SYSTEM AND METHODOLOGY PROVIDING AUTOMATION SECURITY ANALYSIS AND NETWORK INTRUSION PROTECTION IN AN INDUSTRIAL ENVIRONMENT

摘要

Automation security in a networked-based industrial controller environment is implemented. Various components, systems and methodologies are provided to facilitate varying levels of automation security in accordance with security analysis tools, security validation tools and/or security learning systems. The security analysis tool receives abstract factory models or descriptions for input and generates an output that can include security guidelines, components, topologies, procedures, rules, policies, and the like for deployment in an automation security network. The validation tools are operative in the automation security network, wherein the tools perform security checking and/or auditing functions, for example, to determine if security components are in place and/or in suitable working order. The security learning system monitors/learns network traffic patterns during a learning phase, fires alarms or events based upon detected deviations from the learned patterns, and/or causes other automated actions to occur.

主权项

1. A system, comprising:
a pattern analysis component configured to generate at least one learned profile characterizing at least one learned pattern of data traffic determined based at least in part on data traffic information obtained by monitoring the data traffic associated with an industrial network at least during a training period; and a comparison analyzer component configured to detect a deviation of a pattern of data traffic from the at least one learned pattern of data traffic in excess of a defined threshold of deviation, and to initiate one or more security countermeasures in response to detecting the deviation.