Abstract: Examples of techniques for threat detection in an industrial process system are described herein. An aspect includes determining a plurality of subsystems of an industrial process system. Another aspect includes, for each of the plurality of subsystems, constructing and training a respective deep autoencoder (DAE) model of the subsystem based on data corresponding to the industrial process system. Another aspect includes monitoring the industrial process system using the plurality of DAE models corresponding to the plurality of subsystems. Another aspect includes, based on the plurality of DAE models, determining a cyberattack in a subsystem of the plurality of subsystems.

Abstract: Examples of techniques for threat detection in an industrial process system are described herein. An aspect includes determining a plurality of subsystems of an industrial process system. Another aspect includes, for each of the plurality of subsystems, constructing and training a respective deep autoencoder (DAE) model of the subsystem based on data corresponding to the industrial process system. Another aspect includes monitoring the industrial process system using the plurality of DAE models corresponding to the plurality of subsystems. Another aspect includes, based on the plurality of DAE models, determining a cyberattack in a subsystem of the plurality of subsystems.

Abstract: Some embodiments include a method for configuring a network comprising a plurality of transmitters and a plurality of receivers. Each transmitter periodically transmits a predetermined amount of data to an associated receiver with a respective individual predetermined transmission period for each transmitter. There is a predetermined transmission path between each respective transmitter and the associated receiver. The method may include: computing, for each transmission within a predetermined test period, a maximum amount of delay between transmission of data by a transmitter and a reception by the associated receiver; determining, for each transmission whether the computed amount of delay exceeds a predetermined first threshold value; and using the predetermined transmission path only if a number of the computed amounts of delay which exceeds the predetermined first threshold value within the predetermined test period is equal or less than a second predetermined threshold value.

Abstract: Some embodiments include a method for configuring a network comprising a plurality of transmitters and a plurality of receivers. Each transmitter periodically transmits a predetermined amount of data to an associated receiver with a respective individual predetermined transmission period for each transmitter. There is a predetermined transmission path between each respective transmitter and the associated receiver. The method may include: computing, for each transmission within a predetermined test period, a maximum amount of delay between transmission of data by a transmitter and a reception by the associated receiver; determining, for each transmission whether the computed amount of delay exceeds a predetermined first threshold value; and using the predetermined transmission path only if a number of the computed amounts of delay which exceeds the predetermined first threshold value within the predetermined test period is equal or less than a second predetermined threshold value.