Abstract: Methods and systems are disclosed for security management in an industrial control system (ICS). An event entity detection and linking module generates a model for a plurality of event entities extracted from a plurality of different data sources including one ICS data source and one IT data source. The model encodes a set of linked event entities and their relationships, each event entity associated with a vector of attribute value pairs. A data standardization of domain knowledge includes translating, by a machine learning application, extracted knowledge base information to rules for the constraints and using the rules to validate the constraints and to add new constraints. A fusion module performs temporal correlation detection across data streams of the different data sources for establishing causality between triplets of association models within a defined time span.

Abstract: A system for monitoring an industrial system for cyberattacks includes an industrial control system including a plurality of actuators, a plurality of sensors each arranged to measure one of a plurality of operating parameters, and an edge device and a computer including a data storage device having stored thereon a program that includes each of a time-series database including expected operating ranges for each operating parameter, a clustering-based database that includes clusters of operating parameters having similarities, and a correlation database that includes pairs of operating parameters that show a correlation.

Abstract: A computer-implemented method for power grid anomaly detection using a convolutional neural network (CNN) trained to detect anomalies in electricity demand data and electricity supply data includes receiving (i) electricity demand data comprising time series measurements of consumption of electricity by a plurality of consumers, and (ii) electricity supply data comprising time series measurements of availability of electricity by one or more producers. An input matrix is generated that comprises the electricity demand data and the electricity supply data. The CNN is applied to the input matrix to yield a probability of anomaly in the electricity demand data and the electricity supply data. If the probability of anomaly is above a threshold value, an alert message is generated for one or more system operators.

Abstract: A system for monitoring an industrial system for cyberattacks includes an industrial control system including a plurality of actuators, a plurality of sensors each arranged to measure one of a plurality of operating parameters, and an edge device and a computer including a data storage device having stored thereon a program that includes each of a time-series database including expected operating ranges for each operating parameter, a clustering-based database that includes clusters of operating parameters having similarities, and a correlation database that includes pairs of operating parameters that show a correlation.

Abstract: Methods and systems are disclosed for security management in an industrial control system (ICS). An event entity detection and linking module generates a model for a plurality of event entities extracted from a plurality of different data sources including one ICS data source and one IT data source. The model encodes a set of linked event entities and their relationships, each event entity associated with a vector of attributevalue pairs. A data standardization of domain knowledge includes translating, by a machine learning application, extracted knowledge base information to rules for the constraints and using the rules to validate the constraints and to add new constraints. A fusion module performs temporal correlation detection across data streams of the different data sources for establishing causality between triplets of association models within a defined time span.

Abstract: A computer-implemented method for power grid anomaly detection using a convolutional neural network (CNN) trained to detect anomalies in electricity demand data and electricity supply data includes receiving (i) electricity demand data comprising time series measurements of consumption of electricity by a plurality of consumers, and (ii) electricity supply data comprising time series measurements of availability of electricity by one or more producers. An input matrix is generated that comprises the electricity demand data and the electricity supply data. The CNN is applied to the input matrix to yield a probability of anomaly in the electricity demand data and the electricity supply data. If the probability of anomaly is above a threshold value, an alert message is generated for one or more system operators.