Abstract: A method monitors an industrial network. The industrial network is divided into at least two hierarchical levels each with a different hierarchical stage. At least one network component is respectively included for each hierarchical level. Each hierarchical level has at least one segment. Each segment comprises at least one network component of the respective hierarchical level. At least one component monitoring unit for monitoring at least one network component in the respective segment and/or at least one communication monitoring unit for monitoring communication in the respective segment is/are respectively included for each segment. A central monitoring unit is included in one of the segments in order to evaluate information for detecting attacks. At least one decentralized monitoring unit is respectively included in at least one of the other segments.

Abstract: A method for detecting attacks on a network component of an industrial network uses a component monitoring unit integrated in the network component. The component monitoring unit has at least one checking module for performing a check on the network component and a communication module for the component monitoring unit to communicate with at least one further network component of the industrial network. The component monitoring unit further has a management module for managing a communication between the at least one checking module and the communication module. When a predetermined criterion is satisfied, the at least one checking module collects and/or evaluates information concerning the network component and/or concerning the satisfied criterion for the purpose of checking the network component.

Abstract: A method monitors an industrial network. The industrial network is divided into at least two hierarchical levels each with a different hierarchical stage. At least one network component is respectively included for each hierarchical level. Each hierarchical level has at least one segment. Each segment comprises at least one network component of the respective hierarchical level. At least one component monitoring unit for monitoring at least one network component in the respective segment and/or at least one communication monitoring unit for monitoring communication in the respective segment is/are respectively included for each segment. A central monitoring unit is included in one of the segments in order to evaluate information for detecting attacks. At least one decentralized monitoring unit is respectively included in at least one of the other segments.

Abstract: A method for detecting attacks on a network component of an industrial network uses a component monitoring unit integrated in the network component. The component monitoring unit has at least one checking module for performing a check on the network component and a communication module for the component monitoring unit to communicate with at least one further network component of the industrial network. The component monitoring unit further has a management module for managing a communication between the at least one checking module and the communication module. When a predetermined criterion is satisfied, the at least one checking module collects and/or evaluates information concerning the network component and/or concerning the satisfied criterion for the purpose of checking the network component.

Abstract: A method for analyzing a large number of messages, wherein the number of messages is reduced based on pattern recognition and pattern simplification, rules for the pattern recognition and pattern simplification are based on a regular grammatical structure, and patterns are sought in the remaining messages, or directly, i.e., without previous simplification. Syntactic pattern recognition is used for each type of pattern search, and a finite machine is derivable using the regular grammatical structure underlying each pattern recognition by transforming the mapping rules into transfer function, such that structural connections between the messages can be displayed graphically.

Abstract: A method for analysing a large number of messages, wherein the number of messages is reduced based on pattern recognition and pattern simplification, rules for the pattern recognition and pattern simplification are based on a regular grammatical structure, and patterns are sought in the remaining messages, or directly, i.e., without previous simplification. Syntactic pattern recognition is used for each type of pattern search, and a finite machine is derivable using the regular grammatical structure underlying each pattern recognition by transforming the mapping rules into transfer function, such that structural connections between the messages can be displayed graphically.