Back to results
US 10,986,107 B2Granted
Systems and methods for detecting anomalous software on a programmable logic controller
AssigneeGeorgia Tech Research Corporation
InventorsDavid Formby, Abdul Raheem Beyah
Life of this patent
Estimating the term…
Abstract
There is provided a method including: during a training period, collecting a plurality of scan cycle times of a programmable logic controller (PLC) program executing on a PLC; calculating one or more baseline parameters based on the plurality of scan cycle times; determining a baseline PLC program signature based on the one or more baseline statistical parameters; and storing the baseline PLC program signature.
Claims61
A method comprising:
- during a training period, collecting one or more scan cycle times of a programmable logic controller (PLC) program executing on a PLC;
- calculating one or more baseline parameters based on one or more of the collected scan cycle times;
- determining a baseline PLC program signature comprising:
- a first portion representing commonly executed program paths and determined based on one or more of the calculated baseline parameters;
- and
- a second portion representing undetected program paths and determined based on one or more of the collected scan cycle times of the PLC program;
- and
- storing the baseline PLC program signature.
5 more elements
A method comprising:
- during operation of a programmable logic controller (PLC), collecting a first set of one or more scan cycle times of a PLC program executing on the PLC;
- comparing one or more of the collected scan cycle times to a baseline PLC program signature based on at least a mean value of a second set of scan cycle times, wherein comparing comprises:
- calculating a cumulative difference between one or more of the collected scan cycle times and the mean value;
- and
- comparing the cumulative difference to a cumulative sum threshold value;
- and
- outputting a first indicator that indicates a deviation of the PLC program operation from an expected PLC program operation based on the comparing.
4 more elements
A method comprising:
- during operation of a programmable logic controller (PLC), collecting one or more scan cycle times of a PLC program executing on the PLC;
- comparing one or more of the collected scan cycle times to a baseline PLC program signature;
- outputting a first indicator that indicates a deviation of the PLC program operation from an expected PLC program operation based on the comparing;
- receiving, from the PLC, an indication of progress of a proof of work function executed by the PLC;
- comparing the progress of the proof of work function to an expected progress based on at least one of one or more of the collected scan cycle times and a count of the collected scan cycles;
- and
- outputting a second indicator that indicates a deviation of the PLC program operation from the expected PLC program operation based on comparing the progress of the proof of work function.
4 more elements
A method comprising:
- during operation of a programmable logic controller (PLC), collecting one or more scan cycle times of a PLC program executing on the PLC;
- comparing one or more of the collected scan cycle times to a baseline PLC program signature;
- outputting a first indicator that indicates a deviation of the PLC program operation from an expected PLC program operation based on the comparing;
- during operation of the PLC, collecting one or more scan cycle time verification values;
- comparing one or more of the collected scan cycle time verification values to one or more of the collected scan cycle times;
- and
- outputting a second indicator that indicates a deviation of the PLC program operation from the expected PLC program operation based on comparing one or more of the collected scan cycle time verification values to one or more of the collected scan cycle times.
4 more elements
A system comprising:
- a receiver;
- a transmitter;
- a processor;
- and
- a memory having stored thereon computer program code that, when executed by the processor, instructs the processor to:
- collect, during operation of a programmable logic controller (PLC) and through the receiver, a first set of one or more scan cycle times of a PLC program executing on the PLC;
- compare one or more of the collected scan cycle times to a baseline PLC program signature based on at least a mean value of a second set of scan cycle times, wherein comparing comprises:
- calculating a cumulative difference between one or more of the collected scan cycle times and the mean value;
- and
- comparing the cumulative difference to a cumulative sum threshold value;
- and
- output, via the transmitter, a first indicator that indicates a deviation of the PLC program operation from an expected PLC program operation based on comparing one or more of the collected scan cycle times to the baseline PLC program signature.
9 more elements
A system comprising:
- a receiver;
- a transmitter;
- a processor;
- and
- a memory having stored thereon computer program code that, when executed by the processor, instructs the processor to:
- collect, during operation of a programmable logic controller (PLC) and through the receiver, one or more of the collected scan cycle times of a PLC program executing on the PLC;
- compare one or more of the collected scan cycle times to a baseline PLC program signature;
- output, via the transmitter, a first indicator that indicates a deviation of the PLC program operation from an expected PLC program operation based on comparing one or more of the collected scan cycle times to the baseline PLC program signature;
- receive, from the PLC and through the receiver, an indication of progress of a proof of work function executed by the PLC;
- compare the progress of the proof of work function to an expected progress based on one or more of the collected scan cycle times;
- and
- output, via the transmitter, a second indicator that indicates a deviation of the PLC program operation from the expected PLC program operation based on comparing the progress of the proof of work function.
9 more elements
A system comprising:
- a receiver;
- a transmitter;
- a processor;
- and
- a memory having stored thereon computer program code that, when executed by the processor, instructs the processor to:
- collect, during operation of a programmable logic controller (PLC) and through the receiver, one or more of the collected scan cycle times of a PLC program executing on the PLC;
- compare one or more of the collected scan cycle times to a baseline PLC program signature;
- output, via the transmitter, a first indicator that indicates a deviation of the PLC program operation from an expected PLC program operation based on comparing one or more of the collected scan cycle times to the baseline PLC program signature;
- receive, through the receiver, one or more scan cycle time verification values;
- compare one or more scan cycle time verification values to one or more of the collected scan cycle times;
- and
- output, via the transmitter, a second indicator that indicates a deviation of the PLC program operation from the expected PLC program operation based on comparing one or more scan cycle time verification values to one or more of the collected scan cycle times.
9 more elements
A method comprising:
- identifying one or more instructions of a programmable logic controller (PLC) program or branch of a PLC program;
- obtaining expected execution times for one or more of the instructions;
- predicting an execution time of the PLC program or branch of the PLC program based upon calculation of one or more scan cycle times of the PLC program or branch of the PLC program based on the obtained expected execution times;
- determining a baseline PLC program signature based on one or more of the calculated scan cycle times;
- and
- storing the baseline PLC program signature.
3 more elements
A system comprising:
- a receiver;
- a processor;
- and
- a memory having stored thereon computer program code that, when executed by the processor, instructs the processor to:
- collect, during operation of a programmable logic controller (PLC) and through the receiver, one or more scan cycle times of a PLC program executing on the PLC;
- calculate one or more baseline parameters based on one or more of the scan cycle times;
- and
- determine a baseline PLC program signature comprising:
- a first portion representing commonly executed program paths and determined based on one or more of the baseline parameters;
- and
- a second portion representing undetected program paths and determined based on one or more of the calculated scan cycle times of the PLC program.
8 more elements
A method for detecting an endpoint security threat to a programmable logic controller (PLC) comprising:
- storing a baseline PLC program time signature representative of a first set of one or more scan cycle times of a control program stored in a memory and executed by a central processing unit (CPU) of the PLC, one or more of the scan cycle times of the first set representative of embedded hardware and real-time deterministic operating conditions of the PLC;
- during operation of the PLC, generating an operational program time signature representative of a second set of one or more scan cycle times of a PLC program executing on the PLC;
- and
- comparing the operational program time signature to the stored baseline program time signature, wherein exceeding a predetermined threshold variance between the operational program time signature and the stored baseline program time signature identifies an endpoint security threat to the PLC indicative of reprogramming of the PLC.
1 more element
Dependencies are inferred from the claim text.