Method, systems and apparatus for intelligently emulating factory control systems and simulating response data
A controller emulator, coupled to an interface that exposes the controller emulator to inputs from external sources, provides one or more control signals to a process simulator and a deep learning process. In response, the process simulator simulates response data that is provided to the deep learning processor. The deep learning processor generates expected response data and expected behavioral pattern data for the one or more control signals, as well as actual behavioral pattern data for the simulated response data. A comparison of at least one of the simulated response data to the expected response data and the actual behavioral pattern data to the expected behavioral pattern data is performed to determine whether anomalous activity is detected. As a result of detecting anomalous activity, one or more operations are performed to address the anomalous activity.
1. A computer-implemented method, comprising:
providing, by a controller emulator coupled to an interface, one or more control signals to a process simulator and a deep learning processor, wherein the interface exposes the controller emulator to inputs from an external source;
in response to receiving the one or more control signals, simulating, by the process simulator, response data that is provided to the deep learning processor;
generating, by the deep learning processor, expected response data and expected behavioral pattern data for the one or more control signals;
generating, by the deep learning processor, actual behavioral pattern data for the simulated response data;
comparing at least one of: (i) the simulated response data to the expected response data, and (ii) the actual behavioral pattern data to the expected behavioral pattern data to determine whether anomalous activity is detected; and
as a result of detecting the anomalous activity, performing one or more operations to address the anomalous activity.
2. The computer-implemented method of claim 1 , wherein the deep learning processor includes a conditioned machine learning model.
3. The computer-implemented method of claim 1 , wherein the simulated response data includes a control value that is provided to the controller emulator.
4. The computer-implemented method of claim 1 , wherein the one or more operations include shutting down one or more factory process, equipment, and control (P/E/C) systems at risk as a result of the anomalous activity.
5. The computer-implemented method of claim 1 , wherein the one or more operations include generating a notification, wherein the notification specifies the anomalous activity, and wherein the notification is provided to an operator to review the anomalous activity.
6. The computer-implemented method of claim 1 , wherein the anomalous activity is detected as a result of a comparison of the simulated response data to the expected response data indicating a deviation.
7. The computer-implemented method of claim 1 , wherein the anomalous activity is detected as a result of a comparison of the actual behavioral pattern data to the expected behavioral pattern data indicating a deviation.
8. The computer-implemented method of claim 1 , wherein the one or more operations include determining whether the anomalous activity is a malware attack received by the controller emulator from the interface, wherein a determination that the anomalous activity is the malware attack is generated as a result of a confidence level score of the anomalous activity satisfying a confidence level threshold corresponding to detection of the malware attack.
9. A system, comprising:
one or more processors; and
memory storing thereon instructions that, as a result of being executed by the one or more processors, cause the system to:
receive, from a controller emulator coupled to an interface, one or more control signals, wherein the interface exposes the controller emulator to inputs from an external source;
in response to receiving the one or more control signals, simulate response data including control values;
generate expected response data and expected behavioral pattern data for the one or more control signals;
generate actual behavioral pattern data, wherein the actual behavioral pattern data is generated using the simulated response data;
compare at least one of: (i) the simulated response data to the expected response data and (ii) the actual behavioral pattern data to the expected behavioral pattern data to determine whether anomalous activity is detected; and
as a result of detecting the anomalous activity, perform one or more operations to address the anomalous activity.
10. The system of claim 9 , wherein the one or more processors include a conditioned machine learning model.
11. The system of claim 9 , wherein the one or more operations include communicating an alert protocol to cause the controller emulator to shut down one or more factory process, equipment, and control (P/E/C) systems at risk as a result of the anomalous activity.
12. The system of claim 9 , wherein the instructions that cause the one or more processors to perform the one or more operations to address the anomalous activity further cause the system to:
determine, based on the anomalous activity detected, a confidence level associated with the anomalous activity; and
identify, based on the confidence level, the one or more operations.
13. The system of claim 12 , wherein the one or more operations include determining whether the anomalous activity is a malware attack received by the controller emulator from the interface, wherein a determination that the anomalous activity is the malware attack is generated as a result of the confidence level satisfying a confidence level threshold corresponding to detection of the malware attack.
14. The system of claim 9 , wherein the one or more operations include generating a notification, wherein the notification specifies the anomalous activity, and wherein the notification is provided to an operator to review the anomalous activity.
15. The system of claim 9 , wherein the anomalous activity is detected detected as a result of a comparison of the simulated response data indicating to the expected response data indicating a deviation.
16. The system of claim 9 , wherein the anomalous activity is detected as a result of a comparison of the actual behavioral pattern data to the expected behavioral pattern data indicating a deviation.
17. A non-transitory, computer-readable storage medium storing thereon executable instructions that, as a result of being executed by a computer system, cause the computer system to:
receive, from a controller emulator coupled to an interface one or more control signals, wherein the interface exposes the controller emulator to inputs from an external source;
in response to receiving the one or more control signals, simulate response data including control values;
generate expected response data and expected behavioral pattern data for the one or more control signals;
generate actual behavioral pattern data, wherein the actual behavioral pattern data is generated using the simulated response data;
compare at least one of: (i) the simulated response data to the expected response data and (ii) the actual behavioral pattern data to the expected behavioral pattern data to determine whether anomalous activity is detected; and
as a result of detecting the anomalous activity, perform one or more operations to address the anomalous activity.
18. The non-transitory, computer-readable storage medium of claim 17 , wherein the one or more operations include:
identifying a type of the anomalous activity detected; and
executing a set of actions to compensate for the type of the anomalous activity detected.
19. The non-transitory, computer-readable storage medium of claim 17 , wherein the one or more operations include:
determining whether the anomalous activity is a malware attack received by the controller emulator from the interface; and
as a result of a determination that the anomalous activity is the malware attack, communicating an alert protocol to cause the controller emulator to shut down one or more factory process, equipment, and control (P/E/C) systems at risk as a result of the malware attack.
20. The non-transitory, computer-readable storage medium of claim 17 , wherein the one or more operations include generating a notification, wherein the notification specifies the anomalous activity, and wherein the notification is provided to an operator to review the anomalous activity.