Back to results
US 11,902,318 B2Granted
Network visualization, intrusion detection, and network healing
AssigneeAlliance for Sustainable Energy, LLC
InventorsJoshua Eli Rivera, Vivek Kumar Singh, Evan Vladislav Michael Vaughan, Adarsh Hasandka, Joshua Van Natta, Bruno Mauricio Salvatico
Life of this patent
Estimating the term…
Abstract
The present disclosure is related to a cyber-security system that includes a Supervisory Control and Data Acquisition (SCADA) network monitor configured to receive a data set from a power system network, an event manager, and a mitigation system, where the SCADA network monitor includes an anomaly detector.
Claims9
A cyber-security system comprising:
- a supervisory control and data acquisition (SCADA) network monitor configured to receive a first data set from a power system network;
- a synchrophasor network monitor configured to receive time-stamped phasor data from the power system network;
- an event manager;
- and
- a mitigation system, wherein:
- the SCADA network monitor comprises a first anomaly detector configured to:
- compare the first data set to a modeled data set to identify in the first data set a first anomaly occurring in the power system network;
- in response to identifying the first anomaly, generate a first alert signal corresponding to the first anomaly;
- and
- send the first alert signal to the event manager;
- the synchrophasor network monitor comprises a second anomaly detector configured to:
- compare the time-stamped phasor data to a learning data set to identify in the time-stamped phasor data a second anomaly occurring in the power system network;
- and
- in response to identifying the second anomaly, pass a second alert signal corresponding to the second anomaly to the event manager;
- the event manager is configured to:
- receive the first alert signal from the first anomaly detector;
- receive the second alert signal from the second anomaly detector;
- evaluate the first alert signal and the second alert signal;
- determine if the first alert signal corresponds to at least one of a first intrusion or a first undesirable event;
- determine if the second alert signal corresponds to at least one of a second intrusion and a second undesirable event;
- in response to determining the first alert signal corresponds to the at least one of the first intrusion or the first undesirable event, pass the first alert signal to the mitigation system;
- and
- in response to determining the second alert signal corresponds to at least one of the second intrusion or the second undesirable event, pass the second alert signal to the mitigation system;
- and
- the mitigation system is configured to:
- receive the first alert signal from the event manager;
- receive the second alert signal from the event manager;
- in response to receiving the first alert signal, perform a first corrective action affecting the power system network;
- and
- in response to receiving the second alert signal, perform a second corrective action affecting the power system network.
27 more elements
A cyber-security method comprising:
- receiving from a power system network:
- a first data set via a supervisory control and data acquisition (SCADA) network monitor;
- and
- time-stamped phasor data via a synchrophasor network monitor;
- in a first anomaly detector:
- comparing the first data set to a modeled data set to identify in the first data set a first anomaly occurring in the power system network;
- and
- in response to identifying the first anomaly, generating a first alert signal corresponding to the first anomaly;
- in a second anomaly detector:
- receiving the first data set;
- generating, from at least one of the first data set or the time-stamped phasor data, a learning data set;
- comparing the time-stamped phasor data to the learning data set to identify in the time-stamped phasor data a second anomaly occurring in the power system network;
- and
- in response to identifying the second anomaly, generating a second alert signal corresponding to the second anomaly;
- sending the first alert signal and the second alert signal to an event manager;
- evaluating, in the event manager, the first alert signal and the second alert signal;
- determining, in the event manager, if the first alert signal corresponds to at least one of a first intrusion or a first undesirable event and if the second alert signal corresponds to at least one of a second intrusion or a second undesirable event;
- in response to determining that at least one of the first alert signal corresponds to the at least one of the first intrusion or the first undesirable event or the second alert signal corresponds to the at least one of the second intrusion or the second undesirable event, passing, via the event manager, at least one of the first alert signal or the second alert signal to a mitigation system;
- receiving, in the mitigation system, at least one of the first alert signal or the second alert signal;
- and
- in the mitigation system, in response to receiving at least one of the first alert signal or the second alert signal, performing at least one of a first corrective action or a second corrective action affecting the power system network.
18 more elements
Dependencies are inferred from the claim text.