Abstract: The present description concerns a method of identification of risks of cyberattacks on a programmable logic controller, the method comprising: the generation of a digital representation of a minimized finite-state transducer based on a specification of a controller logic of the programmable logic controller, the minimized finite-state transducer comprising a set of source states, a set of destination states, and a set of transitions from a source state to a destination state based on an input data value; the generation of a second computer file, based on a first computer file identifying a subset of sensitive states, the second file comprising a list of critical transitions associated with the sensitive states, and for each transition, a list of the input data; and the generation of a fourth computer file indicating input data to be protected which are both associated with critical transitions and with a corruption risk.

Abstract: The present description concerns a method of identification of risks of cyberattacks on a programmable logic controller, the method comprising: the generation of a digital representation of a minimized finite-state transducer based on a specification of a controller logic of the programmable logic controller, the minimized finite-state transducer comprising a set of source states, a set of destination states, and a set of transitions from a source state to a destination state based on an input data value; the generation of a second computer file, based on a first computer file identifying a subset of sensitive states, the second file comprising a list of critical transitions associated with the sensitive states, and for each transition, a list of the input data; and the generation of a fourth computer file indicating input data to be protected which are both associated with critical transitions and with a corruption risk.

Abstract: A system for detecting malwares in a resources constrained device, the system includes a monitoring module, embedded on the device, for measuring, at a predefined adaptable monitoring period, internal hardware events related data, a local machine learning module, embedded on the device, for providing a confidence score that each monitored data is a malware, the local machine learning module being configured to raise an alert if the confidence score is higher than a first predefined alert threshold and to locally store the monitored data in a memory if the confidence score is lower than the first predefined alert threshold and higher than a second predefined suspicious threshold, a remote machine learning module, embedded on a remote server, for receiving the stored monitored data at a predefined transmission rate and process the received data to detect if it corresponds to malware.