Systems and methods for controlling an industrial asset in the presence of a cyber-attack

1. A method for controlling an industrial asset, the method comprising:

generating, via a controller, a cyber attack model configured to predict a plurality of operational impacts on the industrial asset of a plurality of potential cyber attacks and a corresponding plurality of potential mitigation responses;

training, via the controller, the cyber attack model via a training data set to correlate the plurality of potential mitigation responses to the predicted plurality of operational impacts corresponding to the plurality of potential cyber attacks;

detecting, via a cyber attack neutralization module (neutralization module), a cyber attack impacting at least one component of the industrial asset;

identifying, via the neutralization module, a predicted operational impact of the plurality of operational impacts which corresponds to the detected the cyber attack based on the cyber attack model;

selecting, via the neutralization module, at least one mitigation response of the plurality of potential mitigation responses based on the predicted operational impact of the cyber attack; and

altering an operating state of the industrial asset based on the at least one mitigation response,

wherein identifying the predicted operational impact of the cyber attack further comprises:

correlating, via the neutralization module, the predicted operational impact to an unwarranted shutdown of the industrial asset in response to a shutdown protocol of a safety system in response to the detected cyber attack, wherein the shutdown protocol is unwarranted for the operating state of the industrial asset and

overriding, via the neutralization module, the shutdown protocol to preclude the unwarranted shutdown of the industrial asset.

2. The method of claim 1 , wherein detecting the cyber attack further comprises:

identifying an attack point of the cyber attack via an attack detection localization (ADL) module of the neutralization module, the attack point corresponding to at least one of a first sensor, a the first actuator, and a system controller of the industrial asset.

3. The method of claim 2 , wherein the attack point corresponds to an affected output signal of the first sensor, and wherein selecting the at least one mitigation response further comprises:

filtering the affected output signal so as to preclude a utilization of the affected output signal by the system controller to affect the operating state of the industrial asset; and

generating, via the system controller, a set point for the industrial asset based, at least in part, on an alternative signal obtained from a second sensor.

4. The method of claim 2 , wherein determining the predicted operational impact further comprises:

determining, via the ADL module, a severity score for the cyber attack; and

wherein selecting the at least one mitigation response further comprises selecting the at least one mitigation response based, at least in part, on the severity score.

5. The method of claim 2 , wherein the at least one mitigation response comprises:

emulating, via a system emulator, a nominal operating state of the industrial asset in response to an operating condition affecting the industrial asset;

generating at least one output of the system emulator corresponding to an input or output of at least one of the first sensor, the first actuator, and the system controller of the industrial asset in the absence of a cyber attack; and

replacing, with the at least one output of the emulator, at least one input or output of the at least one of the first sensor, the first actuator, and the system controller which is subject to the cyber attack, wherein replacing the at least one input or output with the at least one output of the emulator mitigates the predicted operational impact of the cyber attack.

6. The method of claim 5 , wherein the attack point corresponds to an affected command signal for the first actuator, and wherein replacing the at least one input or output subject to the cyber attack further comprises:

filtering the affected command signal; and

generating a replacement command signal for the first actuator via the system emulator.

7. The method of claim 5 , wherein the attack point corresponds to an affected feedback signal of the first actuator, and wherein replacing the at least one input or output subject to the cyber attack further comprises:

filtering the affected feedback signal;

modeling a replacement feedback signal for the first actuator via an actuator emulator of the system emulator;

delivering the replacement feedback signal to the system controller; and

generating a command signal for the first actuator based, at least in part, on the replacement feedback signal.

8. The method of claim 5 , wherein the attack point corresponds to the system controller, and wherein replacing the at least one input or output subject to the cyber attack further comprises:

filtering an output of the system controller so as to preclude the system controller from affecting the operating state of the industrial asset; and

generating, via a controller emulator of the system emulator, at least one setpoint command configured to establish or maintain an operation of the industrial asset by altering the operating state of the industrial asset.

9. The method of claim 5 , wherein the attack point corresponds to an affected output signal of the first sensor, and wherein replacing the at least one input or output subject to the cyber attack further comprises:

filtering the affected output signal of the first sensor;

receiving, via the system emulator, an unaffected output signal from at least a second sensor;

generating a replacement output signal for the first sensor via a sensor emulator of the system emulator based, at least in part, on the unaffected output signal; and

delivering the replacement output signal to the system controller.

10. The method of claim 9 , wherein the second sensor is positioned separate from the industrial asset.

11. The method of claim 5 , further comprising:

correlating, via the neutralization module, the predicted operational impact to an impact on an output of the industrial asset delivered to a connected system; and

utilizing the least one output of the system emulator to mitigate the impact of the cyber attack on the output of the industrial asset.

12. The method of claim 11 , wherein mitigating the impact of the cyber attack on the output of the industrial asset further comprises derating the industrial asset.

13. The method of claim 1 , wherein determining the predicted operational impact of the cyber attack further comprises:

correlating, via the neutralization module, the predicted operational impact to an accumulation of damage to a component of the industrial asset; and

derating the industrial asset to mitigate the accumulation of damage.

14. A system for controlling and industrial asset, the system comprising:

at least one sensor operably coupled to the industrial asset;

at least one actuator operably coupled to the industrial asset;

a system controller communicatively coupled to the at least one sensor and the at least one actuator, the system controller comprising at least one processor configured to perform a first plurality of operations so as to affect an operating state of the industrial asset; and

a neutralization module operably coupled to the at least one sensor, the at least one actuator, and the system controller, the neutralization module comprising at least one processor configured to perform a second plurality of operations, the second plurality of operations comprising:

detecting, via a cyber attack neutralization module (neutralization module), a cyber attack impacting at least one component of the industrial asset,

identifying a predicted operational impact of a plurality of operational impacts which corresponds to the detected the cyber attack based on a cyber attack model, wherein the plurality of operational impacts are generated via a controller implementing a cyber attack model to predict the plurality of operational impacts on the industrial asset of a plurality of potential cyber attacks,

selecting at least one mitigation response of a plurality of potential mitigation responses based on the predicted operational impact of the cyber attack, wherein the plurality of potential mitigation responses are generated via the cyber attack model, and wherein an operating state of the industrial asset is altered based on the at least one mitigation response,

wherein identifying the predicted operational impact of the cyber attack further comprises:

correlating, via the neutralization module, the predicted operational impact to an unwarranted shutdown of the industrial asset in response to a shutdown protocol of a safety system in response to the detected cyber attack, wherein the shutdown protocol is unwarranted for the operating state of the industrial asset and

overriding, via the neutralization module, the shutdown protocol to preclude the unwarranted shutdown of the industrial asset.

15. The system of claim 14 , wherein detecting the cyber attack further comprises:

identifying an attack point of the cyber attack via an attack detection localization (ADL) module of the neutralization module, the attack point corresponding to at least one of a first sensor, a first actuator, and a system controller of the industrial asset.

16. The system of claim 15 , wherein the at least one mitigation response further comprises:

emulating, via a system emulator, a nominal operating state of the industrial asset in response to an operating condition affecting the industrial asset, and

generating at least one output of the system emulator corresponding to an input or output of at least one of the first sensor, the first actuator, and the system controller of the industrial asset in the absence of a cyber attack.

17. The system of claim 16 , wherein the attack point corresponds to the system controller, and wherein replacing at least one of the input or output subject to the cyber attack further comprises:

filtering an output of the system controller so as to preclude the system controller from affecting the operating state of the industrial asset; and

generating, via a controller emulator of the system emulator, at least one setpoint command configured to establish or maintain an operation of the industrial asset by altering the operating state of the industrial asset.

18. The system of claim 14 , wherein the industrial asset comprises a wind turbine.

19. A method for controlling an industrial asset, the method comprising:

generating, via a controller, a cyber attack model configured to predict a plurality of operational impacts on the industrial asset of a plurality of potential cyber attacks and a corresponding plurality of potential mitigation responses;

training, via the controller, the cyber attack model via a training data set to correlate the plurality of potential mitigation responses to the predicted plurality of operational impacts corresponding to the plurality of potential cyber attacks;

detecting, via a cyber attack neutralization module (neutralization module), a cyber attack impacting at least one component of the industrial asset;

identifying, via the neutralization module, a predicted operational impact of the plurality of operational impacts which corresponds to the detected the cyber attack based on the cyber attack model;

selecting, via the neutralization module, at least one mitigation response of the plurality of potential mitigation responses based on the predicted operational impact of the cyber attack; and

altering an operating state of the industrial asset based on the at least one mitigation response,

wherein altering the operating state of the industrial asset comprises affecting, via a first actuator operably coupled to the industrial asset, at least one of a physical configuration, an orientation, and an operating status of the industrial asset, and

wherein identifying the predicted operational impact of the cyber attack further comprises:

correlating, via the neutralization module, the predicted operational impact to an unwarranted shutdown of the industrial asset in response to a shutdown protocol of a safety system in response to the detected cyber attack, wherein the shutdown protocol is unwarranted for the operating state of the industrial asset; and

overriding, via the neutralization module, the shutdown protocol to preclude the unwarranted shutdown of the industrial asset.