Patent SG-11201804371R-A (SG)
Title: System and method for detecting a cyber-attack at scada/ics managed plants
Inventor: AROV MICHAEL
IPC: H04L12/12
Filed: 2016-11-25
Abstract: INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT) (19) World Intellectual Property -' Organization International Bureau (43) International Publication Date .... ..sr.) 1 June 2017 (01.06.2017) WIPO I PCT (10) WO International Publication Number 111111111111311111111111111111111111111111111111111111111111111111111311111111111111111 2017/090045 Al (51) International Patent Classification: AO, AT, AU, AZ, BA, BB, BG, BH, BN, BR, BW, BY, G06F 21/50 (2013.01) H04L 12/12 (2006.01) BZ, CA, CH, CL, CN, CO, CR, CU, CZ, DE, DJ, DK, DM, GO6F 11/00 (2006.01) DO, DZ, EC, EE, EG, ES, FI, GB, GD, GE, GH, GM, GT, HN, HR, HU, ID, IL, IN, IR, IS, JP, KE, KG, KN, KP, KR, (21) International Application Number: KW, KZ, LA, LC, LK, LR, LS, LU, LY, MA, MD, ME, PCT/IL2016/051268 MG, MK, MN, MW, MX, MY, MZ, NA, NG, NI, NO, NZ, (22) International Filing Date: OM, PA, PE, PG, PH, PL, PT, QA, RO, RS, RU, RW, SA, 25 November 2016 (25.11.2016) SC, SD, SE, SG, SK, SL, SM, ST, SV, SY, TH, TJ, TM, TN, TR, TT, TZ, UA, UG, US, UZ, VC, VN, ZA, ZM, (25) Filing Language: English ZW. (26) Publication Language: English (84) Designated States (unless otherwise indicated, for every (30) Priority Data: kind of regional protection available): ARIPO (BW, GH, 242808 26 November 2015 (26.11.2015) IL GM, KE, LR, LS, MW, MZ, NA, RW, SD, SL, ST, SZ, TZ, UG, ZM, ZW), Eurasian (AM, AZ, BY, KG, KZ, RU, (71) Applicant: RAFAEL ADVANCED DEFENSE SYS- TJ, TM), European (AL, AT, BE, BG, CH, CY, CZ, DE, TEMS LTD. [IL/IL]; P.O.B. 2250, 3102102 Haifa (IL). DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, LT, LU, (72) Inventors: AROV, Michael; 6 Nahal Snir Street, 4050000 LV, MC, MK, MT, NL, NO, PL, PT, RO, RS, SE, SI, SK, S Even Yehuda (IL). OCHMAN, Ronen; 255 Hasaf Street, M, TR), OAPI (BF, BJ, CF, CG, CI, CM, GA, GN, GQ, 2280500 Kibbutz Saar (IL). COHEN, Moshe; 182 Nesher GW, KM, ML, MR, NE, SN, TD, TG). Street, 2171030 Karmiel (IL). Declarations under Rule 4.17: (74) Agents: CHECHIK, Haim et al.; Luzzatto & Luzzatto, — of inventorship (Rule 4.17(iv)) P.O. Box 5352, 8415202 Beer Sheva (IL). Published: (81) Designated States (unless otherwise indicated, for every with international search report (Art 21(3)) kind AE, AG, AL, AM, of national protection available): (54) Title: SYSTEM AND METHOD FOR DETECTING A CYBER-ATTACK AT SCADA/ICS MANAGED PLANTS (57) : System for detecting a cyber-attack inflicted by an attacker seeking to cause physical damage to, or harm functionality of, a SCADA sys - , tem managed plant, comprising passively connected to the SCADA system. „ . an ' Each of the industrial computerized devices comprises a processor that is 302 o Aro configured with a data validation module to deteimine whether data flow out - putted from a SCADA- connected controller, adapted to command operation ,, „ „„,,,,„„,„,„„ of each electromechanical component of a corresponding controlled subsys - is issuing is : tem of the plant, authentic, and with an alert mechanism that ac- 4 ; tivated following detection that the outputted data flow is indicative of a cy - ber-attack perpetrated with respect to the controller. The at least one dedic - A) ated industrial computerized device is operable to passively monitor in paral - i lel, by the more dedicated industrial device, data one or computerized com- e rp . municated between each of the controllers and the SCADA system including - the outputted data at the nearest points of each of the controllers; seek, by the :Q. 1 - one or more dedicated industrial computerized devices, mismatches between 0 \" e the the if is detected, plant state and physical operation model; a mismatch determine by the dedicated industrial device whether the mis - computerized ,, match is indicative of a cyber-attack perpetrated with respect to one of the t' detecting controllers or an operational malfunction; and upon a cyber- attack, Il .4t activate the alert issuing mechanism to issue a security alert. li n ,12 z [h 3i dcicv d tackvecWxe it I 1 I \" C Fig. 3 0 --..„ IN 1-1 0 N O