Patent ID: 11934521
Assignee: SONALYSTS, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 0:
1. A method performed by a computer that has been programmed with instructions that cause the computer to function as a threat monitoring device for determining, for an industrial control system that performs an industrial control process within an industrial control facility over a data communication network, cross-correlated behaviors of an information technology (IT) domain, an operational technology (OT) domain, and a physical access (PA) domain of the industrial control facility, the method comprising:
receiving first sensor data from the IT domain, wherein the first sensor data received from the IT domain includes communication network traffic information transmitted over the data communication network by network devices;
receiving second sensor data from the OT domain, wherein the second sensor data received from the OT domain includes measurements and actions from particular sensors, actuators, and other components controlled by a controller of the industrial control system, the controller controlling a state of the industrial control process, and wherein the second sensor data includes at least one of a reliability of the industrial control system, a peak capacity of the industrial control system, emission levels of the industrial control system, a status of an operator of the industrial control system, or a response rate of the industrial control system; and
receiving third sensor data from the PA domain, wherein the third sensor data received from the PA domain includes data from one or more of video surveillance systems, burglar alarm systems, and card-reader access control systems;
fusing the first, second, and third sensor data of each of the IT, OT, and PA domains, respectively, to obtain fused sensor data having a common format;
determining feature sets from the fused sensor data using behavior profiles;
constructing behaviors as sets of the features over particular time periods;
classifying the behaviors to determine a degree of anomaly;
classifying anomalous behaviors to determine a threat probability;
generating an alert based on the determined degree of anomaly and the determined threat probability; and
displaying particular sensor data and particular time periods associated with the alert.