Title: Using virtual sensors to accommodate industrial asset control systems during cyber attacks

Abstract

In some embodiments, an industrial asset may be associated with a plurality of monitoring nodes, each monitoring node generating a series of monitoring node values over time that represent operation of the industrial asset. A threat detection computer may determine that an attacked monitoring node is currently being attacked. Responsive to this determination, a virtual sensor coupled to the plurality of monitoring nodes may estimate a series of virtual node values for the attacked monitoring node(s) based on information received from monitoring nodes that are not currently being attacked. The virtual sensor may then replace the series of monitoring node values from the attacked monitoring node(s) with the virtual node values. Note that in some embodiments, virtual node values may be estimated for a particular node even before it is determined that the node is currently being attacked.

Inventors:

Mestha, Lalit Keshav; Achanta, Hema Kumari; John, Justin Varkey; Bushey, Cody Joe

Issue Date:

2019-12-10

Research Org.:

General Electric Co., Schenectady, NY (United States)

Sponsoring Org.:

USDOE

OSTI Identifier:

1600400

Patent Number(s):

10505955

Application Number:

15/683,250

Assignee:

General Electric Company (Schenectady, NY)

Patent Classifications (CPCs):

G - PHYSICS G06 - COMPUTING G06F - ELECTRIC DIGITAL DATA PROCESSING

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION

Show more

G - PHYSICS G06 - COMPUTING G06F - ELECTRIC DIGITAL DATA PROCESSING

G06F21/50 - Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
G06F21/554 - {involving event detection and direct action}
G06F21/566 - {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
G06F21/577 - {Assessing vulnerabilities and evaluating computer system security}
G06F2221/2101 - Auditing as a secondary aspect

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION

H04L63/1416 - {Event detection, e.g. attack signature detection}
H04L63/1425 - {Traffic logging, e.g. anomaly detection}
H04L63/1441 - {Countermeasures against malicious traffic
H04L63/145 - {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
H04L63/1466 - {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
H04L63/1491 - {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment}

Y - NEW / CROSS SECTIONAL TECHNOLOGIES Y04 - INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS Y04S - SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS

Y04S40/20 - Information technology specific aspects

Show less

DOE Contract Number:  

OE0000833

Resource Type:

Patent

Resource Relation:

Patent File Date: 08/22/2017

Country of Publication:

United States

Language:

English

Subject:

97 MATHEMATICS AND COMPUTING; 20 FOSSIL-FUELED POWER PLANTS