Network security assessment using a network traffic parameter
AssigneeSchweitzer Engineering Laboratories, Inc.
InventorsCody W. Tews, Cassandra Seubert
Life of this patent
Estimating the term…
Abstract
Systems and methods may be used to assess network communications by generating one or more thresholds for network traffic parameters based at least in part on a generated baseline for the network traffic parameter in the supervisory control and data acquisition system based on communications within the industrial network. Network communications may be assessed by determining whether the communications in the industrial network fall within the one or more thresholds for the network traffic parameter.
Claims20
A method, comprising:
- receiving, at an industrial control system, data indicative of a network traffic parameter for network traffic in an industrial network monitored by the industrial control system;
- establishing a baseline for the network traffic parameter based at least in part on the data;
- establishing anomalous bounds for the network traffic parameter based at least in part on the baseline for the network traffic parameter;
- determining whether communications in the industrial network fall within the anomalous bounds for the network traffic parameter;
- and
- upon a determination that the communications in the industrial network do not fall within the anomalous bounds, indicating the industrial network is potentially under attack.
A tangible, non-transitory, and computer-readable medium having stored thereon instructions, that when executed, are configured to cause a processor to:
- operate as a component in a supervisory control and data acquisition system for an industrial control system to monitor industrial machinery by communicating within an industrial network;
- generate a baseline for network jitter in the supervisory control and data acquisition system based on communications within the industrial network;
- generating anomalous bounds for the network jitter based at least in part on the baseline;
- determining whether communications in the industrial network fall within the anomalous bounds for the network jitter;
- upon a determination that the communications in the industrial network do not fall within the anomalous bounds, indicating the industrial network is potentially under attack;
- and
- upon a determination that the communications in the industrial network fall within the anomalous bounds, indicating the industrial network is functioning normally.
A system comprising:
- memory storing instructions;
- one or more processors configured to execute the instructions to cause the one or more processors to:
- implement a supervisory control and data acquisition system for an industrial control system to monitor industrial machinery in an industrial network;
- generating one or more thresholds for the network jitter based at least in part on a generated baseline for a network jitter in the supervisory control and data acquisition system based on communications within the industrial network;
- determining whether the communications in the industrial network fall within the one or more thresholds for the network jitter;
- upon a determination that the communications in the industrial network do not fall within the one or more thresholds, indicating that the industrial network is potentially under attack;
- and
- upon a determination that the communications in the industrial network fall within the one or more thresholds, indicating that the industrial network is functioning normally.
Dependencies are inferred from the claim text.