Non-Intrusive Digital Agent for Behavioral Monitoring of Cybersecurity-Related Events in an Industrial Control System

摘要

There is described a digital agent for monitoring of cybersecurity-related events in an industrial control system. The digital agent being residable in a host. The digital agent includes a module for monitoring behavioral data of the host, such as violation of security policy, system usage metric, etc. The digital agent also includes a module for recording behavior baseline of the host, such as operating system, operating system version, firewall status etc. In addition, the digital agent includes an agent state machine for monitoring the CPU load and/or memory usage of the host. Further, the digital agent includes an agent communication module for transmitting monitored data to an analysis unit external to the industrial control system.

主权项

1. A digital agent for monitoring of cybersecurity-related events in an industrial control system, the digital agent being residable in a host and comprising:
a module for monitoring behavioral data of the host, wherein the behavioral data comprises violation of security policy data and/or system usage metric data; a module for recording behavior baseline of the host, wherein the behavior baseline comprises operating system identification, and/or operating system version, and/or firewall status, and/or antivirus status; an agent state machine module for monitoring the CPU load and/or memory usage of the host; and an agent communication module for transmitting monitored data to an analysis unit external to the industrial control system.