A method for computer-implemented identifying unauthorized access to a wind farm IT infrastructure

The invention refers to a method and an apparatus for comput er-implemented identifying unauthorized access to a wind farm IT infrastructure.

Wind farms comprise of a plurality of wind turbines. For pro cessing measurement values received from wind sensors (i.e. anemometers) to estimate a wind direction, and providing con trol commands for adjusting, among others, a yaw angle or pitch angle, each wind turbine comprises a processing unit. Besides the processing unit, each wind turbine comprises a communication device being communicable connected to an IT infrastructure of the wind farm.

The wind farm IT infrastructure consists of the processing units of the plurality of wind turbines, a wind farm control ling unit and a supervisory control and data acquisition sys tem, known as SCADA system. The SCADA system is adapted to monitor and store operational data of the plurality of wind turbines as well as environmental parameters, such as wind speed, wind direction and so on, provided by a wind farm measuring device. The operational data may be requested from the plurality of wind turbines by the SCADA system. Alterna tively, the operational data may be transmitted from the plu rality of wind turbines to the SCADA system. The wind farm controlling unit is adapted to monitor operation of the plu rality of wind turbines and to transmit control commands to them. The control commands are generated by the wind farm controlling unit or received from an external user station and/or a grid operator station.

Nowadays, wind farms have reached a size where they can be classified as a Critical National Infrastructure (CNI). Therefore, intrusion into the IT infrastructure of a wind farm by unauthorized parties, such as hackers, can cause huge impact on the grid network the wind farm is connected to. In times of cyber war cutting of a wind farm classified as a CNI is non-destructive and has the same impact as total destruc tion. In order to prevent any negative impact on the wind farm, identification and response to a cyber threat is re quired.

As wind farms are unmanned, a response to an intrusion can only be initiated after an alarm has been triggered to a su pervisor station of a control center. The main issue is that software incidents are difficult to detect, especially if known software security solutions have already been bypassed. A need for fast identification of a cyber threat and response to the threat on the fly is necessary in order to limit the damage to the wind farm.

Cyber security systems often are organized on a corporate level. Threats to an IT infrastructure are analyzed and solu tions are developed to match the understanding of the threat. Often, there are two main security systems shortfalls: A first solution is a rule-based security system which consid ers known threats. The second solution is scalability of a cyber security system which means that the organization can not move at the same pace as cyber criminals change their strategy in order to access a system.

To detect hacker intrusions, honeypots or honeynets, hardened routers, network firewalls, web application firewalls and so on are used as common technologies. These technologies focus on baiting a hacker while these are scanning the system for weaknesses. Honeypots are non-productive systems, where for every access the honey pot can be considered as an unauthor ized intrusion. The disadvantages of honeypots are that they can be hacked as well and, as part of the IT infrastructure, they can be used for further attacks on the IT infrastruc ture. Therefore, honeypots need to be protected against unau- thorized access in the same manner as applications on the protective systems.

It is therefore an object of the present invention to provide an easy method in order to detect an unauthorized access to a wind farm IT infrastructure.

EP 3343 300 A1 discloses an interface for managing a wind farm having a plurality of wind turbines. Each digital repre sentation of the wind turbines includes information regarding current and/or optimum operation conditions of the digital wind turbines provided from a plurality of sensors for moni toring operating data points or control settings. To provide added security against cyber-attacks a watchdog monitors val ues of configuration parameters on a SCADA system and alerts support personnel when it detects unauthorized changes. Fur thermore, a firewall module may be provided to detect cyber attacks closer to the time of intrusion.

US 2016/0327 025 A1 provides a method for remotely resetting a faulted wind turbine. The method includes an authentication process wherein authentication data with biometric data asso ciated with a user is requested. If the authentication data provided by the user matches predetermined authentication da ta a reset request is transmitted to a separate computing de vice.

US 2012/0056 711 A1 provides a network-enabled wealth man agement system in which unauthorized tampering is detected, a fault condition in a microprocessor is caused which informs a server and alerts users locked into the system. A tamper fault will be detected by motion sensors.

EP 3276 521 A1 provides a method for detecting false data injection attacks by generating profiles for a plurality of sensors and comparing generated profiles to each other. The profiles refer to total harmonic distortion of signals of the sensors. Data is determined as being spoofed by comparing it to the data from other nearby sensors.

This object is solved by the independent patent claims. Pre ferred embodiments of the invention are defined in the de pendent claims.

The invention provides a method for computer-implemented identifying an unauthorized access to a wind farm IT infra structure. The wind farm IT infrastructure comprises a number of wind turbine processing units, a wind farm controlling unit, and a supervisory control and data acquisition system as first network components.

The number of wind turbine processing units is assigned to a corresponding number of wind turbines of the wind farm, i.e. each wind turbine consists of a respective processing unit. The term "processing unit" refers to both, a processor and a communication device for exchanging data with another commu nication device. In other words, each wind turbine processing unit is adapted to receive data, for example measured values captured by a measuring device or the farm controlling unit, and/or to transmit data to the wind farm controlling unit and/or the SCADA system as well as to control the wind tur bine. The term "wind farm controlling unit" refers to a con trolling unit which is adapted to transmit control commands to at least some of the plurality of wind turbines of the wind farm, in order to operate the windfarm in a specific way, e.g. to produce a demand power. The term "supervisory control and data acquisition system" refers to a processor or a processor system which is adapted to gather and store oper ational data of the number of wind turbines of the wind farm. The stored operational data can be used for further investi gation or development of control strategies. The supervisory control and data acquisition system is also known as SCADA system. The first network components are communicable connected, via a router, to second network components outside the wind farm IT infrastructure, where the second network components com prise a wind farm measuring device, a user station, and a grid operator station. According to the present invention, the router can be regarded to be a first network component or a second network component or an edge network component. The second network components are connected, by way of example, via internet to the router for transmitting and/or receiving control commands or operational data. The communication link between two (first and/or second) network components may be wired or wireless.

The user station is typically used to transmit control com mands to the controlling unit. The controlling unit is adapted to either forward the control commands without alter ing them or to create adapted control commands. The user sta tion control commands generated by a user (e.g. an operator) or a software may be such to control the wind farm as whole, e.g. with respect to a demand power, or to control respective wind turbines of the wind farm, e.g. with respect to a power to be produced by them at a specific point of time or to switch them on or off. The grid operator station refers to a computer or a processing unit for processing operational data of the wind farm, such as produced power.

According to the method of the invention, the following steps i) and ii) are performed at each time point of one or more time points during the operation of the wind farm IT infra structure .

In step i), operational data of the wind farm IT infrastruc ture are obtained. In the following the term "obtaining" means that the operational data are received by a processor implementing the method of the invention. Operational data are current operational data acquired by sensors and/or moni toring units installed at or throughout the wind farm IT in frastructure. The operational data comprises conditions of the first network components and/or information about the da ta flow between the first network components as well as be tween the first and the second network components, and vice versa.

In step ii), an unauthorized access to the farm IT infra structure is determined by processing the operational data by a trained data driven model, where the operational data is fed as a digital input to the trained data driven model and the trained data driven model provides an indication about an unauthorized access as a digital output. The unauthorized ac cess is characterized by a predetermined deviation of the ob tained operational data from expected operational data with respect to operational data characteristics.

The method of the invention provides an easy and straightfor ward method for determining an unauthorized access to a wind farm IT infrastructure based on operational data which is ob tained on the fly. To do so, a trained data driven model is used. The model is trained by training data comprising a plu rality of operational data of the wind farm IT infrastructure which has been obtained and acquired in the past together with the information about a normal or an unnormal condition of at least one component or data flow between first network components as well as between first and second network compo nents.

Any known data driven model being learnt by machine learning may be used in the method according to the invention. In a particularly preferred embodiment, the trained data driven model is a neural network, preferably a convolutional neural network. Alternatively, a cognitive algorithm or trained data driven models which are based on pattern recognition or based on artificial intelligence may also be implemented in the method of the invention.

In a preferred embodiment of the invention, the operational data characteristics comprise at least one of patterns (i.e. the presence of abnormal states and/or the absence of normal states), state variables, responses or load of the first and/or second network components, user access to one of the first and/or second network components, data downloads re sulting in a data flow between the first network components and/or the first and the second network components or user geographical location, i.e. an access from a location which is not identical to the location of the user station and/or the grid operator station.

In a further preferred embodiment of the invention, an infor mation based on the unauthorized access is output via a user interface. E.g., the information about the unauthorized ac cess to a specific first component of the wind farm IT infra structure itself may be output via the user interface. Alter natively or additionally, a warning may be provided via the user interface in case that an unauthorized access has been detected. Thus, a human operator is informed about an unex pected deviation or an intended deviation of the obtained op erational data from expected operational data with respect to operational data characteristics. Preferably, the user inter face comprises a visual user interface, but it may also com prise a user interface of another type (e.g. an acoustic user interface) .

In another particularly preferred embodiment, the operational data is obtained by a digital condition monitoring system. Alternatively or additionally, the operational data is ob tained by one or more sensors provided within the wind farm IT infrastructure. Condition monitoring systems are known from vibration monitoring where errors on mechanical devices, e.g. on the drive train, are predicted via the analysis of the vibration data recorded by the vibration condition moni toring system. The vibration condition monitoring system is based on a frequency analysis to determine whether a devia tion is present from a boundary curve where, when the meas ured frequency exceeds a boundary curve, a warning is gener ated. Besides the above method, the invention refers to an appa ratus for computer-implemented identifying an unauthorized access to a wind farm IT infrastructure, where the apparatus is configured to perform the method according to the inven tion or one or more preferred embodiments of the method ac cording to the invention.

Moreover, the invention refers to a computer program product with a program code, which is stored on a non-transitory ma chine readable carrier, for carrying out the method according to the invention or one or more preferred embodiments thereof when the program code is executed on a computer.

Furthermore, the invention refers to a computer program with a program code for carrying out the method according to the invention or one or more preferred embodiments thereof when the program code is executed on a computer.

An embodiment of the invention will now be described in de tail with respect to the accompanying drawings.

Fig. 1 is a schematic illustration of a wind farm IT in frastructure comprising first network components within a wind farm and second network components outside the wind farm being communicable connected, via a router, to the first network components; and

Fig. 2 shows a schematic illustration of an apparatus for performing an embodiment of the invention.

Fig. 1 shows a wind farm IT infrastructure 1. The wind farm IT infrastructure 1 comprises a number of wind turbine pro cessing units 111, 112, 113, a wind farm controlling unit 120, and a supervisory control and data acquisition system 130, also referred to as SCADA system 130. The number of wind turbine processing units 111, 112, 113 corresponds to the number of wind turbines within the wind farm 100. By way of example only, the wind farm 100 according to the present em bodiment consists of three wind turbines which are not shown explicitly.

The wind turbine processing units 111, 112, 113 are adapted to process data and to exchange data via a not shown communi cation device of the respective processing unit with one of the other first network components. Hence, the wind turbine processing units 111, 112, 113 are adapted to receive control command received from the wind farm controlling unit 120 and/or measured values captured by measuring devices of the wind turbines and/or external measuring devices. In addition, the wind turbine processing units 111, 112, 113 are adapted to transmit data to the controlling unit 120 and/or the SCADA system 130.

The SCADA system 130 is adapted to gather operational data of the respective wind turbines and received by the wind turbine processing units 111, 112, 113 and store them in a not shown data storage.

The wind farm controlling unit 120 is adapted to transmit control data to the wind turbine processing units to control the associated wind turbines with respect to a power to be generated, to switch them on or off or to upload software up dates and so on.

The first network components are communicable connected, via a router 140, to second network components outside the wind farm IT infrastructure, where the second network components comprise a wind farm measuring device 201, a user station 202, and a grid operator station 203.

The wind farm measuring device 201 provides weather data, for example wind speed, wind direction, temperature, air pressure and so on. The user station 202 is used to generate control commands suitable for controlling the respective wind turbines. Con trol commands are transmitted, via the router 140, to the wind farm controlling unit 120 which transmits them either without altering them or as adapted control commands to the respective wind turbine processing units 111, 112, 113.

In a normal condition, the individual first network compo nents of the wind farm IT infrastructure 1 cause a specific amount of traffic in the wind farm network which may be dif ferent for different days and/or time of the day and/or de pendent on environmental conditions. For example, a user who accesses the wind farm controlling unit 120 from the user station 202 causes a specific amount of traffic within the wind farm IT infrastructure 1. In particular, the data flow between the user station 201 and the wind farm controlling unit 120 may be increased and/or the processor load of the wind farm controlling unit 120 may be increased and/or access time to a memory of the wind farm controlling unit 120 may be increased.

In a normal condition, the individual network components of the wind farm IT infrastructure 1 as well as users accessing the wind farm IT infrastructure 1 from outside cause a dif ferent network traffic and/or load of respective network com ponents compared to the case where an unauthorized access to the wind farm IT infrastructure takes place. The method as described in the following provides an easy method to identi fy an unauthorized access to the wind farm IT infrastructure, i.e. an unauthorized access to one or more of the first net work components.

To do so, the wind farm IT infrastructure 1 is equipped with a not shown condition monitoring system and/or sensors and/or monitoring means to monitor operational data OD of the first network components of the wind farm IT infrastructure 1 (preferably including the router 140). The operational data OD comprises conditions of the first network components and/or an information about the data flow between the first network components as well as between one of the first net work components and one or more of the second network compo nents, and vice versa.

The operational data OD can be characterized by operational data characteristics consisting of patterns, state variables, responses or load of the first and/or second network compo nents, user access, data downloads, or user geographical lo cation of an access from outside the wind farm IT infrastruc ture. The respective operational data OD are captured by a condition monitoring system and/or one or more sensors in stalled within the wind farm IT infrastructure 1. Immediately after having the operational data OD captured, they are transferred by a suitable communication link to a controller 300 of the wind farm 100 (see Fig. 2). The controller 300 comprises a processor PR implementing a trained data driven model MO receiving the operational data OD as digital input and providing an information about an unauthorized access UACC as a digital output.

In the embodiment described herein, the trained data driven model MO may be based on a neural network, such as convolu tional neural network. However, a cognitive algorithm, a trained data driven model which is based on pattern recogni tion or based on artificial intelligence may be used as well.

In the embodiment of Fig. 1, the indication about an unau thorized access UACC produced as an output of the model MO results in an output of a user interface UI which is only shown schematically. Preferably, the user interface UI com prises a display. The user interface UI provides information for a human operator for further investigation of the cap tured operational data. The output based on the indication about an unauthorized access UACC may be an information about the unauthorized access itself so that the operator is in formed about an intrusion into the wind farm IT infrastruc ture 1. Alternatively or additionally, the output may com- prise an information which of the first network components has been accessed unauthorized. The indication about an unau thorized access may also result in counter measures such as a shutdown of the router 140 and/or a wind turbine.

The method as described above enables identifying an unau thorized access to the wind farm IT infrastructure by con sistently analyzing data within and from/to the wind farm IT infrastructure in the search of patterns and state variables or user access, data downloads, and user geographical loca tion on the fly. The method is based on a learning algorithm in order to improve identification quality and speed. The da ta driven model MO is capable of interpreting the traffic within the wind farm IT infrastructure as well as loads of specific network components in order to differentiate what additional traffic and/or load of specific first network com ponents is caused by a component or a user or a sensor or by an unauthorized access from a cybercriminal. The additional traffic and/or load of one or more of the first network com ponents is identified and classified.

The trained data driven model MO is based on the analysis of the wind farm IT infrastructure data and the first network components dealing with one or a combination of the following situations: detecting threats of unauthorized access; analy sis of cognitive system/algorithm support patterns; monitor ing of network routers and switches; monitoring of network ports for anomalies; analysis of network traffic for anoma lies; analysis of wind farm third party system data, such as shadow management or ice sensors, for anomalies; analysis of honeypots or honeynets for anomalies; analysis of locked data for anomalies; analysis of middleware communication, i.e. communication from and to the SCADA system 130, for anoma lies; analyzing southbound wind farm internal communication for anomalies; analysis of northbound wind farm external com munication, e.g. with a grid operator or energy trader, util ity, service provider; analysis of user login information in cluding geographical information of the user. The trained data driven model is based on the explicit analy sis of system responses and conditions of the first network components of the wind farm IT infrastructure and/or the sec ond network components outside the wind farm IT infrastruc ture to external and/or internal stimulus. Here, the normal range of system responses and conditions can be determined first. Responses and state variables or state data will de velop specific pattern during improper use. Incidents accord ing to the deviation between a normal range and a deviation from a normal range can be made via comparison, where option ally a specific confidence level is identifiable. When an in dication about an unauthorized access is detected, precau tionary measures can be taken to defend against the threats.

In order to describe a normal range of system responses and conditions of the wind farm IT infrastructure data is record ed at the first network components and during normal opera tions: router for external data traffic, switches within the wind farm IT infrastructure, third party systems, user access to the wind farm IT infrastructure components, such as rout ers, switches, software applications, third party systems, event handling systems of middleware, and the processing units of the wind turbines.

By continuous exposure of the processor 300 to threats, the processor is able to identify and classify threats on the fly. The processor 300 is able to indicate the origin of the vulnerability and allow retraction of the vulnerability. Af ter identifying the threats, an alarm is triggered on the us er interface for information purposes.

The method as described above has the advantage that its re sponse is much faster towards cyber-attacks, especially as wind farm are unmanned and therefore more vulnerable towards attacks from inside and outside the wind farm. The method is able to identify threats and classify them, to provide fast response capabilities to cyber-attacks, to identify anomalies on the wind farm IT infrastructure as well as an unauthorized access to the wind farm IT infrastructure, and to support au tomated patching of identified vulnerabilities.