Abstract: A system and method for automatically detecting anomalies in an industrial control system (ICS) is provided. A behavioral model is provided, the model comprising groups of learned sets of interdependent ICS signals of parameters associated with an operation of the ICS. For each of the groups, the learned sets in the respective group include at least one independent signal and one or more dependent signals that are dependent on the independent signal in accordance with a common type of dependency. Monitoring signals of given parameters are obtained, the monitoring signals corresponding to a given learned set of the learned sets in one of the groups. Upon determining a nonconformance of an observed interdependency of the monitoring signals with a predicted interdependency of the monitoring signals, the predicted interdependency being in accordance with the type of dependency associated with the given learned set, an anomaly is automatically detected.

Abstract: A method for automatically detecting an abnormal process flow for a process in an industrial control system (ICS) comprises providing process flow (PF) strings that define normal PFs for processes in the ICS, each of the PF strings defining a time-ordered sequence of events that is a time-ordered recurring sequence of learned events associated with learned changes between learning values of parameters that affect an operation of the ICS, wherein a respective PF string of the PF strings includes an attributed process flow node that represents an attributed event and one or more attributes that are associated therewith. The method further comprises: obtaining monitoring values of the parameters, analyzing the monitoring values to detect monitored events that are associated with monitored changes between monitoring values of the parameters, and detecting the abnormal process flow upon determining a lack of conformance of a monitored event with one of the PF strings.

Abstract: Invention comprises a new IoT Device Authentication Method and secure transaction Authorization System. IoT Device Authentication process based on novel type of Device Identity that consist of information about physical surroundings collected by the device itself. The Transaction Authorization processes does not require Human intervention.