Anomaly detection in industrial communications networks

An anomaly detection system for use in a plant environment, comprising:

• a communications network including a multiplicity of network nodes each having a processor and a computer readable memory, the multiplicity of network nodes interconnected by a communications link;
• a plurality of message modules, wherein each of the message modules executes on the processor at a different one of the network nodes to detect message traffic at the network node and to generate metadata about the message traffic at the network node;
• an analysis engine communicatively coupled to each of the plurality of message modules, wherein the analysis engine executes on a processing device coupled to the communications network including;
• a metadata memory,
• a controller that executes on a processor of the processing device to receive the metadata about each of the network nodes from the plurality of message modules, and that stores the received metadata in the metadata memory,
• a rules database that stores a set of logic rules,
• a rules engine that executes on a processor of the processing device to process the metadata stored in the metadata memory using the logic rules stored in the rules database to detect a traffic pattern anomaly in the communications network, and
• a notification module that executes on a processor of the processing device to send a notification of a detected anomaly.

A method of performing anomaly detection in a plant communications network having a plurality of network nodes interconnected by a communications link, comprising:

• analyzing message traffic at two or more of the plurality of network nodes using a processor at each of the two or more of the plurality of network nodes to create metadata about the message traffic at each of the two or more of the plurality of network nodes;
• electronically sending the created metadata from each of the two or more of the plurality of network nodes to an analysis engine located in a computer processing device coupled to the communications network;
• storing the metadata from each of the two or more of the plurality of network nodes on a computer readable memory at the computer processing device;
• storing a set of baseline metadata parameters in a computer readable memory at the computer processing device;
• analyzing the stored metadata at the analysis engine, using a processor at the computer processing device, using a set of logic rules and the stored baseline metadata parameters, to determine if there is an anomaly in the traffic pattern at one or more of the network nodes of the communications network;
• and
• performing an action to correct the anomaly in the traffic pattern when an anomaly is detected in the traffic pattern at one or more of the network nodes of the communications network.