Systems, Methods, and Devices for Detecting Anomalies in an Industrial Control System

A control system protection mechanism that detects unauthorized interference with an industrial control system controlling an industrial system, comprising:

• a programmable anomaly detection module connected to sensors to receive sensor data, the sensor data representing a configuration of the industrial system;
• the programmable anomaly detection module also being connected to control outputs of the industrial control system and to receive control output data, the control output data commanding functions of the industrial system;
• the anomaly detection module having a processor and a data store with executable instructions to cause the processor to generate error commands responsively to a network model, on a data store of the anomaly detection module, that distinguishes non-anomalous attribute combination in an attribute space defined by all possible values of the control output data and sensor data;
• the error commands including at least one command applied to the industrial control system effective to cause the industrial control system to take a corrective or protective action when the network model indicates that a current combination of sensor data and control output data lies outside the non-anomalous combination;
• wherein the industrial system has one or more production operating modes and one or more non-production operating modes, the latter corresponding to testing, maintenance, startup, or shutdown, non-anomalous combinations include conditions during non-production operating modes,
• the network model being generated by training the network model using unlabeled data obtained by operating the industrial system during production modes and receiving the attending sensor data and control output data of the industrial system during non-anomalous operation or by selecting the attending sensor data and control output data corresponding to non-anomalous operation;
• the industrial control system being signally connected to the anomaly detection module to receive said at least one of said error commands;
• an alarm output device connected to the anomaly detection module to receive at least another of said error commands and to generate an alarm notification receivable by one or more operators responsively thereto;
• said alarm output device or said anomaly detection module being configured to detect a loss of connection between said alarm output device and said anomaly detection module and to generate an alarm notification upon said loss of connection.