A cyber security system for providing security to a railway, the system comprising: a data monitoring and processing hub; a network comprising a plurality of data collection agents synchronized to a same network clock and configured to monitor railway infrastructure devices and onboard devices of rolling stock having a train communication network (TCN), and forward monitored data to the hub for processing by the hub to detect anomalies in railway operation that are indicative of a cyber-attack; at least one anonymizer configured to scrub information items from data that the hub receives from a data collection agent of the plurality of data collection agents which may be used to identify the cyber security system or the railway for which the system provides security.

A cyber security system for providing security to a railway, the system comprising: a data monitoring and processing hub; a network comprising a plurality of data collection agents synchronized to a same network clock and configured to monitor railway infrastructure devices and onboard devices of rolling stock having a train communication network (TCN), and forward monitored data to the hub for processing by the hub to detect anomalies in railway operation that are indicative of a cyber-attack; at least one anonymizer configured to scrub information items from data that the hub receives from a data collection agent of the plurality of data collection agents which may be used to identify the cyber security system or the railway for which the system provides security.

In one embodiment, a method includes receiving, from a controller, a data packet including (1) a plurality of samples each corresponding to measurements from a motion sensor and (2) a timestamp corresponding to a measurement time of one of the samples as measured by a clock of the controller; determining, based on the timestamp, an estimated measurement time relative to a local clock for each of the plurality of samples that is not associated with the timestamp; and converting each of the timestamp and the estimated measurement times to a corresponding synchronization time using a learned relationship relating the clock of the controller and the local clock. The learned relationship is iteratively learned based on previously received data packets from the controller. The synchronization time associated with each of the plurality of samples represents an estimated time, relative to the local clock, at which the sample was measured.

An improved system for monitoring clock duty cycles, comprising: a first monitoring circuit configured to record a first quantity of high levels of the monitored clock signal sampled by a first random clock signal; a second monitoring circuit configured to record a second quantity of high levels of the monitored clock signal sampled by a second random clock signal, wherein the phase of the second random clock is adjusted by a second adjustment degree based on a first clock; a third monitoring circuit configured to record a third quantity of high levels of the monitored clock signal sampled by a third random clock signal, wherein the phase of the third random clock is the reverse of that of the first random clock; and a calculation module configured to determine a duty cycle of the monitored clock based on the first quantity, the second quantity, and the third quantity.

An improved system for monitoring clock duty cycles, comprising: a first monitoring circuit configured to record a first quantity of high levels of the monitored clock signal sampled by a first random clock signal; a second monitoring circuit configured to record a second quantity of high levels of the monitored clock signal sampled by a second random clock signal, wherein the phase of the second random clock is adjusted by a second adjustment degree based on a first clock; a third monitoring circuit configured to record a third quantity of high levels of the monitored clock signal sampled by a third random clock signal, wherein the phase of the third random clock is the reverse of that of the first random clock; and a calculation module configured to determine a duty cycle of the monitored clock based on the first quantity, the second quantity, and the third quantity.

An embodiment method is disclosed for deriving an estimation value of a clock-error for a slave clock, wherein the slave clock is set at a nominal slave period and outputs a sequence of slave clock signals at an actual slave period, and wherein a difference between the actual slave period and the nominal slave period is approximated by the estimation value of the clock-error.

An embodiment method is disclosed for deriving an estimation value of a clock-error for a slave clock, wherein the slave clock is set at a nominal slave period and outputs a sequence of slave clock signals at an actual slave period, and wherein a difference between the actual slave period and the nominal slave period is approximated by the estimation value of the clock-error.

Embodiments of the present invention relate to a method and a device for providing a clock signal to an application, comprising (a) determining a time difference between a clock device and the clock signal; if the time difference is above a predetermined threshold x, (b) calibrating a first time unit and, during calibrating the first time unit, (c) using a second time unit for providing the clock signal to the application.

Some embodiments of the time resilient system and methods disclosed herein can be configured to detect and defend against invalid time signals. According to various embodiments of the disclosed technology, the time resilient system include a receiver for collecting time signals sourced from an external clock. By way of example only, the external clock may be a high precision clock housed within a Global Positioning System. Other embodiments may include an internal clock calibrated to a time reflected on the external clock so that the internal clock and the external clock are synchronized. Additionally, a controller may monitor changes in time signals of the external over a period of time against the internal clock, where the system is alerted of a timing attack when the time signals collected from the receiver deviate a pre-determined time range with the time of the internal clock.

Some embodiments of the time resilient system and methods disclosed herein can be configured to detect and defend against invalid time signals. According to various embodiments of the disclosed technology, the time resilient system include a receiver for collecting time signals sourced from an external clock. By way of example only, the external clock may be a high precision clock housed within a Global Positioning System. Other embodiments may include an internal clock calibrated to a time reflected on the external clock so that the internal clock and the external clock are synchronized. Additionally, a controller may monitor changes in time signals of the external over a period of time against the internal clock, where the system is alerted of a timing attack when the time signals collected from the receiver deviate a pre-determined time range with the time of the internal clock.