System and method for counteracting effects of improper network traffic

Abstract

A monitoring system includes a processor configured to perform operations including: place the monitoring system into a training mode to generate a model of an industrial process; receive indications of observed transmissions of operational commands among multiple monitored devices of a monitored system, wherein at least one of the multiple monitored devices is configured to control the industrial process; and from received indications of observed transmissions of operational commands associated with the industrial process, generate the model of the industrial process, wherein the model comprises indications of an expected order of transmissions of operational commands associated with the industrial process are expected to occur.

We claim: 
     
         1 . A monitoring system comprising a processor configured to perform operations comprising:
 place the monitoring system into a training mode to generate a model of an industrial process;   receive indications of observed transmissions of operational commands among multiple monitored devices of a monitored system, wherein at least one of the multiple monitored devices is configured to control the industrial process; and   from received indications of observed transmissions of operational commands associated with the industrial process, generate the model of the industrial process, wherein the model comprises indications of an expected order of transmissions of operational commands associated with the industrial process are expected to occur.   
     
     
         2 . The monitoring system of  claim 1 , wherein:
 the multiple monitored devices are incorporated into a monitored system;   the monitored system includes at least one interchange device to which each monitored device of the multiple monitored device is separately coupled;   the transmissions of operational commands among the multiple monitored devices are conveyed through the one or more interchange devices; and   the monitoring system is coupled to the at least one interchange device to receive the indications of observed transmissions of operational commands among the multiple monitored devices.   
     
     
         3 . The monitoring system of  claim 1 , wherein the model comprises a finite state model that includes indications of multiple states of the industrial processor and indications of valid transitions among the multiple states. 
     
     
         4 . The monitoring system of  claim 1 , wherein:
 the model comprises indications of ranges of expected values for parameters of operational commands associated with the industrial process that are expected to be transmitted; and   the processor is further configured to perform operations comprising:
 employ a statistical analysis to generate an expected value for a parameter of an operational command associated with the industrial process that is expected to be transmitted based on observations of prior instances of exchanging of the particular operational command in prior iterations of performing the industrial process; and 
 add an indication of the expected value to the model. 
   
     
     
         5 . A monitoring system comprising a processor configured to perform operations comprising:
 place the monitoring system into an operating mode to use a model of an industrial process to analyze observed transmissions of operational commands associated with the industrial process;   receive, from one or more interchange devices, indications of observed transmissions of operational commands among multiple monitored devices of a monitored system, wherein at least one of the monitored devices is configured to control the industrial process; and   compare received indications of observed transmissions of operational commands associated with the industrial process to indications in the model of expected transmissions of operational commands associated with the industrial process to determine whether a particular transmitted operational command is a proper operational command associated with the industrial process.   
     
     
         6 . The monitoring system of  claim 5 , wherein:
 the multiple monitored devices are incorporated into a monitored system;   the monitored system includes at least one interchange device to which each monitored device of the multiple monitored device is separately coupled;   the transmissions of operational commands among the multiple monitored devices are conveyed through the one or more interchange devices; and   the monitoring system is coupled to the at least one interchange device to receive the indications of observed transmissions of operational commands among the multiple monitored devices.   
     
     
         7 . The monitoring system of  claim 5 , wherein:
 the at least one interchange device intercepts and stores the particular transmitted operational command; and   the processor is further configured to respond to a determination that the particular transmitted operational command is a proper operational command associated with the industrial process by instructing the at least one interchange device to release the particular transmitted operational command from storage and allow the particular transmitted operational command to be relayed to its intended destination.   
     
     
         8 . The monitoring system of  claim 5 , wherein:
 the at least one interchange device intercepts and stores the particular transmitted operational command; and   the processor is further configured to respond to a determination that the particular transmitted operational command is an improper operational command associated with the industrial process by performing operations comprising:
 instruct the at least one interchange device to refrain from releasing the particular transmitted operational command and allowing the particular transmitted operational command to be relayed to its intended destination; 
 generate a substitute proper operational command comprising a type of operational command based on an expected order of operational commands specified in the model, and comprising an expected parameter value based on the model; and 
 transmit the substitute proper operational command to the at least one interchange device to be relayed to an expected destination specified in the model. 
   
     
     
         9 . The monitoring system of  claim 5 , wherein:
 the at least one interchange device does not intercept and store the particular transmitted operational command, and allows the particular transmitted operational command to be relayed to its intended destination while a determination is made as to whether the particular transmitted operational command is a proper operational command associated with the industrial process; and   the processor is further configured to respond to a determination that the particular transmitted operational command is an improper operational command associated with the industrial process by performing operations comprising:
 generate at least one of:
 a countermanding operational command to cause stoppage or reversal of an action specified in the particular transmitted operational command; or 
 a substitute proper operational command comprising a type of operational command based on an expected order of operational commands specified in the model, and comprising an expected parameter value based on the model; and 
 
 transmit the at least one of the countermanding operational command or the substitute proper operational command to the at least one interchange device to be relayed to an expected destination specified in the model. 
   
     
     
         10 . The monitoring system of  claim 5 , wherein the model comprises a finite state model that includes indications of multiple states of the industrial processor and indications of valid transitions among the multiple states. 
     
     
         11 . The monitoring system of  claim 10 , wherein the model is generated from data descriptive of logic employed in performing the industrial process, wherein the generation of the model comprises deriving the multiple states from the logic. 
     
     
         12 . A method of generating a model of an industrial process comprising:
 receiving, by a processor of a monitoring system, and from an interchange device of a monitored system, indications of observed transmissions, through the interchange device, of operational commands among multiple monitored devices of the monitored system, wherein at least one of the monitored devices is configured to control the industrial process; and   from received indications of observed transmissions of operational commands associated with the industrial process, generating, by the processor, the model of the industrial process, wherein the model comprises indications of an expected order of transmissions of operational commands associated with the industrial process are expected to occur.   
     
     
         13 . The method of  claim 12 , further comprising:
 employing, by the processor, a statistical analysis to generate an expected value for a parameter of an operational command associated with the industrial process that is expected to be transmitted based on observations of prior instances of exchanging of the particular operational command in prior iterations of performing the industrial process; and   adding an indication of the expected value to the model.   
     
     
         14 . The method of  claim 12 , wherein the model comprises a finite state model that includes indications of multiple states of the industrial processor and indications of valid transitions among the multiple states. 
     
     
         15 . The method of  claim 12 , wherein:
 the model comprises indications of ranges of expected values for parameters of operational commands associated with the industrial process that are expected to be transmitted; and   the processor is further configured to perform operations comprising:
 employ a statistical analysis to generate an expected value for a parameter of an operational command associated with the industrial process that is expected to be transmitted based on observations of prior instances of exchanging of the particular operational command in prior iterations of performing the industrial process; and model. 
 add an indication of the expected value to the 
   
     
     
         16 . A method of using a model of an industrial process to analyze observed transmissions of operational commands associated with the industrial process, the method comprising:
 receiving, by a processor of a monitoring system, and from at least one interchange device of a monitored system, indications of observed transmissions of operational commands among multiple monitored devices of a monitored system, wherein at least one of the monitored devices is configured to control the industrial process; and   comparing, by the processor, received indications of observed transmissions of operational commands associated with the industrial process to indications in the model of expected transmissions of operational commands associated with the industrial process to determine whether a particular transmitted operational command is a proper and expected operational command associated with the industrial process.   
     
     
         17 . The method of  claim 16 , wherein:
 the at least one interchange device intercepts and stores the particular transmitted operational command; and   the method further comprises responding, by the processor, to a determination that the particular transmitted operational command is a proper and expected operational command associated with the industrial process by instructing the at least one interchange device to allow the particular transmitted operational command to be relayed to its intended destination.   
     
     
         18 . The method of  claim 16 , wherein:
 the at least one interchange device intercepts and stores the particular transmitted operational command; and   the method further comprises responding, by the processor, to a determination that the particular transmitted operational command is an improper operational command associated with the industrial process by performing operations comprising:
 instructing the at least one interchange device to refrain from relaying the allow the particular transmitted operational command to its intended destination; 
 generating, by the processor, a substitute proper operational command comprising a type of operational command based on an expected order of operational commands specified in the model, and comprising an expected parameter value based on the model; and 
 transmitting the substitute proper operational command to the at least one interchange device to be relayed to an expected destination specified in the model. 
   
     
     
         19 . The method of  claim 16 , wherein:
 at least one the interchange device does not intercept and store the particular transmitted operational command, and allows the particular transmitted operational command to be relayed to its intended destination while a determination is made as to whether the particular transmitted operational command is a proper and expected operational command associated with the industrial process; and   the method further comprises responding, by the processor, to a determination that the particular transmitted operational command is an improper operational command associated with the industrial process by performing operations comprising:
 generating, by the processor, at least one of:
 a countermanding operational command to cause stoppage or reversal of an action specified in the particular transmitted operational command; or 
 a substitute proper operational command comprising a type of operational command based on an expected order of operational commands specified in the model, and comprising an expected parameter value based on the model; and 
 
 transmitting the at least one of the countermanding operational command or the substitute proper operational command to the at least one interchange device to be relayed to an expected destination specified in the model. 
   
     
     
         20 . The method of  claim 16 , wherein the model comprises a finite state model that includes indications of multiple states of the industrial processor and indications of valid transitions among the multiple states. 
     
     
         21 . The method of  claim 20 , wherein the model is generated from data descriptive of logic employed in performing the industrial process, wherein the generation of the model comprises deriving the multiple states from the logic.