Collection of plc indicators of compromise and forensic data
AssigneeSiemens Aktiengesellschaft
InventorsLeandro Pfleger de Aguiar, Dong Wei, Stefan Woronka
Life of this patent
Estimating the term…
Abstract
The present embodiments relate to monitoring and analyzing programmable logic controllers (PLC) for security threats. By way of introduction, the present embodiments described below include apparatuses and methods for non-intrusive monitoring and forensic data collection for PLCs. Security monitoring and forensic applications are provided to perform secure collection, compression and export of PLC information. The security monitoring and forensic applications collect data indicative of low level PLC data and operations, and a forensic environment is provided to analyze the PLC data and operations and to perform forensic simulations.
Claims20
A method of monitoring a programmable logic controller (PLC), the method comprising:
- receiving (501), by a server implementing a forensic environment from a PLC monitoring application of the PLC or another PLC, PLC security data and PLC process data;
- analyzing (503), by the server in the forensic environment, the PLC security data and the PLC process data;
- validating (505), by the server in the forensic environment, a security event of the PLC based on the analyzing;
- initiating (507), by the server with the forensic environment via a PLC forensics application, forensic data collection for the PLC;
- and
- receiving (509), by the forensic environment of the server and from the PLC forensics application, forensic data for the security event of the PLC.
A system for monitoring programmable logic controller (PLC) operations, the system comprising:
- a memory (601A) configured to store a security monitoring application and a security forensics application;
- and
- a processor (601B) configured to:
- execute the security monitoring application (601C) to collect data indicative of PLC operations;
- and
- execute the security forensics application (601D) to perform non-intrusive forensic evidence collection.
A method of monitoring a programmable logic controller (PLC), the method comprising:
- defining (201) a plurality of PLC operations for monitoring, the plurality of PLC operations indicative of a security event;
- monitoring (203) the plurality of PLC operations, the monitoring comprising:
- collecting data representative of the plurality of PLC operations, process data and PLC status;
- analyzing the data for the security event;
- and
- validating the security event;
- and
- deploying (205), in response to the detected security event, forensic data collection for the PLC.
Dependencies are inferred from the claim text.