Dynamic network security for industrial systems
Systems and methods for controlling network security within an industrial system. One method may include monitoring network traffic at a first industrial device of the industrial system. The method may include determining a first network security threat at the first industrial device using an artificial intelligence (AI) model trained to detect network security threats for the industrial system. The method may include controlling execution of a mitigation operation responsive to the network security threat.
1 . A method for controlling network security within an industrial system, the method comprising:
monitoring, with a processing system including one or more electronic processors, during performance of an industrial process with the industrial system, network traffic at a first industrial device of the industrial system, wherein the first industrial device is a programmable logic controller (PLC) configured to control at least a portion of the industrial process;
receiving, with the processing system, an electronic message from a second industrial device of the industrial system, the electronic message identifying a second network security threat detected at the second industrial device, wherein the electronic message includes a threat identifier for the second network security threat that identifies at least one of an entity or a device associated with an origination of the second network security threat;
determining, with the processing system, based on the network traffic and the second network security threat detected at the second industrial device, a first network security threat at the first industrial device using an artificial intelligence (AI) model trained to detect network security threats for the industrial system; and
controlling, with the processing system, execution of a mitigation operation responsive to the first network security threat.
2 . The method of claim 1 , wherein monitoring the network traffic at the first industrial device includes monitoring the network traffic at the first industrial device in real-time.
3 . The method of claim 1 , further comprising:
receiving the network traffic associated with the first industrial device; and
training the AI model to detect network security threats at the first industrial device, wherein the network traffic is used as training data.
4 . The method of claim 3 , wherein training the AI model includes training the AI model using unsupervised learning.
5 . The method of claim 1 , wherein controlling execution of the mitigation operation includes transmitting, to a third second-industrial device of the industrial system, an electronic signal including information associated with the first network security threat.
6 . The method of claim 5 , wherein transmitting the electronic signal includes transmitting a threat identifier for the first network security threat.
7 . The method of claim 1 , wherein controlling execution of the mitigation operation includes isolating the first industrial device from a third industrial device of the industrial system.
8 . The method of claim 1 , wherein controlling execution of the mitigation operation includes blocking network traffic associated with the first network security threat.
9 . The method of claim 1 , wherein controlling execution of the mitigation operation includes transmitting an alert to a user device for display to a network administrative entity of the industrial system.
10 . The method of claim 9 , further comprising:
receiving, from the user device, a response to the alert, wherein the response confirms whether the first network security threat is an actual threat to the industrial system.
11 . A non-transitory, computer-readable medium storing instructions that, when executed by an electronic processor, perform a set of functions, the set of functions comprising:
monitoring network traffic at a first industrial device of an industrial system;
receiving an electronic message from a second industrial device of the industrial system, the electronic message identifying a second network security threat detected at the second industrial device, wherein the electronic message includes a threat identifier for the second network security threat that identifies at least one of an entity or a device associated with an origination of the second network security threat;
determining, based on the network traffic and the second network security threat detected at the second industrial device, a first network security threat at the first industrial device using an artificial intelligence (AI) model trained to detect network security threats for the industrial system;
transmitting, to a remote device, an electronic signal indicating the first network security threat; and
controlling execution of a mitigation operation responsive to the first network security threat.
12 . The computer readable medium of claim 11 , wherein the set of functions further includes:
receiving the network traffic at the first industrial device associated with the first industrial device; and
training, via unsupervised learning, the AI model to detect network security threats at the first industrial device, wherein the network traffic is used as training data.
13 . The computer readable medium of claim 11 , wherein the set of functions further comprising:
accessing diagnostic data identifying previously detected network security threats of the industrial system, wherein the first network security threat is determined based on the diagnostic data.
14 . The computer readable medium of claim 11 , wherein transmitting the electronic signal indicating the first network security threat includes transmitting an alert indicating an occurrence of the first network security threat, wherein the alert includes a threat identifier for the first network security threat and, wherein the alert requests confirmation of the first network security threat.
15 . A system for controlling network security within an industrial system, the system comprising:
a first programmable logic controller (PLC) of the industrial system, wherein the first PLC is configured to:
monitor network traffic occurring at the first PLC;
receive an electronic message from a second industrial device of the industrial system, the electronic message identifying a second network security threat detected at the second industrial device, wherein the electronic message includes a threat identifier for the second network security threat that identifies at least one of an entity or a device associated with an origination of the second network security threat;
detect, based on the network traffic occurring at the first PLC and the second network security threat detected at the second industrial device, a first network security threat at the first PLC using an artificial intelligence (AI) model trained to detect network security threats for the first PLC;
and
control execution of a mitigation operation responsive to the first network security threat.
16 . The system of claim 15 , wherein the first PLC is configured to update a local copy of diagnostic information for the industrial system to include the second network security threat as a previously detected network security threat of the industrial system.
17 . The system of claim 15 , wherein the first PLC is configured to transmit, to a remote device, an electronic signal indicating a corresponding threat identifier for the first network security threat, wherein the corresponding threat identifier identifies the first PLC, wherein the remote device is a user device of a network administrator for the industrial system and, responsive to receiving the electronic signal, the user device generates an alert to the network administrator, wherein the alert notifies the network administrator of an occurrence of the first network security threat and requests confirmation that the first network security threat does pose a network security threat to the industrial system.