Abstract: A computer-implemented method and a system is provided for protecting at least one device of a target infrastructure against a cyber incident, whereby an infrastructure database contains device-specific information for its devices, by providing a security playbook for the given cyber incident, transforming the security playbook to a transformed playbook, analyzing the respective step of the transformed playbook based on a policy and process database, which shows a rule indicating whether at least a part of the step can be executed without any restriction or only with a restriction or has to be blocked, executing the steps based on the labeled playbook taking the handling label into account and for generating at least one instruction derived from at least one of the steps, and generating a device-specific command based on the instruction and based on a syntax processable by the device.

Abstract: The present invention provides a computer system and method for clustering data points. The system comprises a computer server and a client device, wherein the computer server is configured to: store a dataset comprising a plurality of data points; determine a plurality of candidate clusters for the plurality of data points, where each candidate cluster corresponds to a respective set of the plurality of data points; determine, for each candidate cluster, one or more properties of that candidate cluster; and transmit, to the client device, a sample of the plurality of data points, information indicative of the plurality of candidate clusters, and information indicative of the one or more properties determined for each candidate cluster.

Abstract: Introducing a separation into modes for an industrial control system, wherein a training of a model is conducted for each of the modes and an undefined action is detected by monitoring the industrial system within the respective mode.