PATENT CLAIM ANALYSIS

Application Number: 16024924
Application Type: Utility
Filing Date: 2018-07
Publication Date: 2018-11
Patent Classification: ["726", "023000"]

Abstract:
Methods and systems for detecting a potential compromise of cyber security in an industrial network are disclosed. These methods and systems comprise elements of hardware and software for establishing a baseline of site-acceptable network behavior comprising a list of network states and transition probabilities, wherein a transition probability denotes an estimated probability of a first network state being followed temporally by a second network state during normal network operation; establishing a threshold representing tile probability below which a sequence of network states is anomalous; determining a probability for the occurrence of a sequence of network states as obtained from a particular stream of packets, according to the baseline of site-acceptable network behavior; and, taking protective action according to whether the determined probability is below the established threshold.

Claim (Index 1):
A method for detecting a potential compromise of cyber security in an industrial network utilizing a protocol for controlling an industrial process, comprising:\n polling specific fields of packet data, obtained from packets, at a fixed frequency for a plurality of programmable logic controllers (PLCs), to establish network behavior; deriving a vector based on the specific packet data fields, wherein the specific packet data fields represent the protocol which signifies particular network communications; generating a value based on the vector indicative of a network behavioral state; maintaining a network behavior state machine comprising a list of network states and transition counts, wherein the transition count is maintained in accordance to the value; determining a transition probability corresponding to the transition counts, wherein the transition probability denotes an estimated probability of a first network state being followed temporally by a second network state, during normal network operation; establishing, for the network behavior state machine, a threshold representing the probability below which a sequence of network states is anomalous; determining, by the network behavior state machine, a probability for the occurrence of a sequence of network states, according to the derived vector; and, taking protective action according to whether the determined probability is below the established threshold.

Metadata:
- Claim Count in Document: 1.0
- Percentile: 95.0
- Lexical Diversity: 1.82432
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['14830776', '15471836', '15154469', '15429900', '13039180']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.2118331346007873
- 35 USC 102 Novelty (BERT): 0.4936950845330565
- Combined Prediction Score: 0.2400193295940142
- Mean Citation Score: 148.07216599999995
- Max Citation Score: 276.07596
- Similarity Product: 269.1378163149762

Labels:
- Claim Label 101: 0
- Claim Label 102: 1
- Claim Label 103: 0
- Claim Label 112: 1
- Combined Label: 0
- Label 101 Adjusted: 0

Dataset: test