# US 12,111,922 B2 · Method, systems and apparatus for intelligently emulating factory control systems and simulating response data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,111,922 B2 - Document ID: US12111922B2 - Status: Granted - Kind: B2 - Application number: 18/324,370 - Filed: 2023-05-26 - Published: 2023-09-21 - Granted: 2024-10-08 - Earliest claimed: 2020-02-28 - Assignees: Nanotronics Imaging, Inc. - Applicants: Nanotronics Imaging, Inc. - Inventors: Matthew C. Putman; John B. Putman; Vadim Pinskiy; Andrew Sundstrom; James Williams, III - Web page: https://patentgrep.com/patent/US12111922B2 ## CPC - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 9/455: Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines - G06F 9/45508: {Runtime interpretation or emulation, e g. emulator loops, bytecode interpretation} - G06F 30/20: Design optimisation, verification or simulation (optimisation, verification or simulation of circuit designs G06F30/30) - G06N 3/04: Architecture, e.g. interconnection topology - G06N 3/0442: characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/0475: Generative networks - G06N 3/063: using electronic means - G06N 3/08: Learning methods - G06N 3/09: Supervised learning - G06N 3/092: Reinforcement learning - G06N 3/094: Adversarial learning - G06N 20/00: Machine learning - G06F 30/27: using machine learning, e.g. artificial intelligence, neural networks, support vector machines [SVM] or training a model - G06F 2221/034: Test or assess a computer or a system - G06F 2221/2127: Bluffing - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A controller emulator, coupled to an interface that exposes the controller emulator to inputs from external sources, provides one or more control signals to a process simulator and a deep learning process. In response, the process simulator simulates response data that is provided to the deep learning processor. The deep learning processor generates expected response data and expected behavioral pattern data for the one or more control signals, as well as actual behavioral pattern data for the simulated response data. A comparison of at least one of the simulated response data to the expected response data and the actual behavioral pattern data to the expected behavioral pattern data is performed to determine whether anomalous activity is detected. As a result of detecting anomalous activity, one or more operations are performed to address the anomalous activity. ## Claims ### Claim 1 A method, comprising: receiving, by a honeypot system comprising a deep learning processor, an input from an interface coupled to the honeypot system, the input comprising a malware attack; initiating, by the honeypot system, a simulated process performed by a simulator of the honeypot system, wherein the simulated process simulates a manufacturing process performed by a manufacturing system; generating, by an emulator of the honeypot system, one or more emulated control signals, the emulator configured to emulate a process controller deployed in the manufacturing system; generating, by the simulator of the honeypot system, simulated response data based on the one or more emulated control signals; generating, by the deep learning processor of the honeypot system, expected response data based on the one or more emulated control signals; generating, by the deep learning processor of the honeypot system, actual response data based on the simulated response data; comparing, by the deep learning processor of the honeypot system, the expected response data to the actual response data to the actual response data; and learning, by the deep learning processor of the honeypot system, to identify anomalous activity based on the comparing. ### Claim 2 (depends on 1) The method of claim 1, further comprising: generating, by the deep learning processor of the honeypot system, expected behavioral pattern data based on the one or more emulated control signals; generating, by the deep learning processor of the honeypot system, actual behavioral pattern data based on the simulated response data; comparing, by the deep learning processor of the honeypot system, the expected behavioral pattern data to the expected behavioral pattern data; and learning, by the deep learning processor of the honeypot system, to identify the anomalous activity based on the comparing. ### Claim 3 (depends on 1) The method of claim 1, wherein learning, by the deep learning processor of the honeypot system, to identify the malware attack based on the comparing comprises: identifying deviations between the expected response data and the actual response data. ### Claim 4 (depends on 1) The method of claim 1, further comprising: generating, by the deep learning processor of the honeypot system, a confidence level that the anomalous activity exists. ### Claim 5 (depends on 4) The method of claim 4, further comprising: initiating, by the deep learning processor of the honeypot system, a remedial action based on the confidence level being within a threshold range. ### Claim 6 (depends on 5) The method of claim 5, further comprising: determining, by the deep learning processor of the honeypot system, that the confidence level is above the threshold range; and based on the determining, initiating, by the deep learning processor of the honeypot system, an alert protocol. ### Claim 7 (depends on 5) The method of claim 5, further comprising: determining, by the deep learning processor of the honeypot system, that the confidence level is below the threshold range; and based on the determining, flagging, by the deep learning processor of the honeypot system, the anomalous activity. ### Claim 8 A non-transitory computer readable medium comprising one or more sequences of instructions, which, when executed by a processor, causes a computing system to perform operations comprising: receiving, by a deep learning processor, an input from an interface coupled to the computing system, the input comprising a malware attack; initiating, by the computing system, a simulated process performed by a simulator of the computing system, wherein the simulated process simulates a manufacturing process performed by a manufacturing system; generating, by an emulator of the computing system, one or more emulated control signals, the emulator configured to emulate a process controller deployed in the manufacturing system; generating, by the simulator of the computing system, simulated response data based on the one or more emulated control signals; generating, by the deep learning processor, expected response data based on the one or more emulated control signals; generating, by the deep learning processor, actual response data based on the simulated response data; comparing, by the deep learning processor, the expected response data to the actual response data to the actual response data; and learning, by the deep learning processor, to identify anomalous activity based on the comparing. ### Claim 9 (depends on 8) The non-transitory computer readable medium of claim 8, further comprising: generating, by the deep learning processor, expected behavioral pattern data based on the one or more emulated control signals; generating, by the deep learning processor, actual behavioral pattern data based on the simulated response data; comparing, by the deep learning processor, the expected behavioral pattern data to the expected behavioral pattern data; and learning, by the deep learning processor, to identify the anomalous activity based on the comparing. ### Claim 10 (depends on 8) The non-transitory computer readable medium of claim 8, wherein learning, by the deep learning processor, to identify the malware attack based on the comparing comprises: identifying deviations between the expected response data and the actual response data. ### Claim 11 (depends on 8) The non-transitory computer readable medium of claim 8, further comprising: generating, by the deep learning processor, a confidence level that the anomalous activity exists. ### Claim 12 (depends on 11) The non-transitory computer readable medium of claim 11, further comprising: initiating, by the deep learning processor, a remedial action based on the confidence level being within a threshold range. ### Claim 13 (depends on 12) The non-transitory computer readable medium of claim 12, further comprising: determining, by the deep learning processor, that the confidence level is above the threshold range; and based on the determining, initiating, by the deep learning processor, an alert protocol.