# US 2022/0128985 A1 · Zero-trust architecture for industrial automation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2022/0128985 A1 - Document ID: US20220128985A1 - Status: Published application - Kind: A1 - Application number: 17/077,018 - Filed: 2020-10-22 - Published: 2022-04-28 - Earliest claimed: 2020-10-22 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Thomas Szigeti; Robert E. Barton; Jerome Henry - Web page: https://patentgrep.com/patent/US20220128985A1 ## CPC - G05B 23/0237: {based on parallel systems, e.g. comparing signals produced at the same time by same type systems and detect faulty ones by noticing differences among their responses} - G05B 23/0256: {injecting test signals and analyzing monitored process response, e.g. injecting the test signal while interrupting the normal operation of the monitored system; superimposing the test signal onto a control signal during normal operation of the monitored system} - G05B 23/024: {Quantitative history assessment, e.g. mathematical relationships between available data; Functions therefor; Principal component analysis [PCA]; Partial least square [PLS]; Statistical classifiers, e.g. Bayesian networks, linear regression or correlation analysis; Neural networks} - G05B 23/0262: {Confirmation of fault detection, e.g. extra checks to confirm that a failure has indeed occurred} - G05B 23/0275: {Fault isolation and identification, e.g. classify fault; estimate cause or root of failure} - G06N 20/00: Machine learning - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 43/065: related to network devices - H04L 43/0817: by checking functioning - H04L 43/50: Testing arrangements - G05B 2219/42077: Position, speed or current, combined with vibration feedback - H04L 41/0631: using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis - H04L 41/0894: Policy-based network configuration management - H04L 41/142: using statistical or mathematical methods - H04L 41/149: for prediction of maintenance - H04L 43/20: the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV - G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract According to one or more embodiments of the disclosure, a device in a network obtains parameters for entropy testing of industrial equipment that controls a physical process. Entropy is added to commands sent to the industrial equipment during the entropy testing. The device receives packets that were generated during the entropy testing of the industrial equipment and include sensor data regarding the physical process. The device determines whether the sensor data is inconsistent by analyzing the sensor data using a machine learning model that models the physical process. The device initiates a corrective measure, when the sensor data is determined to be inconsistent. ## Claims ### Claim 1 A method comprising: obtaining, by a device in a network, parameters for entropy testing of industrial equipment that controls a physical process, wherein entropy is added to commands sent to the industrial equipment during the entropy testing; receiving, at the device, packets that were generated during the entropy testing of the industrial equipment and include sensor data regarding the physical process; determining, by the device, whether the sensor data is inconsistent by analyzing the sensor data using a machine learning model that models the physical process; and initiating, by the device, a corrective measure, when the sensor data is determined to be inconsistent. ### Claim 2 (depends on 1) The method as in claim 1, wherein the corrective measure comprises shutting down the physical process or sending an alert to a user interface. ### Claim 3 (depends on 1) The method as in claim 1, further comprising: extracting, by the device, the sensor data from the packets by performing deep packet inspection of the packets. ### Claim 4 (depends on 1) The method as in claim 1, wherein the device comprises a router or network switch. ### Claim 5 (depends on 1) The method as in claim 1, wherein the parameters for the entropy testing are indicative of a start time for the entropy testing and the commands sent to the industrial equipment during the entropy testing. ### Claim 6 (depends on 1) The method as in claim 1, wherein the machine learning model comprises a cluster-based classifier. ### Claim 7 (depends on 1) The method as in claim 1, wherein the machine learning model is trained in part by using principal component analysis to identify correlated variables associated with the physical process. ### Claim 8 (depends on 1) The method as in claim 1, wherein the sensor data regarding the physical process is indicative of at least one of: a temperature measurement, a pressure measurement, or a vibration measurement. ### Claim 9 (depends on 1) The method as in claim 1, wherein a start time for the entropy testing is selected randomly by a security service for the network. ### Claim 10 (depends on 1) The method as in claim 1, wherein the entropy added to the commands sent to the industrial equipment during the entropy testing is selected based in part on a safe operating range for the industrial equipment. ### Claim 11 An apparatus, comprising: one or more network interfaces to communicate with a network; a processor coupled to the one or more network interfaces and configured to execute one or more processes; and a memory configured to store a process that is executable by the processor, the process when executed configured to: obtain parameters for entropy testing of industrial equipment that controls a physical process, wherein entropy is added to commands sent to the industrial equipment during the entropy testing; receive packets that were generated during the entropy testing of the industrial equipment and include sensor data regarding the physical process; determine whether the sensor data is inconsistent by analyzing the sensor data using a machine learning model that models the physical process; and initiate a corrective measure, when the sensor data is determined to be inconsistent. ### Claim 12 (depends on 11) The apparatus as in claim 11, wherein the corrective measure comprises shutting down the physical process or sending an alert to a user interface. ### Claim 13 (depends on 11) The apparatus as in claim 11, wherein the process when executed is further configured to: extract the sensor data from the packets by performing deep packet inspection of the packets. ### Claim 14 (depends on 11) The apparatus as in claim 11, wherein the apparatus comprises a router or network switch. ### Claim 15 (depends on 11) The apparatus as in claim 11, wherein the parameters for the entropy testing are indicative of a start time for the entropy testing and the commands sent to the industrial equipment during the entropy testing. ### Claim 16 (depends on 11) The apparatus as in claim 11, wherein the machine learning model comprises a cluster-based classifier. ### Claim 17 (depends on 11) The apparatus as in claim 11, wherein the sensor data regarding the physical process is indicative of at least one of: a temperature measurement, a pressure measurement, or a vibration measurement. ### Claim 18 (depends on 11) The apparatus as in claim 11, wherein a start time for the entropy testing is selected randomly by a security service for the network. ### Claim 19 (depends on 11) The apparatus as in claim 11, wherein the entropy added to the commands sent to the industrial equipment during the entropy testing is selected based in part on a safe operating range for the industrial equipment. ### Claim 20 A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising: obtaining, by the device in the network, parameters for entropy testing of industrial equipment that controls a physical process, wherein entropy is added to commands sent to the industrial equipment during the entropy testing; receiving, at the device, packets that were generated during the entropy testing of the industrial equipment and include sensor data regarding the physical process; determining, by the device, whether the sensor data is inconsistent by analyzing the sensor data using a machine learning model that models the physical process; and initiating, by the device, a corrective measure, when the sensor data is determined to be inconsistent.