Recognizing deviations in security behavior of automation units

An intelligent switch for recognizing deviations in communication behavior of a network, comprising:

• a processor and a memory configured for executing:
• a metadata module arranged and configured to collect communication metadata in the intelligent switch, wherein the communication metadata comprises data about characteristics of each communication over the intelligent switch;
• a model of the communication behavior of the network communicatively coupled to the metadata module, the model being arranged and configured to derive, for each communication over the intelligent switch, two or three security values from the communication metadata of the respective communication, and threshold values derived during the generation of the model of the communication behavior derived from training communication metadata of the network, wherein the model selects values from the communication metadata that contribute to evaluation of the security of the network;
• and a security module communicatively coupled to the model of the communication behavior, the security module being arranged and configured to:
• span a 2D envelope in a 2D domain or a 3D envelope in a 3D domain based on threshold values, the envelope defining a threshold area in the 2D domain or a threshold space in the 3D domain where all the respective threshold values are met by respective security points, such that a security point of each communication over the switch is geometrically checkable relative to the threshold area or the threshold space defined by the envelope;
• check, for each communication over the intelligent switch, whether the respective two or three security values meet respective predetermined threshold values, the check comprising a geometric check of whether the security point, which is defined by the derived two or three security values, lies within or on the envelope;
• and generate a security warning in case at least one of the security points of the communication lies outside the envelope.

A device for recognizing deviations in communication behavior of a network, the device comprising:

• a processor and a memory configured for implementing and executing a method, the device being communicatively connectable to a switch of the network, the device further comprising:
• a model of the communication behavior of the network, the model being arranged and configured to derive, for each communication over the switch, two or three security values from communication metadata of the respective communication fetched from the switch, wherein the communication metadata comprises data about characteristics of each communication over the switch, and to derive threshold values from the generation of the model of the communication behavior derived from training communication metadata of the network, wherein the model selects values from the communication metadata that contribute to evaluation of the security of the network;
• and
• a security module communicatively coupled to the model of the communication behavior, the security module being arranged and configured to:
• span a 2D envelope in the 2D domain or a 3D envelope in the 3D domain based on threshold values, the envelope defining a threshold area in the 2D domain or a threshold space in the 3D domain where all the respective threshold values are met by the respective security points, such that a security point of each communication over the switch is geometrically checkable relative to the threshold area or the threshold space defined by the envelope;
• check, for each communication over the switch, whether the respective two or three security values meet respective predetermined threshold values, the check comprising a geometric check, for each communication over the switch, whether the security point, which is defined by the derived security values, lies within or on the envelope;
• when the respective security point lies outside the envelope, determine a distance of the respective security point to the envelope, the determined distance identifying a severity of a security issue, and generate a security warning in case at least one of the security points of the communication lies outside the envelope.

A system arranged and configured for recognizing deviations in communication behavior of a network, the system comprising:

• a network;
• at least two network cells communicatively connected over the network;
• and
• an intelligent switch for recognizing deviations in communication behavior of the network, the intelligent switch comprising:
• a processor and a memory, configured for executing:
• a metadata module arranged and configured to collect communication metadata in the intelligent switch, wherein the communication metadata comprises data about characteristics of each communication over the intelligent switch;
• a model of the communication behavior of the network communicatively coupled to the metadata module, the model being arranged and configured to derive, for each communication over the intelligent switch, two or three security values from the communication metadata of the respective communication, and threshold values derived during the generation of the model of the communication behavior derived from training communication metadata of the network, wherein the model selects values from the communication metadata that contribute to evaluation of the security of the network;
• and
• a security module communicatively coupled to the model of the communication behavior, the security module being arranged and configured to:
• span a 2D envelope in a 2D domain or a 3D envelope in a 3D domain based on threshold values, the envelope defining a threshold area in the 2D domain or a threshold space in the 3D domain where all respective threshold values are met by the respective security points, such that a security point of each communication over the switch is geometrically checkable relative to the threshold area or the threshold space defined by the envelope;
• check, for each communication over the intelligent switch, whether the respective two or three security values meet respective predetermined threshold values, the check comprising a geometric check of whether the security point, which is defined by the derived two or three security values, lies within or on the envelope;
• and generate a security warning in case at least one of the security points of the communication lies outside the envelope;
• or a regular switch and a device for recognizing the deviations in the communication behavior of the network, the device being communicatively connected or coupled to the regular switch, the device comprising:
• the model of the communication behavior of the network, the model being arranged and configured to derive, for each communication over the regular switch, the two or three security values from the communication metadata of the respective communication fetched from the regular switch, and to derive the threshold values from the generation of the model of the communication behavior derived from the training of the communication metadata of the network;
• and the security module communicatively coupled to the model of the communication behavior of the network, the security module being arranged and configured to span the 2D envelope in the 2D domain or the 3D envelope in the 3D domain based on the threshold values, check, for each communication over the regular switch, whether the respective two or three security values meet the respective predetermined threshold values, the check comprising the check, for each communication over the regular switch, whether the security point, which is defined by the derived security values, lies within or on the envelope, and generate the security warning in case at least one of the security points of the communication lies outside the envelope,
• wherein the intelligent switch or the regular switch is located at a central connection point of the at least two network cells in the network.

A method of recognizing deviations in communication behavior of a network, the method comprising:

• collecting communication metadata in a switch of the network, wherein the communication metadata comprises data about characteristics of each communication over the switch;
• deriving for each communication over the switch two or three security values from the communication metadata of the respective communication and threshold values derived during the generation of a model of the communication behavior derived from training communication metadata of the network, wherein the model selects values from the communication metadata that contribute to evaluation of the security of the network;
• spanning a 2D envelope in a 2D domain or a 3D envelope in the 3D domain based on the threshold values derived during the generation of the model of the communication behavior derived from the training of the communication metadata of the network, the 2D envelope defining a threshold area in the 2D domain or a threshold space in the 3D domain where all the respective threshold values are met by the respective security points, such that a security point of each communication over the switch is geometrically checkable relative to the threshold area or the threshold space defined by the envelope;
• checking, for each communication over the switch, whether the respective at most three security values meet respective predetermined threshold values, the checking comprising geometrically checking, for each communication over the switch, whether the security point, which is defined by the derived two or three security values, lies within or on the envelope;
• and
• generating a security warning in case at least one of the security points of the communication lies outside the envelope.