Patent Description:
Buildings, such as university buildings, office buildings, residential buildings, and the like, incorporate multiple electrically powered systems. Some or all of these systems are smart systems including Internet, or other network connectivity which facilitates remote control and operation of the building system through computer networks.

Due to their connections to a computer network, smart building systems can be vulnerable to hacking, malware, or other malicious activity. In addition, smart and non-smart building systems can undergo anomalous behaviors due to malfunctions or other operational irregularities. The anomalous activity can be the result of an individual attempting to attack the building, an individual attempting to use one or more building systems to indirectly attack other building systems, the power grid, or other buildings, or the result of accidental non-malicious activities and malfunctions.

<CIT> discloses a computer network defense system including features for detecting highly-distributed, stealth network attacks.

<CIT> discloses systems and methods of detecting an attack in a utility grid using signals from controllers or metering devices.

Certain preferred embodiments will be described by way of example only and with reference to the drawings listed below. The embodiments, examples, and alternatives of the preceding paragraphs, the claims, or the following description and drawings, including any of their various aspects or respective individual features, may be taken independently or in any combination. Features described in connection with one embodiment are applicable to all embodiments, unless such features are incompatible.

Smart building systems, or Cyber Physical Systems (CPS) infrastructures, may be susceptible to cyber attacks. Detection and response methods detect conditions that may be a result of such cyber attacks. However, known systems and methods detect anomalies in the system, and do not distinguish between cyber attacks and physical system faults, such as a failure of a particular system in the CPS. The system and method described herein distinguishes between cyber attacks and system faults, and provides an automated response when a cyber attack is detected.

<FIG> schematically illustrates an example smart building system <NUM>. The building system <NUM> includes a first building 12a and a second building 12b. The building system <NUM> may include additional buildings, in some examples. The building 12a may include a heating, ventilation, and cooling (HVAC) system 30a, a door lock system 32a, a lighting system 34a, an elevator system <NUM> and an electrical vehicle charging system <NUM>, for example. The second building 12b may also include an HVAC system 30b, a door lock system 32b, a lighting system 34b, and/or other systems. The first and second buildings 12a, 12b may have all the same building systems, or some different building systems. The disclosed example building systems <NUM>-<NUM> are exemplary in nature and any number of additional building systems can be incorporated into the buildings 12a, 12b and receive the benefits of the system and method disclosed herein.

In an example embodiment, each of the buildings 12a, 12b is connected to a power line <NUM> via grid interconnects 22a, 22b. Each of the building systems <NUM>-<NUM> may draw operational power from a building power distribution system, which is connected to the grid interconnect 22a, 22b, and draws power from the external power grid to power the building systems <NUM>-<NUM>. Due to the reliance on drawing power through the grid interconnect <NUM>, each of the building systems <NUM>-<NUM> is referred to as being "behind the meter". Although the buildings 12a, 12b are illustrated as being connected to the same power line <NUM>, they may receive power from different power lines in some examples.

Each building 12a, 12b includes a respective computer network node 40a, 40b connected to at least some of the building systems <NUM>-<NUM>. The nodes 40a, 40b collect information from each of the building systems. In some examples, the nodes 40a, 40b may be configured to detect the power characteristics being provided to the building 12a, 12b through the grid interconnect 22a, 22b. The nodes 40a, 40b may detect information such as current, voltage, frequency, active and reactive power, rate of change of frequency, and the like. In the illustrated example, the smart building systems are connected via wireless connections, although it should be appreciated that any other data connection can be utilized. The nodes 40a, 40b may receive data from the building systems via an external network, such as the Internet, for example.

The system <NUM> may include a building automation system <NUM>, that sends signals to the nodes 40a, 40b and/or the building systems <NUM>-<NUM>. In the illustrated example, the building automation system <NUM> is located on the building 12a, but in other examples, the building automation system <NUM> may be located remotely. The building automation system <NUM> may provide signals to all of the buildings 12a, 12b in the system <NUM>, or to only some of the buildings 12a, 12b. The building automation system <NUM> may automate some or all of the example building systems <NUM>-<NUM>. For example, the building automation system <NUM> may be programmed to automatically control the HVAC systems, 30a, 30b. The building automation system <NUM> may be connected to an external network, such as the Internet, to allow authorized users to access and control the building systems <NUM>-<NUM> from remote locations and from throughout the buildings 12a, 12b.

As shown in <FIG>, and with continuing reference to <FIG>, the system <NUM> includes a cyber defense response system (CYDRES) <NUM>. The cyber defense response system <NUM> may include a modem or aggregator <NUM> in communication with the nodes 40a, 40b from each of the buildings 12a, 12b in the system <NUM>. The aggregator <NUM> is, in turn, connected to an external network, such as the Internet, and may allow authorized users to access and control the building systems <NUM>-<NUM>. In some embodiments, the aggregator <NUM> is integrated with the cyber defense response system <NUM>. In other embodiments, the cyber defense response system <NUM> is separate from the aggregator <NUM>, and they communicate through a wired or wireless connection. The building automation system <NUM> is in communication with the cyber defense response system <NUM>. The building automation system <NUM> may be integrated into the cyber defense response system <NUM>, in some examples.

The cyber defense response system <NUM> includes a computing device <NUM>, which may include one or more controllers comprising a processor and memory. The computing device <NUM> may include a hardware device for executing software, particularly software stored in memory, such as a cyber attack detection algorithm. The computing device <NUM> may include a custom made or commercially available processor, a central processing unit (CPU), an auxiliary processor among several processors associated with the computing device <NUM>, a semiconductor based microprocessor (in the form of a microchip or chip set), or generally any device for executing software instructions. The memory can include any one or combination of volatile memory elements (e.g., random access memory (RAM, such as DRAM, SRAM, SDRAM, VRAM, etc.)) and/or nonvolatile memory elements (e.g., ROM, hard drive, tape, CD-ROM, etc.). Moreover, the memory may incorporate electronic, magnetic, optical, and/or other types of storage media. Note that the memory can also have a distributed architecture, where various components are situated remotely from one another, but can be accessed by the processor.

The software in the memory may include one or more separate programs, each of which includes an ordered listing of executable instructions for implementing logical functions. A system component embodied as software may also be construed as a source program, executable program (object code), script, or any other entity comprising a set of instructions to be performed. When constructed as a source program, the program is translated via a compiler, assembler, interpreter, or the like, which may or may not be included within the memory.

The controller can be configured to execute software stored within the memory, to communicate data to and from the memory, and to generally control operations of the computing device <NUM> pursuant to the software. Software in memory, in whole or in part, is read by the processor, perhaps buffered within the processor, and then executed. This software may be used to analyze data from building systems to detect anomalies and determine whether the data indicate that the anomaly is the result of a cyber attack, for example.

The building automation system <NUM> and cyber defense response system <NUM> can then detect malicious activity occurring in one or more of the building systems <NUM>-<NUM> via embedded algorithms and the data from the building systems collected from the nodes 40a, 40b and/or building power characteristics. The cyber defense response system <NUM> compares data from the first node 40a to the second node 40b to determine anomalies. In one embodiment, the cyber defense response system <NUM> is connected to the nodes 40a, 40b, and the building automation system <NUM> wirelessly, such as via BLUETOOTH signaling protocol (IEEE <NUM>. <NUM>), WiFi (IEEE <NUM>), Zigbee (IEEE <NUM>. <NUM>), Near-Field Communication (NFC), or another signaling protocol, for example.

The cyber defense response system <NUM> may also compare the data with a building behavior database <NUM> to help detect anomalies. The building behavior database <NUM> may include set values input by an operator for expected building behavior, and/or may store data over time to further improve algorithms. In an embodiment, the expected power characteristics of the building systems <NUM>-<NUM> may be continuously adapted in the cyber defense response system <NUM>, and the system can account for seasonal variations in expected power characteristics. By way of example, the power characteristics of an air conditioner system will differ from those of a heating system, and the corresponding effect on the building power system will be distinct between a winter season and a summer season. In some embodiments, an operator can input feedback to the system, such that algorithms for localization and response are improved over time.

The cyber defense response system <NUM> is configured to detect anomalies in the system <NUM> by comparing data from the nodes 40a, 40b, the building behavior database <NUM>, and the network. An anomaly in the system <NUM> may be due to a fault in one of the building systems <NUM>-<NUM>, such as a failure of the HVAC system 30a or another building system, or may be a malicious cyber attack. If the anomaly is due to a failure of a building system, then the response might be to alert an operator so that the operator can fix the building system. However, if the anomaly is due to a cyber attack, a different response may be taken.

In one example, when a cyber attack or other malicious activity on one or more of the building systems <NUM>-<NUM> is launched using invalid commands, malware, or by changing the control parameters, the building systems <NUM>-<NUM> behave abnormally resulting in an anomaly in the power characteristics of the power passing through the grid interconnect <NUM>. In an example, the nodes 40a, 40b and the cyber defense response system <NUM> are connected to a network, and the cyber defense response system <NUM> analyzes network behavior, such as traffic and delay, and system response. During a cyber attack, the attack may push a detectable or notable amount of data into the system <NUM>. Thus, an increase in data traffic detected by the cyber defense response system <NUM> may be indicative of a cyber attack.

Comparing data from nodes 40a, 40b across different buildings 12a, 12b helps distinguish system faults from cyber attacks. For example, if a building system, such as an HVAC system 30a breaks down, it will not occur simultaneously across multiple buildings. However, a cyber attack may affect HVAC systems 30a, 30b across multiple buildings simultaneously. When an anomaly is detected across multiple buildings, it is likely a cyber attack.

If the anomaly detected is likely due to a cyber attack, the system <NUM> will respond with a targeted control response. In an embodiment, the system <NUM> commands the targeted control response automatically. The targeted control response may include automatically switching the building 12a, 12b to a resilient mode of operation based on the localized threat and estimated impact. The targeted control response may further include automated isolation and restoration of data and/or activation of resilient control logic. In one example, the response includes shutting down the system <NUM> to prevent the attack from infiltrating any further into the system <NUM> or any of the example building systems. The response may be to shut down the cyber defense response system <NUM>, or to disconnect the cyber defense response system <NUM> and/or nodes 40a, 40b from the network. In another example, the response includes disconnecting the particular targeted building system <NUM>-<NUM> from the network. This automated response occurs quickly and may help mitigate harm from the attack.

<FIG> summarizes an example method of detecting and responding to anomalies. The cyber defense response system <NUM> gathers data from the nodes 40a, 40b located on different buildings 12a, 12b at <NUM>. The cyber defense response system <NUM> compares the data from the first node 40a with the data from the second node 40b at <NUM>. The cyber defense response system <NUM> also compares the data from the nodes 40a, 40b with expected values, such as values input by an operator or gathered over time from the building behavior database <NUM> at <NUM>. When data from one or more of the nodes 40a, 40b deviates from the expected values, an anomaly is detected.

The cyber defense response system <NUM> analyzes the data and system to determine whether the detected anomaly is based on or resulting from a cyber attack or a system fault at <NUM>. In one example, the cyber defense response system <NUM> analyzes network behavior, such as traffic and delay. In another example, the cyber defense response system <NUM> analyzes the variance of the data between the anomaly and the other nodes 40a, 40b and/or from the building behavior database <NUM>. If the anomaly is not considered an attack, the cyber defense response system <NUM> provides a fault response at <NUM>. In one example, the fault response includes sending an alert to an operator. If the anomaly is determined to be due to an attack, the cyber defense response system <NUM> localizes the attack at <NUM> to determine where the cyber attack is coming from and/or which building systems may be affected. The localization is based on analyzing data across building systems. For example, the cyber defense response system <NUM> may analyze individual equipment power characteristics, such as the installed HVAC 30a, 30b, the lighting systems 34a, 34b, power consumed by the building systems, and/or building system modes of operation and control data from the building automation system <NUM>.

When a cyber attack is detected, the cyber defense response system <NUM> will respond with a targeted control response at <NUM>. In one example, the response will include shutting down the system <NUM> or a portion of the system <NUM> to prevent the attack from infiltrating any further into the system <NUM>. According to the invention the response will include disconnecting a building system from the network. For example, at least one of the buildings 12a, 12b, nodes 40a, 40b, and/or building systems <NUM>-<NUM> may be disconnected. In other examples, the building behavior database <NUM> and/or building automation system <NUM> may be disconnected from the network. In an embodiment, the targeted control response is automated.

The disclosed system and method analyze data from the system to determine whether an anomaly is a malicious cyber attack or a system fault. The disclosed system and method further helps mitigate the impact of a successful attack on building devices by providing means to locate, validate, and automatically respond to cyber attacks.

Claim 1:
A method for a defense and response system for buildings, the method comprising:
determining a relationship between first data from a first smart building system (30a, 32a, 34a, 36a, <NUM>) in communication with a first node (40a) and second data from a second smart building system (30b, 32b, 34b, 36b, <NUM>) in communication with a second node (40b), wherein the smart building systems draw power from a building power distribution system (<NUM>), and wherein the first smart building system and/or the second smart building system comprises one of a heating, ventilation, and cooling, HVAC, system (30a, 30b), a door lock system (32a, 32b), a lighting system (34a, 34b), an elevator system (36a, 36b) or an electrical vehicle charging system(<NUM>);
using a cyber defense response system (<NUM>) in communication with the first node and the second node via a network, determining (<NUM>) whether there is an anomaly by comparing one of the first data and second data with a predetermined value;
using the cyber defense response system, determining (<NUM>) whether the anomaly is an attack or a fault based on the relationship;
the cyber defense response system providing (<NUM>) a targeted control response if the anomaly indicates an attack, the targeted control response including disconnecting one of the first and second smart building systems from the network; and
the cyber defense response system providing (<NUM>) a fault response if the anomaly indicates a fault.