US 12,432,223 B1
Embedded intrusion detection system for industrial controllers
Rishabh Das, Huntsville, AL (US); and Thomas Heath Morris, Huntsville, AL (US)
Assigned to Board of Trustees of the Univeristy of Alabama, for and on behalf of the University of Alabama in Huntsville, Huntsville, AL (US)
Filed by Board of Trustees of the University of Alabama, for and on behalf of the University of Alabama in Huntsville, Huntsville, AL (US)
Filed on Dec. 10, 2021, as Appl. No. 17/548,109.
Claims priority of provisional application 63/143,430, filed on Jan. 29, 2021.
Int. Cl. H04L 9/40 (2022.01); G05B 19/4063 (2006.01)
CPC H04L 63/1416 (2013.01) [G05B 19/4063 (2013.01); G05B 2219/45103 (2013.01)] 19 Claims
OG exemplary drawing
 
1. An industrial controller for an industrial control system, the industrial controller comprising:
at least one processor;
a memory device connected to the at least one processor;
a communication interface configured to permit communications with other industrial controllers of the industrial control system; and
an intrusion detection system, the intrusion detection system having instructions that, when executed by the at least one processor, cause the at least one processor to:
receive state information about one or more devices connected to the industrial controller;
receive, from additional industrial controllers of the industrial control system via the communication interface, additional state information on additional devices connected to the additional industrial controllers; and
evaluate, with a plurality of first state estimators and one or more second state estimators, the received state information and the received additional state information to determine whether the one or more devices or the additional devices are operating within expected ranges, wherein operation of a device outside of a corresponding expected range indicates that the industrial control system is being attacked, and wherein each of the additional devices has a corresponding first state estimator of the plurality of first state estimators and each of the one or more devices has a corresponding second state estimator of the one or more second state estimators.