Patent Description:
One of the current problems of industrial security is the problem of secure functioning of Technological Processes (TPs). The principal threats to the functioning of TPs include unintentional or malicious actions in operational control, wear and failure of equipment and subunits, computer attacks on control systems and the Information Technology (IT) system, and others.

Automated Control Systems (ACSs) in enterprises control the technological systems. Thus, the ACSs need to be given an adequate level of security. The elements of technological systems, as well as the operating systems and firmware controlling those elements, often become obsolete. Frequent updating of the operating systems and firmware is not possible because the updates would lead to frequent interruptions in the technological processes. Furthermore, newer versions of the programs being updated may also contain defects that negatively impact the functional stability of the elements of the technological systems. Furthermore, existing obsolete ACSs, which are typically designed to stand in isolation, are often connected to computer networks. However, these obsolete ACSs generally do not have the means for ensuring IT security in the event of a malicious action from outside.

A widespread problem in technological systems is the need to use obsolete equipment that uses unprotected or vulnerable information transmission protocols. This is due to the fact that the service life of the equipment in such systems amounts to years or even decades, and during this time the information transmission protocols are able to become obsolete - thereby enabling vulnerabilities to appear as the equipment ages. In addition, replacing equipment that is already operating is a complicated and costly process (and is sometimes impossible). Therefore, security problems often go unsolved and vulnerabilities appear in the control systems of technological processes. A typical control network of technological systems includes elements of various types. The important elements include control computers (servers and client stations for Supervisory Control and Data Acquisition (SCADA)) and Programmable Logic Controllers (PLCs) which directly control the equipment (for example, actuators). The SCADA software is rather easy to update, while the updating of the PLC firmware requires the involvement of the equipment maker and is often an extremely hard problem to solve. In such a situation, hackers have an opportunity to influence the working of the PLC, which may result in serious consequences. For example, the equipment being monitored may malfunction causing disruptions to the technological processes of the technological system as a whole. In some scenario, the consequences may even be catastrophic.

One approach for solving the problems described above is to detect anomalies by performing an analysis of traffic within the data transmission network of the technological system. For instance, the software KICS for Networks of Kaspersky Laboratories describes anomaly detection using such analysis. However, this approach requires a large volume of a priori information about the PLC (e.g., knowledge about protocols and parameter values used by the PLC may be needed). In addition, the detection of anomalies in traffic of complex systems may contain errors, e.g., type I and type II errors (false positives and false negatives).

<CIT> describes a system and a method for multilevel intrusion detection in an automation and control system.

Thus, there is a need for a more optimal way to detect anomalies in a technological system.

Aspects of the disclosure relate to the field of information security, more specifically the invention is defined by a method claim <NUM> and a system claim <NUM> for detecting anomalies in a technological system. Additional embodiments are defined in the dependent claims. The method is designed to improve the computer security. Thus, the method of the present disclosure advantageously enables information security of data.

Exemplary aspects are described herein in the context of a system, method, and a computer program for detecting anomalies in a technological system. Those of ordinary skill in the art will realize that the following description is illustrative only and is not intended to be in any way limiting. Other aspects will readily suggest themselves to those skilled in the art having the benefit of the disclosure. Reference will now be made in detail to implementations of the example aspects as illustrated in the accompanying drawings. The same reference indicators will be used to the extent possible throughout the drawings and the following description to refer to the same or like items.

In order to present the teachings of the present disclosure with clarity, a number of terms and concepts are defined herein.

An object of control is a technological object subjected to external actions (controlling and/or perturbing) for the purpose of changing its state; in a particular instance, such objects are devices (such as electric motors) or technological processes.

A technological process (TP) is a process of a material production, consisting of sequentially changing states of a material entity (a work object).

The control of a technological process (process control) is a set of methods used to control the technological parameters during the production of an end product.

A technological parameter (process variable, PV) is a current metered value of a particular portion of a TP which is being observed or monitored. A process variable might be, for example, a measurement from a detector.

An external action is a method of changing the state of an element subjected to the action (such as an element of a technological system) in a particular direction, the action being transmitted from one element of the technological system to another element of the technological system in a form of a signal.

The state of an object of control is the totality of its essential attributes, as expressed by parameters of state which are altered or maintained under the influence of external actions, including control actions from a control subsystem.

A parameter of state is one or more numerical values characterizing an essential attribute of an object; in one particular instance, a parameter of state is a numerical value of a physical quantity.

A formal state of an object of control is the state of the object of control corresponding to the process chart and other technological documentation (in the case of a TP) or a timetable (in the case of a device).

A controlling action is a deliberate (the goal of the action is to act on the state of the object), legitimate (provided for by the TP) external action on the part of the control subjects of a control subsystem on an object of control, resulting in a change of state of the object of control or a maintaining of the state of the object of control.

A perturbing action is a deliberate or unintentional illegitimate (i.e., not provided for by the TP) external action on the state of an object of control, including an action on the part of the control subject.

An anomaly is the occurrence of a perturbing action in a technological system.

A control subject is a device which applies a controlling action to an object of control or transmits a controlling action to another control subject for transformation before being applied directly to the object.

A multilevel control subsystem is a group of control subjects that involves several levels.

A cyber-physical system is an IT concept meaning the integration of computing resources into physical processes. In such a system, the detectors, equipment, and IT systems are connected along the entire chain of value creation beyond the boundaries of a single enterprise or business. These systems interact with each other by means of standard protocols for forecasting, feedback, and adapting to changes. Examples of a cyber-physical system are a technological system and an industrial Internet of Things.

The Internet of Things (IoT) is a computer network of physical objects ("things") equipped with built-in technologies for interacting with each other or with the outer world. The Internet of Things includes such technologies as portable devices, electronic systems of means of transportation, smart cars, smart cities, industrial systems, and others.

An Industrial Internet of Things (IIoT) is a subcategory of the Internet of Things which also includes applications oriented to the consumer, such as portable devices, "smart home" technologies and cars with automatic control. A distinguishing feature of both concepts is devices with built-in detectors, machine tools and infrastructure sending data through the Internet and controlled by means of software.

A technological system (TS) is a functionally interrelated group of control subjects of a multilevel control subsystem and an object of control (a TP or a device), realizing through a change in the states of the control subjects a change in state of the object of control. The structure of the technological system is formed by the basic elements of the technological system (the interrelated control subjects of the multilevel control subsystem and the object of control) and the links between these elements.

In the event that the object of control in the technological system is a technological process, the end goal of the control is: to change the state of the work object (raw material, blanks, etc.) by a change in the state of the object of control.

In the event that the object of control in the technological system is a device, the end goal of the control is to change the state of the device (a means of transportation, a spacecraft).

A functional relationship of the elements of the TS refers to a relationship of the states of these elements. It is noted that there may or may not be a direct physical link between the elements. For example, there is no physical link between actuators and a technological operation, yet the cutting speed, for example, is functionally related to the rotational speed of a spindle, even though these parameters of state are not physically connected.

The state of a control subject is the totality of its essential attributes, expressed by the parameters of state, and which can be altered or maintained under the influence of external actions.

The essential attributes (and accordingly the essential parameters of state) of a control subject are attributes having a direct influence on the essential attributes of the state of the object of control.

The essential attributes of the object of control are attributes having a direct influence on the operational factors being controlled (precision, safety, efficacy) for the TS. For example, cutting conditions corresponding to formally specified conditions, the movement of a train corresponding to a timetable, the maintaining of a reactor temperature within permissible limits. Depending on the factors being controlled, one will select the parameters of state of the object of control and accordingly parameters, related thereto, of the states of the control subjects exerting a controlling action on the object of control.

A hypervisor (a monitor of virtual machines) is a program creating an operational environment for other programs (including other hypervisors) by simulating computer hardware and controlling that hardware and the guest operating systems operating in that environment.

In one example, the present disclosure describes a system for detecting anomalies in a technological system that is implemented on a computing system (e.g., a server, computer, etc.), that includes real-world devices, systems, components, and groups of components realized with the use of hardware such as integrated microcircuits (application-specific integrated circuits, ASICs) or field-programmable gate arrays (FPGAs) or, for example, in the form of a combination of software and hardware such as a microprocessor system and set of program instructions, and also on neurosynaptic chips. The functionality of such means of the system may be realized solely by hardware, and also in the form of a combination, where some of the functionality of the system means is realized by software, and some by hardware. In certain examples, some or all of the components, systems, etc., may be executed on the processor of a general-purpose computer (such as the one shown in <FIG>). Furthermore, the system components may be realized either within a single computing device or spread out among several interconnected computing devices.

In one example, the present disclosure describes a method for detecting anomalies that requires minimal a priori knowledge about the PLCs. The present method increases the level of protection of the technological system by guaranteeing detection of unauthorized interventions in the system. In one example, the interaction of the SCADA components with the PLCs protected using a secure connection (for example, using cryptographic protection schemes). Thus, detection of anomalies in a data transmission network is guaranteed. The detection is performed without carrying out a compilation of statistical data and/or checking and filtering network packets for their content (e.g., using DPI (deep packet inspection)). Moreover, the detection of anomalies is performed even in the case when certain elements of the technological system in the data transmission network are using unprotected data transmission protocols. In addition, the method of the present disclosure may also be used to detect malicious actions which may not be part of the TP and are often aimed at disrupting the flows of the TP. In this respect, the method of the present disclosure makes it is possible to provide a protected interaction of the SCADA components with the PLCs, even without modifying the software of the SCADA (e.g., by using virtualization technologies).

<FIG> illustrates an example diagram of a technological system <NUM>. The technological system <NUM> comprises an object of control <NUM> and a multilevel control subsystem <NUM>. The multilevel control subsystem <NUM> includes a plurality of levels <NUM>, e.g., levels <NUM>, <NUM>,. , N, with each level comprising any number of control subjects <NUM>. Horizontal links 130a interconnect subjects within a level and vertical links 130b interconnect the various levels, e.g., levels <NUM> and <NUM>, levels <NUM> and <NUM>, and the like. The control subjects are grouped by levels <NUM>.

<FIG> illustrates a particular examplary implementation of a technological system <NUM>. The object of control <NUM> is a TP or a device; controlling actions are dispatched to the object of control <NUM>, which actions are elaborated and realized by an automated control system (ACS) <NUM>; in the ACS, three levels <NUM> are shown (upper level, middle level and lower level). The functions of the various levels are described below. Each of the upper, middle and lower levels consist control subjects <NUM> which are interconnected to each other by horizontal links (links within the level, not shown in the figure) and by vertical links 130b (links between levels). For clarity, the control subjects of the upper level are shown as <NUM>upper, the control subjects of the middle level are shown as <NUM>middle, and the control subjects of the lower level are shown as <NUM>lower. The relationships are functional, i.e., in the general case, a change in a state of a control subject <NUM> on one level elicits changes in states of other control subjects <NUM> connected to it on the same level and on other levels. Information about the change in the state of the control subject is transmitted in a form of a signal along the horizontal and vertical links established between the control subjects, i.e., information on the change in the state of the particular control subject is an external action with respect to the other control subjects <NUM>. The levels <NUM> in the ACS <NUM> are identified in accordance with the purpose of the control subjects <NUM>. The number of levels may vary. For the physical linkage of the elements of the TS (i.e., <NUM> and <NUM>) and the subsystems of the TS <NUM>, wired networks, wireless networks, or integrated microcircuits are used; for the logical linkages between the elements of the TS (<NUM>, <NUM>) and the subsystems of the TS <NUM>, Ethernet, industrial Ethernet, or industrial networks are used. In these respect, the following industrial networks and protocols of various types and standards may be used: Profibus, FIP, ControlNet, Interbus-S, DeviceNet, P-NET, WorldFIP, LongWork, Modbus and others.

The upper level (the level of supervisory control and data acquisition, SCADA) is the level of dispatcher/operator control and includes at least the following control subjects <NUM>upper: controllers which control computers and human-machine interfaces (HMI) (<FIG> shows the SCADA within a single control subject). This level is designed to track the states of the elements of the TS (<NUM>, <NUM>upper), to obtain and compile information about the state of the elements of the TS (<NUM>, <NUM>upper), and to correct the information if necessary.

The middle level (the CONTROL level) is the level of the controllers and includes at least the following control subjects: programmable logic controllers (PLC), counters, relays, regulators. The control subjects <NUM>middle of PLC type receive information from the control subjects of "measurement and control equipment" type and from the control subjects <NUM>lower of "detector" type as to the state of the object of control <NUM>. The control subjects of PLC type elaborate (create) a controlling action in accordance with a programmed control algorithm for the control subjects of "actuator" type. The actuators realize the action directly (apply the action to the object of control) at the lower level. An actuator is part of an actuating device (equipment).

The lower level (the Input/Output level) is the level of control subjects such as: detectors and sensors, measurement and control instruments (MCI) which monitor the state of the object of control <NUM> and the actuators. The actuators act directly on the state of the object of control <NUM>, in order to bring the state into compliance with a formal state, i.e., a state complying with a technological task, a technological chart or some other technological documentation (in the case of a TP) or a timetable (in the case of a device). On this lower level, the signals from the control subjects <NUM>lower of "detector" type are coordinated with the inputs of the control subjects of the middle level, and the controlling actions elaborated by the control subjects <NUM>middle of "PLC" type are coordinated with the control subjects <NUM>lower of "actuator" type, which implement the controlling actions. An actuator is part of an actuating device. An actuating device moves a regulating element in accordance with signals arriving from a regulator or a controlling device. Actuating devices are the last link in a chain of automatic control and in the general case consist of the units:.

Depending on the application conditions, actuating devices may differ in their design. The actuators and regulating elements are usually among the basic units of the actuating devices.

In a particular example, the actuating device as a whole is known as the actuator.

The enumerated control subjects (<NUM>upper, <NUM>middle, <NUM>lower) of the different levels are the elements of the technological system (hereinafter referred to as the TS).

<FIG> illustrates an exemplary realization of a system <NUM> for detecting anomalies in a technological system.

In the general case, the upper-level TS elements <NUM>upper (computers on which the SCADA components are installed or engineering terminals) are combined into a separate protected data transmission network by systems and methods ordinarily known in the art of network systems. Furthermore, the upper-level TS elements <NUM>upper send data packets (such as packets containing commands of the technological processes and parameters of the commands) to the middle-level TS elements <NUM>middle (in the general case, programmable logic controllers). Because the technological processes are designed to last dozens of years, the middle-level TS elements <NUM>middle in the general case are less protected and often become obsolete. That is, the middle-level TS elements typically operate using obsolete unprotected data transmission protocols. These middle-level TS elements typically also have known vulnerabilities. It is presumed that the IP addresses of the middle-level TS elements <NUM>middle (such as the PLCs) are known. In order to interfere with the operations of the PLCs, a hacker must send information packets to the IP address of the PLC.

Thus, the method of the present disclosure addresses the problems described above by at least determining which packets are "trusted", and which are "untrusted". In general, a trusted data packet is a data packet dispatched by one TS element, such as an upper-level TS element <NUM>upper, to another TS element, such as a middle-level TS element <NUM>middle. In the context of the present disclosure, it is permissible to consider that data packets outgoing from the protected data transmission network are trusted. Trusted packets should be delivered to the middle-level TS elements <NUM>middle.

In one example, the system <NUM> contains at least one duplicator <NUM> and at least one monitor <NUM>.

The duplicator <NUM> comprises a protected operating system with hypervisor function support, and is designed for installation on a TS element (in a particular instance, on an upper-level TS element <NUM>upper). The protected operating system with hypervisor function support is used to run the existing operating systems and applications of the upper-level TS elements <NUM>upper in a virtual environment. Using virtualization technology enables modifications to be made to components of the SCADA systems operating on the upper-level TS elements without modifying the software of the SCADA applications. For example, new attributes may be added to the components of the SCADA systems operating on the upper-level TS elements <NUM>upper, without modifying the software of the SCADA applications.

In one example, the duplicator <NUM> installed on the upper-level TS element <NUM>upper intercepts outgoing data packets addressed to other TS elements (such as middle-level elements <NUM>middle). The outgoing data packets are received from applications being executed in a guest operating system running in the virtual environment, from the guest operating system itself. In one example, the interception of the data packets is performed using virtualization methods.

In one example, the duplicator also determines the IP address of the middle-level TS element <NUM>middle to which the outgoing data packet is addressed.

In one example, each duplicator <NUM> establishes secure connections (indicated for one duplicator <NUM> in <FIG>) with all monitors <NUM> located in the data transmission network, and sends to the monitors <NUM> information about each outgoing data packet that has been intercepted. In one example, the information sent to the monitors <NUM> includes the intercepted outgoing data packet itself in its initial or transformed form (for example, after encryption or packaging) and its check sum (such as MD5 or CRC). In one example, the information sent to the monitors <NUM> further includes: supplemental information obtained by the duplicator <NUM> as a result of the interception of the outgoing data packets. In one example, the duplicator <NUM> uses known cryptography methods of protection when sending the data to the monitors <NUM>. In another example, an additional transformation or encryption of the intercepted outgoing data packets, by the duplicator <NUM>, is provided by the hypervisor level.

In one example, if the IP address of the middle-level TS element <NUM>middle to which the outgoing data packet is addressed has been determined, the duplicator <NUM> sends the information to the IP address of the middle-level TS element <NUM>middle using a secure connection. In one example, the information as to the intercepted outgoing packets is also sent using the secure connection to monitors <NUM> located in a same data transmission network (or subnetwork) as the middle-level TS element <NUM>middle to which the outgoing data packet is addressed.

In one example, the outgoing data packet which has been intercepted by the duplicator <NUM> is not sent onward to the data transmission network, but remains in the memory of the hypervisor. After obtaining a confirmation from the monitor <NUM> as to the receiving of information about the intercepted data packet, the duplicator <NUM> sends the intercepted outgoing data packet saved in the memory of the hypervisor to the data transmission network in its original unchanged form.

In another example, for example, when no delays are permitted in sending of the data packets (i.e., the TS is working in real time), the intercepted outgoing packet is sent by the duplicator <NUM> to the data transmission network at once, i.e., the intercepted outgoing packet is sent to the data transmission network at the same time as the information being sent by the secure connection to the monitor <NUM>.

Returning to <FIG>, modern ACS may have several components of the SCADA systems operating on the upper-level TS elements <NUM>upper situated in different data transmission networks. In this scenario, each such network may contain a duplicator <NUM> performing the above described actions of intercepting an outgoing data packet and sending information about the intercepted data packet to the monitor <NUM>.

The monitor <NUM>, in one example, is implemented on a TS element <NUM>. In another example, the monitor <NUM> is implemented on an upper-level TS element <NUM>upper. In yet another example, the monitor <NUM> is implemented on a middle-level TS element <NUM>middle.

In one example, the monitor <NUM> is situated topologically in the data transmission network so as to intercept all data packets addressed to the TS elements <NUM>. In one example, the monitor <NUM> operates (is implemented) on an existing TS element <NUM>, such as a middle-level TS element <NUM>middle or an upper-level TS element <NUM>upper, the monitor <NUM> being an executable application or service. In yet another example, the monitor <NUM> is a protected operating system with hypervisor function support, designed for installation on the middle-level TS element <NUM>middle. In another example, the monitor <NUM> is installed on an additional middle-level TS element <NUM>middle designed solely for the operation of the monitor <NUM>.

As previously described, the monitor <NUM> receives, from the duplicator <NUM>, information about the intercepted outgoing packets via a secure connection. After receiving the information about the receiving of that information. Moreover, the monitor <NUM> intercepts incoming data packets which are addressed to the middle-level TS elements <NUM>middle by the data transmission network. In one example, the interception of the incoming data packets is performed using virtualization methods known in the art. In yet another example, the interception is performed without the use of virtualization methods. For example, the interception may be performed using a socket opened in a mode of unprocessed (or minimally processed) data (i.e., in RAW mode).

In one example, the monitor <NUM> compares the information received on the secure connection from the duplicator <NUM> regarding the intercepted outgoing packets with the intercepted incoming packets that are addressed to the middle-level TS elements <NUM>middle in the data transmission network.

When the intercepted outgoing data packets are sent to the data transmission network by the duplicator <NUM> at the same time as the information about the intercepted outgoing data packets using the secure connection, the monitor <NUM> compares the information received about the intercepted outgoing data packets with the intercepted incoming data packets within a pre-determined interval of time (such as <NUM> second). If an incoming data packet has been intercepted and no information is received from the duplicator <NUM> during the pre-determined interval of time about the intercepted incoming data packet, then the monitor <NUM> detects an anomaly in the technological system.

In another example, when the intercepted outgoing data packets are sent to the data transmission network by the duplicator <NUM> after receiving a confirmation from the monitor <NUM> of the reception of information about the intercepted outgoing data packets using the secure connection, the monitor <NUM> compares the intercepted incoming data packets to the received information. If an incoming data packet has been intercepted and no information is received from the duplicator <NUM>, then, the monitor <NUM> detects an anomaly in the technological system.

When an anomaly is detected for the technological system, information about the detected anomaly may be sent, by the monitor <NUM>, to the components of the SCADA systems operating on the upper-level TS elements <NUM>upper. The information about the detected anomaly is provided to the components of the SCADA systems both for the purpose of notification and for enabling the SCADA systems to take further actions to deal with the detected anomaly. For example, mitigating steps may be taken to reduce the risk of damage to components and reduce the chance of data loss.

In one example, if the monitor <NUM> is located in the data transmission network topologically after a first middle-level TS element <NUM>middle and before a second middle-level TS element <NUM>middle, and an anomaly is detected for the technological system, then the monitor <NUM> does not send the intercepted incoming data packet onward to the data transmission network - thereby counteracting the possible consequences of the resulting anomaly in the technological system. The middle-level TS element <NUM>middle, in this example, does not receive the intercepted incoming data packet, which prevents a perturbing action on the middle-level TS element <NUM>middle.

In yet another example, the monitor <NUM> may be located in the data transmission network on the same middle-level TS element <NUM>middle to which the intercepted incoming data packet was addressed. In this case, the monitor <NUM>, as described above, counteracts the possible consequences of the resulting anomaly in the technological system.

An exemplary application of the method of the present disclosure is presented below. Suppose there is a building which is outfitted with an automated access system to the premises, a gymnasium, a swimming pool, and the building has at least a ventilation system and a fire suppression system. Suppose also the ACS and SCADA components are located in the data transmission network of the building in a protected environment (or in a protected subnetwork) yet intercommunicate with the programmable logic controllers which control the aforementioned systems, using the data transmission network. Moreover, the workers of the building and visitors may gain access to this same data transmission network. In practice, such data transmission networks exist rather often. The building are built without proper attention to IT security during their design or in consideration of savings material expenses during initial buildout.

Obviously, third parties may send data packets to the network which do not come from SCADA components and which may be received by the programmable logic controllers, which is an anomaly in the context of the method of the present disclosure. Thus, the present system, as described in the present disclosure, may be used to warn other components of the system about such anomalies. Thus, the duplicator <NUM> installed on the SCADA components intercept outgoing data packets and send the intercepted outgoing data packets to the monitor <NUM>. Thus, the monitor <NUM> receives and compares all the incoming data packets addressed to the programmable logic controllers, making detection of anomalies possible. For example, if the data packet has been sent to the data transmission network not from a SCADA component, the anomaly may be detected and steps may be taken to counteract the effects. For instance, incoming data packets may be blocked.

<FIG> illustrates an exemplary method <NUM> for detecting anomalies in a technological system. The method <NUM> may be implemented on a computing system that comprises any number of devices, e.g., the system <NUM> described above.

In step <NUM>, the duplicator <NUM>, running on an upper-level element of a technological system, e.g., <NUM>upper, intercepts at least one outgoing data packet addressed to a middle-level element, e.g., <NUM>middle, of the technological system. The upper-level element is running in a protected environment and the middle-level element is unprotected, e.g., runs unprotected data transmission protocols.

In one example, the duplicator <NUM>, comprises a protected operating system with a hypervisor function support.

In yet another example, the upper-level element of the technological system comprises a SCADA component. In one example, the intercepting of the data packets is performed using virtualization techniques, e.g., virtualization techniques known in the art.

In step <NUM>, the duplicator <NUM> sends information about the intercepted at least one data packet to a monitor <NUM> using a secure connection, wherein the monitor <NUM> is running on the middle-level element, <NUM>middle, of the technological system. In one example, the duplicator <NUM> establishes at least one secure connection with each monitor <NUM> located in the data transmission network, and sends information about each intercepted outgoing data packet to the monitors <NUM> with which the duplicator <NUM> has established at least one secure connection.

In one example, the monitor <NUM> is a protected operating system.

In another example, the monitor <NUM> is situated in a same data transmission network in which the middle-level element, <NUM>middle, of the technological system to which the intercepted at least one data packet is addressed is located. In one example, the monitor <NUM> is a protected operating system with a hypervisor function support that is designed for installation on the middle-level element, <NUM>middle, of the technological system.

In step <NUM>, the monitor <NUM> intercepts at least one incoming data packet. In one example, the intercepting of the incoming at least one data packet is performed using virtualization techniques known in the art.

In step <NUM>, the monitor <NUM> detects an anomaly in the technological system when the intercepted incoming at least one data packet does not conform to the information about the intercepted at least one data packet received from the duplicator <NUM>. For the detection of anomaly, the monitor <NUM> compares the information about the intercepted outgoing data packets received from the duplicator <NUM> on the secure connection with the intercepted incoming data packets addressed to the middle-level elements, <NUM>middle, of the technological system in the data transmission network. If no anomaly is found, the method returns to step <NUM>. In other words, an incoming data packet is intercepted and information about the intercepted data packet is obtained successfully from the duplicator <NUM>. Thus, there is no anomaly detected.

In one example, in step <NUM>, the monitor <NUM> sends information about the detected anomaly to the components of the SCADA systems operating on the upper-level elements, <NUM>upper, of the technological system. In one example, the information about the detected anomaly is sent for notification purposes and/or for taking further steps to avert possible consequences of the detected anomaly in the technological system.

In one example, if an anomaly is detected, the method returns to step <NUM>.

<FIG> is a block diagram illustrating a computer system <NUM> on which examples of systems and methods for detecting anomalies in a technological system may be implemented. The computer system <NUM> can be in the form of multiple computing devices, or in the form of a single computing device, for example, a desktop computer, a notebook computer, a laptop computer, a mobile computing device, a smart phone, a tablet computer, a server, a mainframe, an embedded device, and other forms of computing devices.

As shown, the computer system <NUM> includes a central processing unit (CPU) <NUM>, a system memory <NUM>, and a system bus <NUM> connecting the various system components, including the memory associated with the central processing unit <NUM>. The system bus <NUM> may comprise a bus memory or bus memory controller, a peripheral bus, and a local bus that is able to interact with any other bus architecture. Examples of the buses may include PCI, ISA, PCI-Express, HyperTransport™, InfiniBand™, Serial ATA, I<NUM>C, and other suitable interconnects. The central processing unit <NUM> (also referred to as a processor) can include a single or multiple sets of processors having single or multiple cores. The processor <NUM> may execute one or more computerexecutable code implementing the techniques of the present disclosure. The system memory <NUM> may be any memory for storing data used herein and/or computer programs that are executable by the processor <NUM>. The system memory <NUM> may include volatile memory such as a random access memory (RAM) <NUM> and non-volatile memory such as a read only memory (ROM) <NUM>, flash memory, etc., or any combination thereof. The basic input/output system (BIOS) <NUM> may store the basic procedures for transfer of information between elements of the computer system <NUM>, such as those at the time of loading the operating system with the use of the ROM <NUM>.

Computer readable program instructions for carrying out operations of the present disclosure may be assembly instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language, and conventional procedural programming languages. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a LAN or WAN, or the connection may be made to an external computer (for example, through the Internet). In some examples, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present disclosure.

In various examples, the systems and methods described in the present disclosure can be addressed in terms of modules. The term "module" as used herein refers to a real-world device, component, or arrangement of components implemented using hardware, such as by an application specific integrated circuit (ASIC) or FPGA, for example, or as a combination of hardware and software, such as by a microprocessor system and a set of instructions to implement the module's functionality, which (while being executed) transform the microprocessor system into a specialpurpose device. A module may also be implemented as a combination of the two, with certain functions facilitated by hardware alone, and other functions facilitated by a combination of hardware and software. In certain implementations, at least a portion, and in some cases, all, of a module may be executed on the processor of a computer system (such as the one described in greater detail in <FIG>, above). Accordingly, each module may be realized in a variety of suitable configurations, and should not be limited to any particular implementation exemplified herein.

It is understood that such a development effort might be complex and timeconsuming, but would nevertheless be a routine undertaking of engineering for those of ordinary skill in the art, having the benefit of this disclosure.

Claim 1:
A method (<NUM>) for detecting anomalies in a technological system, the method comprising:
intercepting (<NUM>), by a duplicator (<NUM>) running on an upper-level element of the technological system at least one outgoing data packet addressed to a middle-level element of the technological system, wherein the upper-level element of the technological system includes at least controllers which control computers and human-machine interfaces, and the middle-level element of the technological system includes at least programmable logic controller, PLC, devices;
sending (<NUM>), by the duplicator (<NUM>), information about the intercepted at least one outgoing data packet to a monitor (<NUM>) using a secure connection, the monitor (<NUM>) running on the middle-level element;
intercepting (<NUM>), by the monitor (<NUM>), at least one incoming data packet,
comparing, by the monitor (<NUM>), the information received from the duplicator (<NUM>) with the intercepted at least one incoming data packet, wherein the comparison is performed with information received from the duplicator (<NUM>) within a pre-determined interval of time; and
detecting (<NUM>), by the monitor (<NUM>), an anomaly in the technological system when the intercepted at least one incoming data packet does not conform to the information received from the duplicator (<NUM>).