Patent Description:
Complex machines are composed of multiple systems that are intrinsically dependent. Health monitoring of complex machines typically focuses on systems or subsystems that are linked mechanically, electrically, or by a fluid. Health monitors typically test for expected failure modes, such as a failed open condition, a failed closed condition, a range failure, a rate failure, and the like. Cyber-attacks can be very sophisticated in that they may spoof sensors and communications. Such attacks may not be readily detectable by typical health monitoring systems of control systems of a complex machine, such as a vehicle.

<CIT> discloses a system to protect an industrial asset control system comprising a threat detection model creation computer.

<CIT> discloses a cyber-security threat detection system and method which stores physical data measurements from a cyber-physical system and extracts synchronized measurement vectors synchronized to one or more timing pulses.

<CIT> discloses a system for detecting a cyber-attack of a SCADA system managed plant.

From a first aspect, there is provided a cyber monitored control system as claimed in claim <NUM>.

Further embodiments may include where the inputs include one or more sensor inputs.

Further embodiments may include where one or more of the inputs are derived from redundant sensors and related input/output signals.

Further embodiments may include where the related input/output signals are received from a model of the controlled system configured to derive a model vector based on one or more input vectors, one or more output vectors, and one or more laws of physics associated with operation of the controlled system.

Further embodiments may include where the trending identifies inconsistent behavior that does not match a known fault mode or an expected result from the model of the controlled system as a probable cyber attack.

Further embodiments may include where the cyber threat model is trained using artificial intelligence to adapt as one or more cyber threats are characterized.

Further embodiments may include where the cyber monitor is operable to verify one or more update rates of the controller.

Further embodiments may include where the cyber monitor is operable to monitor behavior of one or more control loops of the controller.

Further embodiments may include where the cyber monitor is updateable through a cyber monitor update process including one or more security controls that are independent of an update process of the controller.

Further embodiments may include where the cyber monitor is operable to track one or more communication anomalies and isolate a communication interface associated with the one or more communication anomalies based on identifying the cyber attack.

According to a second aspect, there is provided a method as claimed in claim <NUM>.

A technical effect of the apparatus, systems and methods is achieved by monitoring one or more control systems for cyber threats as described herein.

The following descriptions are exemplary only and should not be considered limiting in any way.

In one disclosed embodiment, the engine <NUM> bypass ratio is greater than about ten (<NUM>:<NUM>), the fan diameter is significantly larger than that of the low pressure compressor <NUM>, and the low pressure turbine <NUM> has a pressure ratio that is greater than about five (<NUM>:<NUM>). The geared architecture <NUM> may be an epicyclic gear train, such as a planetary gear system or other gear system, with a gear reduction ratio of greater than about <NUM>:<NUM>. It should be understood, however, that the above parameters are only exemplary of one embodiment of a geared architecture engine and that the present disclosure is applicable to other gas turbine engines including direct drive turbofans.

The fan section <NUM> of the engine <NUM> is designed for a particular flight condition--typically cruise at about <NUM> Mach and about <NUM>,<NUM> feet (<NUM>,<NUM> meters). "Low corrected fan tip speed" is the actual fan tip speed in ft/sec divided by an industry standard temperature correction of [(Tram °R)/(<NUM> °R)]^<NUM>.

The gas turbine engine <NUM> is one type of complex machine that includes multiple subsystems that can be controlled. The gas turbine engine <NUM>, as well as other types of vehicle systems, can be susceptible to cyber security attacks due to communication interfaces, digital inputs, and other factors. Cyber attacks may seek to disrupt operation of the gas turbine engine <NUM>.

Referring now to the drawings, <FIG> illustrates a controlled system <NUM> that is controlled by a cyber monitored control system <NUM> that includes a processing system <NUM> coupled to a sensor system <NUM>. The sensor system <NUM> includes a plurality of sensors <NUM> that are configured to collect diagnostic and operational data related to the controlled system <NUM>. The controlled system <NUM> can be any type of machine or system including a plurality of components 108A-108N subject to detectable and predictable failure modes. For example, the controlled system <NUM> can be an engine, a vehicle, a heating, ventilating, and air conditioning (HVAC) system, an elevator system, industrial machinery, or the like. For purposes of explanation, embodiments are primarily described with respect to an engine system of an aircraft as the controlled system <NUM>, such as the gas turbine engine <NUM> of <FIG>. In the example of <FIG>, the sensors <NUM> monitor a plurality of parameters of the controlled system <NUM>, such as one or more temperature sensors 106A, pressure sensors 106B, strain gauges 106C, level sensors 106D, accelerometers 106E, rate sensors 106F, and the like. Examples of the components 108A-108N can include one or more torque motors, solenoids, and/or other effectors.

The processing system <NUM> includes processing circuitry <NUM> and a memory system <NUM> to store data and instructions that are executed by the processing circuitry <NUM>. The executable instructions may be stored or organized in any manner and at any level of abstraction, such as in connection with a controlling and/or monitoring operation of the sensor system <NUM>. The processing circuitry <NUM> can be any type or combination of central processing unit (CPU), including one or more of a microprocessor, a digital signal processor (DSP), a microcontroller, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or the like. Also, in embodiments, the memory system <NUM> may include random access memory (RAM), read only memory (ROM), or other electronic, optical, magnetic, or any other computer readable medium onto which is stored data and algorithms in a non-transitory form. The processing system <NUM> is operable to access sensor data from the sensor system <NUM> and drive outputs to control the components 108A-108N of the controlled system <NUM>. The processing system <NUM> can also use a communication interface <NUM> to send and receive data values over a communication system <NUM> to a data repository <NUM> and/or other locations, such as a vehicle system bus, vehicle management computer, and the like. The processing system <NUM> can include other interfaces (not depicted), such as various outputs, wireless communication interfaces, power management, and the like.

The data repository <NUM> can be subdivided or distributed between multiple databases and/or locations. In embodiments, the data repository <NUM> is accessible by an analysis system <NUM>. The analysis system <NUM> can be in close physical proximity to the controlled system <NUM> or may be remotely located at a greater distance. The analysis system <NUM> may also interface with a number of other instances of the data repository <NUM> associated with other instances of the controlled system <NUM> (e.g., a fleet of controlled systems <NUM>). Similar to the cyber monitored control system <NUM>, the analysis system <NUM> includes a processing system <NUM> with processing circuitry <NUM> and a memory system <NUM> operable to hold data and instructions executable by the processing circuitry <NUM>. In some embodiments, the processing system <NUM> is a workstation, a mainframe, a personal computer, a tablet computer, a mobile device, or other computing system configured as disclosed herein, while the processing system <NUM> may be an embedded computing system of the controlled system <NUM> operable to perform real-time data acquisition and analysis. Further, the processing system <NUM> can be distributed between multiple computing devices. The analysis system <NUM> can collect cyber security data across multiple instances of the control system <NUM> to assist in training and cyber security rule development.

Referring now to <FIG>, an example of the cyber monitored control system <NUM> of <FIG> is depicted in greater detail, where the processing system <NUM> includes a plurality of processor cores 204A, 204B,. Processing resources, such as the processor cores 204A-204N, of the cyber monitored control system <NUM> is distributed between a controller <NUM> including a first processing resource <NUM> operable to execute a control application <NUM> for the controlled system <NUM> of <FIG>. The first processing resource <NUM> can include, for instance, processor core 204A and a section of nonvolatile memory of the memory system <NUM> of <FIG>. A cyber monitor <NUM> includes a second processing resource <NUM> isolated from the first processing resource <NUM>. The second processing resource <NUM> can include, for instance, processor core 204N and a section of nonvolatile memory of the memory system <NUM> of <FIG>. Alternatively, the first and second processing resources <NUM>, <NUM> can be separated as independent processors or a processor/circuitry split, such as a microcontroller and a gate array. The separation between the controller <NUM> and cyber monitor <NUM> helps to ensure that a cyber attack on the controller <NUM> does not spread to the cyber monitor <NUM>.

The cyber monitor <NUM> may be updateable through a cyber monitor update process including one or more security controls that are independent of an update process of the controller <NUM>. For instance, security controls can include the use of different and unique software keys, input sequences, hardware elements, discrete switches, and the like, such that a unique process is applied for updates made to the cyber monitor <NUM>, e.g., through a boot loader or bus loader, as compared to the update process for the controller <NUM>.

The controller <NUM> can implement a number of control related functions as part of or in support of the control application <NUM>. For example, the controller <NUM> may implement a model <NUM> to support decisions by control logic <NUM>. Conversion logic <NUM> can convert raw input data from the sensor system <NUM> of <FIG> into conversion logic outputs, such as engineering unit data. Scheduling <NUM> can control updates of outputs to the components 108A-108N of <FIG> and acquisition of data from various sources such as from the sensor system <NUM>. Communication interface process <NUM> can control message processing through the communication interface <NUM> of <FIG>. Built-in test <NUM> executes diagnostics to detect problems within the processing system <NUM> and other inputs/outputs.

The cyber monitor <NUM> can include artificial intelligence processing to learn and adapt a cyber threat model <NUM>. The cyber threat model <NUM> includes a plurality of rules and/or characteristics that are indicative of a cyber attack, such as spoofing of a sensor, spoofing a component of the communication system <NUM> of <FIG>, a denial of service attack, patterns of attempts to access protected areas of the memory system <NUM>, patterns of attempts to trigger a reset of the processing system <NUM>, and other such cyber security threats. The cyber monitor <NUM> can include trending <NUM> to identify inconsistent behavior that does not match a known fault mode or an expected result from the model <NUM> of the controlled system <NUM> as a probable cyber attack. The cyber monitor <NUM> includes a conversion monitor <NUM> operable to compare a plurality of raw input data with conversion logic <NUM> outputs of the controller <NUM> to verify conversion logic <NUM> performance. The cyber monitor <NUM> may also include a rate monitor <NUM> operable to verify one or more update rates of the controller <NUM>. The cyber monitor <NUM> can further include a communication monitor <NUM> operable to track one or more communication anomalies and isolate a communication interface <NUM> associated with the one or more communication anomalies based on identifying the cyber attack. Communication anomalies can include a pattern of faults that is indicative of a deliberate attack through the communication system <NUM>, for example. A threat response <NUM> of the cyber monitor <NUM> includes isolating one or more subsystems of the cyber monitored control system <NUM> based on identifying the cyber attack, for instance, by no longer accepting input from a suspect sensor, a suspect communication bus, or other source deemed subject to a cyber attack. While expected fault conditions may be recoverable during operation, for instance, due to noise or a transient event, an element identified as subject to a cyber attack may be blocked from future use by the controller <NUM> until an inspection is performed or a software update is installed.

<FIG> depicts an example of monitored control loops <NUM> that may be part of the control logic <NUM> of <FIG>. In the example of <FIG>, the monitored control loops <NUM> can include a plurality of minor loops 302A-302N that are part of a major loop which can include separate major loop processing <NUM>. For instance, at a first time increment, minor loop 302A can process input vector 304A to produce an output vector 306A, while at an nth time increment, minor loop 302N can process input vector 304N to produce an output vector 306N. The rate monitor <NUM> of <FIG> can verify that the minor loops 302A-302N are executing as expected according to the scheduling <NUM> of <FIG>. The cyber monitor <NUM> can also monitor behavior of one or more control loops <NUM> of the controller <NUM> of <FIG> to verify proper operation. As one example, the cyber monitor <NUM> can interface with the model <NUM> to analyze a model vector <NUM> that can receive input vectors 304A-304N and examine one or more of the inputs derived from redundant sensors, related input/output signals, and output vectors 306A-306N. Related input/output signals can be received at the cyber monitor <NUM> from the model <NUM> of the controlled system <NUM> configured to derive a model vector <NUM> based on one or more input vectors 304A-304N, one or more output vectors 306A-306N, and one or more laws of physics associated with operation of the controlled system <NUM>. Built-in test results <NUM>, for instance, from major loop processing <NUM>, as part of built-in test <NUM> of <FIG>, are also provided to the cyber monitor <NUM>.

Referring now to <FIG> with continued reference to <FIG>, <FIG> is a flow chart illustrating a method <NUM> for cyber monitoring of a vehicle control system, in accordance with an embodiment. The method <NUM> may be performed, for example, by the analysis system <NUM> of <FIG>, which may be local to or remote from the controlled system <NUM> of <FIG>. At block <NUM>, the cyber monitor <NUM> evaluates a plurality of inputs to a cyber monitored control system <NUM> with respect to a cyber threat model <NUM>. The controlled system <NUM> can be, for instance, the gas turbine engine <NUM> of <FIG> or another vehicle system. The cyber threat model <NUM> can be trained, for instance, using artificial intelligence to adapt as one or more cyber threats are characterized. At block <NUM>, the cyber monitor <NUM> applies trending <NUM> using the cyber threat model <NUM> to distinguish between a fault and a cyber attack. At block <NUM>, the cyber monitor <NUM> determines whether a cyber attack has been identified, and if not, the method <NUM> returns to block <NUM>. At block <NUM>, one or more subsystems of the cyber monitored control system <NUM> is isolated based on identifying the cyber attack. Isolation includes disabling one or more sensors, communication buses, outputs, and/or other interfaces under a cyber attack.

Claim 1:
A cyber monitored control system (<NUM>) comprising:
a controller (<NUM>) comprising a first processing resource (<NUM>) of a processing system (<NUM>) operable to execute a control application (<NUM>) for a controlled system (<NUM>); and
a cyber monitor (<NUM>) comprising a second processing resource (<NUM>) of the processing system isolated from the first processing resource in processing circuitry (<NUM>) and in different sections of a memory system (<NUM>) of the processing system, the cyber monitor operable to:
evaluate a plurality of inputs of the controller with respect to a cyber threat model (<NUM>);
receive a plurality of built-in test results (<NUM>, <NUM>) of diagnostics, the diagnostics executed to detect a problem within the processing system;
apply trending (<NUM>) using the cyber threat model to distinguish between a fault and a cyber attack, wherein the cyber threat model comprises a plurality of rules and/or characteristics that are indicative of the cyber attack; and
isolate one or more subsystems of the cyber monitored control system based on identifying the cyber attack, wherein isolation of the one or more subsystems comprises disabling one or more sensors, communication buses, outputs, and/or other interfaces under the cyber attack;
wherein the cyber monitored control system is coupled to a sensor system (<NUM>), and the cyber monitor (<NUM>) is operable to compare a plurality of raw input data received from the sensor system with conversion logic outputs of the controller to verify conversion logic (<NUM>) performance of the controller.