US 10,579,033 B2Granted

Reconstructing user-level information from intercepted communication-protocol primitives

AssigneeIndegy Ltd.

InventorDan Shmidt

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method includes holding multiple primitives of a communication protocol, which is used for managing a controller that controls one or more field devices in an industrial control network. Multiple scenarios are defined, each corresponding to one or more respective sequences of primitives exchanged with the controller over the industrial control network for achieving a respective user-level operation. Multiple parsing rules for deriving the sequences of primitives from the respective scenarios are further defined. A sequence of primitives that were exchanged with the controller over the industrial control network is intercepted. An attempt to reconstruct from the intercepted sequence of primitives, using the parsing rules, one or more scenarios that each corresponds to the intercepted sequence of primitives is carried out, and, in response to succeeding in reconstructing one or more scenarios, extracting user-level information from the reconstructed scenarios.

Claims13

Dependent claims

A method, comprising:

defining multiple parsing rules, describing for each scenario of multiple scenarios, a hierarchy of sub-operations forming the scenario from primitive request-response transactions, each parsing rule comprising a left-hand-side part and one or more right-hand-side parts, and a corresponding score value,
intercepting a sequence of the primitive request-response transactions that were exchanged over an industrial control network between a remote node and a controller in response to an actual user-level operation that was performed in the controller by the remote node;
reconstructing from the intercepted sequence of primitive request-response transactions, using the multiple parsing rules, one or more scenarios;
calculating for each of the reconstructed one or more scenarios, a match probability as a function of the corresponding score values of the multiple parsing rules used in the reconstruction of the reconstructed one or more scenarios;
and
outputting at least one of the reconstructed one or more scenarios as a reconstruction of the actual user-level operation that generated the intercepted sequence.

3 more elements

An apparatus, comprising:

an interface, which is configured to communicate over an industrial control network;
and
a processor, which is configured to:
define multiple parsing rules, describing for each scenario of multiple scenarios, a hierarchy of sub-operations forming the scenario from primitive request-response transactions, each parsing rule comprising a left-hand-side part and one or more right-hand-side parts, and a corresponding score value;
intercept a sequence of the primitive request-response transactions that were exchanged over the industrial control network between a remote node and the controller in response to an actual user-level operation that was performed in the controller by the remote node;
reconstruct from the intercepted sequence of primitive request-response transactions, using the multiple parsing rules, one or more scenarios;
calculate for each of the reconstructed one or more scenarios, a match probability as a function of the corresponding score values of the multiple parsing rules used in the reconstruction of the reconstructed one or more scenarios;
and
output at least one of the reconstructed one or more scenarios as a reconstruction of the actual user-level operation that generated the intercepted sequence.

6 more elements

Dependencies are inferred from the claim text.