# US 12,111,923 B2 · Dynamic monitoring and securing of factory processes, equipment and automated systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,111,923 B2 - Document ID: US12111923B2 - Status: Granted - Kind: B2 - Application number: 18/343,421 - Filed: 2023-06-28 - Published: 2023-11-09 - Granted: 2024-10-08 - Earliest claimed: 2019-10-08 - Assignees: Nanotronics Imaging, Inc. - Applicants: Nanotronics Imaging, Inc. - Inventors: Matthew C. Putman; John B. Putman; Vadim Pinskiy; Damas Limoge; Andrew Sundstrom; James Williams, III - Web page: https://patentgrep.com/patent/US12111923B2 ## CPC - G06F 21/552: {involving long-term monitoring or reporting} - G05B 19/4155: characterised by program execution, i.e. part program or machine function execution, e.g. selection of a program - G05B 23/0275: {Fault isolation and identification, e.g. classify fault; estimate cause or root of failure} - G06F 21/554: {involving event detection and direct action} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06N 3/0442: characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU] - G06N 3/0464: Convolutional networks [CNN, ConvNet] - G06N 3/0475: Generative networks - G06N 3/063: using electronic means - G06N 3/08: Learning methods - G06N 3/09: Supervised learning - G06N 3/092: Reinforcement learning - G06N 3/094: Adversarial learning - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G05B 2219/31368: MAP manufacturing automation protocol - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 2221/034: Test or assess a computer or a system - G06N 3/044: Recurrent networks, e.g. Hopfield networks - G06N 3/045: Combinations of networks - G06N 3/047: Probabilistic or stochastic networks - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - G06N 20/10: using kernel methods, e.g. support vector machines [SVM] - H04L 63/1433: {Vulnerability analysis} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system including a deep learning processor receives one or more control signals from one or more of a factory's process, equipment and control (P/E/C) systems during a manufacturing process. The processor generates expected response data and expected behavioral pattern data for the control signals. The processor receives production response data from the one or more of the factory's P/E/C systems and generates production behavioral pattern data for the production response data. The process compares at least one of: the production response data to the expected response data, and the production behavioral pattern data to the expected behavioral pattern data to detect anomalous activity. As a result of detecting anomalous activity, the processor performs one or more operations to provide notice or cause one or more of the factory's P/E/C systems to address the anomalous activity. ## Claims ### Claim 1 A manufacturing system, comprising: a process station configured to perform a step of a manufacturing process; a station controller programmed to control an operation of the process station; a deep learning controller in communication with the process station and the station controller, wherein the deep learning controller is trained to identify anomalous activity in the manufacturing process; a first signal splitter positioned between the station controller and the process station, the first signal splitter having an input, a first output, and a second output, the first signal splitter configured to receive a control signal transmitted from the station controller to the process station, duplicate the control signal, and provide a first portion of the duplicated control signal to the deep learning controller via the first output and a second portion of the duplicated control signal to the process station via the second output; and a second signal splitter positioned downstream of the process station, the second signal splitter having a second input, a third output, and a fourth output, the second signal splitter configured to receive control values output by the process station, duplicate the control values, and provide a first portion of the duplicated control values to the deep learning controller via the third output and a second portion of the duplicated control values is provided to the station controller via the fourth output. ### Claim 2 (depends on 1) The manufacturing system of claim 1, wherein the deep learning controller is further configured to generate expected response data and expected behavioral pattern data based on the first portion of the duplicated control signal and the first portion of the duplicated control values. ### Claim 3 (depends on 2) The manufacturing system of claim 2, wherein the deep learning controller is further configured to compare the expected response data to actual response data generated during the step of the manufacturing process. ### Claim 4 (depends on 2) The manufacturing system of claim 2, wherein the deep learning controller is further configured to compare the expected behavioral pattern data to actual behavioral pattern data during the step of the manufacturing process. ### Claim 5 (depends on 1) The manufacturing system of claim 1, wherein the deep learning controller is further configured to identify that the anomalous activity is a malware attack. ### Claim 6 (depends on 5) The manufacturing system of claim 5, wherein the deep learning controller is further configured to execute an alert protocol when the anomalous activity is a malware attack. ### Claim 7 (depends on 6) The manufacturing system of claim 6, wherein the alert protocol is digitally shutting down the manufacturing process. ### Claim 8 (depends on 6) The manufacturing system of claim 6, wherein the alert protocol is an electronic notification. ### Claim 9 (depends on 6) The manufacturing system of claim 6, wherein the alert protocol is digitally adjusting setpoints associated with downstream process stations. ### Claim 10 A system for identifying anomalous activity in a manufacturing process comprising: a processor; and a memory having programming instructions stored thereon, which, when executed by the processor, causes the system to perform operations comprising: receiving a first portion of a control signal from a station controller, wherein the control signal is duplicated, by a first signal splitter having a single input, a first output, and a second output, the first signal splitter receiving the control signal from the station controller, and duplicating the control signal to generate the first portion of the control signal and a second portion of the control signal, the second portion sent to a process station associated with the station controller via the first signal splitter; receiving a first portion of control values from the process station, wherein the control values are duplicated, by a second signal splitter having a second signal input, a third output, and a fourth output, the second signal splitter receiving the control values from the process station, and duplicating the control values to generate the first portion of the control values and a second portion of the control values, the second portion provided to the station controller; generating expected response data or expected behavioral pattern data based on the first portion of the control signal and the first portion of the control values; and identifying whether there is anomalous activity in the manufacturing process based on the expected response data or the expected behavioral pattern data. ### Claim 11 (depends on 10) The system of claim 10, identifying whether there is anomalous activity in the manufacturing process comprises: comparing the expected response data to actual response data generated during the manufacturing process. ### Claim 12 (depends on 10) The system of claim 10, identifying whether there is anomalous activity in the manufacturing process comprises: comparing the expected behavioral pattern data to actual behavioral pattern data during the manufacturing process. ### Claim 13 (depends on 10) The system of claim 10, wherein the operations further comprise: determining that the anomalous activity is a malware attack. ### Claim 14 (depends on 13) The system of claim 13, wherein the operations further comprise: responsive to determining that the anomalous activity is a malware attack, initiating a remedial action, the remedial action comprising one or more of: digitally shutting down the manufacturing process, generating an electronic notification to be pushed to an administrator, or digitally adjusting setpoints associated with downstream processes. ### Claim 15 A computer-implemented method of detecting anomalous activity in a manufacturing process comprising: receiving a first portion of a control signal from a station controller, wherein the control signal is duplicated, by a first signal splitter having a single input, a first output, and a second output, the first signal splitter receiving the control signal from the station controller, and duplicating the control signal to generate the first portion of the control signal and a second portion of the control signal, the second portion sent to a process station associated with the station controller via the first signal splitter; receiving a first portion of control values from the process station, wherein the control values are duplicated, by a second signal splitter having a second signal input, a third output, and a fourth output, the second signal splitter receiving the control values from the process station, and duplicating the control values to generate the first portion of the control values and a second portion of the control values, the second portion provided to the station controller; generating expected response data or expected behavioral pattern data based on the first portion of the control signal and the first portion of the control values; and identifying whether there is anomalous activity in the manufacturing process based on the expected response data or the expected behavioral pattern data. ### Claim 16 (depends on 15) The computer-implemented method of claim 15, identifying whether there is anomalous activity in the manufacturing process comprises: comparing the expected response data to actual response data generated during the manufacturing process. ### Claim 17 (depends on 15) The computer-implemented method of claim 15, identifying whether there is anomalous activity in the manufacturing process comprises: comparing the expected behavioral pattern data to actual behavioral pattern data during the manufacturing process. ### Claim 18 (depends on 15) The computer-implemented method of claim 15, further comprising: determining that the anomalous activity is a malware attack. ### Claim 19 (depends on 18) The computer-implemented method of claim 18, further comprising: responsive to determining that the anomalous activity is a malware attack, initiating a remedial action, the remedial action comprising one or more of: digitally shutting down the manufacturing process, generating an electronic notification to be pushed to an administrator, or digitally adjusting setpoints associated with downstream processes. ### Claim 20 (depends on 18) The computer-implemented method of claim 18, wherein determining that the anomalous activity is a malware attack comprises: generating a confidence level associated with a prediction that there is anomalous activity in the manufacturing process; and determining that the confidence level falls within a range of values associated with a malware attack.