Patent ID: 11934521
Assignee: SONALYSTS, INC.
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 7:
8. A monitoring device for determining, for an industrial control system that performs an industrial control process within an industrial control facility over a data communication network, cross-correlated behaviors of an information technology (IT) domain, an operational technology (OT) domain, and a physical access (PA) domain of the industrial control facility, the monitoring device comprising:
data fusion circuitry configured to receive and fuse, into fused sensor data having a common format, first sensor data from the IT domain, wherein the first sensor data received from the IT domain includes communication network traffic information transmitted over the data communication network by network devices, second sensor data from the OT domain, wherein the second sensor data received from the OT domain includes measurements and actions from particular sensors, actuators, and other components controlled by a controller of the industrial control system, the controller controlling a state of the industrial control process, and wherein the second sensor data includes at least one of a reliability of the industrial control system, a peak capacity of the industrial control system, emission levels of the industrial control system, a status of an operator of the industrial control system, or a response rate of the industrial control system, and third sensor data from the PA domain, wherein the third sensor data received from the PA domain includes data from one or more of video surveillance systems, burglar alarm systems, and card-reader access control systems;
data preparation circuitry configured to construct features from the fused sensor data using behavior profiles, and to construct behaviors as sets of the features over particular time periods;
threat discovery circuitry configured to
classify the behaviors to determine a degree of anomaly,
classify the anomalous behaviors to determine a threat probability, and
generate an alert based on the determined degree of anomaly and the determined threat probability; and

presentation circuitry configured to display particular sensor data and particular time periods associated with the alert.