Systems and methods for securing industrial networks

An unsupervised method for detecting the source of an attack in an industrial network comprising:

• collecting data from one or more endpoints of the industrial network that are suspected of being sources of an attack;
• normalizing the collected data whereby no individual feature of the collected data dominates any other feature of the collected data:
• electronically filter out data that originates from sources that are not directed at a target;
• generating a scaled, RE value based on data from sources that are directing data at the target during the attack;
• comparing the generated, scaled RE value to a previously computed RE threshold associated with the target based on non-attack traffic patterns;
• declaring one or more of the sources to be a source of the attack when the generated RE value exceeds the RE threshold, wherein declaring an attack when a plurality of consecutive adjustable time periods are classified attack time periods and wherein collecting the data from collection means configured and connected close to an end point of the network.

A hardware controller operable to control an unsupervised, continuous, real-time detection of abnormal traffic in an industrial network by:

• collecting data from endpoints of the industrial network;
• grouping the collected data into sets of data, each set representing data that is grouped into a set during an adjustable time period before the time period expires;
• aggregating and mapping the data that is within each set to a single multi-dimensional point value;
• normalizing each of the multi-dimensional point values so no individual feature of the collected data dominates any other feature of the collected data;
• extracting data features from each multi-dimensional point value by executing a machine learning process that computes a lower dimensional representation of the collected data;
• identifying each set of extracted data in real-time as normal or abnormal once the data has been grouped into groups of data by determining whether a scaled, real-time reconstruction error (RE) value is below or above a RE threshold value, the RE threshold value based on a previously computed error between what is output by the machine learning process for a given input based on data previously collected during normal operation of the industrial network;
• determining the number of sets of data within an adjustable, attack detection time period (hereafter “window”) that have been so-identified as abnormal among all time periods within the window;
• computing a percentage based on the number of identified abnormal sets of data within the window divided by the total number of normal and abnormal sets of data within the window, and declaring the data, within the abnormal sets within the window, attack data when the computed percentage is greater than a threshold percentage, wherein declare an attack when a plurality of consecutive adjustable time periods are classified attack time periods and wherein collect the data from collection means configured and connected close to an end point of the network.