Parametric analysis of integrated operational and information technology systems
A system and method for analyzing integrated operational technology and information technology systems with sufficient granularity to predict key elements of their composite behavior. The system and method involve creating high-fidelity models of the operational technology and information technology systems using one or more cyber-physical graphs, performing parametric analyses of the models to identify key components, scaling the parametric analyses of the models to analyze the key components at a greater level of granularity, and iteratively improving the models via ongoing search and testing against observed data from the real-world systems.
1. A system for parametric analysis of integrated operational and information technology systems, comprising:
a computing system comprising a memory and a processor, the computing system being connected to a network; and
a cyber-physical graph subsystem comprising a first plurality of programming instructions that, when operating on the processor, causes the computing system to:
create a model of a combined system comprising information technology and operational technology elements;
wherein the model of the combined system comprises a cyber-physical graph comprising nodes representing the entities associated with the combined system and edges representing the relationships between entities associated with the combined system;
a model analyzer subsystem comprising a second plurality of programming instructions that, when operating on the processor, causes the computing device to:
perform one or more iterative parameter analyses of one or more parameters of the model of the combined system; and
determine a response of the model of the combined system to each of the iterative parameter analyses performed; and
a scaling optimizer subsystem comprising a third plurality of programming instructions that, when operating on the processor, causes the computing device to:
determine a dimensionality in which to run the model of the combined system;
determine a set of scaling parameters, perturbations and iterative cycles to use when running a simulation of the combined system; and
determine a threshold degree in change of state of the model of the combined system at or above which a new simulation should be triggered.
2. The system of claim 1 , wherein the model of the complex combined system further comprises a distributed computational graph which comprises nodes representing data transformations and edges representing messages between the nodes, wherein the distributed computational graph represents workflows within the model of the combined system.
3. The system of claim 1 , wherein the scaling optimizer subsystem causes the computing device to run one or more simulations on the model of the combined system based on the scaling parameters and to produce simulation data.
4. The system of claim 3 , wherein the scaling optimizer subsystem further causes the computing device to:
receive operational data from the combined system;
compare the operational data to the simulation data; and
change the model of the combined system, by changing entity, interaction, or condition parameters or model elements, to reduce differences between the operational data and the simulation data.
5. The system of claim 4 , wherein the simulation data are used to predict behaviors of the combined system.
6. The system of claim 5 , wherein the predicted behaviors are used to determine a behavior of the combined system under parameters that suggest control by an unauthorized or malicious entity.
7. The system of claim 5 , wherein the predicted behaviors are used to adjust operation of the combined system.
8. The system of claim 1 wherein additional state information of the combined system is captured as time-series data using individual time-series swimlanes and referenced by nodes and edges in the cyber-physical graph.
9. A method for parametric analysis of integrated operational technology systems and information technology systems, comprising the steps of:
creating a model of a combined system comprising information technology and operational technology elements;
wherein the model of the combined system comprises a cyber-physical graph comprising nodes representing the entities associated with the combined system and edges representing the relationships between entities associated with the combined system;
performing one or more iterative parameter analyses of one or more parameters of the model of the combined system;
determining a response of the model of the combined system to each of the iterative parameter analyses performed;
determining a dimensionality in which to run the model of the combined system;
determining a set of scaling parameters, perturbations and iterative cycles to use when running a simulation of the combined system; and
determining a threshold degree in change of state of the model of the combined system at or above which a new simulation should be triggered.
10. The method of claim 9 , wherein the model of the combined system further comprises a distributed computational graph which comprises nodes representing data transformations and edges representing messages between the nodes, wherein the distributed computational graph represents workflows within the model of the combined system.
11. The method of claim 9 , comprising the further step of running one or more simulations on the model of the combined system based on the scaling parameters and to produce simulation data.
12. The method of claim 11 , comprising the further steps of:
receiving operational data from the combined system;
comparing the operational data to the simulation data; and
changing the model of the combined system, by changing entity, interaction, or condition parameters or model elements, to reduce differences between the operational data and the simulation data.
13. The method of claim 12 , wherein the simulation data are used to predict behaviors of the combined system.
14. The method of claim 13 , wherein the predicted behaviors are used to determine a behavior of the combined system under parameters that suggest control by an unauthorized or malicious entity.
15. The method of claim 13 , wherein the predicted behaviors are used to adjust operation of the combined system.
16. The method of claim 9 , wherein additional state information of the combined system is captured as time-series data using individual time-series swimlanes and referenced by nodes and edges in the graph.