Programming environment security model
Various embodiments of the present technology generally relate to industrial automation environments. More specifically, embodiments include systems and methods to detect malicious behavior in an industrial automation environment. In some examples, a security component monitors an integrated design application and generates feature vectors that represent operations of the integrated design application. The security component supplies the feature vectors to a machine learning engine. The security component processes a machine learning output that indicates when anomalous behavior is detected in the operations of the integrated design application. When anomalous behavior is detected in the operations of the integrated design application, the security component generates and transfers an alert that characterizes the anomalous behavior.
1. A system to detect malicious behavior in an industrial automation environment, the system comprising:
a memory that stores executable components; and
a processor, operatively coupled to the memory, that executes the executable components, the executable components comprising:
a security component configured to monitor an integrated design application, generate feature vectors that represent generation of a control program in the integrated design application wherein the control program is executable by a Programmable Logic Controller (PLC) to drive an industrial automated process, and supply the feature vectors to a machine learning engine, wherein the security component comprises at least one of the executable components;
the security component configured to process a machine learning output that indicates when anomalous behavior is detected during the generation of the control program in the integrated design application; and
in response to detecting the anomalous behavior during the generation of the control program in the integrated design application, the security component configured to generate and transfer an alert that characterizes the anomalous behavior.
2. The system of claim 1 further comprising:
a machine learning component configured to ingest the feature vectors, process the feature vectors using its constituent machine learning algorithms to detect the anomalous behavior during the generation of the control program in the integrated design application, and generate the machine learning output.
3. The system of claim 1 further comprising:
the security component configured to generate training feature vectors that represent a set of expected actions in the integrated design application and supply the training feature vectors to the machine learning engine; and
the security component configured to receive a training output that comprises a statistical model of the integrated design application.
4. The system of claim 1 wherein the anomalous behavior comprises an input source Internet Protocol (IP) address.
5. The system of claim 1 wherein the anomalous behavior comprises bot behavior.
6. The system of claim 1 wherein the anomalous behavior comprises a control program type.
7. The system of claim 1 wherein the machine learning engine comprises neural network auto-encoders and unsupervised anomaly detection algorithms.
8. A method to detect malicious behavior in an industrial automation environment, the method comprising:
monitoring, by a system comprising a processor, an integrated design application, generating feature vectors that represent generation of a control program in the integrated design application wherein the control program is executable by a Programmable Logic Controller (PLC) to drive an industrial automated process, and supplying the feature vectors to a machine learning engine;
processing, by the system, a machine learning output that indicates when anomalous behavior is detected during the generation of the control program in the integrated design application; and
in response to detecting the anomalous behavior during the generation of the control program in the integrated design environment, generating and transferring, by the system, an alert that characterizes the anomalous behavior.
9. The method of claim 8 further comprising:
ingesting, by the system, the feature vectors, processing the feature vectors using machine learning algorithms to detect the anomalous behavior during the generation of the control program in the integrated design application, and generating the machine learning output.
10. The method of claim 8 further comprising:
generating, by the system, training feature vectors that represent a set of expected actions in the integrated design application and supplying the training feature vectors to the machine learning engine; and
receiving, by the system, a training output that comprises a statistical model of the integrated design application.
11. The method of claim 8 wherein the anomalous behavior comprises an input source Internet Protocol (IP) address.
12. The method of claim 8 wherein the anomalous behavior comprises bot behavior.
13. The method of claim 8 wherein the anomalous behavior comprises a control program type.
14. The method of claim 8 wherein the machine learning engine comprises neural network auto-encoders and unsupervised anomaly detection algorithms.
15. A non-transitory computer-readable medium stored thereon instructions to detect malicious behavior in an industrial automation environment that, in response to execution, cause a system comprising a processor to perform operations, the operations comprising:
monitoring an integrated design application;
generating feature vectors that represent generation of a control program in the integrated design application wherein the control program is executable by a Programmable Logic Controller (PLC) to drive an industrial automated process;
supplying the feature vectors to a machine learning engine;
processing a machine learning output that indicates when anomalous behavior is detected during the generation of the control program in the integrated design application;
in response to detecting the anomalous behavior during the generation of the control program in the integrated design application, generating an alert that characterizes the anomalous behavior; and
transferring the alert.
16. The non-transitory computer-readable medium of claim 15 , the operations further comprising:
ingesting the feature vectors,
processing the feature vectors using machine learning algorithms to detect the anomalous behavior during the generation of the control program in the integrated design application; and
generating the machine learning output.
17. The non-transitory computer-readable medium of claim 15 , the operations further comprising:
generating, training feature vectors that represent a set of expected actions in the integrated design application;
supplying the training feature vectors to the machine learning engine; and
receiving a training output that comprises a statistical model of the integrated design application.
18. The non-transitory computer-readable medium of claim 15 wherein the anomalous behavior comprises an input source Internet Protocol (IP) address.
19. The non-transitory computer-readable medium of claim 15 wherein the anomalous behavior comprises bot behavior.
20. The non-transitory computer-readable medium of claim 15 wherein the anomalous behavior comprises a control program type.