| 摘要 |
To enhance the security of an industrial control system, a data stream can be received from an input device via a communications network or an I/O subsystem of a computer system. All or part of the data stream can be stored in computer memory. Stored elements of the data stream can be retrieved from the memory. A set of program instructions can be executed to 5 ascertain descriptive characteristics of the stored elements. Using a comparison with a stored normative descriptive characteristic in a database or application of an algorithm, heuristic or rule, it can be determined whether any of the descriptive characteristics are anomalous. When the existence of an anomalous descriptive characteristic has been determined, an alarm can be created, data or an alarm can be communicated to a control system or an operator, and/or the data or alarm can be recorded in a database. |
