# US 10,078,317 B2 · Method, device and computer program for monitoring an industrial control system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,078,317 B2
- Document ID: US10078317B2
- Status: Granted
- Kind: B2
- Application number: 14/440,128
- Filed: 2014-01-07
- Published: 2015-10-22
- Granted: 2018-09-18
- Earliest claimed: 2013-01-08
- Assignees: Secure-NOK AS
- Applicants: Secure-NOK AS
- Inventors: Siv Hilde Houmb
- Web page: https://patentgrep.com/patent/US10078317B2

## CPC

- G05B 19/0428: {Safety, monitoring (G05B19/0423 takes precedence)}
- G05B 19/406: characterised by monitoring or safety (G05B19/19 takes precedence)
- G06F 21/552: {involving long-term monitoring or reporting}
- G06Q 10/06: Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
- G06Q 50/26: Government or public services (business processes related to the transportation industry G06Q50/40)
- H04L 41/0631: using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- G05B 23/0229: {knowledge based, e.g. expert systems; genetic algorithms}
- G05B 2219/14006: Safety, monitoring in general
- G05B 2219/14076: Test of sensor
- G06F 2221/2153: Using hardware token as a secondary aspect
- Y02P 90/80: Management or planning
- G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- Y02P: CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS

## Abstract

A method is for monitoring an industrial control system. The method comprises collecting data from one or more sources external to the industrial control system; collecting data from one or more internal sources on the industrial control system; aggregating data collected from said internal sources or from said external sources; correlating said collected data by analyzing and interpreting said collected data in view of previously collected data so as to monitor the security of the industrial control system. An apparatus is for performing the method.

## Claims

### Claim 1

A method for monitoring an industrial control system, the method comprising:
collecting data from one or more external sources that are external to the industrial control system;
collecting data from one or more internal sources on the industrial control system, the data collected from the one or more internal sources and the one or more external sources being collectively referred to as collected data;
aggregating the collected data to generate aggregated data;
correlating the aggregated data by analyzing and interpreting the aggregated data in view of historical aggregated data that was previously collected and aggregated so as to monitor the security of the industrial control system;
wherein the step of collecting data from the one or more internal sources on the industrial control system comprises collecting data from one or more of:
a sensor, an agent implemented as a computer program for recording and assessing parameters and events, and a recording means adapted to record data from instructions, operations, procedures or security events locally on the industrial control system;
wherein the step of collecting the data from the one or more sources external to the industrial control system comprises collecting data from one or more of:
security blogs, security discussion sources, databases for providing information on threats and security attacks, security evaluation and severity information comprising at least one of Common Vulnerability Scoring System (CVSS), standards, standardization bodies, security best practices, security agencies, and information from security software solution providers; and
wherein the step of correlating the aggregated data comprises, for at least two parameters of the collected data, generating a first graph of one of the at least two parameters during a period and a second graph of data from a critical process during the period, correlating the first graph and the second graph so as to generate a correlation graph, and correlating the correlation graph corresponding to each of the at least two parameters so as to generate an interval graph for forecasting security events within the industrial control system based on correlations between data from the one or more internal sources and the one or more external sources over time.

### Claim 2 (depends on 1)

The method according to claim 1, wherein the step of aggregating the collected data comprises aggregating the data of the one or more said internal sources using one or more of:
parameterized aggregation, layer-wise aggregation, and cross-layer aggregation.

### Claim 3 (depends on 1)

The method according to claim 1, wherein the step of aggregating the collected data comprises aggregating the data from the one or more external sources by performing one or more of:
reformatting the data collected from the one or more external sources; and
reformatting the data collected from the one or more external sources so as to generate reformatted data and aggregating the reformatted data into a database.

### Claim 4 (depends on 1)

The method according to claim 1, wherein the step of correlating the aggregated data comprises one or more of:
correlating across parameters, correlating across layers, correlating across entities in a system, and correlating across systems.

### Claim 5 (depends on 1)

The method according to claim 1, wherein the step of correlating the aggregated data comprises the step of determining a security risk from a detected security event by performing one or more of:
evaluating the aggregated data by comparing to a pre-defined threshold value, evaluating the aggregated data by comparing to a relevant installation baseline, performance baseline, or entity configuration baseline, such as a machine or equipment baseline, to identify abnormal activity, evaluating the aggregated data by comparing to a past events database, evaluating the aggregated data by comparing to a knowledge, experience and recommendations database obtained from a collection of standards and best practices and from the one or more external sources, and evaluating the aggregated data by comparing to security events reports from the one or more external and internal sources.

### Claim 6 (depends on 1)

The method according to claim 1, wherein the method further comprises the step of reacting to a security risk by performing one or more of:
repairing immediately, scheduling a repair, delaying the repair, and doing nothing.

### Claim 7

An apparatus for monitoring an industrial control system, the apparatus comprising:
an internal sources module executable to collect data from one or more internal sources on the industrial control system;
an external sources module executable to collect data from one or more external sources that are external to the industrial control system, wherein the data from the one or more internal sources and the one or more external sources are collectively referred to as collected data;
an aggregation, correlation and interpretation module executable for aggregating, correlating and interpreting the data from the one or more internal and the one or more external sources so as to monitor the security of the industrial control system, the aggregating, correlating and interpretation module generating aggregation data and correlation data;
wherein the one or more internal sources comprise one or more of:
a sensor, an agent implemented as a computer program for recording and assessing parameters and events, and a recording means adapted to record data from, instructions, operations, procedures or security events locally on the industrial control system;
wherein the one or more external sources comprise one or more of:
security blogs, security discussion source, databases for providing information on threats and security attacks, security evaluation and severity information comprising at least one of Common Vulnerability Scoring System (CVSS), standards, standardization bodies, security best practices, security agencies, security statistics, and information from security software solution providers; and
a computer database configured to store the aggregation data and the correlation data;
wherein the aggregation, correlation and interpretation module is adapted to generate, for at least two parameters of the collected data, a first graph of one of the at least two parameters during a period and a second graph of data from a critical process during the period, to correlate the first graph and the second graph so as to generate a correlation graph, and to correlate the correlation graph corresponding to each of the at least two parameters so as to generate an interval graph for forecasting security events within the industrial control system based on correlations between data from the one or more internal sources and the one or more external sources over time.

### Claim 8 (depends on 7)

The apparatus according to claim 7, wherein the apparatus further comprises one or more databases that comprise one or more of:
a knowledge, recommendations and experience database, a past events database, and an external events database.

### Claim 9 (depends on 7)

The apparatus according to claim 7, wherein the aggregation, correlation and interpretation module comprises one or more of: a standard and best practices aggregation and interpretation module, an events recording aggregation, correlation and interpretation module, a sensor and agent data aggregation, correlation and interpretation module, an external events aggregation, correlation and interpretation module, and a configurations module.

### Claim 10 (depends on 7)

The apparatus according to claim 7, wherein the apparatus further comprises a security user interface or an alarm and warning module adapted to communicate the security status of the industrial control system to a user.

### Claim 11

A non-transient computer readable medium comprising a computer program for monitoring an industrial control system, wherein the computer program when executed by a processor is configured to:
collect within an external sources module data from one or more external sources that are external to the industrial control system;
collect within an internal sources module data from one or more internal sources on the industrial control system, the data collected from the one or more internal sources and the one or more external sources being collectively referred to as collected data;
aggregate the collected data within an aggregation correlation and interpretation module to generate aggregated data;
correlate the aggregated data within the aggregation, correlation and interpretation module by analyzing and interpreting the aggregated data in view of historical aggregated data that was previously collected and aggregated from a computer database so as to monitor the security of the industrial control system;
store the aggregated data and the correlated data generated by the aggregation, correlation and interpretation module in the computer database;
wherein collecting the data from the one or more internal sources on the industrial control system comprises collecting data from one or more of:
a sensor, an agent configured to record and assess parameters and events, and a recording means adapted to record data from instructions, operations, procedures or security events locally on the industrial control system;
wherein the step of collecting the data from the one or more sources external to the industrial control system comprises collecting data from one or more of:
security blogs, security discussion sources, databases for providing information on threats and security attacks, security evaluation and severity information comprising at least one of Common Vulnerability Scoring System (CVSS), standards, standardization bodies, security best practices, security agencies, and information from security software solution providers; and
wherein the computer program correlates the aggregated data by, for at least two parameters of the collected data, generating a first graph of one of the at least two parameters during a period and a second graph of data from a critical process during the period, correlating the first graph and the second graph so as to generate a correlation graph, and correlating the correlation graph corresponding to each of the at least two parameters so as to generate an interval graph for forecasting security events within the industrial control system based on correlations between data from the one or more internal sources and the one or more external sources over time.