Critical infrastructure forensics
AssigneeSiemens Aktiengesellschaft
InventorsArquimedes Martinez Canedo, Justinian Rosca, Sanjeev Srivastava
Life of this patent
Estimating the term…
Abstract
A computer-implemented method for detecting cyber-attacks affecting a computing device includes retrieving a plurality of sensor datasets from a plurality of sensors, each sensor dataset corresponding to involuntary emissions from the computing device in a particular modality and extracting a plurality of features from the plurality of sensor datasets. One or more statistical models are applied to the plurality of features to identify one or more events related to the computing device. Additionally, a domain-specific ontology is applied to designate each of the one or more events as benign, failure, or a cyber-attack.
Claims20
A computer-implemented method for detecting cyber-attacks affecting a computing device, the method comprising:
- retrieving a plurality of sensor datasets with heterogeneous modalities from a plurality of multi-modal sensors, each sensor dataset corresponding to involuntary emissions from the computing device in a particular modality;
- extracting a plurality of features from the plurality of sensor datasets;
- applying one or more statistical models to the plurality of features to identify one or more events related to the computing device;
- and
- applying a domain-specific ontology to designate each of the one or more events as benign, failure, or a cyber-attack.
A system for detecting cyber-attacks affecting a computing device, the system comprising:
- a data access module configured to retrieve a plurality of sensor datasets with heterogeneous modalities from a plurality of multi-modal sensors, each sensor dataset corresponding to involuntary emissions from the computing device in a particular modality;
- a statistical learning of signatures module configured to extract a plurality of features from the plurality of sensor datasets;
- an online detection module configured to:
- apply one or more statistical models to the plurality of features to identify one or more events related to the computing device, and
- apply a domain-specific ontology to designate each of the one or more events as benign, failure, or a cyber-attack;
- and
- one or more processors configured to execute the data access module, the statistical learning of signatures module, and the online detection module.
A system for detecting cyber-attacks affecting a computing device, the system comprising:
- at least one processor;
- and
- a non-transitory, computer-readable storage medium in operable communication with the processor, wherein the computer-readable storage medium contains one or more programming instructions that, when executed, cause the at least one processor to:
- retrieve a plurality of sensor datasets with heterogeneous modalities from a plurality of multi-modal sensors, each sensor dataset corresponding to involuntary emissions from the computing device in a particular modality;
- extract a plurality of features from the plurality of sensor datasets;
- apply one or more statistical models to the plurality of features to identify one or more events related to the computing device;
- and
- apply a domain-specific ontology to designate each of the one or more events as benign, failure, or a cyber-attack.
Dependencies are inferred from the claim text.