# US 12,118,081 B2 · Securing industrial production from sophisticated attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,118,081 B2 - Document ID: US12118081B2 - Status: Granted - Kind: B2 - Application number: 16/953,550 - Filed: 2020-11-20 - Published: 2021-08-19 - Granted: 2024-10-15 - Earliest claimed: 2019-11-20 - Assignees: Nanotronics Imaging, Inc. - Applicants: Nanotronics Imaging, Inc. - Inventors: Matthew C. Putman; Vadim Pinskiy; Damas Limoge; Andrew Sundstrom - Web page: https://patentgrep.com/patent/US12118081B2 ## CPC - G06F 21/554: {involving event detection and direct action} - G06N 20/00: Machine learning - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A manufacturing system is disclosed herein. The manufacturing system includes one or more stations, a monitoring platform, and a control module. Each station of the one or more stations is configured to perform at least one step in a multi-step manufacturing process for a component. The monitoring platform is configured to monitor progression of the component throughout the multi-step manufacturing process. The control module is configured to detect a cyberattack to the manufacturing system. The control module is configured to perform operations. The operations include receiving control values for a first station of the one or more stations. The operations further include determining that there is a cyberattack based on the control values for the first station using one or more machine learning algorithms. The operations further include generating an alert to cease processing of the component. In some embodiments, the operations further include correcting errors caused by the cyberattack. ## Claims ### Claim 1 A manufacturing system, comprising: one or more stations, each station configured to perform at least one step in a multi-step manufacturing process for a component; a monitoring platform configured to monitor progression of the component throughout the multi-step manufacturing process; and a control module configured to detect a cyberattack to the manufacturing system, the control module configured to perform operations, comprising: receiving control values for a first station of the one or more stations, the control values comprising attributes of the first station; determining that there is a cyberattack based on the control values for the first station using one or more machine learning algorithms; and based on the determining, generating one or more actions to correct damage caused by the cyberattack, the generating comprising: generating a plurality of possible actions to correct the damage caused by the cyberattack, and identifying the one or more actions from the plurality of possible actions that yields a greatest correction in the damage caused by the cyberattack. ### Claim 2 (depends on 1) The manufacturing system of claim 1, wherein the one or more machine learning algorithms comprise a Kalman Filter. ### Claim 3 (depends on 2) The manufacturing system of claim 2, wherein determining that there is a cyberattack based on the control values for the first station using the one or more machine learning algorithms comprises: generating, using the Kalman filter, an anomaly score for the first station based on the control values; and determining that the anomaly score exceeds a threshold value indicative of a cyberattack. ### Claim 4 (depends on 1) The manufacturing system of claim 1, wherein the one or more machine learning algorithms comprise an autoencoder. ### Claim 5 (depends on 4) The manufacturing system of claim 4, wherein determining that there is a cyberattack based on the control values for the first station using the one or more machine learning algorithms comprises: generating, using the autoencoder, an anomaly score for the first station based on the control values; and determining that the anomaly score exceeds a threshold value indicative of a cyberattack. ### Claim 6 (depends on 1) The manufacturing system of claim 1, wherein the one or more machine learning algorithms comprise a deep learning algorithm. ### Claim 7 (depends on 6) The manufacturing system of claim 6, wherein determining that there is a cyberattack based on the control values for the first station using the one or more machine learning algorithms comprises: generating a predicted quality metric for the component based on the control values; and determining that the predicted quality metric falls outside a range of acceptable values. ### Claim 8 A computer-implemented method, comprising: receiving, by a computing system, control values for a first station of one or more stations of a manufacturing system configured to process a component, the control values comprising attributes of the first station; determining, by the computing system, that there is a cyberattack based on the control values for the first station using one or more machine learning algorithms; and based on the determining, generating, by the computing system, a set of actions to correct for errors caused by the cyberattack, the set of actions associated with downstream stations of the manufacturing system, the generating comprising: generating a plurality of possible actions to correct the errors caused by the cyberattack, and identifying the set of actions from the plurality of possible actions that yields a greatest correction in the errors caused by the cyberattack. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, wherein the one or more machine learning algorithms comprise a Kalman Filter. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, wherein determining that there is a cyberattack based on the control values for the first station using the one or more machine learning algorithms comprises: generating, using the Kalman filter, an anomaly score for the first station based on the control values; and determining that the anomaly score exceeds a threshold value indicative of a cyberattack. ### Claim 11 (depends on 8) The computer-implemented method of claim 8, wherein the one or more machine learning algorithms comprise an autoencoder. ### Claim 12 (depends on 11) The computer-implemented method of claim 11, wherein determining that there is a cyberattack based on the control values for the first station using the one or more machine learning algorithms comprises: generating, using the autoencoder, an anomaly score for the first station based on the control values; and determining that the anomaly score exceeds a threshold value indicative of a cyberattack. ### Claim 13 (depends on 8) The computer-implemented method of claim 8, wherein the one or more machine learning algorithms comprise a deep learning algorithm. ### Claim 14 (depends on 13) The computer-implemented method of claim 13, wherein determining that there is a cyberattack based on the control values for the first station using the one or more machine learning algorithms comprises: generating a predicted quality metric for the component based on the control values; and determining that the predicted quality metric falls outside a range of acceptable values. ### Claim 15 A manufacturing system, comprising: one or more stations, each station configured to perform at least one step in a multi-step manufacturing process for a component; a monitoring platform configured to monitor progression of the component throughout the multi-step manufacturing process; and a control module configured to detect a cyberattack to the manufacturing system, the control module configured to perform operations, comprising: receiving control values for a first station of the one or more stations, the control values comprising attributes of the first station; determining that there is a cyberattack based on the control values for the first station using one or more machine learning algorithms; based on the determining, generating an alert to cease processing of the component; and generating, using one or more second machine learning algorithms, a set of actions to correct for errors caused by the cyberattack, the set of actions associated with downstream stations of the manufacturing system, the generating comprising: generating a plurality of possible actions to correct the errors caused by the cyberattack, and identifying the set of actions from the plurality of possible actions that yields a greatest correction in the errors caused by the cyberattack. ### Claim 16 (depends on 15) The manufacturing system of claim 15, wherein the one or more machine learning algorithms comprise a Kalman Filter and the one or more second machine learning algorithms comprise a deep learning algorithm. ### Claim 17 (depends on 16) The manufacturing system of claim 16, wherein determining that there is a cyberattack based on the control values for the first station using the one or more machine learning algorithms comprises: generating, using the Kalman filter, an anomaly score for the first station based on the control values; and determining that the anomaly score exceeds a threshold value indicative of a cyberattack. ### Claim 18 (depends on 15) The manufacturing system of claim 15, wherein the one or more machine learning algorithms comprise an autoencoder. ### Claim 19 (depends on 18) The manufacturing system of claim 18, wherein determining that there is a cyberattack based on the control values for the first station using the one or more machine learning algorithms comprises: generating, using the autoencoder, an anomaly score for the first station based on the control values; and determining that the anomaly score exceeds a threshold value indicative of a cyberattack. ### Claim 20 (depends on 15) The manufacturing system of claim 15, wherein the one or more machine learning algorithms comprise a deep learning algorithm.