said first data as being sent by said first agent; and

processes, in response to said code that authenticates, said first data by said receiver.

41. The computer program product of claim 40, wherein said code that authenticates includes at least one of:

code that verifies use of said first agent'"'"'s encryption key and checks validity of a message checksum, and code that uses a timestamp or sequence number to detect invalid reports received by said receiver as being sent from said first agent.

42. The computer program product of claim 22, wherein said code that reports uses a threshold size indicating an amount of data that said first agent is permitted to transmit in a fixed periodic reporting interval.

45. The computer program product of claim 22, wherein a second agent reports about communications within said industrial network, said second agent reporting on network activity in said industrial network in accordance with a set of rules, said rules including at least one rule defining an acceptable message, and the computer program product further comprising code that:

receives, by said second agent, a message;

determines if said message is undesirable in accordance with said at least one rule defining an acceptable message; and

reports said message as undesirable if said message is not determined to be in accordance with said at least one rule.

46. The computer program product of claim 45, further comprising code that:

defines another rule for use in said determining if an additional message type is determined to be acceptable in said network.

48. The computer program product of claim 30, wherein said number of open listen connections are the number of open listen connections with respect to all open listen connections of said first computer system.

52. The computer program product of claim 22, wherein a plurality of agents execute on said first computer system and perform monitoring of said first computer system, said plurality of agents including a master agent executing on said first computer system, said master agent controlling execution of one or more others of said plurality of agents executing on said first computer system.

53. The computer program product of claim 22, wherein said first agent performs reporting of said first data over said one way communication connection at an application level.

54. The computer program product of claim 53, wherein said first computer system sends and receives messages at a network level lower than said application level to set up said one way communication connection.

57. The computer program product of claim 22, wherein said first agent reports said first data to a server component, and the computer program product further comprising code that:

reports second data by a second agent to said server component, said second agent monitoring said server component and executing on a same system as said server component.

58. The computer program product of claim 22, wherein said first agent reports said first data to a server, and the computer program product further comprising code that:

reports second data by a second agent to said server, said second agent monitoring said server and executing on said server;

processes said first data and said second data at said server; and

generates one or more notifications in accordance with said first and said second data.