Method, Device and Computer Program for Monitoring an Industrial Control System
AssigneeSecure-NOK AS
InventorSiv Hilde HOUMB
Life of this patent
Estimating the term…
Abstract
A method is for monitoring an industrial control system. The method comprises collecting data from one or more sources external to the industrial control system; collecting data from one or more internal sources on the industrial control system; aggregating data collected from said internal sources or from said external sources; correlating said collected data by analyzing and interpreting said collected data in view of previously collected data so as to monitor the security of the industrial control system. An apparatus is for performing the method.
Claims15
Method for monitoring an industrial control system, the method comprising the following steps:
- collecting data from one or more sources (500) external to the industrial control system;
- collecting data from one or more internal sources (100) on the industrial control system;
- aggregating data collected from said internal sources and/or from said external sources;
- correlating said collected data by analyzing and interpreting said collected data in view of previously collected data so as to monitor the security of the Industrial control system.
Method according to any of the preceding claims, wherein the step of aggregating data includes aggregating data from said internal sources in one or more of the following steps:
- parameterized aggregation;
- layer-wise aggregation;
- and
- cross-layer aggregation.
Method according to any of the preceding claims, wherein the step of aggregating data includes aggregating data from said external sources by means of the steps of:
- reformatting data collected from said external sources;
- and
- aggregating said reformatted data into a database.
Method according to any of the preceding claims, wherein the step of correlating said aggregated data includes one or more of the following steps:
- correlating across parameters;
- correlating across layers;
- correlating across entities in a system;
- and
- correlating across systems.
Method according to any of the preceding claims, wherein the step of correlating said aggregated data includes the step of determining a security risk from any detected security event by means of one or more of the following sub-steps:
- evaluating said aggregated data by comparing to a pre-defined threshold value;
- evaluating said aggregated data by comparing to a relevant installation baseline, performance baseline and/or entity configuration baseline such as a machine or equipment baseline to identify abnormal activity;
- evaluating said aggregated data by comparing to a past events database (320);
- evaluating said aggregated data by comparing to a knowledge, experience and recommendations database (310) obtained from a collection of standards and best practices and from external sources (500);
- and
- evaluating said aggregated data by comparing to security events reports from one or more external and/or internal sources.
Method according to any of the preceding claims, wherein the method further comprises the step of reacting to a security risk by means of one or more of the following actions:
- repairing immediately;
- scheduling a repair;
- delaying the repair;
- or
- doing nothing.
Apparatus (1) for monitoring an industrial control system, the apparatus (1) comprising:
- one or more internal sources (100) on the industrial control system;
- one or more sources (500) external to the industrial control system;
- an aggregation, correlation and interpretation module (400) for aggregating, correlating and interpreting data from internal and external sources (100, 500) so as to monitor the security of the industrial control system.
Dependencies are inferred from the claim text.