# US 12,118,089 B2 · Method, systems and apparatus for intelligently emulating factory control systems and simulating response data

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,118,089 B2
- Document ID: US12118089B2
- Status: Granted
- Kind: B2
- Application number: 18/622,215
- Filed: 2024-03-29
- Published: 2024-07-18
- Granted: 2024-10-15
- Earliest claimed: 2021-09-15
- Assignees: Nanotronics Imagiing, Inc.
- Applicants: Nanotronics Imaging, Inc.
- Inventors: John B. Putman; Joanna Lee; Matthew C. Putman
- Web page: https://patentgrep.com/patent/US12118089B2

## CPC

- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G05B 13/0265: {the criterion being a learning criterion}
- G05B 17/02: electric
- G05B 19/41885: {characterised by modeling, simulation of the manufacturing system}
- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06F 2221/034: Test or assess a computer or a system
- G06F 2221/2107: File encryption
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G)

## Abstract

A simulated process is initiated. The simulated process includes generating, by an emulator, a control signal based on external inputs. The simulated process further includes processing, by a simulator, the control signal to generate simulated response data. The simulated process further includes generating, by a deep learning processor, expected behavioral pattern data based on the simulated response data. An actual process is initiated by initializing setpoints for a process station in a manufacturing system. The actual process includes generating, by the deep learning processor, actual behavioral pattern data based on actual process data from the at least one process station. The deep learning processor compares the expected behavioral pattern to the actual behavioral pattern. Based on the comparing, the deep learning processor determines that anomalous activity is present in the manufacturing system. Based on the anomalous activity being present, the deep learning processor initiates an alert protocol.

## Claims

### Claim 1

A method of detecting anomalous activity in a manufacturing environment, the method comprising:
receiving a control signal in a manufacturing system;
generating, by a decomposer, a pair of transformed control signal by modifying the control signal, the pair of transformed signals comprising a first transformed control signal and a second transformed control signal;
splitting the first transformed control signal into a first duplicated transformed control signal and a second duplicated transformed control signal;
splitting the second transformed control signal into a third duplicated transformed control signal and a fourth duplicated transformed control signal;
restoring, by an integrator, the control signal based on the first duplicated transformed control signal back and the third duplicated transformed control signal;
generating, by the integrator, a delta between the second duplicated transformed control signal and the fourth duplicated transformed control signal;
analyzing, by a deep learning processor, the restored control signal, the second duplicated transformed control signal, the fourth duplicated transformed control signal, and the delta to determine if anomalous activity is present in the manufacturing environment; and
based on the analyzing, raising an alarm if the deep learning processor determines that the anomalous activity is present.

### Claim 2 (depends on 1)

The method of claim 1, wherein generating, by the decomposer, the pair of transformed signals comprises:
generating a first transformed signal by adding an amount of noise to the control signal; and
generating a second transformed signal by subtracting the amount of noise from the control signal.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
providing, by the decomposer, the control signal to the deep learning processor.

### Claim 4 (depends on 1)

The method of claim 1, wherein restoring, by the integrator, the control signal based on the first duplicated transformed control signal and the third duplicated transformed control signal comprises:
generating an average of the first duplicated transformed control signal and the third duplicated transformed control signal.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
determining that anomalous activity is present;
generating a confidence level in the determination of the anomalous activity; and
based on the confidence level, initiating an alert protocol corresponding to the confidence level.

### Claim 6 (depends on 5)

The method of claim 5, wherein initiating the alert protocol corresponding to the confidence level comprises:
identifying an alert protocol from a plurality of possible alert protocols corresponding to a plurality of confidence levels.

### Claim 7 (depends on 5)

The method of claim 5, wherein the alert protocol is one of a mechanical response or a functional response.

### Claim 8

A non-transitory computer readable medium comprising one or more sequences of instructions, which, when executed by a processor, causes a computing system to perform operations comprising:
receiving a control signal in a manufacturing system;
generating, by a decomposer, a pair of transformed control signal by modifying the control signal, the pair of transformed signals comprising a first transformed control signal and a second transformed control signal;
splitting the first transformed control signal into a first duplicated transformed control signal and a second duplicated transformed control signal;
splitting the second transformed control signal into a third duplicated transformed control signal and a fourth duplicated transformed control signal;
restoring, by an integrator, the control signal based on the first duplicated transformed control signal back and the third duplicated transformed control signal;
generating, by the integrator, a delta between the second duplicated transformed control signal and the fourth duplicated transformed control signal;
analyzing, by a deep learning processor, the restored control signal, the second duplicated transformed control signal, the fourth duplicated transformed control signal, and the delta to determine if anomalous activity is present in the manufacturing system; and
based on the analyzing, raising an alarm if the deep learning processor determines that the anomalous activity is present.

### Claim 9 (depends on 8)

The non-transitory computer readable medium of claim 8, wherein generating, by the decomposer, the pair of transformed signals comprises:
generating a first transformed signal by adding an amount of noise to the control signal; and
generating a second transformed signal by subtracting the amount of noise from the control signal.

### Claim 10 (depends on 8)

The non-transitory computer readable medium of claim 8, further comprising:
providing, by the decomposer, the control signal to the deep learning processor.

### Claim 11 (depends on 8)

The non-transitory computer readable medium of claim 8, wherein restoring, by the integrator, the control signal based on the first duplicated transformed control signal and the third duplicated transformed control signal comprises:
generating an average of the first duplicated transformed control signal and the third duplicated transformed control signal.

### Claim 12 (depends on 8)

The non-transitory computer readable medium of claim 8, further comprising:
determining that anomalous activity is present;
generating a confidence level in the determination of the anomalous activity; and
based on the confidence level, initiating an alert protocol corresponding to the confidence level.

### Claim 13 (depends on 12)

The non-transitory computer readable medium of claim 12, wherein initiating the alert protocol corresponding to the confidence level comprises:
identifying an alert protocol from a plurality of possible alert protocols corresponding to a plurality of confidence levels.

### Claim 14 (depends on 12)

The non-transitory computer readable medium of claim 12, wherein the alert protocol is one of a mechanical response or a functional response.

### Claim 15

A system comprising:
a processor; and
a memory having programming instructions stored thereon, which, when executed by the processor, causes the system to perform operations comprising:
receiving a control signal in a manufacturing system;
generating a pair of transformed control signal by modifying the control signal, the pair of transformed signals comprising a first transformed control signal and a second transformed control signal;
splitting the first transformed control signal into a first duplicated transformed control signal and a second duplicated transformed control signal;
splitting the second transformed control signal into a third duplicated transformed control signal and a fourth duplicated transformed control signal;
restoring the control signal based on the first duplicated transformed control signal back and the third duplicated transformed control signal;
generating a delta between the second duplicated transformed control signal and the fourth duplicated transformed control signal;
analyzing, by a deep learning processor, the restored control signal, the second duplicated transformed control signal, the fourth duplicated transformed control signal, and the delta to determine if anomalous activity is present in the manufacturing system; and
based on the analyzing, raising an alarm if the deep learning processor determines that the anomalous activity is present.

### Claim 16 (depends on 15)

The system of claim 15, wherein generating the pair of transformed signals comprises:
generating a first transformed signal by adding an amount of noise to the control signal; and
generating a second transformed signal by subtracting the amount of noise from the control signal.

### Claim 17 (depends on 15)

The system of claim 15, wherein the operations further comprise:
providing the control signal to the deep learning processor.

### Claim 18 (depends on 15)

The system of claim 15, wherein restoring the control signal based on the first duplicated transformed control signal and the third duplicated transformed control signal comprises:
generating an average of the first duplicated transformed control signal and the third duplicated transformed control signal.

### Claim 19 (depends on 15)

The system of claim 15, wherein the operations further comprise:
determining that anomalous activity is present;
generating a confidence level in the determination of the anomalous activity; and
based on the confidence level, initiating an alert protocol corresponding to the confidence level.

### Claim 20 (depends on 19)

The system of claim 19, wherein initiating the alert protocol corresponding to the confidence level comprises:
identifying an alert protocol from a plurality of possible alert protocols corresponding to a plurality of confidence levels.