Patent Document ID: 8712596
Application ID: 13103538
Patent Flag: 1

Claim One:
1. A method of characterizing malicious activity in an intelligent utility grid system, the method executable by a computer having at least one processor and at least one memory, comprising: receiving, by the at least one processor, information-technology (IT) data including IT-related activity from the intelligent grid system; receiving, by the at least one processor, non-IT data including location-specific event data from a plurality of electronic sources; grid analog measurements comprising phasor measurements; and a list of high-value targets and corresponding geographic locations; pre-processing, by the at least one processor, the non-IT data including: disregarding the non-IT data failing to meet a predetermined level of relevance to one of a plurality of risk-related events; applying, by the at least one processor, a plurality of rules to the pre-processed non-IT data comprising: associating an undesired event with the IT-related activity; determining a probability that the undesired event is indicative of malicious activity including comparing predetermined criteria to the non-IT data to generate one of a plurality of probability levels as a sum of: (1) a product of a probability of occurrence of an intentional malicious attack and a probability of existence of a vulnerability exploitable by the intentional malicious attack; and (2) a product of a probability of occurrence of an unexpected hazard and a probability of existence of a vulnerability associated with the unexpected hazard, where the intentional malicious attack and the unexpected hazard comprise mutually independent events; and applying, by the at least one processor, a risk characterization to the undesired event based on the probability level and the IT-related activity.