Patent ID: 11934521
Assignee: SONALYSTS, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 13:
14. A monitoring device for determining, for an industrial control system that performs an industrial control process within an industrial control facility over a data communication network, cross-correlated behaviors of an information technology (IT) domain, an operational technology (OT) domain, and a physical access PA domain of the industrial control facility, the monitoring device comprising:
data ingestion circuitry configured to receive, via a streaming service, first sensor data from the IT domain, wherein the first sensor data received from the IT domain includes communication network traffic information transmitted over the data communication network by network devices, second sensor data from the OT domain, wherein the second sensor data received from the OT domain includes measurements and actions from particular sensors, actuators, and other components controlled by a controller of the industrial control system, the controller controlling a state of the industrial control process, and wherein the second sensor data includes at least one of a reliability of the industrial control system, a peak capacity of the industrial control system, emission levels of the industrial control system, a status of an operator of the industrial control system, or a response rate of the industrial control system, and third sensor data from the PA domain, wherein the third sensor data received from the PA domain includes data from one or more of video surveillance systems, burglar alarm systems, and card-reader access control systems, and to receive, via a bulk ingestion service, the first sensor data from the IT domain, the second sensor data from the OT domain, and the third sensor data from the PA domain;
data preparation circuitry configured to perform online data preparation and offline data preparation, including determining feature sets from the streamed sensor data and the bulk ingested sensor data using behavior profiles, and constructing behaviors as sets of the features over particular time periods;
machine learning model training circuitry configured to train a plurality of domain machine learning models, including one for each of the IT, OT, and PA domains, and including, for each domain model, mapping each domain to its own domain machine learning model, each domain's machine learning model producing independent results, and then the machine learning model training service training a cross-correlation machine learning model to perform cross-correlation across those domain machine learning model results to find and analyze cross-domain anomalies;
machine-learning model scoring circuitry configured to select selected machine learning models from among the plurality of domain machine learning models by performing a scoring process; and
performance monitoring circuitry configured to evaluate the performance of the selected domain machine learning models.