Patent Description:
In particular, IT networks are often connected to OT systems so as to collect data from the OT systems. It is recognized herein, however, that current approaches to collecting the data from OT systems might compromise privacy associated with the data, which can result in valuable trade secrets, logic, or data, among other information, being divulged to competitors or others. For example, secrets can be derived from network traffic that is used for network monitoring, such as process recipes or other ICS data. It is further recognized herein that current approaches often require that security monitoring operations are hosted on the cloud or off-premises, which can add to the risk of a data compromise.

Document <CIT> discloses an apparatus for monitoring a protected network using unidirectional communication. The apparatus includes a sending unit coupled to one or more devices of the protected network for obtaining network data related to protected network status. The apparatus further includes an eavesdropping unit with an interceptor configured to intercept the requested data within the sending unit via a loop connection between input and output interfaces of the sending unit. The interceptor and the loop connection are inductively coupled and configured for unidirectional communication from the sending unit to the receiving unit. A receiving unit is coupled to the eavesdropping unit for receiving the duplicated data and forwarding the duplicated data to an evaluation system located in a low security external network. A reconfigurable application layer includes at least one modular application configured to operate security related functions that support intrusion detection.

Further, document <CIT> discloses techniques that facilitate adaptive anonymization of data using statistical inference. In one example, a system includes an anonymization component and a statistical learning component. The anonymization component applies an anonymization strategy to data associated with an electronic device. The statistical learning component modifies the anonymization strategy to generate an updated anonymization strategy for the data based on a machine learning process associated with a probabilistic model that represents the data.

The objects of the present invention are achieved by means of the appended set of claims. Embodiments of the invention address and overcome one or more of the describedherein shortcomings by providing methods, systems, and apparatuses that protect the privacy of data. By protecting the privacy of raw data, for instance by generating anonymized or synthetic data that represents the raw data, the raw data can used or analyzed via the anonymized or synthetic data. For example, a data capture apparatus can be configured to operate as a unidirectional communication connection between a private network and a public network. The data capture apparatus can be further configured to generate anonymized or synthetic data from real data that is collected from a private network. The anonymized or synthetic data can represent the real data, such that the real data can be analyzed outside of the data capture apparatus without the data capture apparatus disclosing the actual real data.

In an example aspect, a data capture apparatus is configured to operate as a unidirectional communication connection between a private network and a public network. The data capture apparatus can include a sender machine comprising a unidirectional network interface coupled to one or more devices of the private network. The sender machine can be configured to collect raw data from the one or more devices of the private network. The raw data can define a first data distribution. The data capture apparatus can further include a receiver machine configured to receive synthetic data from the sender machine via the unidirectional communication connection. The sender machine can be further configured to generate the synthetic data based on the first data distribution of the raw data, such that the synthetic data represents the raw data without disclosing the raw data. Thus, the sender machine can connect to the source data and forward anonymized or synthetic data that is based on the source data, to the receiver machine, which can be physically separate from the sender machine so as to not have access to the source data.

The foregoing and other aspects of the present invention are best understood from the following detailed description when read in connection with the accompanying drawings. For the purpose of illustrating the invention, there is shown in the drawings embodiments that are presently preferred, it being understood, however, that the invention is not limited to the specific instrumentalities disclosed. Included in the drawings are the following Figures:.

Referring initially to <FIG>, an example distributed control system (DCS) or industrial control system (ICS) <NUM> includes an untrusted or unsecure IT network <NUM>, such as an office or corporate network, and a secure or trusted operation technology (OT) network <NUM>, such as a production network, communicatively coupled to the IT network <NUM> via a data control apparatus or data control unit (DCU) <NUM>. The IT network <NUM> can define an office or public network that has lower security requirements than the OT network <NUM>, which can define a private or critical production network. The DCU <NUM> can be configured to operate as a unidirectional communication connection between a private network and a public network. The DCU <NUM> can collect network traffic data that is shared over the OT network <NUM>, via a communication link <NUM> from the OT network <NUM> to the DCU <NUM>. In particular, for example, the OT network <NUM> can include various production machines configured to work together to perform one or more manufacturing operations. Example production machines of the production network <NUM> can include, without limitation, robots and other field devices, such as sensors, actuators, or other machines, which can be controlled by a respective programmable logic controller (PLC) <NUM>. The PLC <NUM> can send instructions to respective field devices. In some cases, a given PLC <NUM> can be coupled, or the OT network <NUM> can otherwise include, human machine interfaces (HMIs) <NUM>. It will be understood that the ICS <NUM> is simplified for purposes of example. That is, the ICS <NUM> may include additional or alternative nodes or systems, for instance other network devices, that define alternative configurations, and all such configurations are contemplated as being within the scope of this disclosure. For example, the ICS <NUM> can be configured for building automation, energy automation, traffic management systems, train automation, embedded medical devices, or the like.

In some cases, the communication link <NUM> is configured to receive data from the OT network <NUM>, but not send data to the production network <NUM>, such that that communication link <NUM> defines a unidirectional communication link from the OT network <NUM> to the DCU <NUM>. Thus, the DCU <NUM> can define a unidirectional communication connection between the IT network <NUM> and the OT network <NUM>, for instance from the OT network <NUM> to the IT network <NUM> or, in alternative cases, from the IT network <NUM> to the OT network <NUM>. Network packets that are collected by the DCU <NUM> can be used by cybersecurity functions that are performed on the IT network <NUM>. The collected network packets can be sent from the DCU <NUM> to the IT network <NUM>, in particular to systems within the IT network <NUM> such as, for example and without limitation, an Intrusion Detection System (IDS) <NUM>, a Security Information and Event Management (SIEM) system <NUM>, and a Forensic Analysis system <NUM>. The IT network <NUM> can also define or include the cloud. For example, managed security service providers (MSSPs) can host the monitoring data (e.g., IDS <NUM>, SIEM System <NUM>, Forensic Analysis system <NUM>) off-premises or on the cloud. It is recognized herein that such fine-grained data extraction from critical production systems, for instance production systems within the OT network <NUM>, can create privacy issues. For example, the OT network <NUM> may include different asset owners that each control respective data, and a breach of data privacy can result in confidential information being divulged to different asset owners. Such data or privacy breaches can also result in different asset owners refraining from sharing their data with a central entity, such as the IDS <NUM>, the SIEM system <NUM>, or the Forensic Analysis system <NUM>, which can lower overall security in terms of anomaly detection capabilities, among other negative effects. Thus, embodiments described herein address privacy issues related to data that is collected from the OT network <NUM>, while maintaining the utility of the collected data.

With continuing reference to <FIG>, the DCU <NUM> can include Ethernet ports <NUM> that are connected to the OT network <NUM>, for instance via a switch <NUM>. The Ethernet ports <NUM> can define a unidirectional interface that is configured to receive real or raw data packets without being able to send packets out. The DCU <NUM> can further include a multi-directional interface or port <NUM> that can communicate with the IT network <NUM>, for instance via a switch <NUM>. In particular, the multi-directional interface <NUM> can send data to, and receive data from, the IDS <NUM>, the SIEM system <NUM>, and the Forensic Analysis system <NUM>. In some cases, for example, the multi-directional port <NUM> is exposed to the IT network <NUM> such that the IDS <NUM>, the SIEM system <NUM>, and the Forensic Analysis system <NUM> can access data packets collected by the DCU <NUM>, so as to record packets and/or perform data packet analysis on the recorded packets. Thus, it is recognized herein that the of the packets at rest and in motion can be critical for various functions related to the DCU <NUM>. Further, it will be understood that security monitoring is provided as an example use case for the data provided by the DCU <NUM>, and the data is not limited to security uses. By way of example, data can be provided by the DCU <NUM> for condition-based monitoring. In such an example, process variable content (e.g., time series data of a sensor) can be anonymized and shipped for anomaly detection on the cloud.

By way of example, if the collected data is not protected, a hacker might sniff and/or manipulate (e.g., change, delete, create) the collected data on the DCU <NUM>. For example, a hacker might access the DCU <NUM> over the IT network <NUM> via the multi-directional port <NUM>, so as to sniff the data on the DCU <NUM>. In some cases, the multi-directional port <NUM> is used to send collected data packets to the IT network 102over a TCP stream that might not be secure against cyber attacks. Thus, a hacker might use a computing device that connects to the IT network <NUM> to directly or indirectly access the DCU <NUM>, so as to sniff the collected data within the DCU <NUM>. By way of another example, a hacker might use sniffed data to their competitive advantage, for example by identifying confidential logic or attributes associated with the data, in addition to the data itself.

In an example embodiment, to protect against such sniffing, among other potential vulnerabilities, the DCU <NUM> generates anonymized data that can be analyzed by systems within the IT network <NUM> or elsewhere, for instance the SIEM system <NUM>. In some cases, the anonymized data defines synthetic data that is generated based on real data, such that the synthetic data defines one or more statistical properties that are similar or the same as the real data. The anonymized or synthetic data can be generated so as to preserve the privacy of the original dataset, while maintaining the utility of the original dataset. It is recognized herein that other approaches to protecting privacy, such as encoding, differential privacy, or the like, can be ill-suited for an industrial environment that includes heterogeneous OT networks with different and/or legacy applications across the network. By way of example, other privacy techniques might require implementations at the source of data generation (e.g., heterogeneous OT networks), which can make standardization across networks difficult or cost-prohibitive.

Referring to <FIG>, an example ICS <NUM> can include the DCU <NUM>. In accordance with an example embodiment, the DCU <NUM> can include a first or sender machine <NUM> and a second or receiver machine <NUM> configured to receive data from the sender machine <NUM>. The DCU <NUM> can further include a unidirectional network interface <NUM> coupled to the sender machine <NUM> and the private OT network <NUM>, such that the sender machine <NUM> can receive data from the private OT network <NUM> via the unidirectional network interface <NUM>. In an example, the unidirectional network interface <NUM> includes the Ethernet ports <NUM>. In some cases, the sender machine <NUM> can include the unidirectional network interface <NUM> that can be coupled to one or more devices of a private network, for instance the OT network <NUM>. Thus, in some examples, the sender machine <NUM> can be configured to collect real or raw data from the one or more devices of the private OT network <NUM>, and the raw data can define a data distribution, for instance a first data distribution. By way of example, and without limitation, the raw data can indicate various process variables related to the OT network <NUM>, such as temperature, pressure, motor speed, heater variables, pump variables, valve variables, or the like. By way of further example, the raw data can include network traffic metadata, endpoint/host data (e.g., performance counters), control system specific data (e.g., PLC memory content of critical memory areas monitored for malicious manipulation), personal health data (e.g., lab test data), building data (e.g., temperature, pressure, air flow, speed, humidity), or energy parameters (e.g., frequency, voltage, power consumption, load, current).

As further described herein, the sender machine <NUM> can be configured to generate anonymized or synthetic data based on the data distribution of the raw data, such that the anonymized or synthetic data represents the raw data without disclosing the raw data. The receiver machine <NUM> can be configured to receive the anonymized or synthetic data from the sender machine <NUM>. In some cases, the sender machine <NUM> is further configured to generate the anonymized data that corresponds to the raw data as the sender machine <NUM> receives the respective raw data, so as to define continuous online data anonymization.

The multi-directional port <NUM> of the DCU <NUM> can be coupled to the receiver machine <NUM> and IT network <NUM>, such that the receiver machine <NUM> can send data to, or receive data from, the IT network <NUM>. In particular, the receiver machine <NUM> can be configured to send the synthetic data to an analysis system within the public IT network <NUM>, such that the raw data can be analyzed based on the synthetic data that represents the raw data. In some examples, the unidirectional network interface <NUM> only allows data to be received from, and not sent to, the OT network <NUM>, such that only unidirectional communications are allowed from the OT network <NUM> to the public IT network <NUM>. The OT or production network <NUM> may define a critical or private network such as, for example, a network for industrial automation, a financial network, a network for railway automation and control, a life-critical system, or the like. In some cases, the OT network <NUM> obtains monitoring and evaluation services from a service provider located in the IT network <NUM>, which can define an insecure public network, such as an internet-based or cloud-based service capable of providing intensive data analysis related to security or diagnostics. The DCU <NUM> can listen on the unidirectional network interface <NUM>, in particular the Ethernet ports <NUM>, in a passive manner, for instance by performing sniffing operations, such that active requests are not sent to devices within the OT network <NUM>.

As described herein, the DCU <NUM> can define a unidirectional communication device that supports one or more privacy preserving mechanisms. Such privacy preserving techniques can be activated for one or more data streams from one or more sources, so as to ensure that data that is output from the receiver machine <NUM> is safe for transit in a network environment (e.g., IT network <NUM>) that is less secure than the network environment from which the original data is collected (e.g., OT network <NUM>).

The DCU <NUM> can further include a monitoring apparatus <NUM> configured to transfer data, for instance the synthetic data, from the sender machine <NUM> to the receiver machine <NUM> without permitting data to be transferred from the receiver machine <NUM> to the sender machine <NUM>. In some examples, the monitoring apparatus <NUM> can define a data copier or network tap, so as to provide unidirectional data transmission from the sender machine <NUM> to the receiver machine <NUM> without the sender machine <NUM> and receiver machine <NUM> being hardwired together. In an example, the monitoring apparatus <NUM> can include a wire <NUM> arranged in a loop, such that the wire <NUM> is connected to an output <NUM> defined by the sender machine <NUM>, and to an input <NUM> defined by the sender machine <NUM>. Thus, data can be transmitted by the sender machine <NUM> at the output <NUM>, along the wire <NUM>, and back to the sender machine <NUM> at the input. The input <NUM> and the output <NUM> of the sender machine <NUM> can be isolated from the unidirectional network interface <NUM>. In an example, the monitoring apparatus <NUM>, in particular the wire <NUM>, can define an inductor so as to transfer data from the sender machine <NUM> to the receiver machine <NUM> without a conductive wire or cable connected between the sender machine <NUM> and the receiver machine <NUM>. For example, the monitoring apparatus <NUM> can further include an interceptor <NUM> that is connected to the receiver machine <NUM>. In some examples, the interceptor <NUM> can define a conductive wire such that the conductive wire and the wire <NUM> that defines the loop can be inductively coupled with one another.

Thus, in an example, a data stream can pass through the loop from the output <NUM> through the wire <NUM> to the input <NUM>. Such a data stream can be duplicated inductively by the interceptor <NUM>, and passed to the receiver machine <NUM> via the connection between the interceptor <NUM>, for instance the conductive wire, and the receiver machine <NUM>. The original data stream that passes through the loop can remain unchanged from the output <NUM> to the input <NUM>. Thus, the monitoring apparatus <NUM> can define an inductive configuration that connects the sender machine <NUM> to the receiver machine <NUM>, and thus connects the OT network <NUM> to the IT network <NUM>. In particular, the monitoring apparatus <NUM> can define a physically separated connection between the OT network <NUM> and the IT network <NUM>. In some cases, only duplicated data from the wire <NUM> that defines the loop can be transferred unidirectionally to the receiver machine <NUM> due to the inductive configuration of the monitoring apparatus <NUM>. That is, in various examples, data cannot flow from the interceptor <NUM> to the wire <NUM> that defines the loop, thereby providing the OT network <NUM> with freedom from interference with respect to the IT network <NUM>. In an example, the interceptor <NUM> functions as a network test access point (TAP) that intercepts the transmission between the output <NUM> and the input <NUM> defined by the sender machine <NUM>, and copies that data to a monitor port the receiver machine <NUM>. In another example, the interceptor <NUM> can be implemented as a switched port analyzer (SPAN) that performs port mirroring of the intercepted transmissions on the wire <NUM> that defines the loop. In yet another example, data can be sent to directly to the DCU <NUM>, in particular the sender machine <NUM>, for anonymization. In some examples, the data can be anonymized, and the anonymized data can be made available on the receiver machine <NUM> upon request.

Still referring to <FIG>, the sender machine <NUM> can further include a bootloader <NUM> and firmware <NUM> that can include operational instructions for the sender machine <NUM>, and thus for the DCU <NUM>. Similarly, the receiver machine <NUM> can further include a bootloader <NUM> and firmware <NUM> that can include operational instructions for the receiver machine <NUM>, and thus the DCU <NUM>. The DCU <NUM> can also include one or more databases. For example, the sender machine <NUM> can include a first sender or raw data database <NUM> and a second sender or sanitized synthetic data database 227data database <NUM>. The receiver machine <NUM> can include a receiver database <NUM>. In an example, data that is copied from the sender machine <NUM> can be buffered in the receiver database <NUM>. Similarly, data that is received by the sender machine <NUM> from the OT network <NUM> can be buffered in the raw data database <NUM>, for example, so that the data can be processed so as to be privacy-protected. As described herein, data from the raw data database <NUM> can be processed so as to define sanitized data. Sanitized data can be buffered in the synthetic data database <NUM> before being transmitted via the wire <NUM> of the monitoring apparatus <NUM> at regular intervals, predefined times, or the like.

In various examples, the DCU <NUM> can include one or more processors that may include one or more central processing units (CPUs), graphical processing units (GPUs), or any other processor known in the art. More generally, a processor as described herein is a device for executing machine-readable instructions stored on a computer readable medium, for performing tasks and may comprise any one or combination of hardware and firmware. In an example aspect, any software and firmware deployed in the receiver machine <NUM> can executed by a processor of the receiver machine <NUM>. In an aspect, any software and firmware deployed in the sender machine <NUM> can be executed by a processor of the sender machine <NUM>, so as to maintain physical isolation between the pubic IT network <NUM> and the private OT network <NUM>, and to ensure unidirectional communication. Processors of the DCU <NUM> may also comprise memory storing machine-readable instructions executable for performing tasks. Processors of the DCU <NUM> may use or comprise the capabilities of a computer, controller or microprocessor, for example, and be conditioned using executable instructions to perform special purpose functions not performed by a general purpose computer. The DCU <NUM> may include one or more processors that include any type of suitable processing unit including, but not limited to, a central processing unit, a microprocessor, a Reduced Instruction Set Computer (RISC) microprocessor, a Complex Instruction Set Computer (CISC) microprocessor, a microcontroller, an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), a System-on-a-Chip (SoC), a digital signal processor (DSP), and so forth. Further, processors of the DCU <NUM> may have any suitable micro architecture design that includes any number of constituent components such as, for example, registers, multiplexers, arithmetic logic units, cache controllers for controlling read/write operations to cache memory, branch predictors, or the like. The microarchitecture design of the processors may be capable of supporting any of a variety of instruction sets.

With continuing reference to <FIG>, the receiver machine <NUM> may include various applications or modules, such as embedded cyber security applications for supporting security monitoring and diagnosis related to the OT network <NUM>. For example, the sender machine <NUM> can include a transceiver module <NUM> configured to send and receive data to devices in various networks such as, for example, GPRS, LTE, or <NUM> networks. Additionally, or alternatively, the receiver machine <NUM> can include a data managing application <NUM> that can be configured with a given data processing policy, and can process data in accordance with the data processing policy. In an example, the data managing application <NUM> can read and/or delete data from the receiver database <NUM>. In some cases, the data managing application <NUM> can filter and/or compress data in accordance with a policy. Further, the data managing application <NUM> can transmit copied data from the sender machine <NUM> to the IT network <NUM>, in particular, for example, to the IDS <NUM>, the SIEM system <NUM>, or the Forensic Analysis system <NUM>. The duplicated data can be transmitted via the transceiver module <NUM> or multi-directional port <NUM>. In some cases, data that is received in the receiver machine <NUM> can be transmitted to systems within the IT network <NUM> by way of a push mechanism, for instance by passing data as in a publish-and-subscribe approach. Additionally, or alternatively, data can be buffered in the receiver database <NUM> and can be transmitted by way of a pull mechanism by systems within the IT network <NUM>. For example, systems can actively request data from the receiver database <NUM> or the receiver machine <NUM>, for instance via the multi-directional port <NUM>.

The sender machine <NUM> can also include various applications or modules in accordance with various embodiments. In some examples, the sender machine <NUM> can include a data collection application <NUM> configured to receive data from data capture ports, for instance Ethernet ports <NUM>, of the unidirectional network interface <NUM>. In some cases, the data collection application <NUM> can be configured to filter data in accordance with a policy. Such a policy or configuration can be obtained, in some examples, by the data collection application <NUM> from the sender database <NUM>. The sender machine <NUM> can further include various privacy preserving applications. In particular, for example, the sender machine <NUM> can be configured to include a neural network application or module <NUM> that is configured to protect the privacy of information related to data that is collected from the OT network <NUM>, and stored in the raw data database <NUM>, as further described herein.

In some examples, the neural network module <NUM> includes or accesses a generative adversarial network (GAN) that can learn attributes related to raw data collected from the OT network <NUM>, so as to generate sanitized data. For example, the data collection application <NUM> can collect raw data from the unidirectional network interface <NUM> and provide the raw data to the neural network module <NUM>. The neural network module <NUM> can learn the distribution of the collected raw data. Based on learning the data distributions associated with raw data, the neural network module <NUM> can generate a data sample that has a similar distribution to given raw data. Such a data sample can define sanitized data that corresponds to raw data. By way of example, the sanitized data can be sent to the receiver machine <NUM> from the sender machine <NUM>, and the receiver machine <NUM> can transmit the sanitized data to the IT network <NUM>, for instance to the SIEM system <NUM> for analysis. Thus, in such a configuration, the data that leaves the DCU <NUM> is different than the actual data that is collected from the OT network <NUM>. It is recognized herein that, because the actual raw data is not transmitted to the receiver machine <NUM> or outside the DCU <NUM>, privacy protections are enhanced, such that various data owners or customers associated with OT networks may have greater confidence in sharing their data for combined analysis at various systems, for instance the SIEM system <NUM>. Further, more data that is shared and analyzed, for instance at the SIEM system <NUM>, can enhance anomaly detection capabilities, among other capabilities that are based on analyzing data.

Referring now to <FIG>, an example system <NUM> includes the DCU <NUM> deployed at a plant, for instance a first plant <NUM>. The plant <NUM> can further include the OT network <NUM>. The DCU <NUM>, in particular the sender machine <NUM>, can include one or more containers that define respective runtime environments for applications or modules. For example, the sender machine <NUM> can include a first container <NUM> and a second container <NUM> that is separate from the first container <NUM>. The containers can be protected such that the first and second containers <NUM> and <NUM> cannot be configured by various users of the DCU <NUM>. The first container <NUM> can include the data collection application <NUM> and the raw data database <NUM>. The second container <NUM> can include one or more data privacy-preserving applications or modules. In an example embodiment, the second container <NUM> includes the neural network module <NUM> that is configured to generate synthetic data based on raw data. In particular, the raw data collected by the data collection application <NUM> can define a first data distribution, and the neural network module <NUM> can generate synthetic data based on the first distribution of the raw data, such that the synthetic data defines a second data distribution that falls within a predetermined tolerance of the first data distribution. By way of example, the data distributions of the synthetic and real data can each define a mean, and the means can be compared to a predetermined tolerance to determine whether they are sufficiently close to each other such that the synthetic data sufficiently represents the raw data. The predetermined tolerance can vary as desired. For example, the predetermined tolerance might vary depending on the type of data that is being generated and compared. By way of another example, the predetermined tolerance may also indicate a maximum accuracy with which the synthetic data can represent the raw data. For example, in some cases, if the synthetic data is too close (e.g., greater than an upper limit of the predetermined tolerance) to the raw data, privacy related to the raw data might be comprised. Thereafter, the synthetic data that represents the raw data can be analyzed, such that an analysis of the raw data is performed without the raw data having to be sent to the receiver machine <NUM>, and thus without the raw data having to be sent to any analysis systems.

In some cases, one or more statistical properties of the raw data are identified and compared to one or more statistical properties of the corresponding synthetic data. Statistical properties may include, for example and without limitation, average, mean mode, standard deviation, overall data distribution (e.g., defined by linear or nonlinear regression), kurtosis, and skewness. Data can be anonymized or synthesized by the sender machine <NUM> so as to preserve one or more statistical properties of interest. Thus, the sender machine <NUM> can be configured to preserve one or more select statistical properties, which can be dependent on the type of raw data that is collected. Further, in some cases, the statistical properties that are of interest can be changed while data is collected.

The data collection application <NUM> within the first container <NUM> can be configured to listen to the unidirectional network interface <NUM> so as to collect the raw data from one or more devices of the private OT network <NUM>. In an example configuration, the data collection application <NUM> is within a separate container from the neural network module <NUM>, or is otherwise separated from the neural network module <NUM>, such that the data collection application <NUM> can be updated or scaled without interrupting the neural network module <NUM>.

Further, still referring to <FIG>, the system <NUM> can include a plurality of sites or plants that each provide data to a central system or server <NUM>, for example, so that data can be pooled and analyzed collectively. The plurality of sites or plants can each include one or more DCUs <NUM> that can provide synthetic data to the central server <NUM>. Thus, a plurality of DCUs can be configured to operate as a unidirectional communication connection between the central server <NUM> and a respective private network of a plurality of private networks of the system <NUM>. In an example, synthetic data can be retrieved by the SIEM system <NUM> and/or the IDS <NUM> from the central server <NUM> for analysis. The example system <NUM> includes a first plant <NUM>, a second plant <NUM>, and a third plant <NUM>, though it will be understood that any number of sites or plants, and thus any number of DCUs, can be coupled to the central server <NUM> as desired. The receiver machine <NUM> of each of the DCUs <NUM> in the system <NUM> can be configured to send respective synthetic data to the central server <NUM>, such that the raw data from the plurality of the private OT networks can be analyzed, based on the synthetic data that represents the raw data, without the central server obtaining the raw data.

It is recognized herein that generating synthetic data and providing the synthetic data, rather than the raw or real data, to a central server of analysis system can protect various information related to the raw data, in addition to the raw data itself. In some cases, the synthetic data can be generated so as to mask values associated with the corresponding raw data. By way of further example, and without limitation, the identity of various asset owners related to each of the plants, logic or trade secrets related to the plants, and components or systems of the various plants, can be protected by generating synthetic data to represent raw data. It is further recognized herein that such privacy protections derived from the synthetic data can, in some cases, motivate or allow the various plants to combine their data together at the central server <NUM> for analysis, thereby improving the data sample that can be analyzed and enhancing the data analysis that can be performed.

With continuing reference to <FIG>, the neural network module <NUM> can include a generator <NUM> and a discriminator <NUM> so as to define a generative adversarial network (GAN) or convolutional neural network (CNN). The sender machine <NUM> can be configured to train the neural network based on real or raw data from one or more devices of the private OT network <NUM>. When the neural network is trained, the neural network module <NUM> can generate synthetic data, based on corresponding raw data, that defines a data distribution that is similar to the data distribution of the corresponding raw data. For example, the synthetic data can define a data distribution that falls within a predetermined tolerance of the data distribution defined by the corresponding raw data. In some cases, noise vectors <NUM> are input into the generator <NUM>. In an example, the noise vectors <NUM> can define random number generators. Based on the noise vectors <NUM>, the generator <NUM> can generate fake or synthetic data, which can be stored in the sanitized synthetic data database <NUM>. During training, fake data and the real data can be input to the discriminator <NUM>, from the synthetic data database <NUM> and the raw data database <NUM>, respectively. The discriminator <NUM> can lean real data from fake data, and the outputs of the discriminator <NUM> can be fed back to the generator <NUM> so that the neural network module <NUM> can be fine-tuned. Thereafter, the generator <NUM> can generate synthetic data that more closely resembles the corresponding raw data, or defines statistical properties that more closely resemble select statistical properties of the raw data.

Thus, training phase can include gathering the original source data for subscribed variables or statistical properties of interest. Such variables or properties of interest can be configured on the DCU <NUM> via a configuration file or a user interface, for example. The source data can be input to the generator <NUM> and the discriminator <NUM>. The discriminator <NUM> can use the source data as a training dataset (e.g., sampling from it) and can control the training process until predetermined accuracy levels are reached. The generator <NUM> can use those samples to generate seed data, in some cases, as opposed to randomized data from a normal distribution. The generator <NUM> can derive the distribution of the data, then use the distribution to spread random data to, so as to increase the error rate of the discriminator <NUM> (e.g., fooling the discriminator into thinking incorrect candidates are selected). In some cases, the neural network can be configured so as to be in a continuous training mode, wherein its output parameters are adjusted as incoming data arrives.

Referring now to <FIG>, an example operation <NUM> can be performed by the DCU <NUM> that includes the sender machine <NUM> and the receiver machine <NUM> physically isolated from the sender machine <NUM>. The monitoring apparatus <NUM> can be disposed between the sender machine <NUM> and the receiver machine <NUM>, and the DCU <NUM> can be disposed between a private network and a public network. Thus, the monitoring apparatus <NUM> can be disposed between the private network and the public network. At <NUM>, the sender machine <NUM> can collect real or raw data from one or more devices of the private network. In some cases, the data collection application <NUM> application <NUM> listens to the unidirectional network interface <NUM> to collect data from the private network. At <NUM>, the data collection application <NUM> can store the raw data within a container. For example, the data collection application <NUM> can store the raw data at the raw data database <NUM> that is within the first container <NUM>. At <NUM>, in an example, the neural network module <NUM> that is located in a different container as the raw data database <NUM> can obtain the raw data. For example, the neural network module <NUM> within the second container 306can retrieve the raw data from the raw data database <NUM>. Based on the retrieved raw data, at <NUM>, the neural network module <NUM> can generate synthetic data that corresponds to the raw data. At <NUM>, the neural network module <NUM> can verify that the generated synthetic data represents the raw data accurately. For example, the data distribution of the raw data can be compared to the data distribution of the synthetic data, and if the data distributions are within a predetermined tolerance of each other, the synthetic data can be verified. If the synthetic data is not verified, the data can be fed back to the generator <NUM> so that updated synthetic data can be generated. In an example, when the synthetic data is verified at <NUM>, it can be transmitted to an external system, such as the IT network <NUM> or the central server <NUM>. In particular, the sender machine <NUM> can transmit the verified synthetic data to the receiver machine <NUM> via the monitoring apparatus <NUM>, and the receiver machine <NUM> can transmit the synthetic data externally from the DCU <NUM>.

Without being bound by theory, it is recognized herein that, in accordance with various embodiments, if data is somehow hacked as it is being sent to the receiver machine <NUM> or sent from the receiver machine <NUM> to an external system, the hacker would access fake or synthetic data. Thus, in some cases, even if communications were intercepted, secrets related to the raw data might remain protected and private.

<FIG> illustrates an example of a computing environment within which embodiments of the present disclosure may be implemented. A computing environment <NUM> includes a computer system <NUM> that may include a communication mechanism such as a system bus <NUM> or other communication mechanism for communicating information within the computer system <NUM>. The computer system <NUM> further includes one or more processors <NUM> coupled with the system bus <NUM> for processing the information. The robot device <NUM> may include, or be coupled to, the one or more processors <NUM>.

The processors <NUM> may include one or more central processing units (CPUs), graphical processing units (GPUs), or any other processor known in the art. More generally, a processor as described herein is a device for executing machine-readable instructions stored on a computer readable medium, for performing tasks and may comprise any one or combination of, hardware and firmware. A processor may also comprise memory storing machine-readable instructions executable for performing tasks. A processor acts upon information by manipulating, analyzing, modifying, converting or transmitting information for use by an executable procedure or an information device, and/or by routing the information to an output device. A processor may use or comprise the capabilities of a computer, controller or microprocessor, for example, and be conditioned using executable instructions to perform special purpose functions not performed by a general purpose computer. A processor may include any type of suitable processing unit including, but not limited to, a central processing unit, a microprocessor, a Reduced Instruction Set Computer (RISC) microprocessor, a Complex Instruction Set Computer (CISC) microprocessor, a microcontroller, an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), a System-on-a-Chip (SoC), a digital signal processor (DSP), and so forth. Further, the processor(s) <NUM> may have any suitable microarchitecture design that includes any number of constituent components such as, for example, registers, multiplexers, arithmetic logic units, cache controllers for controlling read/write operations to cache memory, branch predictors, or the like. The microarchitecture design of the processor may be capable of supporting any of a variety of instruction sets. A processor may be coupled (electrically and/or as comprising executable components) with any other processor enabling interaction and/or communication there-between. A user interface processor or generator is a known element comprising electronic circuitry or software or a combination of both for generating display images or portions thereof. A user interface comprises one or more display images enabling user interaction with a processor or other device.

The system bus <NUM> may include at least one of a system bus, a memory bus, an address bus, or a message bus, and may permit exchange of information (e.g., data (including computer-executable code), signaling, etc.) between various components of the computer system <NUM>. The system bus <NUM> may include, without limitation, a memory bus or a memory controller, a peripheral bus, an accelerated graphics port, and so forth. The system bus <NUM> may be associated with any suitable bus architecture including, without limitation, an Industry Standard Architecture (ISA), a Micro Channel Architecture (MCA), an Enhanced ISA (EISA), a Video Electronics Standards Association (VESA) architecture, an Accelerated Graphics Port (AGP) architecture, a Peripheral Component Interconnects (PCI) architecture, a PCI-Express architecture, a Personal Computer Memory Card International Association (PCMCIA) architecture, a Universal Serial Bus (USB) architecture, and so forth.

Continuing with reference to <FIG>, the computer system <NUM> may also include a system memory <NUM> coupled to the system bus <NUM> for storing information and instructions to be executed by processors <NUM>. The system memory <NUM> may include computer readable storage media in the form of volatile and/or nonvolatile memory, such as read only memory (ROM) <NUM> and/or random access memory (RAM) <NUM>. The RAM <NUM> may include other dynamic storage device(s) (e.g., dynamic RAM, static RAM, and synchronous DRAM). The ROM <NUM> may include other static storage device(s) (e.g., programmable ROM, erasable PROM, and electrically erasable PROM). In addition, the system memory <NUM> may be used for storing temporary variables or other intermediate information during the execution of instructions by the processors <NUM>. A basic input/output system <NUM> (BIOS) containing the basic routines that help to transfer information between elements within computer system <NUM>, such as during start-up, may be stored in the ROM <NUM>. RAM <NUM> may contain data and/or program modules that are immediately accessible to and/or presently being operated on by the processors <NUM>. System memory <NUM> may additionally include, for example, operating system <NUM>, application programs <NUM>, and other program modules <NUM>. Application programs <NUM> may also include a user portal for development of the application program, allowing input parameters to be entered and modified as necessary.

The operating system <NUM> may be loaded into the memory <NUM> and may provide an interface between other application software executing on the computer system <NUM> and hardware resources of the computer system <NUM>. More specifically, the operating system <NUM> may include a set of computer-executable instructions for managing hardware resources of the computer system <NUM> and for providing common services to other application programs (e.g., managing memory allocation among various application programs). In certain example embodiments, the operating system <NUM> may control execution of one or more of the program modules depicted as being stored in the data storage <NUM>. The operating system <NUM> may include any operating system now known or which may be developed in the future including, but not limited to, any server operating system, any mainframe operating system, or any other proprietary or non-proprietary operating system.

The computer system <NUM> may also include a disk/media controller <NUM> coupled to the system bus <NUM> to control one or more storage devices for storing information and instructions, such as a magnetic hard disk <NUM> and/or a removable media drive <NUM> (e.g., floppy disk drive, compact disc drive, tape drive, flash drive, and/or solid state drive). Storage devices <NUM> may be added to the computer system <NUM> using an appropriate device interface (e.g., a small computer system interface (SCSI), integrated device electronics (IDE), Universal Serial Bus (USB), or FireWire). Storage devices <NUM>, <NUM> may be external to the computer system <NUM>.

The computer system <NUM> may also include a field device interface <NUM> coupled to the system bus <NUM> to control a field device <NUM>, such as a device used in a production line. The computer system <NUM> may include a user input interface or GUI <NUM>, which may comprise one or more input devices, such as a keyboard, touchscreen, tablet and/or a pointing device, for interacting with a computer user and providing information to the processors <NUM>.

The computer system <NUM> may perform a portion or all of the processing steps of embodiments of the invention in response to the processors <NUM> executing one or more sequences of one or more instructions contained in a memory, such as the system memory <NUM>. Such instructions may be read into the system memory <NUM> from another computer readable medium of storage <NUM>, such as the magnetic hard disk <NUM> or the removable media drive <NUM>. The magnetic hard disk <NUM> and/or removable media drive <NUM> may contain one or more data stores and data files used by embodiments of the present disclosure. The data store <NUM> may include, but are not limited to, databases (e.g., relational, object-oriented, etc.), file systems, flat files, distributed data stores in which data is stored on more than one node of a computer network, peer-to-peer network data stores, or the like. The data stores may store various types of data such as, for example, skill data, sensor data, or any other data generated in accordance with the embodiments of the disclosure. Data store contents and data files may be encrypted to improve security. The processors <NUM> may also be employed in a multi-processing arrangement to execute the one or more sequences of instructions contained in system memory <NUM>. Thus, embodiments are not limited to any specific combination of hardware circuitry and software.

As stated above, the computer system <NUM> may include at least one computer readable medium or memory for holding instructions programmed according to embodiments of the invention and for containing data structures, tables, records, or other data described herein. The term "computer readable medium" as used herein refers to any medium that participates in providing instructions to the processors <NUM> for execution. A computer readable medium may take many forms including, but not limited to, non-transitory, non-volatile media, volatile media, and transmission media. Non-limiting examples of non-volatile media include optical disks, solid state drives, magnetic disks, and magneto-optical disks, such as magnetic hard disk <NUM> or removable media drive <NUM>. Non-limiting examples of volatile media include dynamic memory, such as system memory <NUM>. Non-limiting examples of transmission media include coaxial cables, copper wire, and fiber optics, including the wires that make up the system bus <NUM>. Transmission media may also take the form of acoustic or light waves, such as those generated during radio wave and infrared data communications.

Computer readable medium instructions for carrying out operations of the present disclosure may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, statesetting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present disclosure.

It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, may be implemented by computer readable medium instructions.

The computing environment <NUM> may further include the computer system <NUM> operating in a networked environment using logical connections to one or more remote computers, such as remote computing device <NUM>. The network interface <NUM> may enable communication, for example, with other remote devices <NUM> or systems and/or the storage devices <NUM>, <NUM> via the network <NUM>. Remote computing device <NUM> may be a personal computer (laptop or desktop), a mobile device, a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to computer system <NUM>. When used in a networking environment, computer system <NUM> may include modem <NUM> for establishing communications over a network <NUM>, such as the Internet. Modem <NUM> may be connected to system bus <NUM> via user network interface <NUM>, or via another appropriate mechanism.

Network <NUM> may be any network or system generally known in the art, including the Internet, an intranet, a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a direct connection or series of connections, a cellular telephone network, or any other network or medium capable of facilitating communication between computer system <NUM> and other computers (e.g., remote computing device <NUM>). The network <NUM> may be wired, wireless or a combination thereof. Wired connections may be implemented using Ethernet, Universal Serial Bus (USB), RJ-<NUM>, or any other wired connection generally known in the art. Wireless connections may be implemented using Wi-Fi, WiMAX, and Bluetooth, infrared, cellular networks, satellite or any other wireless connection methodology generally known in the art. Additionally, several networks may work alone or in communication with each other to facilitate communication in the network <NUM>.

It should be appreciated that the program modules, applications, computer-executable instructions, code, or the like depicted in <FIG> as being stored in the system memory <NUM> are merely illustrative and not exhaustive and that processing described as being supported by any particular module may alternatively be distributed across multiple modules or performed by a different module. In addition, various program module(s), script(s), plug-in(s), Application Programming Interface(s) (API(s)), or any other suitable computer-executable code hosted locally on the computer system <NUM>, the remote device <NUM>, and/or hosted on other computing device(s) accessible via one or more of the network(s) <NUM>, may be provided to support functionality provided by the program modules, applications, or computer-executable code depicted in <FIG> and/or additional or alternate functionality. Further, functionality may be modularized differently such that processing described as being supported collectively by the collection of program modules depicted in <FIG> may be performed by a fewer or greater number of modules, or functionality described as being supported by any particular module may be supported, at least in part, by another module. In addition, program modules that support the functionality described herein may form part of one or more applications executable across any number of systems or devices in accordance with any suitable computing model such as, for example, a client-server model, a peer-to-peer model, and so forth. In addition, any of the functionality described as being supported by any of the program modules depicted in <FIG> may be implemented, at least partially, in hardware and/or firmware across any number of devices.

It should further be appreciated that the computer system <NUM> may include alternate and/or additional hardware, software, or firmware components beyond those described or depicted without departing from the scope of the disclosure. More particularly, it should be appreciated that software, firmware, or hardware components depicted as forming part of the computer system <NUM> are merely illustrative and that some components may not be present or additional components may be provided in various embodiments. While various illustrative program modules have been depicted and described as software modules stored in system memory <NUM>, it should be appreciated that functionality described as being supported by the program modules may be enabled by any combination of hardware, software, and/or firmware. It should further be appreciated that each of the above-mentioned modules may, in various embodiments, represent a logical partitioning of supported functionality. This logical partitioning is depicted for ease of explanation of the functionality and may not be representative of the structure of software, hardware, and/or firmware for implementing the functionality. Accordingly, it should be appreciated that functionality described as being provided by a particular module may, in various embodiments, be provided at least in part by one or more other modules. Further, one or more depicted modules may not be present in certain embodiments, while in other embodiments, additional modules not depicted may be present and may support at least a portion of the described functionality and/or additional functionality. Moreover, while certain modules may be depicted and described as sub-modules of another module, in certain embodiments, such modules may be provided as independent modules or as sub-modules of other modules.

Although specific embodiments of the disclosure have been described, one of ordinary skill in the art will recognize that numerous other modifications and alternative embodiments are within the scope of the disclosure. For example, any of the functionality and/or processing capabilities described with respect to a particular device or component may be performed by any other device or component. Further, while various illustrative implementations and architectures have been described in accordance with embodiments of the disclosure, one of ordinary skill in the art will appreciate that numerous other modifications to the illustrative implementations and architectures described herein are also within the scope of this disclosure. In addition, it should be appreciated that any operation, element, component, data, or the like described herein as being based on another operation, element, component, data, or the like can be additionally based on one or more other operations, elements, components, data, or the like. Accordingly, the phrase "based on," or variants thereof, should be interpreted as "based at least in part on.

Although embodiments have been described in language specific to structural features and/or methodological acts, it is to be understood that the disclosure is not necessarily limited to the specific features or acts described. Rather, the specific features and acts are disclosed as illustrative forms of implementing the embodiments. Conditional language, such as, among others, "can," "could," "might," or "may," unless specifically stated otherwise, or otherwise understood within the context as used, is generally intended to convey that certain embodiments could include, while other embodiments do not include, certain features, elements, and/or steps.

Claim 1:
A data capture apparatus (<NUM>) configured to operate as a unidirectional communication connection between a private network (<NUM>) and a public network (<NUM>), the data capture apparatus (<NUM>) comprising:
a sender machine (<NUM>) comprising a unidirectional network interface (<NUM>) coupled to one or more devices of the private network (<NUM>), the sender machine (<NUM>) configured to collect raw data from the one or more devices of the private network (<NUM>), the raw data defining a first data distribution;
a monitoring apparatus (<NUM>) between the sender machine (<NUM>) and a receiver machine (<NUM>);
the receiver machine (<NUM>) physically isolated from the sender machine and configured to receive anonymized data from the sender machine (<NUM>) via the unidirectional communication connection defined by the monitoring apparatus,
wherein the sender machine (<NUM>) is configured to generate the anonymized data based on the first data distribution of the raw data, such that the anonymized data represents the raw data without disclosing the raw data,
wherein the sender machine (<NUM>) further comprises a neural network configured to generate the anonymized data based on the first data distribution of the raw data such that the anonymized data defines synthetic data having a second data distribution that falls within a predetermined tolerance of the fi rst data distribution.