US 2019/0104138 A1Published application

Autonomous edge device for monitoring and threat detection

AssigneeNew Context Services, Inc.

InventorsAndrew Charles Storms, Daniel C. Riedel

Life of this patent

Estimating the term…

Loading patent…

Abstract

Techniques are described for monitoring an operational technology environment (OTE) to detect threats, and performing actions to respond to detected threats. Edge device(s) are arranged to monitor and/or control the operations of component(s) within an OTE. An edge device stores threat profiles, each including a set of physical indicators that would, if exhibited by sensor data collected from the component, indicate the presence of a particular threat in the OTE. The edge device may collect sensor data from sensor devices situated in or near the monitored component. By comparing the sensor data to the threat profile(s), the edge device determines whether any of the threats described by the threat profiles are currently active. If a threat is detected, the edge device sends an alert message to server computing device(s). In some instances, the edge device can also autonomously perform response or remediation action(s) in response to detecting a threat.

Claims20

Dependent claims

A system for monitoring an operational technology environment (OTE), the system comprising:

one or more edge computing devices communicatively coupled, at least intermittently, to one or more server computing devices, each respective edge computing device monitoring a respective component of the OTE, each respective edge computing device executing one or more edge modules that perform operations comprising:
receiving, from the one or more server computing devices, one or more threat profiles each corresponding to a respective cyber-attack and including one or more physical indicators exhibited by the OTE while subjected to the respective cyber-attack;
receiving one or more current state values of the respective component monitored by the respective edge computing device, the one or more current state values generated by one or more sensor devices measuring the one or more current state values of the respective component;
comparing the one or more current state values to respective one or more physical indicators for each of the one or more threat profiles;
and
in response to detecting a correspondence between the one or more current state values and the respective one or more physical indicators for a threat profile, sending an alert message to the one or more server computing devices indicating that the OTE is being subjected to an active cyber-attack corresponding to the threat profile.

3 more elements

A computer-implemented method performed by an edge computing device, the method comprising:

receiving, by the edge computing device, from one or more server computing devices, one or more threat profiles each corresponding to a respective cyber-attack and including one or more physical indicators exhibited by an operational technology environment (OTE) while subjected to the respective cyber-attack;
receiving, by the edge computing device, one or more current state values of a component of the OTE monitored by the edge computing device, the one or more current state values generated by one or more sensor devices measuring the one or more current state values of the component;
comparing, by the edge computing device, the one or more current state values to respective one or more physical indicators for each of the one or more threat profiles;
and
in response to detecting a correspondence between the one or more current state values and the respective one or more physical indicators for a threat profile, sending, by the edge computing device, an alert message to the one or more server computing devices indicating that the OTE is being subjected to an active cyber-attack corresponding to the threat profile.

2 more elements

Dependencies are inferred from the claim text.