# US 12,603,910 B2 · Cybersecurity risk assessment and mitigation for industrial control systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,910 B2 - Document ID: US12603910B2 - Status: Granted - Kind: B2 - Application number: 17/987,487 - Filed: 2022-11-15 - Published: 2024-05-16 - Granted: 2026-04-14 - Earliest claimed: 2022-11-15 - Assignees: Honeywell International Inc. - Applicants: Honeywell International Inc. - Inventors: Tarun Gupta - Web page: https://patentgrep.com/patent/US12603910B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - H04L 63/1416: {Event detection, e.g. attack signature detection} - G05B 19/0428: {Safety, monitoring (G05B19/0423 takes precedence)} - G05B 19/41835: {characterised by program execution} - G06F 21/55: Detecting local intrusion or implementing counter-measures - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Various embodiments described herein relate to cybersecurity risk assessment and mitigation for industrial control systems. In an embodiment, a request to perform a cybersecurity assessment of a set of industrial assets is received. Additionally, the set of industrial assets are correlated to industrial asset data associated with the set of industrial assets and a first industrial asset feature set is compared to a cybersecurity rules set to determine a cybersecurity threat level indicator for respective industrial assets from the set of industrial assets. In response to the cybersecurity threat level indicator satisfying a defined criterion, one or more cybersecurity countermeasure actions for the respective industrial assets are then determined based on a comparison between a second industrial asset feature set and a predefined industrial asset feature set for a set of predefined industrial assets associated with one or more predefined cybersecurity countermeasures. ## Claims ### Claim 1 A system, comprising: one or more processors; a memory; and one or more programs stored in the memory, the one or more programs comprising instructions configured to: generate a knowledge graph that defines at least a portion of a network topology for an industrial control system, wherein the knowledge graph defines nodes associated with the set of industrial assets of the industrial control system and links associated with network connections of the industrial control system; monitor network traffic broadcasted to a set of industrial assets of the industrial control system to generate industrial asset data associated with the set of industrial assets; in response to a detection of a change in the industrial control system based on the network traffic, scan the knowledge graph to determine modeled network topology information for the industrial control system; determine a set of asset descriptors respectively describing an industrial asset from the set of industrial assets based on the modeled network topology information; correlate, based on the set of asset descriptors, respective industrial assets from the set of industrial assets to respective portions of the industrial asset data associated with the set of industrial assets; compare a first industrial asset feature set from the industrial asset data to a cybersecurity rules set stored in an asset risk assessment signature repository to determine a cybersecurity threat level indicator for the respective industrial assets from the set of industrial assets; in response to a determination that that the cybersecurity threat level indicator for the respective industrial assets satisfies a defined criterion, determine one or more cybersecurity countermeasure actions for the respective industrial assets based on a comparison between a second industrial asset feature set from the industrial asset data and a predefined industrial asset feature set for a set of predefined industrial assets associated with one or more predefined cybersecurity countermeasures; and cause performance of the one or more cybersecurity countermeasure actions associated with the industrial control system. ### Claim 2 (depends on 1) The system of claim 1, the one or more programs further comprising instructions configured to: scan the knowledge graph in response to an action initiated via a processing unit associated with the set of industrial assets. ### Claim 3 (depends on 1) The system of claim 1, the one or more programs further comprising instructions configured to: determine the set of asset descriptors based on textual analysis of data provided via an electronic interface of a computing device. ### Claim 4 (depends on 1) The system of claim 1, the one or more programs further comprising instructions configured to: provide the first industrial asset feature set to a machine learning model configured to determine the cybersecurity threat level indicator based on the cybersecurity rules set. ### Claim 5 (depends on 1) The system of claim 1, the one or more programs further comprising instructions configured to: provide a threat level mapping of a network topology associated with the industrial control system based on the one or more cybersecurity countermeasure actions. ### Claim 6 (depends on 1) The system of claim 1, the one or more programs further comprising instructions configured to: provide asset information for a new industrial asset to replace one or more industrial assets in the industrial control system in response to the determination that the cybersecurity threat level indicator for the respective industrial assets satisfies the defined criterion. ### Claim 7 (depends on 1) The system of claim 1, the one or more programs further comprising instructions configured to: generate an alert for an electronic interface of a computing device in response to the determination that the cybersecurity threat level indicator for the respective industrial assets satisfies the defined criterion. ### Claim 8 (depends on 1) The system of claim 1, the one or more programs further comprising instructions configured to: generate a ranking of cybersecurity countermeasure actions in response to the determination that the cybersecurity threat level indicator for the respective industrial assets satisfies the defined criterion. ### Claim 9 (depends on 1) The system of claim 1, the one or more programs further comprising instructions configured to: determine the one or more cybersecurity countermeasure actions for the respective industrial assets responsive to a comparison between (i) the cybersecurity threat level indicator for the respective industrial assets and (ii) a predefined cybersecurity threat indicator associated with a particular type of cybersecurity threat level. ### Claim 10 A computer-implemented method, comprising: generating a knowledge graph that defines at least a portion of a network topology for an industrial control system, wherein the knowledge graph defines nodes associated with the set of industrial assets of the industrial control system and links associated with network connections of the industrial control system; monitoring network traffic broadcasted to a set of industrial assets of the industrial control system to generate industrial asset data associated with the set of industrial assets; in response to a detection of a change in the industrial control system based on the network traffic, scanning the knowledge graph to determine modeled network topology information for the industrial control system; determining a set of asset descriptors respectively describing an industrial asset from the set of industrial assets based on the modeled network topology information; correlating, based on the set of asset descriptors, respective industrial assets from the set of industrial assets to respective portions of the industrial asset data associated with the set of industrial assets; comparing a first industrial asset feature set from the industrial asset data to a cybersecurity rules set stored in an asset risk assessment signature repository to determine a cybersecurity threat level indicator for the respective industrial assets from the set of industrial assets; in response to a determination that that the cybersecurity threat level indicator for the respective industrial assets satisfies a defined criterion, determining one or more cybersecurity countermeasure actions for the respective industrial assets based on a comparison between a second industrial asset feature set from the industrial asset data and a predefined industrial asset feature set for a set of predefined industrial assets associated with one or more predefined cybersecurity countermeasures; and causing performance of the one or more cybersecurity countermeasure actions associated with the industrial control system. ### Claim 11 (depends on 10) The computer-implemented method of claim 10, wherein the scanning the knowledge graph comprises scanning the knowledge graph in response to an action initiated via a processing unit associated with the set of industrial assets. ### Claim 12 (depends on 10) The computer-implemented method of claim 10, further comprising: determining the set of asset descriptors based on textual analysis of data provided via an electronic interface of a computing device. ### Claim 13 (depends on 10) The computer-implemented method of claim 10, further comprising: providing the first industrial asset feature set to a machine learning model configured to determine the cybersecurity threat level indicator based on the cybersecurity rules set. ### Claim 14 (depends on 10) The computer-implemented method of claim 10, further comprising: providing a threat level mapping of a network topology associated with the industrial control system based on the one or more cybersecurity countermeasure actions. ### Claim 15 (depends on 10) The computer-implemented method of claim 10, further comprising: providing asset information for a new industrial asset to replace one or more industrial assets in the industrial control system in response to the determination that the cybersecurity threat level indicator for the respective industrial assets satisfies the defined criterion. ### Claim 16 (depends on 10) The computer-implemented method of claim 10, further comprising: generating an alert for an electronic interface of a computing device in response to the determination that the cybersecurity threat level indicator for the respective industrial assets satisfies the defined criterion. ### Claim 17 (depends on 10) The computer-implemented method of claim 10, further comprising: determining the one or more cybersecurity countermeasure actions for the respective industrial assets responsive to a comparison between (i) the cybersecurity threat level indicator for the respective industrial assets and (ii) a predefined cybersecurity threat indicator associated with a particular type of cybersecurity threat level. ### Claim 18 A computer program product comprising at least one computer-readable storage medium having program instructions embodied thereon, the program instructions executable by a processor to cause the processor to: generate a knowledge graph that defines at least a portion of a network topology for an industrial control system, wherein the knowledge graph defines nodes associated with the set of industrial assets of the industrial control system and links associated with network connections of the industrial control system; monitor network traffic broadcasted to a set of industrial assets of the industrial control system to generate industrial asset data associated with the set of industrial assets; in response to a detection of a change in the industrial control system based on the network traffic, scan the knowledge graph to determine modeled network topology information for the industrial control system; determine a set of asset descriptors respectively describing an industrial asset from the set of industrial assets based on the modeled network topology information; correlate, based on the set of asset descriptors, respective industrial assets from the set of industrial assets to respective portions of the industrial asset data associated with the set of industrial assets; compare a first industrial asset feature set from the industrial asset data to a cybersecurity rules set stored in an asset risk assessment signature repository to determine a cybersecurity threat level indicator for the respective industrial assets from the set of industrial assets; in response to a determination that that the cybersecurity threat level indicator for the respective industrial assets satisfies a defined criterion, determine one or more cybersecurity countermeasure actions for the respective industrial assets based on a comparison between a second industrial asset feature set from the industrial asset data and a predefined industrial asset feature set for a set of predefined industrial assets associated with one or more predefined cybersecurity countermeasures; and cause performance of the one or more cybersecurity countermeasure actions associated with the industrial control system. ### Claim 19 (depends on 18) The computer program product of claim 18, the program instructions further executable by the processor to cause the processor to: determine the one or more cybersecurity countermeasure actions for the respective industrial assets responsive to a comparison between (i) the cybersecurity threat level indicator for the respective industrial assets and (ii) a predefined cybersecurity threat indicator associated with a particular type of cybersecurity threat level. ### Claim 20 (depends on 18) The computer program product of claim 18, the program instructions further executable by the processor to cause the processor to: scan the knowledge graph in response to an action initiated via a processing unit associated with the set of industrial assets.