Collaborative infrastructure supporting cyber-security analytics in industrial networks
AssigneeGeneral Electric Company
InventorsShai Dekel, Lior Ateret, Evgeny Bogokovsky
Life of this patent
Estimating the term…
Abstract
A system comprising a computer-readable storage medium storing at least one program, and a method for reducing cyber-security related false positive alerts is presented. In example embodiments the method may include identifying an indication of a cyber-security threat based on an operational anomaly in a network system. The method may further include determining that the operational anomaly is a false positive indicator with respect to the cyber-security threat based on the operational anomaly being correlated with a malfunction or reconfiguration event.
Claims20
A method comprising:
- identifying an indication of a cyber-security threat to a network system based on an operational anomaly that includes an operation pattern that is inconsistent with a normal operation pattern observed in the network system;
- identifying a malfunction or reconfiguration event associated with an asset;
- determining, by at least one processor, that the operational anomaly is a false positive with respect to the potential cyber-security threat based on the operational anomaly being correlated with the malfunction or reconfiguration event;
- clearing the indication based on the determining that the anomaly is a false positive;
- and
- causing a record to be stored in a database, the record comprising:
- the operational anomaly, information associated with the malfunction or reconfiguration event, and information associated with the determining that the anomaly is a false positive.
A system comprising:
- one or more processors of a machine;
- and
- a machine-readable medium storing instructions that, when executed by the one or more processors, cause the machine to perform operations comprising:
- identifying an indication of a cyber-security threat to a network system based on an operational anomaly that includes an operation pattern that is inconsistent with a normal operation pattern observed in the network system;
- identifying a malfunction or reconfiguration event associated with an asset;
- determining that the operational anomaly is a false positive with respect to the potential cyber-security threat based on the operational anomaly being correlated with the malfunction or reconfiguration event;
- clearing the indication based on the determining that the anomaly is a false positive;
- and
- causing a record to be stored in a database, the record comprising:
- the operational anomaly, information associated with the malfunction or reconfiguration event, and information associated with the determining that the anomaly is a false positive.
A non-transitory machine-readable storage medium embodying instructions that, when executed by at least one processor of a machine, cause the machine to perform operations comprising:
- identifying an indication of a cyber-security threat to a network system based on an operational anomaly that includes an operation pattern that is inconsistent with a normal operation pattern observed in the network system;
- identifying a malfunction or reconfiguration event associated with an asset;
- determining that the operational anomaly is a false positive with respect to the potential cyber-security threat based on the operational anomaly being correlated with the malfunction or reconfiguration event;
- clearing the indication based on the determining that the anomaly is a false positive;
- and
- causing a record to be stored in a database, the record comprising:
- the operational anomaly, information associated with the malfunction or reconfiguration event, and information associated with the determining that the anomaly is a false positive.
Dependencies are inferred from the claim text.