Abstract: Systems and methods of providing industrial system cybersecurity event detection and corresponding response are described. The systems and methods utilize various end point sensors already available in an industrial control system and an associated monitoring process to detect cybersecurity and other security threats based on data collected by the sensors. The cybersecurity monitoring process may be trained with sensor data patterns and behaviors for known threats to recognize potentially malicious activity. Such a process may also learn to recognize and be trained on new threats and may incorporate each new threat to stay current with evolving industrial threats. This allows an enterprise to utilize its existing industrial infrastructure to detect and act upon a variety of threats to an industrial system with little or no interference or interruption of existing industrial processes.

Abstract: A control system for a power distribution grid including an electrical distribution circuit includes a processor configured to perform operations including constructing a grid model comprising edges and nodes representing assets and transmission paths of the power distribution grid, generating an analysis of an operation of the power distribution grid over a predetermined time duration, determining a plurality of constraint violations based on the analysis of the operation of the power distribution grid within the predetermined time duration, generating a plurality of alterations to the power distribution grid, respective ones of the plurality of alterations resolving at least one of the constraint violations, selecting a first alteration of the plurality of alterations to the power distribution grid responsive to determining that the selected first alteration resolves at least two of the plurality of constraint violations, and autonomously implementing the first alteration to the power distribution grid.

Abstract: Systems and methods of providing industrial system cybersecurity event detection and corresponding response are described. The systems and methods utilize various end point sensors already available in an industrial control system and an associated monitoring process to detect cybersecurity and other security threats based on data collected by the sensors. The cybersecurity monitoring process may be trained with sensor data patterns and behaviors for known threats to recognize potentially malicious activity. Such a process may also learn to recognize and be trained on new threats and may incorporate each new threat to stay current with evolving industrial threats. This allows an enterprise to utilize its existing industrial infrastructure to detect and act upon a variety of threats to an industrial system with little or no interference or interruption of existing industrial processes.