Patent attributes
A method for automatically detecting an abnormal process flow for a process in an industrial control system (ICS) comprises providing process flow (PF) strings that define normal PFs for processes in the ICS, each of the PF strings defining a time-ordered sequence of events that is a time-ordered recurring sequence of learned events associated with learned changes between learning values of parameters that affect an operation of the ICS, wherein a respective PF string of the PF strings includes an attributed process flow node that represents an attributed event and one or more attributes that are associated therewith. The method further comprises: obtaining monitoring values of the parameters, analyzing the monitoring values to detect monitored events that are associated with monitored changes between monitoring values of the parameters, and detecting the abnormal process flow upon determining a lack of conformance of a monitored event with one of the PF strings.
