Smart infrastructure control systems (sics) security monitoring and defense

A computer implemented method comprising:

• providing a control application configured to exchange messages over at least one network, the messages including commands to a plurality of devices to control the plurality of devices;
• generating and storing log data for the control application in one or more log files held in at least one memory, where the log data is generated in dependence upon the messages exchanged over the at least one network by the control application;
• extracting a set of information from the at least one memory, the set of information including a subset of the log data from the one or more log files;
• analysing the extracted subset of the log data to determine whether any of a set of conditions are met;
• and
• in response to determining that one of the conditions is met, causing an action to be performed to notify a user.

A computer program comprising computer readable instructions, which when executed by at least one processor cause a method to be performed, the method comprising:

• providing a control application configured to exchange messages over at least one network, the messages including commands to a plurality of devices to control the plurality of devices;
• generating and storing log data for the control application in one or more log files held in at least one memory, where the log data is generated in dependence upon the messages exchanged over the at least one network by the control application;
• extracting a set of information from the at least one memory, the set of information including a subset of the log data from the one or more log files;
• analysing the extracted subset of the log data to determine whether any of a set of conditions are met;
• and
• in response to determining that one of the conditions is met, causing an action to be performed to notify a user.