Method and apparatus for detecting the anomalies of an infrastructure

The method according to one or more claims from 1, wherein before said comparison step said method comprises the step of defining said critical states, wherein said step of defining the critical states comprising the steps of

• analysing, by means of said network analyser connected to said telecommunication system, each of said data packets exchanged in a. predetermined time interval;
• identifying, by means of said network analyser, for each of said analysed data packet, the network protocols used and at least one field of said protocols;
• generating, through said computerized data processing means, an aggregate virtual representation of said infrastructure in said predetermined time interval based on said protocols and fields of said protocols identified with each exchanged data packet;
• storing, in second storage means of the permanent type, said aggregate virtual representation;
• identifying said critical states as virtual representations not comprised in said aggregate virtual representation.

An apparatus (100) for detecting anomalies in an infrastructure (1) provided with:

• one or more actuators (10, 20) and/or sensors operatively connected to one or more logic controllers (12, 22, 32), wherein said logic controllers (12, 22, 32) control, in use, values of the variable attributes relating to the physical state of said actuators and/or sensors;
• at least one supervision unit (52) of said logic controllers (12, 22, 32);
• a telecommunication system between said logic controllers and/or said supervision unit (52) and said logic controllers (12, 22, 32), said telecommunication system being able to exchange data packets (PD) comprising said values of the variable attributes of the physical state by means of network communication protocols;
• said apparatus (100) for detecting anomalies comprising:
• a network analyser (101) able to be connected to said telecommunication system, wherein said network analyser (101) is able to analyse each of said data packets (PD) exchanged in said telecommunication system and to identify the network protocol used for each of said data packets (PD) and at least one field of said protocol;
• computerized data processing means (102) operatively connected to said network analyser (101), said computerized data processing means (102) being able to generate a virtual representation of said infrastructure (1) on the basis of said protocols and fields of said protocols identified by said network analyser (101) to each exchanged data packet (PD);
• first volatile storage means (103) operatively connected to said computerized means (102), said first storage means (103) storing said virtual representation generated for each exchanged data packet (PD);
• second permanent storage means (104) operatively connected to said computerized means (102), said second storage means (104) comprising in their memory one or more comparison elements;
• wherein said computerized data processing means, in use, compare said virtual representation with at least one of said comparison elements, and wherein the computerized data processing means identify and signal at least one critical state of said infrastructure from the differences and/or similarities between said stored virtual representation and said comparison elements.