Portaledge: Detecting Cyber Attacks – Part 4: The PI ACE Engine
The PI Advanced Computing Engine (ACE) is the environment in which Portaledge modules are developed, execute and are managed. ACE allows for the creation of modules to perform complex calculations, systems and process monitoring, and communications between systems and data sources. In Portaledge with use ACE to correlate security events from a variety of data sources to detect cyber attacks.
These custom modules are built using an OSIsoft provided SDK in the Microsoft Visual Studio environment and are typically developed in Visual Basic. The 3 primary components that comprise ACE are the Wizard and SDK, the Manager and the Scheduler.
The Wizard and SDK provide a framework for developing ACE modules. The Wizard allows for the selection of input and output tags either directly to the tag or through an alias. It also provides a template file for custom development with the entry and exit points into the module and function stubs for the initialization of variables and garbage collection of data. The key functionality of a module is also stubbed out by the Wizard in the form of the “Calculation” method, which is called each time the module runs and is where calculations and calls to other functions pertinent to the custom calculations are performed. The SDK contains the API and library functions upon which modules are built and that the Wizard relies.
The ACE Manager allows for the control of modules. Via the Manager the period of a module’s execution can be controlled, modules can be started and suspended, and module execution can be monitored. The Manager also monitors the status of a module and will note if it has errored out and can supply some information in reference to the error.
The ACE Scheduler is the system service that actually executes the modules. It executes the modules based on the parameters specified in the Manager such as frequency, time offset, PI Context, etc. There are two versions of the Scheduler and SDK depending on what version of ACE is employed.
Custom ACE modules are useful as they allow a user to develop solutions to problem that may be unique to their deployment. Such solutions could be the conversion of units, monitoring and storing new records into the historian based on custom events, or updating the Module Database with data from an external source. Portaledge is such a custom solution that uses the power of ACE to monitor and correlate custom security events.
Post in the Portaledge Series;
Part 1: Portaledge Overview
Part 2: Aggregating and Identifying Security Events
Part 3: PI Points, Tags and the Module Database
Part 4: The PI ACE Engine
Part 5: Triggers and Events
Part 6: Event Class Events
Part 7: Meta Events
Portaledge GUI
Author: Kevin Lackey
Posted: June 1st, 2009 under Portaledge.
Comments: none
Write a comment