Detection of mis-configuration and hostile attacks in industrial control networks using active querying
AssigneeIndegy Ltd.
InventorMille Gandelsman
Life of this patent
Estimating the term…
Abstract
A method includes requesting a controller, which controls one or more field devices in an industrial control network, to report code currently used by the controller for controlling the field devices. The code reported by the controller is compared with a stored baseline version of the code, and a notification is issued upon detecting a discrepancy between the code reported by the controller and the baseline version.
Claims15
A method, comprising:
- requesting a controller, which controls one or more field devices in an industrial control network, to report code currently used by the controller for controlling the field devices;
- comparing the code reported by the controller with a stored baseline version of the code;
- and
- issuing a notification upon detecting a discrepancy between the code reported by the controller and the baseline version.
An apparatus, comprising:
- a memory, which is configured to hold a baseline version of code used by a controller to control one or more field devices in an industrial control network;
- and
- a processor, which is configured to request the controller to report the code currently used by the controller for controlling the field devices, to compare the code reported by the controller with the baseline version of the code stored in the memory, and to issue a notification upon detecting a discrepancy between the code reported by the controller and the baseline version.
A computer software product, the product comprising a tangible non-transitory computer-readable medium in which program instructions are stored, which instructions, when read by a processor, cause the processor to request a controller, which controls one or more field devices in an industrial control network, to report code currently used by the controller for controlling the field devices, to compare the code reported by the controller with a stored baseline version of the code, and to issue a notification upon detecting a discrepancy between the code reported by the controller and the baseline version.
Dependencies are inferred from the claim text.