Patent ID: 9384066
Filing Date: 2016-07-05
CPC Classification: G06F

Claim Text:
1. A method for monitoring messages in an industrial control system, comprising: obtaining a training set of messages; generating a model based on mapping a plurality of message field sequences in subsets of the training set of messages, using processor-based recursion evaluation of message field values in the training set of messages; obtaining a message outside of the training set of messages; determining whether the message matches the model, starting at a first message field, and proceeding via recursion to each next message field, wherein the determining includes evaluating message values at all message fields of the message, and wherein the model includes at least one fixed byte value, at least one length field value representing a length of a message, and at least one opcode field value; and indicating the message is an outlier in response to the determining showing noncompliance for the message relative to the model, wherein at least one method operation is executed through a processor.