Back to results
US 2019/0297095 A1Published application
Systems and Methods For Detecting Anomalous Software on a Programmable Logic Controller
AssigneeGeorgia Tech Research Corporation
InventorsDavid Formby, Abdul Raheem Beyah
Life of this patent
Estimating the term…
Abstract
There is provided a method including: during a training period, collecting a plurality of scan cycle times of a programmable logic controller (PLC) program executing on a PLC; calculating one or more baseline parameters based on the plurality of scan cycle times; determining a baseline PLC program signature based on the one or more baseline statistical parameters; and storing the baseline PLC program signature.
Claims47
A method comprising:
- during a training period, collecting one or more scan cycle times of a programmable logic controller (PLC) program executing on a PLC;
- calculating one or more baseline parameters based on one or more of the scan cycle times;
- determining a baseline PLC program signature comprising:
- a first portion representing commonly executed program paths and determined based on one or more of the baseline parameters;
- and
- a second portion representing undetected program paths and determined based on one or more of the calculated scan cycle times of the PLC program;
- and
- storing the baseline PLC program signature.
5 more elements
(canceled)
A method comprising:
- during operation of a programmable logic controller (PLC), collecting one or more scan cycle times of a PLC program executing on the PLC;
- comparing one or more scan cycle times to a baseline PLC program signature based on at least a mean value of scan cycle times, wherein comparing comprises:
- calculating a cumulative difference between one or more scan cycle times and the mean value;
- and
- comparing the cumulative difference to a cumulative sum threshold value;
- and
- outputting a first indicator that indicates a deviation of the PLC program operation from an expected PLC program operation based on the comparing.
4 more elements
A method comprising:
- during operation of a programmable logic controller (PLC), collecting one or more scan cycle times of a PLC program executing on the PLC;
- comparing one or more scan cycle times to a baseline PLC program signature;
- outputting a first indicator that indicates a deviation of the PLC program operation from an expected PLC program operation based on the comparing;
- receiving, from the PLC, an indication of progress of a proof of work function executed by the PLC;
- comparing the progress of the proof of work function to an expected progress based on at least one of one or more scan cycle times and a count of scan cycles;
- and
- outputting a second indicator that indicates a deviation of the PLC program operation from the expected PLC program operation based on comparing the progress of the proof of work function.
4 more elements
A method comprising:
- during operation of a programmable logic controller (PLC), collecting one or more scan cycle times of a PLC program executing on the PLC;
- comparing one or more scan cycle times to a baseline PLC program signature;
- outputting a first indicator that indicates a deviation of the PLC program operation from an expected PLC program operation based on the comparing;
- during operation of the PLC, collecting one or more scan cycle time verification values;
- comparing one or more scan cycle time verification values to one or more scan cycle times;
- and
- outputting a second indicator that indicates a deviation of the PLC program operation from the expected PLC program operation based on comparing one or more scan cycle time verification values to one or more scan cycle times.
4 more elements
A system comprising:
- a receiver;
- a transmitter;
- a processor;
- and
- a memory having stored thereon computer program code that, when executed by the processor, instructs the processor to:
- collect, during operation of a programmable logic controller (PLC) and through the receiver, one or more scan cycle times of a PLC program executing on the PLC;
- compare one or more scan cycle times to a baseline PLC program signature based on at least a mean value of scan cycle times, wherein comparing comprises:
- calculating a cumulative difference between one or more scan cycle times and the mean value;
- and
- comparing the cumulative difference to a cumulative sum threshold value;
- and
- output, via the transmitter, a first indicator that indicates a deviation of the PLC program operation from an expected PLC program operation based on comparing one or more scan cycle times to the baseline PLC program signature.
9 more elements
A system comprising:
- a receiver;
- a transmitter;
- a processor;
- and
- a memory having stored thereon computer program code that, when executed by the processor, instructs the processor to:
- collect, during operation of a programmable logic controller (PLC) and through the receiver, one or more scan cycle times of a PLC program executing on the PLC;
- compare one or more scan cycle times to a baseline PLC program signature;
- output, via the transmitter, a first indicator that indicates a deviation of the PLC program operation from an expected PLC program operation based on comparing one or more scan cycle times to the baseline PLC program signature;
- receive, from the PLC and through the receiver, an indication of progress of a proof of work function executed by the PLC;
- compare the progress of the proof of work function to an expected progress based on one or more of the scan cycle times;
- and
- output, via the transmitter, a second indicator that indicates a deviation of the PLC program operation from the expected PLC program operation based on comparing the progress of the proof of work function.
9 more elements
A system comprising:
- a receiver;
- a transmitter;
- a processor;
- and
- a memory having stored thereon computer program code that, when executed by the processor, instructs the processor to:
- collect, during operation of a programmable logic controller (PLC) and through the receiver, one or more scan cycle times of a PLC program executing on the PLC;
- compare one or more scan cycle times to a baseline PLC program signature;
- output, via the transmitter, a first indicator that indicates a deviation of the PLC program operation from an expected PLC program operation based on comparing one or more scan cycle times to the baseline PLC program signature;
- receive, through the receiver, one or more scan cycle time verification values;
- compare one or more scan cycle time verification values to one or more scan cycle times;
- and
- output, via the transmitter, a second indicator that indicates a deviation of the PLC program operation from the expected PLC program operation based on comparing one or more scan cycle time verification values to one or more scan cycle times.
9 more elements
A method comprising:
- obtaining expected execution times for instructions of a programmable logic controller (PLC) program;
- identifying one or more branches of the PLC program, each branch comprising a respective set of instructions;
- calculating, for one or more branches, one or more scan cycle times of the PLC program based on the obtained expected execution times for one or more of the instructions and the respective set of instructions;
- determining a baseline PLC program signature based on one or more of the calculated scan cycle times;
- and
- storing the baseline PLC program signature.
3 more elements
A system comprising:
- a receiver;
- a processor;
- and
- a memory having stored thereon computer program code that, when executed by the processor, instructs the processor to:
- collect, during operation of a programmable logic controller (PLC) and through the receiver, one or more scan cycle times of a PLC program executing on the PLC;
- calculate one or more baseline parameters based on one or more of the scan cycle times;
- and
- determine a baseline PLC program signature comprising:
- a first portion representing commonly executed program paths and determined based on one or more of the baseline parameters;
- and
- a second portion representing undetected program paths and determined based on one or more of the calculated scan cycle times of the PLC program.
8 more elements
Dependencies are inferred from the claim text.