ANALYSIS OF EVENT BASED BEHAVIOUR OF END-POINTS IN AN INDUSTRIAL SYSTEM

There is provided mechanisms for analyzing event based behavior of end-points of a network in an industrial system. A method is performed by a control node. The method comprises collecting(S102), from the end-points, timestamped event log entries as created by the end-points within a time window. Each respective timestamped event log entry pertains to a respective event performed by one of the end-points. The method comprises identifying (S106) tuples of correlated events by comparing the timestamped event log entries to each other, thereby providing a mapping between the events and those end-points where the events of each tuple of correlated events are performed. 提供了用于分析工业系统中网络的端点的基于事件的行为的机制。方法由控制节点执行。该方法包括从端点收集(S102)如由端点在时间窗口内创建的带有时间戳的事件日志条目。每个相应的带有时间戳的事件日志条目都与由端点中的一个端点执行的相应的事件有关。该方法包括通过将带有时间戳的事件日志条目相互比较来标识(S106)相关事件元组，从而提供事件与其中执行每个相关事件元组的事件的那些端点之间的映射。