Abstract: A first mapping component produces observed triple statements from events received from a security tool monitoring an industrial system. A link-prediction component estimates a probability score for each observed triple statement by link prediction in a knowledge graph. A scoring component computes a priority score for an entity of the industrial system contained in the knowledge graph and/or events based on the probability scores. Priority scores can be computed for some or all possible events in the industrial system as a reference to prioritize alerts coming from the security tools. The system works in an unsupervised manner. In fact, the system does not directly try to infer (predict) maliciousness in entities or events on the knowledge graph. Instead, priority scores are used during operation to evaluate actual system observations and prioritize them. Therefore, a knowledge graph-based recommendation system for automated analysis of industrial cybersecurity events is provided.

Abstract: A computer system and method for clustering data points comprises a computer server configured to: store a dataset compris-ing a plurality of data points; determine a plurality of candidate clusters for the plurality of data points, where each candidate cluster corresponds to a respec-tive set of the plurality of data points; determine, for each candidate cluster, one or more properties of that candidate cluster; and transmit, to the client device, a sample of the plurality of data points, information indicative of the plurality of candidate clusters, and information indicative of the one or more properties de-termined for each candidate cluster; and a client device configured to: receive the sample of data points, information indicative of the plurality of candidate clusters, and information indicative of the one or more properties determined for each candidate cluster; and determine a cluster constraint, wherein the cluster constraint relates to at least one of the one or more properties of each candidate c

Abstract: A first mapping component produces observed triple statements from events received from a security tool monitoring an industrial system. A link-prediction component estimates a probability score for each observed triple statement by link prediction in a knowledge graph. A scoring component computes priority score for an entity of the industrial system contained in the knowledge graph and/or events based on the probability scores. Priority scores can be computed for some or all possible events in the industrial system as a reference to prioritize alerts coming from the security tools. The system works in an unsupervised manner. In fact, the system does not directly try to infer (predict) maliciousness in entities or events on the knowledge graph. Instead, priority scores are used during operation to evaluate actual system observations and prioritize them. Therefore, a knowledge graph-based recommendation system for automated analysis of industrial cybersecurity events is provided.

Abstract: A computer-implemented method and a system is provided for protecting at least one device of a target infrastructure against a cyber incident, whereby an infrastructure database contains device-specific information for its devices, by providing a security playbook for the given cyber incident, transforming the security playbook to a transformed playbook, analyzing the respective step of the transformed playbook based on a policy and process database, which shows a rule indicating whether at least a part of the step can be executed without any restriction or only with a restriction or has to be blocked, executing the steps based on the labeled playbook taking the handling label into account and for generating at least one instruction derived from at least one of the steps, and generating a device-specific command based on the instruction and based on a syntax processable by the device.

Abstract: The present invention provides a computer system and method for clustering data points. The system comprises a computer server and a client device, wherein the computer server is configured to: store a dataset comprising a plurality of data points; determine a plurality of candidate clusters for the plurality of data points, where each candidate cluster corresponds to a respective set of the plurality of data points; determine, for each candidate cluster, one or more properties of that candidate cluster; and transmit, to the client device, a sample of the plurality of data points, information indicative of the plurality of candidate clusters, and information indicative of the one or more properties determined for each candidate cluster.

Abstract: Introducing a separation into modes for an industrial control system, wherein a training of a model is conducted for each of the modes and an undefined action is detected by monitoring the industrial system within the respective mode.