Large-scale, time-sensitive secure distributed control systems and methods

• US 9,910,982 B2
• Filed: 05/21/2014
• Issued: 03/06/2018
• Est. Priority Date: 05/25/2013
• Status: Active Grant

• Current Assignee: North Carolina State University (University of North Carolina System)
• Original Assignee: North Carolina State University (University of North Carolina System)
• Inventors: Chow, Mo-Yuen, ZENG, Wente
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Chao, Michael
• Application Number:
  US14/889,840
• Publication Number:
  US 20160117505A1
• Time in Patent Office: 1,385 Days
• Field of Search: None
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/1057 involving pre-assessment of levels of reputation of peers
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks

Abstract

Large-scale, time-sensitive secure distributed control systems and methods are disclosed. According to an aspect, a method includes detecting an anomaly at a module among a plurality of modules in a network. The method also includes adjusting a reputation level of the module associated with the detected anomaly. Further, the method includes controlling interaction of the module associated with the detected anomaly within the network based on the adjusted reputation level.

Claims

1. A method comprising:

determining, by a processor, a consensus computation weight at a plurality of modules in a computer network;

detecting, by the processor, an anomaly at a module among the plurality of modules in the computer network;

decreasing, by the processor, the consensus computation weight of the module associated with the detected anomaly to reduce a malicious effect to a second module among the plurality of modules with the computer network;

adjusting, by the processor, a reputation level of the module associated with the decreased consensus computation weight of the module associated with the detected anomaly in parallel with the plurality of modules in the computer network;

determining, by the processor, that the computer network would remain connected upon isolating the module associated with the detected anomaly;

isolating, by the processor, the module associated with the detected anomaly in the computer network based on the adjusted reputation level of the module associated with the detected anomaly; and

controlling interaction of the module associated with the detected anomaly within the network based on the adjusted reputation level.

2. The method of claim 1, wherein detecting an anomaly comprises:

determining states of the modules; and

comparing the states of the modules to determine anomaly behavior of one of the modules.

3. The method of claim 1, wherein detecting an anomaly comprises detecting behaviors among the modules that are indicative of one of a cyber attack and a malicious operation among neighboring modules.

4. The method of claim 1, further comprising receiving information about availability of one of communication links and information flows with one or more neighboring modules, and

wherein detecting an anomaly comprises detecting the anomaly based on the one of the communication links and information flows.

5. The method of claim 1, wherein controlling interaction of the module comprises isolating the module from the network based on the reputation level.

6. The method of claim 1, further comprising restoring the consensus computation weight of the module when the anomaly is not detected.

7. The method of claim 1, further comprising determining whether the reputation level of the module associated with the detected anomaly is below a predetermined level, and

wherein controlling interaction of the module comprises rejecting information from the module in response to determining that the reputation level is below the predetermined level.

8. A system comprising:

at least a processor and memory configured to;

determine a consensus computation weight at a plurality of modules in a computer network;

detect an anomaly at a module among the plurality of modules in the computer network;

decrease the consensus computation weight of the module associated with the detected anomaly to reduce a malicious effect to a second module among the plurality of modules within the computer network;

adjust a reputation level of the module associated with the decreased consensus computation weight of the module associated with the detected anomaly in parallel with the plurality of modules in the computer network;

determine that the computer network would remain connected upon isolating the module associated with the detected anomaly;

isolate the module associated with the detected anomaly in the computer network based on the adjusted reputation level of the module associated with the detected anomaly; and

control interaction of the module associated with the detected anomaly within the network based on the adjusted reputation level.

9. The system of claim 8, wherein the at least a processor and memory are configured to:

determine states of the modules; and

compare the states of the modules to determine anomaly behavior of one of the modules.

10. The system of claim 8, wherein the at least a processor and memory are configured to detect behaviors among the modules that are indicative of one of a cyber attack and a malicious operation among neighboring modules.

11. The system of claim 8, wherein the at least a processor and memory are configured to:

receive information about availability of one of communication links and information flows with one or more neighboring modules; and

detect the anomaly based on the one of the communication links and information flows.

12. The system of claim 8, wherein the at least a processor and memory are configured to isolate the module from the network based on the reputation level.

13. The system of claim 8, wherein the at least a processor and memory are configured to restore the consensus computation weight of the module when the anomaly is not detected.

14. The system of claim 8, wherein the at least a processor and memory are configured to:

determine whether the reputation level of the module associated with the detected anomaly is below a predetermined level; and

reject information from the module in response to determining that the reputation level is below the predetermined level.

15. A computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions readable by a computing device to cause the computing device to:

determine, by the computing device, a consensus computation weight at a plurality of modules in a computer network;

detect, by the computing device, an anomaly at a module among the plurality of modules in the computer network;

decrease, by the computing device, the consensus computation weight of the module associated with the detected anomaly to a malicious effect to a second module among the plurality of modules with the computer network;

adjust, by the computing device, a reputation level of the module associated with the decreased consensus computation weight of the module associated with the detected anomaly in parallel with the plurality of modules in the computer network;

determine, by the computing device, that the computer network would remain connected upon isolating the module associated with the detected anomaly;

isolate, by the computing device, the module associated with the detected anomaly in the computer network based on the adjusted reputation level of the module associated with the detected anomaly; and

control, by the computing device, interaction of the module associated with the detected anomaly within the network based on the adjusted reputation level.

16. The computer program product of claim 15, wherein the program instructions are readable by the computing device to cause the computing device to:

determine, by the computing device, states of the modules; and

compare, by the computing device, the states of the modules to determine anomaly behavior of one of the modules.

17. The computer program product of claim 15, wherein the program instructions are readable by the computing device to cause the computing device to detect behaviors among the modules that are indicative of one of a cyber attack and a malicious operation among neighboring modules.

18. The computer program product of claim 15, wherein the program instructions are readable by the computing device to cause the computing device to:

receive information about availability of one of communication links and information flows with one or more neighboring modules; and

detect the anomaly based on the one of the communication links and information flows.

19. The computer program product of claim 15, wherein the program instructions are readable by the computing device to cause the computing device to isolate the module from the network based on the reputation level.

20. The computer program product of claim 15, wherein the program instructions are readable by the computing device to cause the computing device to:

determine whether the reputation level of the module associated with the detected anomaly is below a predetermined level; and

reject information from the module in response to determining that the reputation level is below the predetermined level.