Computer system and method for DETERMINING a CAUSE of an anomaly event for a network device
AssigneeSchneider Electric USA, Inc.
InventorMichael William Pyle
Life of this patent
Estimating the term…
Abstract
A computer system and method that provides a computer-implemented method for a network monitoring device/system for determining a root cause of a detected anomaly event for at least one network device using one or more computer algorithmic techniques. At least one network device is operatively coupled to a computer network that is monitored by: 1) a Supervisory Control and Data Acquisition (SCADA) system for detecting one or more anomaly events associated with one or more network devices, and 2) an Intrusion Detection System (IDS) for detecting one or more network events associated with a computer network that is coupled to, or otherwise associated with, the one or more network devices.
Claims22
A computer-implemented method for a network monitoring device for determining a cause of a detected anomaly event for at least one network device coupled to a computer network using one or more computer algorithmic techniques, wherein the computer network is operatively coupled to:
- 1) an automated and industrial control (AIC) system for detecting one or more process anomaly events associated with the at least one network device, and 2) an Intrusion Detection System (IDS) for detecting one or more network events associated with the computer network, comprising the steps:
- capturing, in a computer processor of the network monitoring device, from the AIC system, data related to a detected process anomaly event for the at least one network device;
- capturing, in the computer processor, from the IDS, data related to a detected network event occurring in the computer network;
- correlating, by the computer processor using the one or more computer algorithmic techniques, the captured data from the AIC system and IDS to determine if the detected process anomaly event for the at least one network device was caused by a network anomaly event.
A computer monitoring device for determining a cause of a detected process anomaly event for at least one network device, comprising:
- a memory configured to store instructions;
- a processor disposed in communication with said memory, wherein said processor upon execution of the instructions is configured to:
- capture from an automated and industrial control (AIC) system, data related to a detected process anomaly event for the at least one network device;
- capture from an Intrusion Detection System (IDS), data related to a detected network event occurring in the computer network;
- correlate using one or more computer algorithmic techniques, the captured data from each of the AIC system and IDS to determine if the detected process anomaly event for the at least one network device was caused by a network anomaly event.
Dependencies are inferred from the claim text.