Analysis of event based behavior of end-points in an industrial system
AssigneeABB Schweiz AG
InventorsJörgen Gade, Johan Åkerberg, Ewa Hansen
Life of this patent
Estimating the term…
Abstract
A mechanisms for analyzing event based behavior of end-points of a network in an industrial system and a method performed by a control node, the method includes collecting, from the end-points, timestamped event log entries as created by the end-points within a time window. Each respective timestamped event log entry pertains to a respective event performed by one of the end-points. The method includes identifying tuples of correlated events by comparing the timestamped event log entries to each other, thereby providing a mapping between the events and those end-points where the events of each tuple of correlated events are performed.
Claims14
A method for analyzing event based behavior of end-points of a Time-Sensitive Network, TSN, in an industrial system, wherein the end-points are configured for operation in the TSN, and wherein the end-points are time synchronized with respect to each other, the method being performed by a control node, the method comprising:
- collecting, from the end-points, timestamped event log entries as created by the end-points within a time window, wherein each respective timestamped event log entry pertains to a respective event performed by one of the end-points;
- and
- identifying tuples of correlated events by comparing the timestamped event log entries to each other, thereby providing a mapping between the events and those end-points where the events of each tuple of correlated events are performed, wherein the identifying further comprises comparing observed network behavior, as defined by the timestamped event log entries, to a configured network behavior;
- wherein each of the events pertains to any of:
- creating a packet, modifying a packet, performing an action based on content of a packet, transmitting a packet, receiving a packet.
A control node for analyzing event based behavior of end-points of a Time-Sensitive Network, TSN, in an industrial system, wherein the end-points are configured for operation in the TSN, and wherein the end-points are time synchronized with respect to each other, the control node comprising processing circuitry, the processing circuitry being configured to cause the control node to:
- collect, from the end-points, timestamped event log entries as created by the end-points within a time window, wherein each respective timestamped event log entry pertains to a respective event performed by one of the end-points;
- and
- identify tuples of correlated events by comparing the timestamped event log entries to each other, thereby providing a mapping between the events and those end-points where the events of each tuple of correlated events are performed, wherein the identify further comprises comparing observed network behavior, as defined by the timestamped event log entries, to a configured network behavior;
- wherein each of the events pertains to any of:
- creating a packet, modifying a packet, performing an action based on content of a packet, transmitting a packet, receiving a packet.
An industrial system for analyzing event based behavior of end-points of a Time-Sensitive Network, TSN, in the industrial system, wherein the end-points are configured for operation in the TSN, and wherein the end-points are time synchronized with respect to each other, the industrial system comprising:
- a control node having processing circuitry, the processing circuitry being configured to cause the control node to:
- collect timestamped event log entries as created by the end-points within a time window, wherein each respective timestamped event log entry pertains to a respective event performed by one of the end-points;
- and
- identify tuples of correlated events by comparing the timestamped event log entries to each other, thereby providing a mapping between the events and those end-points where the events of each tuple of correlated events are performed, wherein the identify further comprises comparing observed network behavior, as defined by the timestamped event log entries, to a configured network behavior;
- wherein each of the events pertains to any of:
- creating a packet, modifying a packet, performing an action based on content of a packet, transmitting a packet, receiving a packet;
- and
- at least one of the end-points, configured to:
- create at least one of the timestamped event log entries;
- and
- provide said at least one of the timestamped event log entries to the control node.
A computer program for analyzing event based behavior of end-points of a Time-Sensitive Network, TSN, in an industrial system, wherein the end-points are configured for operation in the TSN, and wherein the end-points are time synchronized with respect to each other, the computer program comprising computer code which, when run on processing circuitry of a control node, causes the control node to:
- collect, from the end-points, timestamped event log entries as created by the end-points within a time window, wherein each respective timestamped event log entry pertains to a respective event performed by one of the end-points;
- and
- identify tuples of correlated events by comparing the timestamped event log entries to each other, thereby providing a mapping between the events and those end-points where the events of each tuple of correlated events are performed, wherein the identify further comprises comparing observed network behavior, as defined by the timestamped event log entries, to a configured network behavior;
- wherein each of the events pertains to any of:
- creating a packet, modifying a packet, performing an action based on content of a packet, transmitting a packet, receiving a packet.
A computer program product comprising a computer program for analyzing event based behavior of end-points of a Time-Sensitive Network, TSN, in an industrial system, wherein the end-points are configured for operation in the TSN, and wherein the end-points are time synchronized with respect to each other, the computer program comprising computer code which, when run on processing circuitry of a control node, causes the control node to:
- collect, from the end-points, timestamped event log entries as created by the end-points within a time window, wherein each respective timestamped event log entry pertains to a respective event performed by one of the end-points;
- identify tuples of correlated events by comparing the timestamped event log entries to each other, thereby providing a mapping between the events and those end-points where the events of each tuple of correlated events are performed, wherein the identify further comprises comparing observed network behavior, as defined by the timestamped event log entries, to a configured network behavior;
- wherein each of the events pertains to any of:
- creating a packet, modifying a packet, performing an action based on content of a packet, transmitting a packet, receiving a packet;
- and
- a computer readable storage medium on which the computer program is stored.
Dependencies are inferred from the claim text.