US Patent 9794278 Network-based whitelisting approach for critical systems

A method for modeling or monitoring a control system is provided. The method includes deriving a plurality of message prototypes from a plurality of messages of the control system, the plurality of messages gathered from the control system during operation of the control system. The method includes deriving relationships among the plurality of message prototypes and constructing a model of the control system, based upon the derived message prototypes and the derived relationships among the plurality of message prototypes, wherein at least one method operation is executed through a processor.