Interpreting and categorizing traffic on industrial control networks
AssigneeSiemens Aktiengesellschaft
InventorsLuis Humberto Rodriguez, Jr., Charif Mahmoudi, Joseph Tylka
Life of this patent
Estimating the term…
Abstract
Tools can generate semantic information that indicates the purpose and contents of messages that are transmitted on a given network. In particular, for example, forensic tools described herein can discriminate between security issues, bugs, performance limitations, user errors, and the like.
Claims15
A method performed within an industrial control network that defines an IT network and a production network communicatively coupled to each other, the production network comprising 1) a plurality of plants that define a plant level communicatively coupled to the IT network, and 2) a plurality of field devices that define a field level, each plant of the plurality of plants communicatively coupled to respective field devices of the plurality of field devices, the method comprising:
- monitoring, by first edge devices, first communication traffic exchanged between the IT network and the plant level;
- monitoring, by second edge devices, second communication traffic exchanged between the plant level and the field level;
- based on the first communication traffic and the second communication traffic, determining a plurality of communication pairs and communication protocols used by the plurality of communication pairs;
- based on the plurality of communication pairs and communication protocols, identifying protocol transformations and determining a category associated with each communication pair, so as to define network analysis data associated with each edge device of the first and second edge devices;
- and
- based on the network analysis data associated with each edge device of the first and second edge devices, generating synthetic network traffic data for a network digital twin of the industrial control network.
A computing system comprising:
- a memory having a plurality of application modules stored thereon;
- and
- a processor for executing the application modules, the modules configured to:
- monitor first communication traffic exchanged between an IT network and a plant level of a production network, the IT network and the production network defined by an industrial control network;
- monitoring, by second edge devices, second communication traffic exchanged between the plant level and the field level;
- based on the first communication traffic and the second communication traffic, determining a plurality of communication pairs and communication protocols used by the plurality of communication pairs;
- based on the plurality of communication pairs and communication protocols, identifying protocol transformations and determining a category associated with each communication pair, so as to define network analysis data associated with each edge device of the first and second edge devices;
- and
- based on the network analysis data associated with each edge device of the first and second edge devices, generating synthetic network traffic data for a network digital twin of the industrial control network.
A non-transitory computer-readable storage medium including instructions that, when processed by a computing system cause the computing system to perform operations comprising:
- monitoring first communication traffic exchanged between an IT network and a plant level of a production network, the IT network and the production network defined by an industrial control network;
- monitoring second communication traffic exchanged between the plant level and a field level of the production network;
- based on the first communication traffic and the second communication traffic, determining a plurality of communication pairs and communication protocols used by the plurality of communication pairs;
- based on the plurality of communication pairs and communication protocols, identifying protocol transformations and determining a category associated with each communication pair, so as to define network analysis data associated with edge devices of the industrial control network;
- and
- based on the network analysis data associated with each edge device, generating synthetic network traffic data for a network digital twin of the industrial control network.
Dependencies are inferred from the claim text.