Patent Document ID: 20170230410
Application ID: 15429900
Patent Flag: 0

Claim One:
1. A security system for detecting a security anomaly associated with a physical process within an industrial control system (ICS) comprising: an industrial control network including a plurality of endpoint devices, and at least one programmable logic controller that communicates with the endpoint devices through the industrial control network; the endpoint devices producing telemetry data and transmitting the telemetry data on the industrial control network; and a telemetry analytics engine configured to receive the telemetry data from the endpoint devices, and configured to receive reference data from the at least one programmable logic controller; the telemetry analytics engine further comprising: an anomaly detection processor configured to analyze the telemetry data to detect anomalies that indicate a potential security compromise; a root cause analysis processor configured to execute a correlation process between security data received from external sources, and data that is output from the anomaly detection processor; the telemetry analytics engine identifying the root cause of the potential security compromise with respect to the industrial control system and providing a security alert to a human machine interface (HMI).