Module and method for detecting anomalies in a critical infrastructure system
AssigneeEnsign InfoSecurity Pte. Ltd.
InventorsWen Ni Pang, Jonathan Whye Wei Goh
Life of this patent
Estimating the term…
Abstract
This disclosure describes a module and method for detecting anomalies in a critical infrastructure (CI) system based on pre-generated rule sets and a trained anomaly detection model. The pre-generated rule sets are automatically generated based on state variables associated with the CI system, while the anomaly detection model is trained on features that are automatically extracted from the CI system. Additionally, the module is configured to dynamically regenerate the rule sets and retrain the anomaly detection model in response to a decline in anomaly detection performance to ensure adaptive and continuous optimization of the anomaly detection system.
Claims20
An anomaly detection module for detecting anomalies in a critical infrastructure (CI) system, the system comprising:
- a processing unit;
- and
- a non-transitory media readable by the processing unit, the media storing instructions that when executed by the processing unit causes the processing unit to:
- receive state variables generated by a plurality of components of the CI system, the state variables comprising discrete and continuous state variables;
- provide the received continuous state variables to a discretization module configured to:
- discretize the received continuous state variables by assigning each received continuous state variable to a cluster, the cluster being one of a plurality of pre-generated clusters, wherein each of the plurality of pre-generated clusters is associated with a cluster center value;
- combine the discretized continuous state variables and received discrete state variables into discretized state variables and provide the discretized state variables to a rule validation module configured to:
- retrieve rule sets associated with all the plurality of components of the CI system, wherein each rule set was generated by applying pattern mining algorithms to sets of discretized baseline state variables, each set being associated with corresponding components of the CI system,
- identify discretized state variables that contravene a rule in the retrieved rule set and flag the component of the CI system associated with the identified discretized state variable with an anomaly tag,
- provide a first list comprising flagged components of the CI system and their corresponding anomaly tags to a priority list database;
- and
- identify anomalous components of the CI system based on the first list stored in the priority list database.
A method for detecting anomalies in a critical infrastructure (CI) system, the method comprising:
- receiving, using an anomaly detection module, state variables generated by a plurality of components of the CI system, the state variables comprising discrete and continuous state variables;
- providing the received continuous state variables to a discretization module configured to:
- discretize the received continuous state variables by assigning each received continuous state variable to a cluster, the cluster being one of a plurality of pre-generated clusters, wherein each of the plurality of pre-generated clusters is associated with a cluster center value;
- combining, using the anomaly detection module, the discretized continuous state variables and received discrete state variables into discretized state variables and providing the discretized state variables to a rule validation module configured to:
- retrieve rule sets associated with all the plurality of components of the CI system, wherein each rule set was generated by applying pattern mining algorithms to sets of discretized baseline state variables, each set being associated with corresponding components of the CI system,
- identify discretized state variables that contravene a rule in the retrieved rule set and flag the component of the CI system associated with the identified discretized state variable with an anomaly tag,
- provide a first list comprising flagged components of the CI system and their corresponding anomaly tags to a priority list database;
- and
- identifying anomalous components of the CI system based on the first list stored in the priority list database.
Dependencies are inferred from the claim text.