DOMAIN LEVEL THREAT DETECTION FOR INDUSTRIAL ASSET CONTROL SYSTEM

• US 20170310690A1
• Filed: 04/25/2016
• Published: 10/26/2017
• Est. Priority Date: 04/25/2016
• Status: Active Grant

• Current Assignee: GE Infrastructure Technology, LLC (General Electric Company)
• Original Assignee: General Electric Company
• Inventors: MESTHA, Lalit Keshav, THATCHER, Jonathan Carl, HOLZHAUER, Daniel Francis, JOHN, Justin Varkey
• Granted Patent: US 9,998,487 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A normal space data source stores, for each of a plurality of threat nodes, a series of normal values that represent normal operation of an industrial asset control system, and a threatened space data source stores a series of threatened values. A model creation computer may generate sets of normal and threatened feature vectors. The computer may also calculate and output at least one decision boundary for a threat detection model based on the normal and threatened feature vectors. The plurality of threat nodes may then generate a series of current values from threat nodes that represent a current operation of the asset control system. A threat detection computer may receive the series of current values from threat nodes, generate a set of current feature vectors, execute the threat detection model, and transmit a threat alert signal based on the current feature vectors and at the least one decision boundary.

Claims

1. A system to protect an industrial asset control system, comprising:

a plurality of threat nodes each generating a series of current threat node values over time that represent a current operation of the industrial asset control system; and

a threat detection computer, coupled to the plurality of threat nodes, to;

(i) receive the series of current threat node values and generate a set of current feature vectors,

(ii) access a threat detection model having at least one decision boundary created using a set of normal feature vectors a set of threatened feature vectors, and

(iii) execute the threat detection model and transmit a threat alert signal based on the set of current feature vectors and the at least one decision boundary.

2. The system of claim 1, wherein at least one of the set of normal feature vectors and the set of threatened feature vectors are associated with at least one of:

(i) principal components, (ii) statistical features, (iii) deep learning features, (iv) frequency domain features, (v) time series analysis features, (vi) logical features, (vii) geographic or position based locations, and (viii) interaction features.

3. The system of claim 1, wherein the threat detection model including the at least one decision boundary is dynamically adapted based on at least one of:

(i) a transient condition, (ii) a steady state model of the industrial asset control system, and (iii) data sets obtained while operating the system as in self-learning systems from incoming data stream.

4. The system of claim 1, wherein the threat detection model is associated with at least one of:

(i) an actuator attack, (ii) a controller attack, (iii) a threat node attack, (iv) a plant state attack, (v) spoofing, (vi) financial damage, (vii) unit availability, (viii) a unit trip, (ix) a loss of unit life, and (x) asset damage requiring at least one new part.

5. The system of claim 4, wherein information from each of the plurality of threat nodes is normalized and an output is expressed as a weighted linear combination of basis functions.

6. The system of claim 5, wherein natural basis vectors are obtained using covariance of a threat node data matrix.

7. The system of claim 1, wherein the threat nodes are associated with at least one of:

(i) critical sensor nodes, (ii) actuator nodes, (iii) controller nodes, and (iv) key software nodes.

8. The system of claim 1, wherein the threat detection model including the at least one decision boundary is associated with at least one of:

(i) a line, (ii) a hyperplane, and (iii) a non-linear boundary separating normal space and threatened space.

9. The system of claim 1, wherein the threat detection model including the at least one decision boundary is a multi-class decision boundary separating normal space, threatened space, and degraded operation space.

10. The system of claim 1, further comprising:

a normal space data source storing, for each of the plurality of threat nodes, a series of normal threat node values over time that represent normal operation of the industrial asset control system;

a threatened space data source storing, for each of the plurality of threat nodes, a series of threatened threat node values over time that represent a threatened operation of the industrial asset control system; and

a threat detection model creation computer, coupled to the normal space data source and the threatened space data source, to;

(i) receive the series normal threat node values and generate the set of normal feature vectors,

(ii) receive the series of threatened threat node values and generate the set of threatened feature vectors, and

(iii) automatically calculate and output the at least one decision boundary for the threat detection model based on the set of normal feature vectors and the set of threatened feature vectors.

11. The system of claim 10, wherein at least one of the series of normal threat node values and the series of threatened threat node values are associated with a high fidelity equipment model.

12. The system of claim 10, wherein at least one decision boundary exists in a multi-dimensional space and is associated with at least one of:

(i) a dynamic model, (ii) design of experiment data, (iii) machine learning techniques, (iv) a support vector machine, (v) a full factorial process, (vi) Taguchi screening, (vii) a central composite methodology, (viii) a Box-Behnken methodology, (ix) real-world operating conditions, (x) a full-factorial design, (xi) a screening design, and (xii) a central composite design.

13. The system of claim 10, wherein the plurality of threatened threat node values were generated from a set of potential threat vectors in accordance with a risk priority number analysis including at least one of:

(i) a level of expertise, (ii) an amount of time, (iii) a level of ease, and (iv) an amount of damage.

14. The system of claim 10, wherein the threat detection model is associated with decision boundaries and at least one of:

(i) feature mapping, and (ii) feature parameters.

15. The system of claim 10, wherein at least one of the normal and threatened threat node values are obtained by running design of experiments on an industrial control system associated with at least one of:

(i) a power turbine, (ii) a jet engine, (iii) a locomotive, and (iv) an autonomous vehicle.

16. A computerized method to protect an industrial asset control system, comprising:

retrieving, for each of a plurality of threat nodes, a series of normal threat node values over time that represent normal operation of the industrial asset control system;

generating a set of normal feature vectors based on the normal threat node values retrieving, for each of the plurality of threat nodes, a series of threatened threat node values over time that represent a threatened operation of the industrial asset control system;

generating a set of threatened feature vectors based on the threatened threat node values; and

automatically calculating and outputting at least one decision boundary for a threat detection model based on the set of normal feature vectors and the set of threatened feature vectors.

17. The method of claim 16, wherein the at least one decision boundary exists in a multi-dimensional space and is associated with at least one of:

(i) a dynamic model, (ii) design of experiment data, (iii) machine learning techniques, (iv) a support vector machine, (v) a full factorial process, (vi) Taguchi screening, (vii) a central composite methodology, (viii) a Box-Behnken methodology, (ix) real-world operating conditions, (x) a full-factorial design, (xi) a screening design, and (xii) a central composite design.

18. The method of claim 16, wherein at least one of the set of normal feature vectors and the set of threatened feature vectors are associated with at least one of:

(i) principal components, (ii) statistical features, (iii) deep learning features, (iv) frequency domain features, (v) time series analysis features, (vi) logical features, (vii) geographic or position based locations, and (viii) interaction features.

19. The method of claim 16, wherein the plurality of threatened node values were generated from a set of potential threat vectors in accordance with a risk priority number analysis including at least one of:

(i) a level of expertise, (ii) an amount of time, (iii) a level of ease, and (iv) an amount of damage.

20. The method of claim 16, wherein at least one decision boundary is dynamically adapted based on at least one of:

(i) a transient condition, (ii) a steady state model of the industrial asset control system, and (iii) data sets obtained while operating the system as in self-learning systems from incoming data streams.

21. The method of claim 16, wherein information from each of the plurality of threat nodes is normalized and output is expressed as a weighted linear combination of basis functions.

22. The method of claim 21, wherein natural basis vectors are obtained using covariance of a threat node data matrix.

23. A non-transitory, computer-readable medium storing instructions that, when executed by a computer processor, cause the computer processor to perform a method to protect an industrial asset control system, the method comprising:

receiving, from a plurality of threat nodes, a series of current threat node values over time that represent a current operation of the industrial asset control system;

generating, by a threat detection computer based on the received series of current threat node values, a set of current feature vectors; and

executing a threat detection model that transmits a threat alert signal based on the set of current feature vectors and at least one decision boundary.