Collaborative infrastructure supporting cyber-security analytics in industrial networks

1. A method comprising:

obtaining and storing asset domain data, the asset domain data comprising information related to one or more of an operational states of an asset deployed in a network system and the configuration of parameters related to the asset;

receiving sensed network operational information associated with operation of the network system that includes the asset;

identifying from the sensed network operational information an indication of a cyber-security threat to the network system based on an operational anomaly that includes an operation pattern that is inconsistent with a normal operation pattern observed in the network system;

automatically identifying a malfunction or reconfiguration event associated with the asset based upon an analysis of the asset domain data;

automatically determining, by at least one processor, that the operational anomaly is a false positive with respect to the cyber-security threat based on the operational anomaly being correlated with the malfunction or reconfiguration event;

clearing the indication based on the determining that the anomaly is a false positive; and

causing a record to be stored in a database, the record comprising: the operational anomaly, information associated with the malfunction or reconfiguration event, and information associated with the determining that the anomaly is a false positive.

2. The method of claim 1 , wherein the asset domain data is accessed from an asset analytics engine configured to monitor a status and parameter configuration of the asset.

3. The method of claim 1 , wherein the identifying the indication includes detecting an anomaly flag being updated by a cyber-security analytics engine in response to detecting the operational anomaly.

4. The method of claim 3 , wherein the detecting of the operational anomaly by the cyber-security analytics engine comprises:

monitoring operation of the network system;

determining the normal operation pattern of the network system; and

detecting the operation pattern that is inconsistent with the normal operation pattern of the network system.

5. The method of claim 3 , wherein clearing the indication includes transmitting a signal to the cyber security engine to clear the anomaly flag.

6. The method of claim 1 , wherein the determining the operational anomaly is a false positive includes determining that the operational anomaly and the reconfiguration event or malfunction are time-correlated.

7. The method of claim 6 , wherein the determining that the operational anomaly and the reconfiguration event or malfunction are time-correlated includes determining the reconfiguration event or malfunction and the operational anomaly occurred within a certain time period.

8. The method of claim 1 , wherein the network system is an industrial network system comprising physical machinery with embedded sensors.

9. The method of claim 1 , wherein the reconfiguration event includes at least one of adding the asset to the network system, removing the asset from the network system, replacing a component of the asset, or adding an additional asset to the network system.

10. A system comprising:

one or more processors of a machine; and

a machine-readable medium storing instructions that, when executed by the one or more processors, cause the machine to perform operations comprising:

obtaining and storing asset domain data, the asset domain data comprising information related to one or more of operational states of an asset deployed in a network system and the configuration of parameters related to the asset;

receiving sensed network operational information associated with operation of the network system that includes the asset;

identifying from the sensed network operational information an indication of a cyber-security threat to the network system based on an operational anomaly that includes an operation pattern that is inconsistent with a normal operation pattern observed in the network system;

automatically identifying a malfunction or reconfiguration event associated with the asset based upon an analysis of the asset domain data;

automatically determining that the operational anomaly is a false positive with respect to the cyber-security threat based on the operational anomaly being correlated with the malfunction or reconfiguration event;

clearing the indication based on the determining that the anomaly is a false positive; and

causing a record to be stored in a database, the record comprising: the operational anomaly, information associated with the malfunction or reconfiguration event, and information associated with the determining that the anomaly is a false positive.

11. The system of claim 10 , wherein the asset domain data is accessed from an asset analytics engine configured to monitor a status and parameter configuration of the asset.

12. The system of claim 11 , wherein the asset is coupled to a plurality of sensors, and wherein the asset analytics engine monitors the plurality of sensors to generate the asset domain data.

13. The system of claim 10 , further comprising a cyber-security analytics engine in communication with the machine, the cyber-security analytics engine configured to perform operations comprising:

monitoring operation of the network system;

determining the normal operation pattern of the network system;

detecting the operational anomaly; and

updating an anomaly flag in response to detecting the operational anomaly, the anomaly flag signaling the detection of the operational anomaly.

14. The system of claim 13 , wherein identifying the indication of the cyber-security threat includes accessing the anomaly flag.

15. The system of claim 13 , wherein clearing the indication includes transmitting a signal to the cyber security engine to clear the anomaly flag.

16. The system of claim 10 , wherein determining that the operational anomaly is a false positive includes comparing respective timings of reconfiguration event or malfunction and the operational anomaly.

17. The system of claim 10 , wherein the reconfiguration event includes at least one of adding the asset to the network system, removing the asset from the network system, replacing a component of the asset, or adding an additional asset to the network system.

18. A non-transitory machine-readable storage medium embodying instructions that, when executed by at least one processor of a machine, cause the machine to perform operations comprising:

obtaining and storing asset domain data, the asset domain data comprising information related to one or more of operational states of an asset deployed in a network system and the configuration of parameters related to the asset;

receiving sensed network operational information associated with operation of the network system that includes the asset;

identifying from the sensed network operational information an indication of a cyber-security threat to the network system based on an operational anomaly that includes an operation pattern that is inconsistent with a normal operation pattern observed in the network system;

automatically identifying a malfunction or reconfiguration event associated with the asset based upon an analysis of the asset domain data;

automatically determining that the operational anomaly is a false positive with respect to the cyber-security threat based on the operational anomaly being correlated with the malfunction or reconfiguration event;

clearing the indication based on the determining that the anomaly is a false positive; and

causing a record to be stored in a database, the record comprising: the operational anomaly, information associated with the malfunction or reconfiguration event, and information associated with the determining that the anomaly is a false positive.