Patent ID: 9177139
Filing Date: 2015-11-03
Classification: G05B,G06F,H04L

Abstract:
1. A method, comprising: receiving, by a computing device, a first plurality of measurements gathered by each of a number of sensing and actuating devices of a control system over a first time period; determining, by the computing device, a predicted second plurality of measurements associated with a second time period later than the first time period; receiving, by the computing device, a second plurality of measurements gathered by each of the number of sensing and actuating devices of the control system over the second time period; determining, by the computing device, a suspected portion of the received second plurality of measurements based on a difference between the predicted second plurality of measurements and the received second plurality of measurements exceeding a particular threshold; monitoring, by the computing device, the suspected portion of the received second plurality of measurements over a particular time period; determining, by the computing device, whether the suspected portion of the received second plurality of measurements is associated with a cyber attack; determining a measurement falsely set by the cyber attack; correcting the measurement falsely set by the cyber attack; and providing at least one decoy measurement to an attacker to conceal the correction.