CPC H04L 69/40 (2013.01) [G05B 19/042 (2013.01); G05B 19/054 (2013.01); G05B 19/41835 (2013.01); G06F 8/65 (2013.01); G06F 11/2023 (2013.01); G06F 11/2033 (2013.01); H04L 41/0668 (2013.01); H04L 41/082 (2013.01); H04L 41/0846 (2013.01); H04L 67/04 (2013.01); H04L 67/10 (2013.01); H04L 67/1048 (2013.01); H04L 67/1051 (2013.01); H04L 67/12 (2013.01); H04L 67/125 (2013.01); H04L 67/34 (2013.01); H04L 67/565 (2022.05); G05B 2219/1105 (2013.01); G05B 2219/1214 (2013.01); G05B 2219/32043 (2013.01); G05B 2219/33112 (2013.01); G06F 2201/805 (2013.01); G06F 2201/82 (2013.01); G06F 2201/85 (2013.01)] | 23 Claims |
1. At least one non-transitory machine-readable medium including instructions, which when executed by processing circuitry, cause the processing circuitry to perform operations to:
identify information indicative of a plurality of alarms of an industrial control system;
analyze the information to determine alarm stream correlations among the plurality of alarms;
detect an alarm event at two or more alarms;
prevent the two or more alarms from issuing;
generate a clustered alarm for the two or more alarms prevented from issuing based on an alarm stream correlation of the alarm stream correlations, the alarm stream correlation corresponding to the two or more alarms prevented from issuing; and
output the clustered alarm.
|