Patent application EP19180060A (EP), filed 2019-06-13
Publication number: EP3751813A1
Title: DEVICE AND METHOD FOR PERFORMING THREAT DETECTION AND/OR MITIGATION
Abstract: An analyzer (40) processes, in combination, cyber security information detected by an intrusion detection system (25) of a cyber subsystem (20) and physical subsystem information representing measurements in a physical subsystem (10) to perform threat detection.
IPC codes: H04L  29/    06            A I
H04L  29/    08            A I
G06F  21/    55            A I
H04L  67/    12            A I
H04L   9/    40            A I
Claims: number: 1
text: An analyzer (40) operative to perform threat detection for a system that comprises a physical subsystem (10) having a plurality of devices (11, 12) and a cyber subsystem (20) associated with the physical subsystem (10), the analyzer (40) comprising:
number: 2
text: The analyzer (40) of claim 1, wherein the at least one integrated circuit (42) is operative to process a feature set that is based on the physical subsystem information and a cyber security status derived from the cyber subsystem (20) information to perform the threat detection.
number: 3
text: The analyzer (40) of claim 2, wherein the at least one integrated circuit (42) is operative to perform a state classification based on the feature set to perform the threat detection.
number: 4
text: The analyzer (40) of claim 3, wherein the at least one integrated circuit (42) is operative to execute a machine learning algorithm to continually update, during ongoing operation of the system, a state classification process that is applied to the feature set.
number: 5
text: The analyzer (40) of any one of claims 2 to 4, wherein the at least one integrated circuit (42) is operative to perform a cluster analysis based on the feature set and the cyber security status to perform the threat detection.
number: 6
text: The analyzer (40) of claim 5, wherein the at least one integrated circuit (42) is operative to execute a machine learning algorithm to continually update, during ongoing operation of the system, a cluster analysis process that is applied to the feature set and the cyber security status.
number: 7
text: The analyzer (40) of any one of the claims 2 to 6, wherein the at least one integrated circuit (42) is operative to report results of the threat detection to a monitoring station (52) of the system.
number: 8
text: The analyzer (40) of claim 7, wherein the analyzer (40) is operative to report the results of the threat detection in response to any one or any combination of the following:
number: 9
text: The analyzer (40) of any one of the preceding claims, wherein the at least one integrated circuit (42) is operative to process, in combination, the cyber security information and the physical subsystem information to identify measures for mitigating a detected threat.
number: 10
text: A system, comprising:
number: 11
text: The system of claim 10, further comprising a security event logger (32) coupled to the intrusion detection system (25) and optionally to a database (51) that stores the cyber security information, wherein the at least one interface (41) of the analyzer (40) is communicatively coupled to the security event logger (32) and/or the database (51).
number: 12
text: The system of claim 10 or claim 11, wherein the cyber subsystem (20) is an industrial automation control system comprising at least one IED (21, 22).
number: 13
text: The system of any one of claims 10 to 12, wherein:
number: 14
text: The system of any one of claims 10 to 13, wherein the data collector (31) and analyzer (40) are independent computing devices having different operating systems.
number: 15
text: A method of performing threat detection for a system that comprises a physical subsystem (10) having a plurality of devices (11, 12) and a cyber subsystem (20) associated with the physical subsystem (10), the method comprising:
Office action: search_report, dated 2020-12-16
Rejection reasons: novelty_epc_54
Prior art cited: ref_id: US2015378339A1
ref_type: patent
severity: background
ref_id: EP2779569A1
ref_type: patent
severity: background
ref_id: EP2657880A1
ref_type: patent
severity: background
ref_id: EP2657880
ref_type: patent
severity: novelty_destroying
ref_id: EP2779569
ref_type: patent
severity: novelty_destroying
Final disposition: pending (2020-12-16)