US 11,924,227 B2
Hybrid unsupervised machine learning framework for industrial control system intrusion detection
Jiaxing Pi, Weehawken, NJ (US); Dong Wei, Edison, NJ (US); Leandro Pfleger de Aguiar, Robbinsville, NJ (US); Honggang Wang, Edison, NJ (US); and Saman Zonouz, Edison, NJ (US)
Assigned to SIEMENS AKTIENGESELLSCHAFT, Munich (DE); and Rutgers University, New Brunswick, NJ (US)
Appl. No. 17/259,010
Filed by Siemens Aktiengesellschaft, Munich (DE); and Rutgers University, New Brunswick, NJ (US)
PCT Filed Jun. 18, 2019, PCT No. PCT/US2019/037600
§ 371(c)(1), (2) Date Jan. 8, 2021,
PCT Pub. No. WO2020/013958, PCT Pub. Date Jan. 16, 2020.
Claims priority of provisional application 62/695,873, filed on Jul. 10, 2018.
Prior Publication US 2021/0306356 A1, Sep. 30, 2021
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1416 (2013.01) [H04L 63/1425 (2013.01); H04L 63/1466 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method of protecting an industrial system from cyberattacks, the method comprising:
collecting initial operating data from a plurality of sensors each positioned within the industrial system and operable to monitor an operating parameter of the industrial system;
analyzing the initial operating data to develop a program that includes a time-series database including expected operating ranges for each operating parameter, a clustering-based database that includes clusters of operating parameters having similarities, and a correlation database that includes pairs of operating parameters that show a correlation in their initial operating data;
operating the program including the time-series database, the clustering-based database, and the correlation database in a computer, the program operable to receive current operating data and to analyze that operating data in view of each of the time-series database, the clustering-based database, and the correlation database; and
triggering an alarm in response to the analysis of the current operating data indicating at least one of an operating parameter outside of an expected range, a change in the expected clustering, and a variation in a correlation.