Using virtual sensors to accommodate industrial asset control systems during cyber attacks
In some embodiments, an industrial asset may be associated with a plurality of monitoring nodes, each monitoring node generating a series of monitoring node values over time that represent operation of the industrial asset. A threat detection computer may determine that an attacked monitoring node is currently being attacked. Responsive to this determination, a virtual sensor coupled to the plurality of monitoring nodes may estimate a series of virtual node values for the attacked monitoring node(s) based on information received from monitoring nodes that are not currently being attacked. The virtual sensor may then replace the series of monitoring node values from the attacked monitoring node(s) with the virtual node values. Note that in some embodiments, virtual node values may be estimated for a particular node even before it is determined that the node is currently being attacked.
1. A system to protect an industrial asset, comprising:
a plurality of monitoring nodes associated with the industrial asset, each monitoring node generating a series of monitoring node values over time that represent operation of the industrial asset; and
a virtual sensor creation platform comprising one or more hardware processors, the virtual sensor creation platform to: (i) execute a forward feature transform, (ii) create a virtual sensor estimation lookup table for an attacked monitoring node from monitoring nodes that are not currently being attacked, (iii) execute an inverse feature transform, and (iv) create normal space data and attacked space data based on information from a high-fidelity, physics-based model and virtual controllers.
2. The system of claim 1 , wherein the virtual sensor creation platform is further to perform data pre-processing to create local features for the plurality of monitoring nodes.
3. The system of claim 1 , wherein the virtual sensor creation platform creates a virtual sensor using a linear principal component analysis.
4. The system of claim 3 , wherein a matrix C is computed during a training phase using a linear least squares regression.
5. The system of claim 4 , wherein the virtual sensor creation platform builds the virtual sensor estimation lookup table with matrices C i,j where j indicates a number of attacked monitoring nodes being estimated by the virtual sensor and i indicates a particular attacked monitoring nodes being estimated.
6. The system of claim 5 , wherein the inverse feature transform maps feature vectors back to input space.
7. The system of claim 6 , wherein the virtual sensor creation platform is further to perform a verification process using the virtual sensor estimation lookup table to verify how closely estimated sensor values are to original sensor values in the input space.
8. The system of claim 1 , wherein signals are processed in a sliding time window during real-time detection.
9. A computerized method to protect an industrial asset, comprising:
receiving signals from a plurality of monitoring nodes associated with the industrial asset, each monitoring node generating a series of monitoring node values over time that represent operation of the industrial asset;
executing, by a virtual sensor creation platform comprising one or more processors, a forward feature transform;
creating a virtual sensor estimation lookup table for an attacked monitoring node from monitoring nodes that are not currently being attacked;
executing an inverse feature transform; and
creating normal space data and attacked space data based on information from a high-fidelity, physics-based model and virtual controllers.
10. The method of claim 9 , further comprising:
performing data pre-processing to create local features for the plurality of monitoring nodes.
11. The method of claim 9 , further comprising:
creating a virtual sensor using a linear principal component analysis.
12. The method of claim 11 , wherein a matrix C is computed during a training phase using a linear least squares regression.
13. The method of claim 12 , further comprising:
building the virtual sensor estimation lookup table with matrices C i,j where j indicates a number of attacked monitoring nodes being estimated by the virtual sensor and i indicates a particular attacked monitoring nodes being estimated.
14. The method of claim 13 , wherein the inverse feature transform maps feature vectors back to input space.
15. The method of claim 13 , further comprising:
performing a verification process using the virtual sensor estimation lookup table to verify how closely estimated sensor values are to original sensor values in the input space.
16. The method of claim 9 , wherein signals are processed in a sliding time window during real-time detection.
17. A non-transitory, computer-readable medium storing instructions that, when executed by a computer processor, cause the computer processor to perform a method comprising:
receiving signals from a plurality of monitoring nodes associated with an industrial asset, each monitoring node generating a series of monitoring node values over time that represent operation of the industrial asset;
executing, by a virtual sensor creation platform comprising one or more processors, a forward feature transform;
creating a virtual sensor estimation lookup table for an attacked monitoring node from monitoring nodes that are not currently being attacked;
executing an inverse feature transform, and
creating normal space data and attacked space data based on information from a high-fidelity, physics-based model and virtual controllers.