Autonomous reconfigurable virtual sensing system for cyber-attack neutralization

Abbaszadeh, Masoud; Mestha, Lalit Keshav

Title: Autonomous reconfigurable virtual sensing system for cyber-attack neutralization

Abstract

An industrial asset may be associated with a plurality of monitoring nodes, each monitoring node generating a series of monitoring node values over time representing current operation of the industrial asset. An abnormality detection computer may determine that at least one abnormal monitoring node is currently being attacked or experiencing a fault. A virtual sensing estimator may continuously execute an adaptive learning process to create or update virtual sensor models for the monitoring nodes. Responsive to an indication that a monitoring node is currently being attacked or experiencing a fault, the virtual sensing estimator may be dynamically reconfigured to estimate a series of virtual node values for the abnormal monitoring node or nodes based on information from normal monitoring nodes and appropriate virtual sensor models. The series of monitoring node values from the abnormal monitoring node or nodes may then be replaced with the virtual node values.

Inventors:: Abbaszadeh, Masoud; Mestha, Lalit Keshav

Issue Date:: 2020-10-13

Research Org.:: General Electric Co., Schenectady, NY (United States)

Sponsoring Org.:: USDOE

OSTI Identifier:: 1771516

Patent Number(s):: 10805329

Application Number:: 15/977,595

Assignee:: General Electric Company (Schenectady, NY)

Patent Classifications (CPCs):: H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION

G - PHYSICS G05 - CONTROLLING G05B - CONTROL OR REGULATING SYSTEMS IN GENERAL

Show more

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
H04L63/1408 - {by monitoring network traffic
H04L63/1441 - {Countermeasures against malicious traffic

G - PHYSICS G05 - CONTROLLING G05B - CONTROL OR REGULATING SYSTEMS IN GENERAL
G05B23/0229 - {knowledge based, e.g. expert systems

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
H04L41/06 - {involving management of faults or events or alarms}

Y - NEW / CROSS SECTIONAL TECHNOLOGIES Y04 - INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS Y04S - SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
Y04S40/20 - Information technology specific aspects

G - PHYSICS G05 - CONTROLLING G05B - CONTROL OR REGULATING SYSTEMS IN GENERAL
G05B19/0428 - {Safety, monitoring

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
H04L63/1416 - {Event detection, e.g. attack signature detection}

G - PHYSICS G05 - CONTROLLING G05B - CONTROL OR REGULATING SYSTEMS IN GENERAL
G05B23/0297 - {Reconfiguration of monitoring system, e.g. use of virtual sensors

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
H04L63/1466 - {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
H04L67/12 - {adapted for proprietary or special purpose networking environments, e.g. medical networks, sensor networks, networks in a car or remote metering networks
H04L63/1425 - {Traffic logging, e.g. anomaly detection}

Show less

DOE Contract Number:: OE0000833

Resource Type:: Patent

Resource Relation:: Patent File Date: 05/11/2018

Country of Publication:: United States

Language:: English

Citation Formats


                    Abbaszadeh, Masoud, and Mestha, Lalit Keshav. Autonomous reconfigurable virtual sensing system for cyber-attack neutralization.  United States: N. p., 2020. 
        Web.

Copy to clipboard


                    Abbaszadeh, Masoud, & Mestha, Lalit Keshav. Autonomous reconfigurable virtual sensing system for cyber-attack neutralization.  United States.

Copy to clipboard


                    Abbaszadeh, Masoud, and Mestha, Lalit Keshav. Tue .  
        "Autonomous reconfigurable virtual sensing system for cyber-attack neutralization".  United States.  https://www.osti.gov/servlets/purl/1771516.

Copy to clipboard


                    
@article{osti_1771516,

  title        = {Autonomous reconfigurable virtual sensing system for cyber-attack neutralization},

  author       = {Abbaszadeh, Masoud and Mestha, Lalit Keshav},

  abstractNote = {An industrial asset may be associated with a plurality of monitoring nodes, each monitoring node generating a series of monitoring node values over time representing current operation of the industrial asset. An abnormality detection computer may determine that at least one abnormal monitoring node is currently being attacked or experiencing a fault. A virtual sensing estimator may continuously execute an adaptive learning process to create or update virtual sensor models for the monitoring nodes. Responsive to an indication that a monitoring node is currently being attacked or experiencing a fault, the virtual sensing estimator may be dynamically reconfigured to estimate a series of virtual node values for the abnormal monitoring node or nodes based on information from normal monitoring nodes and appropriate virtual sensor models. The series of monitoring node values from the abnormal monitoring node or nodes may then be replaced with the virtual node values.},

  doi          = {},

  journal      = {},
number       = ,

  volume       = ,

  place        = {United States},

  year         = {2020},

  month        = {10}

}

Copy to clipboard

Patent:

View Patent

Save / Share:

Export Metadata

Save to My Library

Works referenced in this record:

Model-Based Attack Detection and Mitigation for Automatic Generation Control
journal, March 2014

Sridhar, Siddharth; Govindarasu, Manimaran
IEEE Transactions on Smart Grid, Vol. 5, Issue 2
https://doi.org/10.1109/TSG.2014.2298195

Threat Detection and Localizatino for Monitoring Nodes of an Industrial Asset Control System
patent-application, December 2017

Bushey, Cody Joe; Mestha, Lalit Keshav; Holzhauer, Daniel Francis
US Patent Application 15/179034; 20170359366
URL: http://appft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PG01&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.html&r=1&f=G&l=50&s1=%2220170359366%22.PGNR.&OS=DN/20170359366&RS=DN/20170359366

A Framework for Attack-Resilient Industrial Control Systems: Attack Detection and Controller Reconfiguration
journal, January 2018

Paridari, Kaveh; O'Mahony, Niamh; El-Din Mady, Alie
Proceedings of the IEEE, Vol. 106, Issue 1
https://doi.org/10.1109/JPROC.2017.2725482

Using virtual sensors to accommodate industrial asset control systems during cyber attacks
patent, December 2019

Mestha, Lalit Keshav; Achanta, Hema; John, Justin Varkey
US Patent Document 10,505,955
URL: http://patft.uspto.gov/netacgi/nph-Parser?patentnumber=10505955

Methods and system for detecting false data injection attacks
patent, August 2019

Premerlani, William James; Baone, Chaitanya Ashok; Pan, Yan
US Patent Document 10,372,569
URL: http://patft.uspto.gov/netacgi/nph-Parser?patentnumber=10372569

Similar Records in DOE Patents and OSTI.GOV collections:

Using virtual sensors to accommodate industrial asset control systems during cyber attacks

Patent Mestha, Lalit Keshav; Achanta, Hema Kumari; John, Justin Varkey; ...

In some embodiments, an industrial asset may be associated with a plurality of monitoring nodes, each monitoring node generating a series of monitoring node values over time that represent operation of the industrial asset. A threat detection computer may determine that an attacked monitoring node is currently being attacked. Responsive to this determination, a virtual sensor coupled to the plurality of monitoring nodes may estimate a series of virtual node values for the attacked monitoring node(s) based on information received from monitoring nodes that are not currently being attacked. The virtual sensor may then replace the series of monitoring nodemore »« less
Full Text Available
Using virtual sensors to accommodate industrial asset control systems during cyber attacks

Patent Mestha, Lalit Keshav; Achanta, Hema Kumari; John, Justin Varkey; ...

In some embodiments, an industrial asset may be associated with a plurality of monitoring nodes, each monitoring node generating a series of monitoring node values over time that represent operation of the industrial asset. A threat detection computer may determine that an attacked monitoring node is currently being attacked. Responsive to this determination, a virtual sensor coupled to the plurality of monitoring nodes may estimate a series of virtual node values for the attacked monitoring node(s) based on information received from monitoring nodes that are not currently being attacked. The virtual sensor may then replace the series of monitoring nodemore »« less
Full Text Available
Dynamic concurrent learning method to neutralize cyber attacks and faults for industrial asset monitoring nodes

Patent Mestha, Lalit Keshav; Anubi, Olugbenga; Achanta, Hema Kumari

Input signals may be received from monitoring nodes of the industrial asset, each input signal comprising time series data representing current operation. A neutralization engine may transform the input signals into feature vectors in feature space, each feature vector being associated with one of a plurality of overlapping batches of received input signals. A dynamic decision boundary may be generated based on the set of feature vectors, and an abnormal state of the asset may be detected based on the set of feature vectors and a predetermined static decision boundary. An estimated neutralized value for each abnormal feature value maymore »« less
Full Text Available
Cyber-attack detection, localization, and neutralization for unmanned aerial vehicles

Patent Mestha, Lalit Keshav; Anubi, Olugbenga; John, Justin Varkey

In some embodiments, an Unmanned Aerial Vehicle (“UAV”) system may be associated with a plurality of monitoring nodes, each monitoring node generating a series of monitoring node values over time that represent operation of the UAV system. An attack detection computer platform may receive the series of current monitoring node values and generate a set of current feature vectors. The attack detection computer platform may access an attack detection model having at least one decision boundary (e.g., created using a set of normal feature vectors a set of attacked feature vectors). The attack detection model may then be executed andmore »« less
Full Text Available
Cyber-attack detection and neutralization

Patent Mestha, Lalit Keshav; Anubi, Olugbenga; Abbaszadeh, Masoud

The example embodiments are directed to a system and method for neutralizing abnormal signals in a cyber-physical system. In one example, the method includes receiving input signals comprising time series data associated with an asset and transforming the input signals into feature values in a feature space, detecting one or more abnormal feature values in the feature space based on a predetermined normalcy boundary associated with the asset, and determining an estimated true value for each abnormal feature value, and performing an inverse transform of each estimated true value to generate neutralized signals comprising time series data and outputting themore » neutralized signals.« less
Full Text Available

Similar Records

Title: Autonomous reconfigurable virtual sensing system for cyber-attack neutralization

Abstract

Citation Formats

Model-Based Attack Detection and Mitigation for Automatic Generation Control journal, March 2014

Threat Detection and Localizatino for Monitoring Nodes of an Industrial Asset Control System patent-application, December 2017

A Framework for Attack-Resilient Industrial Control Systems: Attack Detection and Controller Reconfiguration journal, January 2018

Using virtual sensors to accommodate industrial asset control systems during cyber attacks patent, December 2019

Methods and system for detecting false data injection attacks patent, August 2019

Model-Based Attack Detection and Mitigation for Automatic Generation Control
journal, March 2014

Threat Detection and Localizatino for Monitoring Nodes of an Industrial Asset Control System
patent-application, December 2017

A Framework for Attack-Resilient Industrial Control Systems: Attack Detection and Controller Reconfiguration
journal, January 2018

Using virtual sensors to accommodate industrial asset control systems during cyber attacks
patent, December 2019

Methods and system for detecting false data injection attacks
patent, August 2019