Identification of deviant engineering modifications to programmable logic controllers

A network security computer for identifying deviant engineering modifications to programmable logic controllers, comprising:

• at least one processor, and a non-transitory storage medium storing an operating system, a network security program, and computer executable instructions, when executed on at least one processor, the network security program causes the processor to identify deviant engineering modifications to programmable logic controllers, wherein the network security program comprises:
• a network traffic collection device for collecting network traffic data from a plurality of engineering stations, each engineering station comprising at least one programmable logic controller, wherein the plurality of engineering stations are connected through an industrial automation control network, and wherein the network traffic data comprise streams of machine data generated by the industrial automation control network and technology infrastructure;
• a network traffic data storage device for storing the network traffic data collected, wherein stored network traffic data comprises:
• a first set of network traffic data collected during engineering or design of the plurality of engineering stations, wherein signatures of the first set of network traffic data are collected and stored as network traffic benchmark data templates, and
• a second set of network traffic data collected during operation of the plurality of engineering stations;
• a network traffic comparison module for comparing the first set of network traffic data with the second set of network traffic data;
• an abnormality detection module for detecting any deviant engineering modifications to a plurality of programmable logic controllers in the plurality of engineering stations based on the comparing of the first set of network traffic data with the second set of network traffic data;
• and
• an alarming and correction module for generating one or more reports for the deviant engineering modifications to the plurality of programmable logic controllers based on a detected deviant engineering modification,
• wherein the network traffic data collected comprises at least:
• content of the network traffic data and timing patterns of the network traffic data, and
• wherein the network traffic comparison module compares the content of the network traffic data collected with the content of network traffic data templates stored in the network traffic data storage device, and the timing patterns of the network traffic data collected with the timing patterns of the network traffic data templates stored in the network traffic data storage device.

A computer program product operable on a network security computer, comprising a non-transitory storage medium readable by at least one processor of the network security computer, wherein the non-transitory storage medium stores an operating system, a network security program and computer executable instructions for execution by the processor of the network security computer for performing a method for identifying deviant engineering modifications to programmable logic controllers, the method comprising:

• collecting, by a network traffic collection device of the network security computer, network traffic data from a plurality of engineering stations, each engineering station comprising at least one programmable logic controller, wherein the plurality of engineering stations are connected through an industrial automation control network, and wherein the network traffic data comprise streams of machine data generated by the industrial automation control network and technology infrastructure;
• storing, by a network traffic data storage device of the network security computer, the network traffic data collected, wherein the storing comprises:
• storing a first set of network traffic data collected during engineering or design of the plurality of engineering stations, wherein signatures of the first set of network traffic data are collected and stored as network traffic benchmark data templates, and
• storing a second set of network traffic data collected during operation of the plurality of engineering stations;
• comparing, by a network traffic comparison module of the network security computer, the first set of network traffic data with the second set of network traffic data;
• detecting, by an abnormality detection module of the network security computer, any deviant engineering modifications to a plurality of programmable logic controllers in the plurality of engineering stations based on the comparing of the first set of network traffic data with the second set of network traffic data;
• and
• generating, by an alarming and correction module of the network security computer, one or more reports for the deviant engineering modifications to the plurality of programmable logic controllers based on a detected deviant engineering modification,
• wherein the network traffic data collected comprises at least:
• content of the network traffic data and timing patterns of the network traffic data, and
• wherein comparing comprises:
• comparing, by the network traffic comparison module of the network security computer, content of the network traffic data collected with the content of network traffic data templates stored in the network traffic data storage device;
• and
• comparing, by the network traffic comparison module of the network security computer, timing patterns of the network traffic data collected with the timing patterns of the network traffic data templates stored in the network traffic data storage device.