# US 2019/0173899 A1 · Network security assessment using a network traffic parameter > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0173899 A1 - Document ID: US20190173899A1 - Status: Published application - Kind: A1 - Application number: 16/206,733 - Filed: 2018-11-30 - Published: 2019-06-06 - Earliest claimed: 2017-12-05 - Assignees: Schweitzer Engineering Laboratories, Inc. - Applicants: Schweitzer Engineering Laboratories, Inc. - Inventors: Cody W. Tews; Cassandra Seubert - Web page: https://patentgrep.com/patent/US20190173899A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - H04L 63/1433: {Vulnerability analysis} - G06N 20/00: Machine learning - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Systems and methods may be used to assess network communications by generating one or more thresholds for network traffic parameters based at least in part on a generated baseline for the network traffic parameter in the supervisory control and data acquisition system based on communications within the industrial network. Network communications may be assessed by determining whether the communications in the industrial network fall within the one or more thresholds for the network traffic parameter. ## Claims ### Claim 1 A method, comprising: receiving, at an industrial control system, data indicative of a network traffic parameter for network traffic in an industrial network monitored by the industrial control system; establishing a baseline for the network traffic parameter based at least in part on the data; establishing anomalous bounds for the network traffic parameter based at least in part on the baseline for the network traffic parameter; determining whether communications in the industrial network fall within the anomalous bounds for the network traffic parameter; and upon a determination that the communications in the industrial network do not fall within the anomalous bounds, indicating the industrial network is potentially under attack. ### Claim 2 (depends on 1) The method of claim 1, wherein the network traffic parameter comprises network jitter in the industrial network. ### Claim 3 (depends on 1) The method of claim 1, wherein establishing the baseline comprises generating a histogram from the data indicative of the network traffic parameter. ### Claim 4 (depends on 3) The method of claim 3, wherein generating the histogram comprises averaging a plurality of histograms of sub-sequences of the data indicative of the network traffic parameter. ### Claim 5 (depends on 3) The method of claim 3, wherein generating the histogram comprises performing vector quantization on a plurality of histograms of sub-sequences of the data indicative of the network traffic parameter. ### Claim 6 (depends on 1) The method of claim 1, wherein establishing the baseline comprises generating a probability mass function for the data indicative of the network traffic parameter. ### Claim 7 (depends on 1) The method of claim 1, wherein establishing the anomalous bounds comprises generating an anomaly score threshold for the data indicative of the network traffic parameter. ### Claim 8 (depends on 7) The method of claim 7, wherein generating the anomaly score threshold is based at least in part on a mean and standard deviation of the data indicative of the network traffic parameter. ### Claim 9 (depends on 8) The method of claim 8, wherein determining whether communications in the industrial network fall within the anomalous bounds for the network traffic parameter comprises: determining an anomaly score for the communications using subsequent data indicative of the network traffic parameter; and determining that the communications does not fall within the anomalous bounds when the anomaly score exceeds the anomaly score threshold. ### Claim 10 (depends on 1) The method of claim 1, wherein establishing the anomalous bounds comprises generating probability bounds on both sides of a probability curve for the network traffic parameter. ### Claim 11 (depends on 10) The method of claim 10, wherein generating the probability bounds comprises using the Dvoretzky-Kiefer-Wolfowitz inequality to generate the probability bounds. ### Claim 12 (depends on 11) The method of claim 11, wherein determining whether communications in the industrial network fall within the anomalous bounds for the network traffic parameter comprises: determining whether a present distribution is outside of anomalous bounds; and determining that the communications do not fall within the anomalous bounds when the present distribution is outside of the anomalous bounds at any point. ### Claim 13 (depends on 11) The method of claim 11, wherein determining whether communications in the industrial network fall within the anomalous bounds for the network traffic parameter comprises: determining whether a present distribution is outside of anomalous bounds; and determining that the communications do not fall within the anomalous bounds when the present distribution is outside of the anomalous bounds by an amount greater than an anomaly threshold. ### Claim 14 (depends on 1) The method of claim 1, wherein the industrial control system comprises a supervisory control and data acquisition system, and the network traffic comprises communications within the supervisory control and data acquisition system. ### Claim 15 A tangible, non-transitory, and computer-readable medium having stored thereon instructions, that when executed, are configured to cause a processor to: operate as a component in a supervisory control and data acquisition system for an industrial control system to monitor industrial machinery by communicating within an industrial network; generate a baseline for network jitter in the supervisory control and data acquisition system based on communications within the industrial network; generating anomalous bounds for the network jitter based at least in part on the baseline; determining whether communications in the industrial network fall within the anomalous bounds for the network jitter; upon a determination that the communications in the industrial network do not fall within the anomalous bounds, indicating the industrial network is potentially under attack; and upon a determination that the communications in the industrial network fall within the anomalous bounds, indicating the industrial network is functioning normally. ### Claim 16 (depends on 15) The tangible, non-transitory, and computer-readable medium of claim 15, wherein the network jitter comprises server-centric jitter or client-centric jitter. ### Claim 17 (depends on 15) The tangible, non-transitory, and computer-readable medium of claim 15, wherein generating the anomalous bounds comprises generating an anomaly score threshold for the network jitter, and determining whether communications in the industrial network fall within the anomalous bounds for the network jitter comprises: determining an anomaly score for the communications using subsequent data indicative of subsequent network jitter; and determining that the communications do not fall within the anomalous bounds when the anomaly score exceeds the anomaly score threshold. ### Claim 18 (depends on 15) The tangible, non-transitory, and computer-readable medium of claim 15, wherein establishing the anomalous bounds comprises generating probability bounds on both sides of a probability curve for the network jitter, and wherein determining whether communications in the industrial network fall within the anomalous bounds for the network jitter comprises: determining whether a present distribution is outside of anomalous bounds; and determining that the communications does not fall within the anomalous bounds when the present distribution is outside of the anomalous bounds. ### Claim 19 A system comprising: memory storing instructions; one or more processors configured to execute the instructions to cause the one or more processors to: implement a supervisory control and data acquisition system for an industrial control system to monitor industrial machinery in an industrial network; generating one or more thresholds for the network jitter based at least in part on a generated baseline for a network jitter in the supervisory control and data acquisition system based on communications within the industrial network; determining whether the communications in the industrial network fall within the one or more thresholds for the network jitter; upon a determination that the communications in the industrial network do not fall within the one or more thresholds, indicating that the industrial network is potentially under attack; and upon a determination that the communications in the industrial network fall within the one or more thresholds, indicating that the industrial network is functioning normally. ### Claim 20 (depends on 19) The system of claim 19, wherein the one or more thresholds comprise thresholds on either side of a probability curve based on a probability mass function, and the communications comprise a present distribution of network jitter to be tested for abnormality.