Using virtual sensors to accommodate industrial asset control systems during cyber attacks

A computerized method to protect an industrial asset associated with a plurality of monitoring nodes, each monitoring node generating a series of monitoring node values over time that represent operation of the industrial asset, comprising:

• determining, by a threat detection computer, that an attacked monitoring node is currently being attacked;
• estimating, by a virtual sensor, a series of virtual node values for the attacked monitoring node based on information received from monitoring nodes that are not currently being attacked;
• and
• replacing the series of monitoring node values from the attacked monitoring node with the virtual node values,
• wherein the threat detection computer is to further determine:
• that a plurality of monitoring nodes is being attacked and the virtual sensor replaces monitoring node values from the plurality of attacked monitoring nodes with virtual node values, and
• that a subset of the attacked monitoring nodes qualifies as dependent attacks and the monitoring node values from the subset of dependent attacked monitoring nodes are not replaced with virtual node values.

A non-transitory, computer-readable medium storing instructions that, when executed by a computer processor, cause the computer processor to perform a method to protect an industrial asset associated with a plurality of monitoring nodes, each monitoring node generating a series of monitoring node values over time that represent operation of the industrial asset, the method comprising:

• determining, by a threat detection computer, that an attacked monitoring node is currently being attacked;
• estimating, by a virtual sensor, a series of virtual node values for the attacked monitoring node based on information received from monitoring nodes that are not currently being attacked;
• and
• replacing the series of monitoring node values from the attacked monitoring node with the virtual node values,
• wherein the threat detection computer is to further determine:
• that a plurality of monitoring nodes is being attacked and the virtual sensor replaces monitoring node values from the plurality of attacked monitoring nodes with virtual node values, and
• that a subset of the attacked monitoring nodes qualifies as dependent attacks and the monitoring node values from the subset of dependent attacked monitoring nodes are not replaced with virtual node values.

A system to protect an industrial asset, comprising:

• a threat detection computer to determine that an attacked monitoring node is currently being attacked;
• and
• a virtual sensor, coupled to the threat detection computer and in communication with a plurality of monitoring nodes, each monitoring node generating a series of monitoring node values over time that represent operation of the industrial asset, wherein the virtual sensor is to, responsive to an indication that the attacked monitoring node is being attacked:
• (i) estimate a series of virtual node values for the attacked monitoring node based on information received from monitoring nodes that are not currently being attacked, and
• (ii) replace the series of monitoring node values from the attacked monitoring node with the virtual node values,
• wherein the threat detection computer is to further determine:
• that a plurality of monitoring nodes is being attacked and the virtual sensor replaces monitoring node values from the plurality of attacked monitoring nodes with virtual node values, and
• that a subset of the attacked monitoring nodes qualifies as dependent attacks and the monitoring node values from the subset of dependent attacked monitoring nodes are not replaced with virtual node values.