Protocol-independent anomaly detection
US11297082B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Aug 8, 2019 |
| Grant date | Apr 5, 2022 |
| Priority date | — |
| Expiry date | May 26, 2040 |
Classification
- Technology area (CPC Y)Emerging Cross-Sectional Technologies
- CPC primaryY02P90/02
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
A computer-implemented method for implementing protocol-independent anomaly detection within an industrial control system (ICS) includes implementing a detection stage, including performing byte filtering using a byte filtering model based on at least one new network packet associated with the ICS, performing horizontal detection to determine whether a horizontal constraint anomaly exists in the at least one network packet based on the byte filtering and a horizontal model, including analyzing constraints across different bytes of the at least one new network packet, performing message clustering based on the horizontal detection to generate first cluster information, and performing vertical detection to determine whether a vertical anomaly exists based on the first cluster information and a vertical model, including analyzing a temporal pattern of each byte of the at least one new network packet.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.