Abstract: To enhance the security of an industrial control system, a data stream can be received from an input device via a communications network or an I/O subsystem of a computer system. All or part of the data stream can be stored in computer memory. Stored elements of the data stream can be retrieved from the memory. A set of program instructions can be executed to ascertain descriptive characteristics of the stored elements. Using a comparison with a stored normative descriptive characteristic in a database or application of an algorithm, heuristic or rule, it can be determined whether any of the descriptive characteristics are anomalous. When the existence of an anomalous descriptive characteristic has been determined, an alarm can be created, data or an alarm can be communicated to a control system or an operator, and/or the data or alarm can be recorded in a database.

Abstract: A method of detecting anomalies in an industrial control system includes analyzing data of correct operational parameters from at least one input device and storing the correct operational parameter or a correlation of at least two operational parameters as training data. The training data is used to train an anomaly detection system. Current operational parameters of the at least one input device are detected. The anomaly detection system then checks at least one of the detected operational parameter or a correlation of at least two detected operational parameters to detect a deviation from the training data. When the detected deviation is above or below a defined threshold, a communication function is performed. For example, the communication function is at least one of creating an alarm, communicating data to at least one of a control system and an operator, and recording the data or the alarm.