Patent AU-2011253630-A1 (AU)
Title: Malicious attack detection and analysis
Inventor: David scott anthony
IPC: G05B9/02
Filed: 2011-11-23
Abstract: A system for characterizing malicious activity in an intelligent utility grid system includes a system storage in which to store a database including a plurality of rules. A collector is operable to collect 5 and store in the system storage information-technology (IT) data including IT-related activity from the intelligent grid system. A complex event processing (CEP) bus is operable to receive non-IT data including location-specific event data from a plurality of electronic sources, the CEP bus further operable to disregard the non-IT data 10 failing to meet a predetermined level of relevance to one of a plurality of risk-related events. A processor is operable to apply the plurality of rules to the relevant non-IT data to: associate an undesired event with reference to the IT-related activity; and determine a probability that the undesired event is indicative of malicious activity. The processor 15 further applies a risk characterization to the undesired event based on the probability and the IT-related activity. 1078423_2 FIG. 1 104 105--, 106--, FIG. JA|FIG. lB FIG. JC BUSINESS ENTERPRISE BUSINESS DATA INTELLIGENCE RESOURCE 101 102 PORTAL WAREHOUSE APPLICATIONS PLANNING 100 122 GRID DATA/ METER DATA METERING ANALYTICS SERVICES MANAGEMENT ANALYTICS SENSOR ANALYTICS SYSTEM AND SERVICES DATA MANAGEMENT SERVICES SERVICES R 131 321313 9I TO ISO/RTO's I CENTRALIZED I NASPI, NERC, T CONNECTIVITY CIM DATA METER DATA GRID I WEATHER Y WAREHOUSE WAREHOUSE WAREHOUSE ANALYTICS I FEEDS, APIAIN ANALYTICS F 1 SERVICE R 134 APPLICATIONS ORGANIZATIONS A FEDERATION MIDDLEWARE |13 ETC M 135 1361318 W EVENT HISTORICAL OPERATIONAL DFER 0 LOG S LOGS DATA DATA FILES 161, 1643 163 16 |MONITOR/CONTROL] COLLECTOR 163U7 .1,166 DISTRIBUTED 16 13 N HOE|S-ENSORS| 162 ~ GENERATION! SMART METER DISPLAY CONTROLS-167 STORAGE r NETWORK CUSTOMER PREMISES 178 r PSTN1 FIG. ]A 107- 108- 109% 110 FIACILCUSTOMER HUMAN ASSET SYSTEMSA INFORMATION RESOURCES MANAGEMENT SYSTEMSSYSTEM SYSTEM SYSTEM ENTERPRISE INTEGRATION ENVIRONMENT SECURITY FRAMEWORK GRID META-DATA SERVICES -126 OPERATIONS INDE SOA CONNECTIVITY NAME TEDS SERVICE CORE SUPPORT SERVICES TRANSLATION (IEEE 1451.4) 127 128 129 130 -120 OPERATIONS SERVICE BUS 140 141 145-1 153 VISUALIZATION/ A NTIES NETWORK METER DATA NOTIFICATION MANAGEMENT COLLECTION SERVICES APPLICATIONS DISTRIBUTED SERVICES HEAD END(S) SUPPORT COMPUTING SERVICES I SUPPORT -F.--- REAL TIME OP/ NON-OP DATA BUS REAL TIME COMPLEX EVENT PROCESSING BUS SECURITY FRAMEWORK 170 UTILITY COMMUNICATIONS NETWORKS -- 160 SUBSTATION 180 INDE SUBSTATION 181 r182 SECURITY S UBSTATIO ON-OPDATA SUSTATIONOPDATA SECURITY SFRVlCFS| } t SUBSTATION LAN MICROPROCESSOR RELAYS j |SUBSTATION INSTRUMENTATION 173 FIG. 1B r7 111, 112% 113 ENTERPRISE NETWORK ENTERPRISE SOA MANAGEMENT MESSAGING ENTERPRISE SUPPORT SYSTEM SERVICES IT 115 116- OPERATIONS 152 CONTROL CENTER 1492 150 151- CIRCUIT AND LOAD GEOGRAPHIC WORK IVR AND FLOW ANALYSIS, INFORMATION MANAGEMENT CALL PLANNING, LIGHTNING SYSTEM SYSTEM MANAGEMENT ANALYSIS AND GRID SIMULATION TOOLS 154 155 156-, 157-, 159 DEMAND OUTAGE ENERGY DISTRIBUTION DISPATCH RESPONSE MANAGEMENT MANAGEMENT MANAGEMENT MOBILE DATA MANAGEMENT SYSTEM SYSTEM SYSTEM SYSTEM SYSTEM 7x SUBSTATION ANALYTICS 183 168 DETECTION/ CLASSIFICATION PROCESSING 184 INDE DEVICE SIGNAU WAVEFORM PROCESSING -185 DISTRIBUTED GRID DEVICE DISTRIBUTED COMPUTING SUPPORT -186 SIGNAL/EVENT ANALYTICS INTERFACE/ COMMUNICATIONS STACK -187 189 189 189 EVENT/FILE RECORDERS| STATION RTU 175 176 FIG. iC