Method and apparatus for detecting the anomalies of an infrastructure

An apparatus (100) for detecting anomalies in an infrastructure (1) provided with:

• one or more actuators (10, 20) and/or sensors operatively connected to one or more logic controllers (12, 22, 32), wherein said logic controllers (12, 22, 32) control, in use, values of the variable attributes relating to the physical state of said actuators and/or sensors;
• at least one supervision unit (52) of said logic controllers (12, 22, 32);
• a telecommunication system between said logic controllers and/or said supervision unit (52) and said logic controllers (12, 22, 32), said telecommunication system being able to exchange data packets (PD) comprising said values of the variable attributes of the physical state by means of network communication protocols;
• said apparatus (100) for detecting anomalies comprising:
• a network analyser (101) to be connected to said telecommunication system, wherein said network analyser (101) analysing each of said data packets (PD) exchanged in said telecommunication system and identifying the network protocol used for each of said data packets (PD) and all the fields of said protocol;
• computerized data processing means (102) operatively connected to said network analyser (101), said computerized data processing means (102) generating a virtual representation of said infrastructure (1) on the basis of said protocols and fields of said protocols identified by said network analyser (101) to each exchanged data packet (PD);
• first volatile storage means (103) operatively connected to said computerized means (102), said first storage means (103) storing said virtual representation generated for each exchanged data packet (PD);
• second permanent storage means (104) operatively connected to said computerized means (102), said second storage means (104) comprising in their memory one or more comparison elements;
• wherein said computerized data processing means, in use, comparing said virtual representation with at least one of said comparison elements, and
• wherein the computerized data processing means identifying and signaling at least one critical state of said infrastructure from the differences and/or similarities between said stored virtual representation and said comparison elements,
• wherein said computerized data processing means, in use, comparing two or more subsequent virtual representations identifying one or more communication sequences and the communication frequency between said logic controllers and/or between said logic controllers and said sensors or actuators and/or between said logic controllers and said supervision unit,
• wherein said computerized data processing means identifying and signaling at least one critical state of said infrastructure in the differences and/or similarities between said subsequent virtual representations and said comparison elements,
• wherein said comparison elements comprise non-allowable communication sequences and threshold values for the communication frequencies between two or more of said subsequent virtual representations, and
• wherein said computerized data processing means identifying at least one of said critical states when at least one identified communication sequence corresponds to a non-allowable communication sequence and when at least one threshold value of the detected communication frequencies is exceeded.