Network-based whitelisting approach for critical systems

A non-transitory, tangible, computer-readable media having instructions thereupon which, when executed by a processor, cause the processor to perform a method comprising:

• categorizing, into types of messages, according to message source, message destination, repeated and unchanging portion of message, and variable parameter portion of message, through protocol learning, message clustering, region synthesis, and without a priori knowledge of specific message formats and protocols of a control system, a plurality of messages of networked controllers in a control system, the plurality of messages collected from a network of the networked controllers wherein the plurality of messages are from within the control system;
• generating a time series involved in a message exchange and cause-effect relationships;
• analyzing the plurality of messages as to periodicity and the cause-effect relationships according to the categorizing and based on the time series;
• and
• generating a model of the control system according to the categorizing and the analyzing, the model indicating periodicity in at least one type of message, the model indicating a cause and effect relationship between at least two types of messages, the model indicating at least one value of a variable parameter in at least one type of message, each of a plurality of states of the model indicating one of a plurality of message prototypes, a source of the message prototype, and a destination of the message prototype, wherein the source and destination are members of the network controller in the control system, with each message prototype capturing semantics of a specific message type.

A control system monitoring apparatus, comprising:

• a memory;
• a network port, configured to couple to a network having a plurality of controllers coupled thereto;
• and
• a processor, coupled to the memory and to the network port, the processor configured to perform actions including:
• characterizing, through protocol learning, message clustering, region synthesis, and without a priori knowledge of specific message formats and protocols of the control system, by generating a plurality of message prototypes each capturing semantics of a specific message type, each of a plurality of messages as to source, destination, unchanging and changing portions of the messages, the plurality of messages communicated among the plurality of controllers and gathered from the network, via the network port, during a training phase wherein the plurality of messages are from within a control system;
• generating a time series based on the characterized plurality of messages and involved in a message exchange and cause-effect relationships;
• extracting a periodicity of repeating messages and the cause-effect relationships in the time series, each of the repeating messages having a same unchanging portion of the message;
• extracting a statistical range of at least one of the changing portions of the messages;
• extracting a cause and effect dependency of at least one characterized type of message on another characterized type of message, based on the time series;
• forming a model, in the memory, based on the characterized plurality of messages, the periodicity, the statistical range, and the cause and effect dependency, each of a plurality of states of the model indicating one of the plurality of message prototypes, the source of the message prototype, and the destination of the message prototype, the source and destination are members of the plurality of controllers in the control system;
• comparing at least one further message, gathered from the network during a monitoring phase, to the model;
• and
• communicating regarding an anomaly in an event of the comparing showing a deviation of the at least one further message from the model.