# US 12,111,924 B2 · System for detecting malicious programmable logic controller code > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,111,924 B2 - Document ID: US12111924B2 - Status: Granted - Kind: B2 - Application number: 17/789,439 - Filed: 2021-01-16 - Published: 2023-02-16 - Granted: 2024-10-08 - Earliest claimed: 2020-01-16 - Assignees: Georgia Tech Research Corporation - Applicants: Georgia Tech Research Corporation - Inventors: Qinchen Gu; Abdul Raheem Beyah - Web page: https://patentgrep.com/patent/US12111924B2 ## CPC - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system (100) and method for detecting a malicious programmable logic controller (PLC) code segment (110) in a PLC program corresponding to a specific type of PLC includes a binary parser (112) that parses the code segment (110) into a plurality of functional elements. A variable and function block mapper (114) maps the functional elements into a high-level data structure. A fuzzer (116) generates a behavioral model of the high-level data structure into an automaton (118). A classifier (120) predicts to which processes the automaton (118) corresponds. A detector (122) detects unsafe states in the automaton (118) and that generates an indication of a detected unsafe state. ## Claims ### Claim 1 A system for detecting a malicious programmable logic controller (PLC) code segment in a PLC program corresponding to a specific type of PLC, the system comprising: (a) a binary parser that parses the code segment into a plurality of functional elements; (b) a variable and function block mapper that maps the functional elements into a high-level data structure; (c) a fuzzer that generates a behavioral model of the high-level data structure into an automaton; (d) a classifier that predicts to which processes the automaton corresponds; and (e) a detector that detects unsafe states in the automaton and that generates an indication of a detected unsafe state, wherein the automaton includes a directed multigraph that includes a plurality of states in which each state is represented as a node and in which each state transition is represented as an edge, in which the classifier indicates a total number of states in the automaton and average degree of the multigraph, wherein the average degree equals a total number of edges in multigraph divided by a total number of nodes in the multigraph. ### Claim 2 (depends on 1) The system of claim 1, wherein the fuzzer comprises an emulator that is programmed to emulate execution of the high-level data structure that is used to program the specific type of PLC by applying test case data to the high-level data structure and by detecting state transitions in the specific type of PLC. ### Claim 3 (depends on 2) The system of claim 2, wherein at least one rule is applied in the emulator to a physical process controlled by the PLC and wherein the detector indicates an unsafe state in the code segment when the emulator indicates that the automaton goes into a predetermined state in which the rule is violated. ### Claim 4 (depends on 2) The system of claim 2, wherein the emulator comprises a digital computer with a tangible non-volatile memory that includes a program that runs a model of the specific type of PLC. ### Claim 5 (depends on 1) The system of claim 1, wherein the fuzzer comprises an example of the specific type of PLC that has been programmed to run the high-level data structure and into which test case data is fed. ### Claim 6 (depends on 1) The system of claim 1, wherein the detector also detects paths leading to the unsafe states. ### Claim 7 (depends on 1) The system of claim 1, wherein the classifier predicts to which processes the automaton corresponds by comparing the average degree of the multigraph to average degrees of other known processes. ### Claim 8 (depends on 1) The system of claim 1, wherein the detector compares the average degree of the multigraph to an average degree of known safe code and wherein the system indicates that the code segment is suspicious when the average degree of the multigraph is less that the average degree of known safe code. ### Claim 9 A method, operable on a digital computer that includes a tangible non-volatile memory, for detecting a malicious programmable logic controller (PLC) code segment in a PLC program corresponding to a specific type of PLC, comprising the steps of (a) parsing the code segment into a plurality of functional elements; (b) mapping the functional elements into a high-level data structure; (c) generating, with a fuzzer, a behavioral model of the high-level data structure into an automaton; (d) classifying the behavioral model so as to predict to which processes the automaton corresponds; (e) detecting unsafe states in the automaton and generating an indication of a detected unsafe state; (f) generating a multigraph so as to include a plurality of nodes and edges by representing each state as a node and by representing each state transition as an edge; (g) determining a total number of states in the automaton; and (h) determining an average degree of the multigraph, wherein the average degree equals a total number of edges in multigraph divided by a total number of nodes in the multigraph. ### Claim 10 (depends on 9) The method of claim 9, wherein the fuzzer comprises an emulator and further comprising the step of emulating with the emulator execution of the high-level data structure that is used to program the specific type of PLC by applying test case data to the high-level data structure and by detecting state transitions in the specific type of PLC. ### Claim 11 (depends on 10) The method of claim 10, further comprising the steps of: (a) applying at least one rule in the emulator to a physical process controlled by the PLC; and (b) indicating an unsafe state in the code segment when the emulator indicates that the automaton goes into a predetermined state in which the rule is violated. ### Claim 12 (depends on 10) The method of claim 10, wherein the emulator comprises a program run on the digital computer and further comprising the step of running a model of the specific type of PLC as part of the emulator. ### Claim 13 (depends on 9) The method of claim 9, wherein the fuzzer comprises an example of the specific type of PLC that has been programmed to run the high-level data structure and further comprising the step of feeding test case data into the example of the specific type of PLC. ### Claim 14 (depends on 9) The method of claim 9, further comprising the step of determining at least one path leading to the unsafe states. ### Claim 15 (depends on 9) The method of claim 9, further comprising the step of predicting to which processes the automaton corresponds by comparing the average degree of the multigraph to average degrees of other known processes. ### Claim 16 (depends on 9) The method of claim 9, further comprising the steps of: (a) comparing the average degree of the multigraph to an average degree of known safe code; and (b) indicating that the code segment is suspicious when the average degree of the multigraph is less that the average degree of known safe code.