Integrated behavior-based infrastructure command validation

One or more non-transitory computer-readable storage media storing computer-executable instructions for causing a computing system, when programmed thereby, to perform operations for infrastructure system protection, the operations comprising:

• receiving a first command for a target infrastructure asset of a plurality of infrastructure assets, wherein the plurality of infrastructure assets are integrated into an infrastructure system;
• validating the first command, wherein the first command is validated according to a command validation model, the command validation model having been generated based on the plurality of infrastructure assets;
• responsive to a successful validation, providing the first command to the target infrastructure asset;
• adapting the command validation model to account for change in usage of the plurality of infrastructure assets over time and for variance of components of the plurality of infrastructure assets, including updating the command validation model based on results data of the command validation, the results data including the first command and a validity determination for the first command, wherein the updated command validation model is a process for analyzing and determining validity of one or more subsequent commands for the plurality of infrastructure assets;
• receiving a second command, among the one or more subsequent commands, for another infrastructure asset of the plurality of infrastructure assets;
• and
• responsive to an unsuccessful validation of the second command, rejecting the second command and preventing the second command from being executed by the other infrastructure asset, wherein the second command is malformed or the second command is determined to result in incorrect behavior of the other infrastructure asset.

A system for infrastructure asset security, the system comprising:

• one or more memories;
• one or more processing units coupled to the one or more memories;
• and
• one or more computer-readable storage media storing instructions that, when loaded into the one or more memories, cause the one or more processing units to perform asset command validation operations comprising:
• collecting state data of an infrastructure asset;
• collecting validation results data of the infrastructure asset, wherein the validation results data comprises command validation results of one or more previously processed commands for the infrastructure asset;
• configuring a command validation model, wherein the command validation model is based, at least in part, on the collected state data and the collected validation results data;
• intercepting a first new command for the infrastructure asset, wherein intercepting the first new command prevents or delays the first new command from being received by the infrastructure asset;
• analyzing the first new command according to the command validation model, wherein the analyzing comprises determining if the first new command is improperly formed or if the first new command meets a threshold for causing the infrastructure asset to enter a detrimental state when executed by the infrastructure asset;
• responsive to the analyzing, providing the first new command to the infrastructure asset or updating a log of the analyzing without providing the first new command to the infrastructure asset;
• adapting the command validation model to account for change in usage of the infrastructure asset over time and for variance of components of the infrastructure asset, including updating the command validation model based on new results data from the analyzing the new command according to the command validation model, the new results data including the new command and a validity determination for the new command, wherein the updated command validation model is a process for analyzing and determining validity of one or more subsequent commands for the infrastructure asset;
• receiving a second new command, among the one or more subsequent commands, for the infrastructure asset;
• and
• responsive to an unsuccessful validation of the second new command, rejecting the second new command and preventing the second new command from being executed by the infrastructure asset, wherein the second new command is malformed or the second new command is determined to result in incorrect behavior of the infrastructure asset.