Cyber monitor segmented processing for control systems
A cyber monitored control system includes a controller with a first processing resource operable to execute a control application for a controlled system. The cyber monitored control system also includes a cyber monitor with a second processing resource isolated from the first processing resource. The cyber monitor is operable to evaluate a plurality of inputs to the cyber monitored control system with respect to a cyber threat model, verify one or more update rates of the controller, apply trending using the cyber threat model to distinguish between a fault and a cyber attack, and isolate one or more subsystems of the cyber monitored control system based on identifying the cyber attack.
1. A cyber monitored control system comprising:
a controller comprising a first processing resource operable to execute a control application for a controlled system, wherein the controller is implemented using one or more hardware processors; and
a cyber monitor comprising a second processing resource isolated from the first processing resource, the cyber monitor operable to:
evaluate a plurality of inputs to the cyber monitored control system with respect to a cyber threat model;
verify one or more update rates of the controller based on determining whether a plurality of control loops of the controller execute at the one or more update rates according to scheduling;
apply trending using the cyber threat model to distinguish between a fault and a cyber attack; and
isolate one or more subsystems of the cyber monitored control system based on identifying the cyber attack.
2. The cyber monitoring system of claim 1 , wherein the inputs comprise one or more sensor inputs.
3. The cyber monitoring system of claim 2 , wherein one or more of the inputs are derived from redundant sensors and related input/output signals.
4. The cyber monitoring system of claim 3 , wherein the related input/output signals are received from a model of the controlled system configured to derive a model vector based on one or more input vectors, one or more output vectors, and operation of the controlled system.
5. The cyber monitoring system of claim 4 , wherein trending identifies inconsistent behavior that does not match a known fault mode or an expected result from the model of the controlled system as a probable cyber attack.
6. The cyber monitoring system of claim 1 , wherein the cyber threat model is trained using artificial intelligence to adapt as one or more cyber threats are characterized.
7. The cyber monitoring system of claim 1 , wherein the cyber monitor is operable to compare a plurality of raw input data with conversion logic outputs of the controller to verify conversion logic performance.
8. The cyber monitoring system of claim 1 , wherein the cyber monitor is operable to monitor behavior of one or more of the control loops of the controller.
9. The cyber monitoring system of claim 1 , wherein the cyber monitor is updateable through a cyber monitor update process comprising one or more security controls that are independent of an update process of the controller.
10. The cyber monitoring system of claim 1 , wherein the cyber monitor is operable to track one or more communication anomalies and isolate a communication interface associated with the one or more communication anomalies based on identifying the cyber attack.
11. A method comprising:
evaluating, by a cyber monitor, a plurality of inputs to a cyber monitored control system with respect to a cyber threat model, the cyber monitored control system comprising a controller implemented using one or more hardware processors, the controller comprising a first processing resource operable to execute a control application for a controlled system and the cyber monitor comprising a second processing resource isolated from the first processing resource;
verifying, by the cyber monitor, one or more update rates of the controller based on determining whether a plurality of control loops of the controller execute at the one or more update rates according to scheduling;
applying trending, by the cyber monitor, using the cyber threat model to distinguish between a fault and a cyber attack; and
isolating one or more subsystems of the cyber monitored control system based on identifying the cyber attack.
12. The method of claim 11 , wherein the inputs comprise one or more sensor inputs.
13. The method of claim 12 , wherein one or more of the inputs are derived from redundant sensors and related input/output signals.
14. The method of claim 13 , further comprising:
receiving the related input/output signals from a model of the controlled system configured to derive a model vector based on one or more input vectors, one or more output vectors, and operation of the controlled system.
15. The method of claim 14 , wherein trending identifies inconsistent behavior that does not match a known fault mode or an expected result from the model of the controlled system as a probable cyber attack.
16. The method of claim 11 , further comprising:
training the cyber threat model using artificial intelligence to adapt as one or more cyber threats are characterized.
17. The method of claim 11 , further comprising:
comparing, by the cyber monitor, a plurality of raw input data with conversion logic outputs of the controller to verify conversion logic performance.
18. The method of claim 11 , further comprising:
monitoring, by the cyber monitor, behavior of one or more of the control loops of the controller.
19. The method of claim 11 , wherein the cyber monitor is updateable through a cyber monitor update process comprising one or more security controls that are independent of an update process of the controller.
20. The method of claim 11 , further comprising:
tracking, by the cyber monitor, one or more communication anomalies and isolate a communication interface associated with the one or more communication anomalies based on identifying the cyber attack.