Threshold calculation device, anomaly detection device, threshold calculation method, and anomaly detection method

Abstract

The threshold calculation device calculates the threshold used in the anomaly detection device, which detects abnormal communication of a first device in an facility equipped with a home network (11). A second device, different from the first device, is provided in the facility. The threshold calculation device includes: a device status acquisition unit (110) that acquires the device status of the first device during a first period; an in-room status determination unit (120) that determines the in-room status of a person in the facility during the first period based on information obtained from the second device; a communication log collection unit (130) that collects communication logs generated based on communications sent and received by the first device during the first period; and a learning unit (140) that calculates the threshold for communication of the first device in a second period following the first period based on the device status, the in-room status, and the communication logs. The device status includes one or more states of the first device, and the in-room status includes one or more states of a person. The learning unit (140) calculates the threshold for each of the one or more states and combinations of the one or more states.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to a threshold value calculation device, an anomaly detection device, a threshold value calculation method, and an anomaly detection method. BACKGROUND

[0002] In recent years, various IoT (Internet of Things) devices in a home have begun to be connected to the Internet via a home router. By these IoT devices in the home being connected to the Internet, functions such as remote control, state monitoring, and device collaboration are realized.

[0003] On the other hand, in ECHONET Lite (registered trademark, hereinafter the same), UPnP (Universal Plug and Play), DLNA (registered trademark, hereinafter the same) (Digital Living Network Alliance), and the like, which are home network protocols that have become widespread, a concept of security such as encryption of communication is not included.

[0004] Furthermore, in the IoT devices in the home, it is more common that security software such as an antivirus program cannot be introduced as in the case of conventional IT (Information Technology) devices such as personal computers, and network attacks targeting devices connected on a home network (for example, a LAN: Local Area Network, and the like) in the home and the like occur.

[0005] For example, in a case where an IoT device in the home is operated improperly due to a network attack, there are cases where a smart television is infected with a virus, images of a surveillance camera are disclosed to a network, or an IoT device in the home is held hostage to an attack on another server on the Internet, and the like. Furthermore, in a case where an IoT device in the home is a medical device, there are cases where operations that are related to life and death are performed.

[0006] Therefore, it becomes important to monitor traffic flowing in a network in a home network and detect improper access, anomalies of IoT devices in the home due to virus infection, and the like.

[0007] As a way of detecting anomalies of a network, there are a signature detection way of comparing known abnormal packet patterns (signatures) with packet patterns flowing on a network to detect anomalies, and an anomaly detection way of comparing normal state packet patterns with packet patterns flowing on a network to detect anomalies (for example, refer to Patent Literature 1).

[0008] However, in the signature detection way, since abnormal packet patterns must be set in advance, anomalies of unknown viruses and the like cannot be detected.

[0009] On the other hand, in the abnormality detection method, as in Patent Literature 1, by learning the packet pattern of the normal state using a machine learning technique, all packet patterns that do not match the learned model are detected as abnormal, and thus it is possible to detect unknown abnormalities such as viruses.

[0010] Prior Art Documents

[0011] Patent Literature

[0012] Patent Literature 1: Japanese Patent Application Publication No. 2004-312064 SUMMARY

[0013] Problems to be Solved by the Invention

[0014] However, in the method disclosed in Patent Literature 1, although the packet pattern of the normal device is used in learning for abnormality detection, there is a case where abnormality detection cannot be properly performed in a case where the usage situation of communication corresponding to a change in the state within the facility changes.

[0015] Therefore, the present disclosure provides a threshold value calculation device, an abnormality detection device, a threshold value calculation method, and an abnormality detection method that can more properly perform abnormality detection in order to solve the above problems.

[0016] Means for Solving the Problems

[0017] A threshold value calculation device according to an aspect of the present disclosure calculates a threshold value used in an abnormality detection device that is connected to an in-facility network that detects abnormal communication in a first device within a facility that sets the in-facility network, and in the in-facility, a second device different from the first device is provided. The threshold value calculation device includes a first device state acquisition section that acquires a device state of the first device for a first period, a first in-room situation determination section that determines an in-room situation of a person within the facility during the first period based on information acquired from the second device, a first communication log collection section that collects a communication log generated by communication transmitted and received by the first device during the first period, and a calculation section that calculates a threshold value for communication of the first device during a second period after the first period based on the device state, the in-room situation, and the communication log. The device state includes one or more states of the first device, the in-room situation includes one or more situations of the person, and the calculation section calculates the threshold value for each combination of the one or more states and the one or more situations.

[0018] An anomaly detection device according to one aspect of this disclosure is connected to an intra-facility network to detect abnormal communication in a first device within an facility on which the intra-facility network is installed; a second device, different from the first device, is provided within the facility; the anomaly detection device comprises: a second device status acquisition unit that acquires the device status of the first device in a second period following a first period; a first presence status determination unit that determines the presence status of a person in the facility during the second period based on information acquired from the second device; a second communication log collection unit that collects communication logs generated by communications sent and received by the first device during the second period; and an anomaly detection unit that selects a threshold corresponding to the device status and presence status during the second period from thresholds calculated by a threshold calculation unit for each combination of one or more statuses of the first device, and detects the abnormal communication of the first device during the second period based on the selected threshold and the communication logs during the second period.

[0019] A threshold calculation method according to one aspect of this disclosure calculates a threshold used in an anomaly detection device connected to an intra-facility network to detect abnormal communication in a first device within an intra-facility network; a second device, different from the first device, is provided within the intra-facility; the threshold calculation method includes: obtaining the device status of the first device during a first period; determining the presence status of a person within the intra-facility during the first period based on information obtained from the second device; collecting communication logs generated by communications sent and received by the first device during the first period; and calculating a threshold for communication of the first device in a second period following the first period based on the device status, the presence status, and the communication logs; the device status includes one or more states of the first device; the presence status includes one or more states of the person; and in the calculation of the threshold, the threshold is calculated for each combination of the one or more states and the one or more states.

[0020] An anomaly detection method according to one aspect of this disclosure detects abnormal communication in a first device connected to an intra-facility network and located within an intra-facility network. A second device, different from the first device, is located within the facility. The device status of the first device is obtained for a second period following a first period. Based on information obtained from the second device, the presence status of a person within the facility during the second period is determined. A communication log generated from communications sent and received by the first device during the second period is collected. From thresholds calculated according to the threshold calculation method for each combination of one or more states of the first device, a threshold corresponding to the device status and presence status during the second period is selected. Based on the selected threshold and the communication log during the second period, the abnormal communication of the first device during the second period is detected.

[0021] Invention Effects

[0022] According to this disclosure, a threshold calculation device and the like can be realized that can perform anomaly detection more accurately. Attached Figure Description

[0023] Figure 1 This is an overall configuration diagram of the anomaly detection system implemented in this way.

[0024] Figure 2 This is a configuration diagram of the anomaly detection and processing device according to the implementation method.

[0025] Figure 3 This is a diagram illustrating an example of device status data in an implementation method.

[0026] Figure 4 This is a diagram illustrating an example of indoor condition data for an implementation method.

[0027] Figure 5 This is a diagram illustrating an example of a communication log in an implementation method.

[0028] Figure 6 This is a diagram illustrating an example of learning data from an implementation method.

[0029] Figure 7 This is a diagram illustrating an example of threshold data in an implementation method.

[0030] Figure 8A This is a flowchart illustrating the operation of the threshold calculation device in the implementation method.

[0031] Figure 8B This is a flowchart illustrating the operation of the anomaly detection device in the implementation method.

[0032] Figure 9 This is a flowchart illustrating an example of the device status acquisition process in an implementation method.

[0033] Figure 10 This is a flowchart illustrating an example of the device status acquisition process in an implementation method.

[0034] Figure 11 This is a flowchart illustrating another example of the device status acquisition process in an implementation method.

[0035] Figure 12 This is a flowchart illustrating another example of the device status acquisition process in the implementation method.

[0036] Figure 13 This is a flowchart illustrating an example of the indoor status determination process in an implementation method.

[0037] Figure 14 This is a flowchart illustrating an example of communication log collection and processing in an implementation method.

[0038] Figure 15 This is a flowchart illustrating an example of the learning process in an implementation method.

[0039] Figure 16 This is a flowchart illustrating an example of the learning data creation and processing in an implementation method.

[0040] Figure 17 This is a flowchart illustrating an example of the threshold setting process in an implementation method.

[0041] Figure 18 This is a flowchart illustrating an example of anomaly detection processing in an implementation method. Detailed Implementation

[0042] (The reason for making this public)

[0043] As described in the "Problems to be Solved by the Invention" section above, the method disclosed in Patent Document 1 has the problem of failing to correctly detect anomalies when the communication usage changes in response to changes in the state within the facility. For example, in IoT devices within a home, the usage of the devices varies depending on the number of occupants present, their attributes, etc., so relying solely on normal device grouping patterns may lead to false detections or missed detections.

[0044] For example, if the smart TV is turned on and the lights are on, and the resident is not present, we want to detect an anomaly. However, since we cannot determine whether the resident is present or not, we cannot detect an anomaly and it may result in a missed detection.

[0045] Furthermore, when visitors arrive, or when communication volume increases due to new terminals connected by people other than the residents, or when the number of people in the room increases, these situations may be detected as abnormal and could become false detections.

[0046] Thus, in the existing technology, since the occupant's presence in the room is not taken into account when detecting anomalies, the anomaly detection cannot be performed correctly when the communication usage changes in response to changes in the state within the facility, which may result in missed detections or false detections.

[0047] Therefore, the inventors of this application have conducted special research on threshold calculation devices, anomaly detection devices, threshold calculation methods, and anomaly detection methods that can perform anomaly detection more accurately, and have invented the threshold calculation devices, anomaly detection devices, threshold calculation methods, and anomaly detection methods shown below.

[0048] According to one aspect of this disclosure, a threshold calculation apparatus calculates a threshold used in an anomaly detection device connected to an intra-facility network to detect abnormal communication in a first device within an intra-facility network. A second device, different from the first device, is provided within the same intra-facility. The threshold calculation apparatus comprises: a first device status acquisition unit that acquires the device status of the first device during a first period; a first in-room status determination unit that determines the in-room status of a person present in the intra-facility during the first period based on information obtained from the second device; a first communication log collection unit that collects communication logs generated by communications sent and received by the first device during the first period; and a calculation unit that calculates a threshold for communication of the first device in a second period following the first period based on the device status, the in-room status, and the communication logs. The device status includes one or more states of the first device; the in-room status includes one or more states of the person; and the calculation unit calculates the threshold for each of the one or more states and combinations thereof.

[0049] Therefore, since thresholds are calculated separately for the combination of equipment status and room condition, the anomaly detection device uses thresholds corresponding to the equipment status and room condition of the second period to detect communication anomalies in that second period. This allows for more accurate anomaly detection compared to the case in Patent Document 1, where normal equipment grouping patterns are used to detect communication anomalies without considering the conditions within the facility. Thus, the thresholds calculated by the threshold calculation device enable more accurate anomaly detection.

[0050] Alternatively, for example, the first device status acquisition unit may acquire at least one of the power status and setting value of the first device based on communication as the device status, wherein the communication includes a device control command for controlling the first device.

[0051] Therefore, the calculation unit can calculate a threshold for at least one of the power supply state and the set value. When the anomaly detection device uses a threshold corresponding to at least one of the power supply state and the set value in the second period to detect anomalies, anomaly detection can be performed more accurately for that at least one condition. Thus, by using the threshold calculated by the threshold calculation device, anomaly detection can be performed more accurately for at least one condition of the power supply state and the set value.

[0052] Alternatively, for example, the first indoor status determination unit may determine the indoor status based on information obtained from the first device or a third device other than the first device and the second device.

[0053] Therefore, since information obtained from devices other than the second device is also used to determine the presence status, the presence status can be determined more accurately. This is beneficial for more accurate anomaly detection.

[0054] Alternatively, for example, the communication log may include category information, which represents the online category determined based on the destination identifier of the communication log; the category information may include one or more online categories in the communication log, and the calculation unit may also calculate the threshold for each combination of the one or more online categories.

[0055] Therefore, thresholds are calculated separately for combinations containing one or more online types. That is, thresholds can be calculated for each transmission destination of the communication. When the anomaly detection device uses a threshold corresponding to the online type of the communication in the second period to detect anomalies, anomaly detection for that online type can be performed more accurately. Thus, by using the threshold calculated by the threshold calculation device, anomaly detection can be performed more accurately when there are one or more online types.

[0056] Alternatively, for example, the computing unit may generate learning data that establishes corresponding information about the device status, the room status, and the communication logs, and calculate the threshold based on the learning data.

[0057] Therefore, by pre-creating learning data, the threshold can be calculated simply by extracting the required data from that learning data, making the threshold calculation easy.

[0058] Alternatively, for example, the aforementioned presence status may include the presence or absence of the aforementioned person within the aforementioned facility, and the aforementioned calculation unit may calculate the aforementioned thresholds separately for the presence and absence of the aforementioned person.

[0059] Therefore, the calculation unit can calculate thresholds separately for whether a person is present or absent. When the anomaly detection device uses a threshold corresponding to whether a person is present or absent during the second period to detect anomalies, the anomaly detection can be performed more accurately in that specific situation. Thus, by using the threshold calculated by the threshold calculation device, anomaly detection can be performed more accurately for both present and absent situations.

[0060] Alternatively, for example, the aforementioned indoor situation may include at least one of the number of people and their locations within the aforementioned facility, and the aforementioned calculation unit may calculate the aforementioned threshold for each of the aforementioned at least one.

[0061] Therefore, the calculation unit can calculate a threshold for at least one of the number of people and their location. When the anomaly detection device uses a threshold corresponding to at least one of the number of people and their location in the second period to detect anomalies, anomaly detection can be performed more accurately in the case of at least one of these factors. Thus, by using the threshold calculated by the threshold calculation device, anomaly detection can be performed more accurately in the case of at least one of the number of people and their location.

[0062] Alternatively, for example, the aforementioned indoor situation may include activity information of one or more persons during the aforementioned first period, and the aforementioned calculation unit may then calculate the aforementioned threshold based on the aforementioned activity information.

[0063] Therefore, thresholds are calculated separately for each combination of human activity information. That is, a threshold can be calculated for each piece of human activity information. When the anomaly detection device uses a threshold corresponding to the human activity information in the second period to detect anomalies, anomaly detection can be performed more accurately for that activity information. Thus, by using the threshold calculated by the threshold calculation device, anomaly detection can be performed more accurately when there is more than one piece of activity information.

[0064] Alternatively, for example, the threshold may be a threshold for the communication volume of the first device, including the maximum and minimum values ​​of the communication volume.

[0065] Therefore, it is possible to calculate thresholds for detecting anomalies in both high and low traffic scenarios. By using such thresholds, anomaly detection can be performed more accurately compared to cases where the threshold is only set to an upper or lower limit.

[0066] Furthermore, regarding one aspect of the present disclosure, an anomaly detection device is connected to an intra-facility network to detect abnormal communication of a first device within an intra-facility network. In the intra-facility, a second device different from the first device is provided. The anomaly detection device comprises: a second device status acquisition unit that acquires the device status of the first device during a second period following a first period; a first presence status determination unit that determines the presence status of a person within the intra-facility during the second period based on information acquired from the second device; a second communication log collection unit that collects communication logs generated by communications sent and received by the first device during the second period; and an anomaly detection unit that selects a threshold corresponding to the device status and presence status during the second period from thresholds calculated by a threshold calculation device for each combination of one or more states of the first device. Based on the selected threshold and the communication logs during the second period, it detects the abnormal communication of the first device during the second period.

[0067] Therefore, the anomaly detection device can detect communication anomalies in the second period by using a threshold calculated for each combination of equipment status and room condition that corresponds to the equipment status and room condition in the second period. By using such a threshold to detect communication anomalies, the anomaly detection device can perform anomaly detection more accurately than the case in Patent Document 1, which uses the normal equipment grouping mode to detect communication anomalies without considering the conditions within the facility.

[0068] Alternatively, for example, the anomaly detection unit may compare the selected threshold with the communication log, and if the communication log does not meet the threshold, it may be determined as an anomaly and the determination result may be output.

[0069] Therefore, when an anomaly is detected, the anomaly detection device can notify that an anomaly has been detected.

[0070] A threshold calculation method according to one aspect of this disclosure calculates a threshold used in an anomaly detection device connected to an intra-facility network to detect abnormal communication of a first device within an intra-facility network. A second device, different from the first device, is also provided within the intra-facility. The threshold calculation method includes: obtaining the device status of the first device during a first period; determining the presence status of a person within the intra-facility during the first period based on information obtained from the second device; collecting communication logs generated by communications sent and received by the first device during the first period; and calculating a threshold for communication of the first device in a second period following the first period based on the device status, the presence status, and the communication logs. The device status includes one or more states of the first device; the presence status includes one or more states of the person; and in the threshold calculation, the threshold is calculated for each combination of the one or more states and the one or more states.

[0071] Therefore, it achieves the same effect as the threshold calculation device mentioned above.

[0072] An anomaly detection method according to one aspect of this disclosure detects abnormal communication of a first device connected to an intra-facility network and located within an intra-facility network. A second device, different from the first device, is located within the facility. The method obtains the device status of the first device during a second period following a first period. Based on information obtained from the second device, the method determines the presence status of a person within the facility during the second period. It collects communication logs generated from communications sent and received by the first device during the second period. From thresholds calculated by the threshold calculation method for each combination of one or more states of the first device, a threshold corresponding to the device status and presence status during the second period is selected. Based on the selected threshold and the communication logs during the second period, the method detects the abnormal communication of the first device during the second period.

[0073] Therefore, it achieves the same effect as the aforementioned anomaly detection device.

[0074] Hereinafter, with reference to the accompanying drawings, the configuration of the anomaly detection system, the configuration of the threshold calculation device and the anomaly detection device, and the processing flow in the threshold calculation device and the anomaly detection device of the present disclosure will be described.

[0075] Furthermore, the embodiments described below represent preferred specific examples of this disclosure. That is, the values, shapes, materials, constituent elements, configurations and connection forms of constituent elements, steps, and order of steps shown in the following embodiments are examples of this disclosure, and their purpose is not to limit this disclosure.

[0076] This disclosure is based on the description in the claims. Therefore, elements in the following embodiments that are not described in the independent claims representing the highest concept of this disclosure are not necessarily necessary to achieve the objectives of this disclosure, but are described as elements constituting a more preferred form.

[0077] Furthermore, the numerical values ​​and ranges described in the embodiments are examples and are not limited to those values ​​and ranges.

[0078] (Implementation Method)

[0079] In embodiments of this disclosure, it is described that the status of the occupant is inferred based on the operating status of each device in the home and information obtained from each sensor or device installed in the home, and the threshold changes used for anomaly detection are used to determine the composition of an anomaly of the device.

[0080] [1. Details of the implementation method]

[0081] Here, as an embodiment of this disclosure, the anomaly detection system of this disclosure will be described with reference to the accompanying drawings. Furthermore, in this embodiment, the case where a home network (home network 11) is connected to home IoT devices (air conditioners, televisions, etc.) and IT devices (smartphones, personal computers), etc., is described; however, the devices connected to the network are not limited to these.

[0082] Furthermore, the following examples illustrate the deployment of IoT and IT devices within residences, but are not limited to residences; they can be deployed in any facility accessible to people.

[0083] [1.1 Overall Structure of the Anomaly Detection System]

[0084] Figure 1 This is an overall configuration diagram of the anomaly detection system 1 in this embodiment. Figure 1 This is a diagram representing the network structure of anomaly detection system 1.

[0085] like Figure 1 As shown, the anomaly detection system 1 includes an Internet 10, a home network 11, a home gateway 20, an air conditioner 30, a gas water heater 31, an electronic lock 32, lighting (lighting device) 33, a television 40, a recorder 41, a controller 50, a smartphone 60, a personal computer 61, an anomaly detection processing device 70, and an anomaly monitoring device 80.

[0086] Internet 10 is the usual Internet, Smartphone 60 is the usual Smartphone, and Personal Computer 61 is the usual Personal Computer.

[0087] Home gateway 20, air conditioner 30, gas water heater 31, electronic lock 32, lighting 33, television 40, recorder 41, controller 50, smartphone 60, personal computer 61 and anomaly detection and processing device 70 are connected through home network 11. When air conditioner 30, gas water heater 31, electronic lock 32, lighting 33, television 40, recorder 41, controller 50, smartphone 60, personal computer 61 and anomaly detection and processing device 70 communicate with Internet 10, they communicate through home gateway 20.

[0088] The home gateway 20 connects to an air conditioner 30, a gas water heater 31, an electronic lock 32, lighting 33, a television 40, a recorder 41, a controller 50, a smartphone 60, a personal computer 61, and an anomaly detection and processing device 70, and mediates communication between the connected devices and between the connected devices and the Internet 10.

[0089] In addition, the home gateway 20 manages information such as the IP addresses required for communication between the air conditioner 30, gas water heater 31, electronic lock 32, lighting 33, television 40, recorder 41, controller 50, smartphone 60, personal computer 61, and anomaly detection and processing device 70, and allocates IP addresses or notifies the device of information required for communication based on requests from each device.

[0090] In addition, the home gateway 20 monitors the communication between connected devices and the communication between the connected devices and the Internet 10, and forwards the communication content to the anomaly detection and processing device 70.

[0091] The communication content forwarded to the anomaly detection and processing device 70 can be either the communication packets received by the home gateway 20 itself, or the logs that have shaped the communication packets.

[0092] When the home gateway 20 forwards logs, it can either have its own log collection function or use other log collection devices.

[0093] Air conditioner 30, gas water heater 31, electronic lock 32, lighting 33, television 40, and recorder 41 are home IoT devices that receive and interpret device control commands to perform actions. Device control commands can be sent from the home network 11 or from a terminal (not shown) or server (not shown) on the Internet 10 via the home gateway 20.

[0094] In addition, each device connects to the Internet 10 via the home gateway 20 as needed to perform firmware updates, download content, etc. Furthermore, each device notifies other devices of its actions or information detected by its onboard sensors (sensor information).

[0095] For example, if it is an air conditioner 30, it will notify other devices of its operating status (power on / power off), energy saving setting (energy saving in progress / normal operation in progress), operating mode setting (automatic / cooling / heating / dehumidifying / humidifying / air supply, etc.), temperature setting, information from the built-in sensors (room temperature / humidity / outdoor temperature), and settings for air direction and air volume, etc.

[0096] If it is a gas water heater 31, it will notify other devices of its operating status (power on / power off), water heater combustion status, or hot water temperature setting, hot water heat preservation setting, automatic operation time setting, etc.

[0097] If it is an electronic lock 32, it will notify other devices of the settings such as the operation status (power on / power off), locking setting (locked / unlocked), door opening / closing status, alarm status (normal status / prying / door open / manual unlocking / tampering, etc.), and automatic locking mode setting (open / closed).

[0098] If it is lighting 33, then the operating status (power on / power off) and the setting value when dimming function is enabled will be notified to other devices.

[0099] If it is a television 40, it will notify other devices of its operating status (power on / power off), the CH (channel) number in the audio-visual system, or the volume setting. If it is a recorder 41, it will notify other devices of its operating status (power on / power off) and content transfer status (stopped / playing back / moving / paused (playing back) / paused (recording) / recording / no media, etc.).

[0100] There are no particular restrictions on the timing of these notifications; they can be sent periodically, when the status or value changes, or when there is a query from another device.

[0101] The controller 50 is used to control home IoT devices such as the air conditioner 30, gas water heater 31, electronic lock 32, and lighting 33. It controls these devices by sending control commands to them. The controller 50 may send control commands in response to user input or automatically based on pre-set conditions.

[0102] The smartphone 60 and personal computer 61 are IT devices connected to the Internet 10 via the home gateway 20. Alternatively, a server may be connected to the Internet 10, and the home gateway 20, smartphone 60, and personal computer 61 may communicate with the server via the Internet 10 to engage in conversations with IoT devices within the home on the home network 11.

[0103] When the anomaly detection and processing device 70 detects anomalies in communication between home IoT devices such as air conditioner 30, gas water heater 31, electronic lock 32, lighting 33, television 40, and recorder 41, and IT devices such as smartphone 60 and personal computer 61, it notifies the anomaly monitoring device 80 on the Internet 10 via the home gateway 20. Furthermore, the communication anomaly can be either an anomaly in communication volume or an anomaly in the number of communications. Additionally, the anomaly detection and processing device 70 can also be a server device managed by a SOC (Security Operation Center). Communication volume and number of communications may refer to the communication volume and number of communications within a specified period, but communication volume may also refer to the communication volume within a single communication session.

[0104] The anomaly monitoring device 80 collects communication logs, groups, etc., required for alarm analysis based on alarms notified by the anomaly detection and processing device 70 and performs unified management.

[0105] The anomaly monitoring device 80 uses collected logs, data groups, etc., to perform relevant analysis and determine anomalies such as signs or traces of security incidents. If an anomaly is determined, the anomaly monitoring device 80 notifies residents of the equipment malfunction.

[0106] Furthermore, the analysis performed by the anomaly monitoring device 80 is not limited to correlation analysis; other methods can also be used for analysis.

[0107] Apart from this, there are no particular limitations on the method for collecting communication logs used by the anomaly monitoring device 80 in its analysis. They can be obtained from the anomaly detection processing device 70, the home gateway 20, or other methods.

[0108] Furthermore, there are no particular limitations on the method by which the anomaly monitoring device 80 notifies the resident of any anomalies. Notifications can be sent to the resident's smartphone, sound an alarm installed in the home, or other methods may be used.

[0109] In addition, in this embodiment, the home gateway 20 and the anomaly detection processing device 70 are illustrated separately, but the function of the anomaly detection processing device 70 can also be incorporated into the home gateway 20.

[0110] In addition, the components of the anomaly detection system 1 include an air conditioner 30, a gas water heater 31, an electronic lock 32, a lighting 33, a television 40 and a recorder 41 as IoT devices in the home that receive device control commands, and a smartphone 60 and a personal computer 61 as IT devices connected to the Internet 10 via a home gateway 20. However, these devices are not required to be included; other devices may also be included, or only one type of device may be included.

[0111] Furthermore, IoT devices within the home can not only receive device control commands but also send device control commands to other devices, and can also perform communication beyond device control commands. Home IoT devices are an example of IoT devices configured within the facility.

[0112] Furthermore, while IT devices are connected to the Internet 10, they are not limited to this; they can also communicate with devices on the home network 11. Additionally, these devices can also communicate with terminals or servers on the Internet 10 via the Internet 10.

[0113] Alternatively, the home gateway 20 can also be equipped with devices capable of detecting people, such as a camera (not shown) and a human sensor (not shown). In other words, devices capable of detecting people, such as cameras and human sensors, can be installed inside the residence. Furthermore, the camera can be a camera mounted on the electronic lock 32, the smartphone 60, or the personal computer 61, and the human sensor can be a human sensor mounted on the air conditioner 30 or the lighting 33. Additionally, devices capable of detecting people can include carbon dioxide sensors, water usage sensors, etc.

[0114] In addition, a home gateway 20, air conditioner 30, gas water heater 31, electronic lock 32, lighting 33, television 40, recorder 41, controller 50, smartphone 60, and personal computer 61 are installed inside the residence. Anomaly detection and processing device 70 can be installed either inside or outside the residence.

[0115] Furthermore, one of the following devices—air conditioner 30, gas water heater 31, electronic lock 32, lighting 33, television 40, recorder 41, controller 50, smartphone 60, and personal computer 61—is an example of a first device installed in a residence (an example of an installation). The other device is an example of a second device, and the third device is an example of a third device. Additionally, at least one of the second and third devices can be a camera, human sensor, or other device capable of detecting people. The first device is the object to which the threshold calculation device calculates the threshold.

[0116] [1.2 Overall Structure of the Anomaly Detection and Processing Device 70]

[0117] Figure 2 This is a configuration diagram of the anomaly detection and processing device 70 of this embodiment. Figure 2 This is a block diagram illustrating the functional configuration of the anomaly detection and processing device 70.

[0118] like Figure 2 As shown, the anomaly detection and processing device 70 includes a communication unit 100, a device status acquisition unit 110, an in-room status determination unit 120, a communication log collection unit 130, a learning unit 140, an anomaly detection unit 150, a device status storage unit 200, an in-room status storage unit 210, a communication log storage unit 220, and a learning data storage unit 230.

[0119] In this embodiment, the threshold calculation unit is configured to include a communication unit 100, a device status acquisition unit 110 (an example of a first device status acquisition unit), an indoor status determination unit 120 (an example of a first indoor status determination unit), a communication log collection unit 130 (a first communication log collection unit), a learning unit 140, a device status storage unit 200, an indoor status storage unit 210, a communication log storage unit 220, and a learning data storage unit 230. Furthermore, in this embodiment, the anomaly detection device is configured to include the communication unit 100, the device status acquisition unit 110 (an example of a second device status acquisition unit), the indoor status determination unit 120 (an example of a second indoor status determination unit), the communication log collection unit 130 (a second communication log collection unit), and the anomaly detection unit 150. The anomaly detection processing device 70 has both a threshold calculation unit and an anomaly detection device. In this embodiment, the first device status acquisition unit and the second device status acquisition unit, the first room status determination unit and the second room status determination unit, and the first communication log collection unit and the second communication log collection unit are implemented as common components, but are not limited thereto.

[0120] The threshold calculation device calculates the threshold used in the anomaly detection device, which is connected to the home network 11 and detects abnormal communication of the first device in the residence where the home network 11 is installed. Furthermore, the anomaly detection device is connected to the home network 11 and detects abnormal communication of the first device in the residence where the home network 11 is installed.

[0121] The communication unit 100 receives communication packets from the Internet 10 or the home network 11. The communication unit 100 does not only conduct communications destined for the home gateway 20, but receives all communication packets flowing through the home gateway 20 on the home network 11.

[0122] Furthermore, the communication unit 100 sends a device status acquisition request sent from the device status acquisition unit 110 to the communication line connected to the home gateway 20, and sends a device status acquisition response received from the home gateway 20 via the communication line to the device status acquisition unit 110. Alternatively, the communication unit 100 sends device information and device status (device status) actively sent by devices connected to the home network 11 to the device status acquisition unit 110 via the home gateway 20.

[0123] The device status acquisition unit 110 sends a device status acquisition request via the communication unit 100 and receives a device status acquisition response, thereby acquiring information and status of devices connected to the home network 11 and registering it in the device status storage unit 200. Alternatively, the device status acquisition unit 110 acquires information and status of devices actively sent by devices connected to the home network 11 from the home gateway 20 via the communication unit 100 and registers it in the device status storage unit 200. The information registered by the device status acquisition unit 110 is also recorded as device status data (see [reference]). Figure 3 Additionally, registration refers to storage or updating.

[0124] The device information is information used to identify the device, such as at least one of the following: device identifier and device type.

[0125] The status of a device can also be inferred from factors such as the power it uses. Furthermore, the status of a device is not limited to its operational state (power on / power off); it can be the inherent status of each device or a combination of multiple device statuses. Additionally, the status of a device can include at least one of the power status and setpoint of a first device based on communication, wherein the communication includes device control commands that control multiple devices, including the first device.

[0126] The following examples illustrate the information included in the device status of each device, excluding the power status (power on / power off). The power status can also be referred to as the device's operating status.

[0127] For example, if it's an air conditioner (model 30), you can also register the set temperature, operating mode (cooling / heating, etc.). The set temperature is one example of a set value.

[0128] If it is a gas water heater 31, then the values ​​of the hot water setting temperature and the water heater usage status (gas or hot water usage, etc.) can also be registered. The hot water setting temperature is one example of a set value.

[0129] If it is an electronic lock 32, the unlocking / locking status can also be registered. If it is a lighting system 33, the dimming status can also be registered.

[0130] If it is a television set 40, the values ​​of the CH number, volume, etc., in the audio-visual process can also be registered. If it is a recorder 41, the status such as playback / recording can also be registered.

[0131] If it is a smartphone 60 or a personal computer 61, you can also register a user agent or the name of the application in use.

[0132] If it is a human detection sensor, it can also register whether a person was detected or not. If it is a temperature and humidity sensor (not shown), it can also register the temperature or humidity values ​​themselves.

[0133] If it is a window (not shown) or door opening / closing sensor (not shown), it can also register information such as the difference between open / closed, the degree of opening, and the locking status (unlocked / locked).

[0134] The device status storage unit 200 stores information about the status of devices connected to the home network 11 as device status data. The device status storage unit 200 is a storage device such as a semiconductor memory.

[0135] Figure 3 This is a diagram showing an example of the device status data in this embodiment. Figure 3 The device status data shown is generated by the device status acquisition unit 110.

[0136] like Figure 3 As shown, the device status data includes a device identifier and device type as information used to identify the device; it also includes device status as information indicating the current status of the device. The device type and device status are registered as a group.

[0137] When a device is first connected to home network 11, a new device identifier, device type, and device status are registered, and the device status is subsequently updated to the latest status as appropriate.

[0138] The device identifier can be either the MAC (Media Access Control) address obtained from the device or information other than the MAC address.

[0139] Among the device types, you can register the device name, model name, or OS (Operating System) name inferred from the terminal information obtained from the device, or you can register a combination of them.

[0140] The device status is recorded in the device status register, including the operating status (power on / power off) determined by the device status acquisition unit 110. Figure 3In this system, one device status is registered for each device type, but multiple device statuses can also be registered. These statuses can be listed separately for each device type, or the registration items can be changed for each device type. A device status includes one or more statuses for each of multiple devices, including the first device (e.g., power on, power off, and unlocked).

[0141] Back Figure 2 The presence status determination unit 120 determines the presence status of a person in the residence based on information obtained from devices connected to the home network 11. For example, the presence status determination unit 120 uses at least information obtained from a second device, which is a device other than the first device used to calculate a threshold for anomaly detection, to determine the presence status of a person in the residence. The presence status determination unit 120 can also determine the presence status of a person in the residence based on information obtained from at least one of the first and third devices. Furthermore, the presence status determination unit 120 can also obtain the current device status from the device status storage unit 200 and determine the presence status based on a combination of device statuses to create presence status data (see [reference]). Figure 4 The room status determination unit 120 registers the generated room status data with the room status storage unit 210. The room status data is a table that establishes a correspondence between the status of the device and the room status (e.g., in or out). The room status data is generated, for example, before the threshold calculation device actually calculates the threshold.

[0142] The indoor status determination unit 120 can also analyze the usage status of each device or the information of various sensors to determine the indoor status of a person in the residence, and then register the generated indoor status data with the indoor status storage unit 210.

[0143] When determining the presence of an object based on the usage status of each device, the presence status determination unit 120 infers the presence status based on the combination of the usage statuses of each device. For example, if the air conditioner 30 is in a powered-on state, the electronic lock 32 is in an unlocked state, and the television 40 is in a powered-on state, the presence status determination unit 120 determines that the object is indoors. The presence status determination unit 120 may also use a table that establishes a correspondence between the combination of the usage statuses of each device and the presence status, and infer the presence status based on the usage status of the devices.

[0144] When determining the presence of residents based on information from various sensors, the presence status determination unit 120 can make a determination based on information from human-sensing sensors installed in the residence, or based on information obtained by analyzing images or videos from cameras installed in the residence. Alternatively, all residents can carry transmitters such as RF tags, and receivers such as RF receivers installed in the residence can receive information from sensors mounted on the transmitters, indicating the transmitter's location, whether it is moving, and other relevant data. The presence status determination unit 120 then determines the presence status based on whether the transmitter is moving. Furthermore, all residents can carry receivers installed in the residence, and the presence status determination unit 120 determines the presence status by notifying the received signals to a controller 50 in the residence, such as a server or home gateway 20. Alternatively, the presence status can be determined based on information obtained by tracking the movement of residents using an indoor location tracking system. In addition, the indoor status determination unit 120 can estimate the number of users based on the actual value of the communication volume passing through the home gateway 20 and the past communication volume, or it can estimate the number of users based on the number of connections of the Wi-Fi (registered trademark) access point (Wi-FiAP), or it can make a determination based on other information.

[0145] In addition, the indoor status determination unit 120 determines the indoor status based on sensor information obtained from various home appliances (such as information from the refrigerator's opening and closing sensor, information from the window or door's opening and closing sensor, water usage in the kitchen or bathroom, room temperature, humidity, carbon dioxide concentration, chemical concentration or their changes, etc.), based on information that can determine whether a person is actually at home or information that can determine whether a person is moving.

[0146] The room status storage unit 210 stores information about the room status determined based on the status of the second device or a combination of the statuses of multiple devices including the second device as room status data. The room status storage unit 210 is a storage device such as a semiconductor memory.

[0147] Figure 4 This is a diagram showing an example of indoor status data in this embodiment. Figure 4 The room condition data shown is generated by the room condition determination unit 120.

[0148] like Figure 4 As shown, combinations of all device statuses from the device status data stored in the device status storage unit 200 are mapped to corresponding on-site statuses and registered in the on-site status data. The on-site status records the presence or absence of a dwelling (present / absent). That is, the on-site status includes the presence or absence of a person in the dwelling. The on-site status includes one or more statuses of a person in the dwelling (present or absent, etc.).

[0149] Furthermore, the status of being in a room is not limited to being in or out (in a room / outside). When a person is in a room, for example, the number of people in the room, the location of the resident, the attributes of the resident, etc. can be registered. Multiple statuses of being in a room can also be combined and registered.

[0150] For example, as data on the presence of people, one can register the number of people in the house, such as 1 person or 2 people in the house, or information about their location within the house, such as being only on the first floor, only on the second floor, only in the bedroom, only in the living room, or only in the kitchen. In other words, the presence of people can include at least one aspect: the number of people in the residence or their location. Furthermore, as data on the presence of people, one can also register attributes such as only children or only grandparents being present, or attributes such as the presence of guests or other non-residents. Location includes which room they are in, which floor they are on, etc.

[0151] In addition, the presence status can also include information about human activity. This activity information can include whether the person is awake or asleep, the amount of movement, etc. This activity information can be obtained from various sensors. Furthermore, even if a person is indoors but the home security company's monitoring system is on, the presence status determination unit 120 can determine that the person is asleep.

[0152] In addition, Figure 4 The status of the room is recorded in one column, but it can also be recorded in separate columns for each of the above items.

[0153] Figure 4 The content is an example, but the actual presence or absence can also be pre-registered as a combination of presence and absence. It can be automatically determined by learning from past actual values, and residents can also register their presence status when using the anomaly detection system 1.

[0154] Figure 4 The in-room status data shown is produced separately for each residence. For example, the in-room status data differs depending on the residence.

[0155] exist Figure 4 In the context of any situation where the equipment status or room condition is arbitrary, symbols such as "-" can also be used to indicate the condition.

[0156] Back Figure 2 The communication log collection unit 130 registers the communication packets received by the communication unit 100 as communication logs in the communication log storage unit 220. For example, the communication log collection unit 130 collects communication logs generated by communications sent and received through multiple devices, including the first device.

[0157] The communication log storage unit 220 stores information related to communication between devices connected to the home network 11 as communication data. The communication log storage unit 220 is a storage device such as a semiconductor memory.

[0158] Figure 5 This is a diagram illustrating an example of the communication log in this embodiment. Figure 5 The communication data shown was generated by the communication log collection unit 130.

[0159] like Figure 5 As shown, the communication log records the communication date and time, source identifier, destination identifier, communication protocol, communication volume, and online type contained in the communication packets. The communication log is time-series data for a certain period.

[0160] The communication date and time is recorded. Furthermore, the granularity of the time is not limited to seconds; it can be recorded in milliseconds or even microseconds.

[0161] The source identifier registers the MAC addresses of devices connected to home network 11. The source identifier may also use information other than MAC addresses as identifiers.

[0162] The destination identifier registers a Fully Qualified Domain Name (FQDN) or domain name as the destination identifier for devices connected to home network 11 to communicate. Alternatively, the destination identifier can be a MAC address or an IP address, or a combination of both.

[0163] The communication protocol is registered in the communication protocol. The communication log collection unit 130 can determine the communication protocol used in the communication based on the data portion of the communication packets, or it can infer it based on the destination port number.

[0164] For example, in ECHONET Lite, since the first two bytes of the communication data are set to 0x1081 or 0x1082, the communication log collection unit 130 determines that the communication protocol is ECHONET Lite when the first two bytes of the data part of the communication packet are 0x1081 or 0x182.

[0165] Furthermore, for example, in ECHONET Lite, since communication is conducted using port number 3610 of UDP (User Datagram Protocol), the communication log collection unit 130 determines that the communication protocol is ECHONET Lite when the destination port number of the received communication is 3610.

[0166] Furthermore, the communication log collection unit 130 can combine the above-mentioned determinations or make determinations based on other information.

[0167] In the traffic, the size of the communication packets is recorded.

[0168] In the online category, the online category (local communication / global communication) is registered. The communication log collection unit 130 determines "local communication" when the destination identifier indicates a device destination within the home network 11, and determines "global communication" when the destination identifier indicates a server (not shown) or site (not shown) on the Internet 10, and registers the determination result.

[0169] As mentioned above, the communication log contains category information indicating the online category determined by the destination identifier based on the communication log. The category information may also include more than one online category from the communication log.

[0170] Alternatively, the home gateway 20 or other devices (not shown) can be equipped with a communication log generation function to transfer communication logs to the communication log collection unit 130.

[0171] Back Figure 2 The learning unit 140 calculates thresholds (e.g., communication volume thresholds) for communication of multiple devices, including the first device, based on device status, in-room status, and communication logs. The learning unit 140 calculates thresholds corresponding to the device status and in-room status during a second period, which includes the time when the communication logs, which are the target of the anomaly detection device, are acquired. The learning unit 140 may also calculate thresholds separately for combinations of device status (e.g., more than one status) and in-room status (e.g., more than one status). Furthermore, the learning unit 140 may also calculate thresholds separately for combinations of more than one online type. That is, the learning unit 140 may calculate thresholds separately for combinations of device status (e.g., more than one status), in-room status (e.g., more than one status), and more than one online type.

[0172] The learning unit 140 generates learning data and threshold data based on the device status data obtained from the device status storage unit 200, the room status data obtained from the room status storage unit 210, and the communication log obtained from the communication log storage unit 220, and registers them in the learning data storage unit 230. The learning unit 140 is an example of a computing unit.

[0173] The learning data storage unit 230 stores communication content, including device status and room condition, as learning data. Furthermore, the learning data storage unit 230 stores thresholds calculated based on the learning data as threshold data. The learning data is measured data used to calculate the thresholds.

[0174] Figure 6 This is a diagram illustrating an example of the learning data used in this implementation method. Figure 6 The learning data shown was produced by Learning Department 140.

[0175] like Figure 6 As shown, the learning data includes the communication date and time, device identifier, device status, in-room status, communication volume, and online type.

[0176] The device identifier and device status are registered in the device status storage unit 200, which stores the device status data.

[0177] In the room status, the room status data stored by the room status storage unit 210 is recorded.

[0178] The communication date and time, online type, and communication volume are recorded in the communication data stored in the communication log storage unit 220.

[0179] like Figure 6 As shown, the learning unit 140 generates device status, in-room status, and communication logs (in... Figure 6 In the example, corresponding learning data was established for (communication volume and online types). This learning data is, for example, time-series data that arranges device status, in-room status, and communication logs in chronological order. Furthermore, the learning unit 140 calculates a threshold based on the learning data, as described later.

[0180] Learning Unit 140 can also generate separate outputs for multiple devices, including the first device. Figure 6 The learning data shown.

[0181] Figure 7 This is a diagram illustrating an example of the threshold data in this embodiment. Figure 7 The threshold data shown was generated by the learning unit 140.

[0182] like Figure 7 As shown, the threshold data includes the registered device identifier, device status, in-room status, online type, and threshold.

[0183] The device identifier and device status are registered in the device status storage unit 200, which stores the device status data.

[0184] In the room status, the room status data stored by the room status storage unit 210 is recorded.

[0185] The communication date and time, online type, and communication volume are recorded in the communication data stored in the communication log storage unit 220.

[0186] In the threshold calculation, the minimum and maximum values ​​of the packet size calculated by the learning unit 140 based on the communication volume stored by the communication log storage unit 220 are used as the threshold. The threshold is not limited to the minimum and maximum values ​​of the packet size. The average packet size, the number of accesses per time unit, or other information can be registered as the threshold, or a combination of these can be registered. Columns for threshold data can also be added based on the registered thresholds. The calculation of the thresholds will be described later.

[0187] Alternatively, the threshold can be a threshold for communication volume, including both the maximum and minimum communication volume. Alternatively, the threshold can be a threshold for the number of communications, including both the maximum and minimum number of communications. Furthermore, the threshold only needs to include at least one of the maximum and minimum values.

[0188] like Figure 7 As shown, the learning unit 140 generates threshold data that establishes corresponding thresholds for device status, in-room status, online type, and current communication volume. This threshold data, for example, establishes corresponding data for each combination of device status, in-room status, and online type. Furthermore, as described later, the anomaly detection unit 150 detects device anomalies based on the threshold data generated by the learning unit 140.

[0189] Learning Unit 140 can generate separate data for multiple devices, including Device 1. Figure 7 The threshold data shown.

[0190] Back Figure 2 The anomaly detection unit 150 compares the threshold data of the learning data storage unit 230 with the communication log of the communication log storage unit 220 to determine an anomaly. The anomaly detection unit 150 notifies the anomaly monitoring device 80 of the communication determined to be abnormal via the communication unit 100.

[0191] [1.3 Operation of the Anomaly Detection System]

[0192] The following is for reference Figures 8A-18 The operation of the above-mentioned anomaly detection system 1 will be explained. First, refer to... Figures 8A-17 The operation of the threshold calculation device (threshold calculation method) is explained. Figure 8A This is a flowchart illustrating the anomaly detection processing device 70 for the operation (threshold calculation processing) of the threshold calculation device. The threshold calculation processing is also referred to as the learning processing.

[0193] (S801a) The anomaly detection processing device 70 performs device status acquisition processing. In step S801a, the threshold calculation device of the anomaly detection processing device 70 acquires the device status of each of the multiple devices, including the first device, for a first period in order to determine a threshold. The first period is the period preceding the time when the communication log of the anomaly detection object in the anomaly detection device was acquired.

[0194] (S802a) The anomaly detection processing device 70 performs an in-room status determination process. In step S802a, the threshold calculation device of the anomaly detection processing device 70 performs an in-room status determination process based on the information obtained from the second device during the first period.

[0195] (S803a) The anomaly detection processing device 70 performs communication log collection processing. In step S803a, the threshold calculation device of the anomaly detection processing device 70 performs processing of the communication logs collected during the first period.

[0196] (S804) The anomaly detection processing device 70 performs learning processing. In step S804, the threshold calculation device of the anomaly detection processing device 70 performs processing to calculate the thresholds for communication of multiple devices, including the first device, in the second period following the first period.

[0197] Next, refer to Figure 8B The operation of the anomaly detection device is explained. Figure 8B This is a flowchart illustrating the actions (anomaly detection and processing) of the anomaly detection device.

[0198] (S801b) In step S801b, the anomaly detection device of the anomaly detection processing apparatus 70 performs a process to obtain the device status in a second period following a first period for each of the multiple devices, including the first device, in order to determine a communication anomaly. The second period is, for example, a period following the first period, but it may also be a period in which at least a portion of the period is included in the first period. The second period may be the moment when the communication log of the detected object was obtained (e.g., the current time), or it may be a period of 1 hour, 1 day, etc.

[0199] (S802b) The anomaly detection processing device 70 performs an on-site status determination process. In step S802b, the anomaly detection device of the anomaly detection processing device 70 performs an on-site status determination process for the second period based on information obtained from the second device.

[0200] (S803b) The anomaly detection processing device 70 performs communication log collection processing. In step S803b, the anomaly detection device of the anomaly detection processing device 70 performs the processing of collecting communication logs during the second period.

[0201] (S805) The anomaly detection processing device 70 performs anomaly detection processing. The anomaly detection device of the anomaly detection processing device 70 detects abnormal communication of multiple devices, including the first device, during the second period based on the threshold calculated by the threshold calculation device, the device status during the second period, the in-room status, and the communication log.

[0202] Furthermore, communication log collection and processing can be performed before device status acquisition and room condition determination. Additionally, learning processing and anomaly detection processing can also be performed in parallel.

[0203] The following is for reference Figures 9-18 The learning process and anomaly detection process are explained separately.

[0204] [1.3.1 Actions during equipment status acquisition processing]

[0205] Figure 9 This is a flowchart illustrating an example of the device status acquisition process (S801 (S801a, S801b)) of this embodiment. Figure 9 This indicates the processing of the device status acquisition unit 110.

[0206] (S1101) The device status acquisition unit 110 performs a status survey of the ECHONET Lite compatible devices connected to the home network 11 and updates the device status data.

[0207] (S1102) The device status acquisition unit 110 performs a status survey of the UPnP / DLNA compatible devices connected to the home network 11 and updates the device status data.

[0208] (S1103) The device status acquisition unit 110 performs a status survey of other devices connected to the home network 11 and updates the device status data.

[0209] (S1104) The device status acquisition unit 110 waits for a certain period of time and then returns to step S1101 to continue the processing after step S1101.

[0210] exist Figure 9 In this process, the device status acquisition unit 110 executes the processing steps S1101 to S1103 sequentially, but it may not be in that order. Figure 9The processing is performed in the order shown. Furthermore, the device status acquisition unit 110 can perform these processes in parallel. Additionally, the device status acquisition unit 110 does not necessarily perform all of steps S1101 to S1103 every time. The device status acquisition unit 110 only needs to perform at least one of steps S1101 to S1103 in the device status acquisition process. Furthermore, if the device actively sends status notifications periodically, the device status acquisition unit 110 can also perform processing at the time the notification is received (timed).

[0211] The following is for reference Figures 10-12 Steps S1101 to S1103 will be explained separately.

[0212] [1.3.1.1 Status Investigation and Processing of ECHONET Lite Compatible Devices]

[0213] Figure 10 This is a flowchart illustrating an example of the device status acquisition process in this embodiment. Specifically, Figure 10 This is a flowchart illustrating an example of the status investigation process (S1101) for the ECHONET Lite device.

[0214] (S11011) The device status acquisition unit 110 requests its own node instance list (0xD6) for the control commands of the corresponding ECHONET Lite device multicast to the home network 11 as a device retrieval request for the home network 11.

[0215] (S11012) The device status acquisition unit 110 determines whether there is a response to the request for its own node instance list (0xD6). If there is a response (if "yes" in S11012), the device status acquisition unit 110 performs the processing in step S11013. If there is no response (if "no" in S11012), the device status acquisition unit 110 performs the processing in step S11017.

[0216] (S11013) The device status acquisition unit 110 determines whether the responding device is registered in the device status data, for example, whether it is an unregistered device. Specifically, the device status acquisition unit 110 determines whether the connection terminal device identifier, such as the sending source MAC address contained in the response, is registered in the device status storage unit 200. If it is determined that the device is not registered (if "No" in S11013), the device status acquisition unit 110 performs the processing of step S11014. If it is determined that the device is registered (if "Yes" in S11013), the device status acquisition unit 110 performs step S11015.

[0217] (S11014) The device status acquisition unit 110 registers the connection terminal device identifier (sending source MAC address, etc.) and device type of the target device in the device status storage unit 200. The device type is determined based on the ECHONET (registered trademark) object code (EOJ). For example, if the class group code is 0x01 (air conditioner associated device class group) or the class code is 0x30 (household air conditioner class), the device type can be determined to be an air conditioner. In addition, the device status acquisition unit 110 can also determine the device type by parsing communication packets, or it can infer the device type based on the OUI (Organizationally Unique Identifier) ​​of the MAC address.

[0218] (S11015) The device status acquisition unit 110 sends an action status acquisition request for the target device using the control command corresponding to the ECHONET Lite device.

[0219] As control commands, there are requests to read the attribute value of the device's power operation status (EPC (ECHONET attribute): 0x80) (ESV (ECHONET Lite service): 0x62) or status requests inherent to the device type, and these requests can also be combined. When the device is a household air conditioner, the device status acquisition unit 110 sends a request to read the attribute value of the operating mode setting (EPC: 0xB0) (ESV: 0x62) as an operation status acquisition request; when the device is a water heater, it sends a request to read the attribute value of the hot water temperature setting (EPC: 0xD1) (ESV: 0x62) as an operation status acquisition request.

[0220] (S11016) The device status acquisition unit 110 receives the response result of the control command sent in step S11015, determines the device status based on the received response result, and registers the determined device status into the device status data.

[0221] The response to the request (ESV: 0x62) to read the attribute value of the device's power operation status (EPC: 0x80) is either power on (EDT (ECHONET attribute value data): 0x30) or power off (EDT: 0x31). The device status acquisition unit 110 registers "power on" or "power off" in the device status data. The device status acquisition unit 110 can register either the string "power on" or "power off" as the registration content, or it can register the attribute value "EDT: 0x30" or "EDT: 0x31" as the registration content.

[0222] Furthermore, in the case of a water heater, for example, assuming a request to read the attribute value of the device's power operation status (EPC: 0x80) is made, the response result is, for example, power on (EDT: 0x30). Similarly, for a request to read the attribute value of the hot water temperature setting (EPC: 0xD1), the response result is, for example, set temperature 48°C (EDT: 0x30). In this case, the device status acquisition unit 110 records both EPC and EDT together as the water heater's response result, such as "0x80 / 0x30" or "EPC: 0xD1 / 0x30".

[0223] (S11017) The device status acquisition unit 110 can also update the device status by setting the device status to "power off" for devices that are not responding among the devices already registered in the device status data, i.e., devices that were previously connected to the home network 11 but are not currently connected to the home network 11. Alternatively, the device status acquisition unit 110 can also update the device status by setting it to "not connected" instead of "power off".

[0224] [1.3.1.2 Status Investigation and Processing of UPnP / DLNA Compatible Devices]

[0225] Figure 11 This is a flowchart illustrating another example of the device status acquisition process in this embodiment. Specifically, Figure 11 This is a flowchart illustrating an example of the status investigation and processing (S1102) of a UPnP / DLNA-compatible device.

[0226] (S11021) The device status acquisition unit 110 multicasts the M-SEARCH request, which is a control command for the UPnP / DLNA corresponding device, to the home network 11 as a device retrieval request.

[0227] (S11022) The device status acquisition unit 110 determines whether there is a response to the M-SEARCH request. If there is a response (if "yes" in S11022), the device status acquisition unit 110 performs the processing in step S11023. If there is no response (if "no" in S11022), the device status acquisition unit 110 performs the processing in step S11027.

[0228] (S11023) The device status acquisition unit 110 determines whether the responding device is registered in the device status data, for example, whether it is an unregistered device. Specifically, the device status acquisition unit 110 determines whether the connection terminal device identifier, such as the sending source MAC address contained in the response, is registered in the device status storage unit 200. If it is not registered (if "No" in S11023), the device status acquisition unit 110 performs step S11024. If it is registered (if "Yes" in S11023), the device status acquisition unit 110 performs step S11026.

[0229] (S11024) The device status acquisition unit 110 sends a device type request (e.g., an HTTP GET request) to the target device.

[0230] (S11025) The device status acquisition unit 110 acquires the response result (DeviceDescription XML) for the device type request, and registers unregistered devices into the device status data based on the acquired response result. Specifically, the device status acquisition unit 110 infers the device type based on parameters such as "modelName", "modelNumber", and "modelDescription" contained in the response result, and registers the connection terminal device identifier (sending source MAC address, etc.) and device type contained in the response result into the device status data (device status storage unit 200). Furthermore, the above parameters are just one example; the device status acquisition unit 110 can also infer the device type based on other parameters. In addition, the device status acquisition unit 110 can also determine the device type by parsing communication packets, or it can infer it based on the OUI of the MAC address.

[0231] (S11026) For the target device, since there is a response, the device status acquisition unit 110 sets the device status to "power on" and registers it in the device status data. The device status can also be set based on the response result of the status request specific to the device type.

[0232] (S11027) For devices that are not responding among those already registered in the device status data, i.e., devices that were previously connected to the home network 11 but are not currently connected to the home network 11, the device status acquisition unit 110 sets the device status to "power off" and updates the device status. Alternatively, the device status acquisition unit 110 may set the device status to "not connected" instead of "power off" and update the device status.

[0233] [1.3.1.3 Status Investigation and Processing of Other Equipment]

[0234] Figure 12 This is a flowchart illustrating another example of the device status acquisition process in this embodiment. Figure 12 This is a flowchart illustrating an example of status investigation and processing (S1103) for devices other than ECHONET Lite compatible devices and UPnP / DLNA compatible devices (such as smartphones 60 and personal computers 61).

[0235] (S11031) The device status acquisition unit 110 broadcasts an ARP (Address Resolution Protocol) request to the home network 11 as a device retrieval request.

[0236] (S11032) The device status acquisition unit 110 determines whether there is a response to the ARP request. If there is a response (if "yes" in S11032), the device status acquisition unit 110 performs the processing in step S11033. If there is no response (if "no" in S11032), the device status acquisition unit 110 performs the processing in step S11036.

[0237] (S11033) The device status acquisition unit 110 determines whether the responding device is registered in the device status data, for example, whether it is an unregistered device. Specifically, the device status acquisition unit 110 determines whether the connection terminal device identifier, such as the sending source MAC address included in the response, is registered in the device status storage unit 200. If it is determined that the device is not registered (if "No" in S11033), the device status acquisition unit 110 performs step S11034. If it is determined that the device is registered (if "Yes" in S11033), the device status acquisition unit 110 performs step S11035.

[0238] (S11034) For the target device, the device status acquisition unit 110 newly registers the connection terminal device identifier (sending source MAC address, etc.) and device type into the device status data (device status storage unit 200). The device status acquisition unit 110 can determine the device type by parsing the communication packets used by the device, or it can infer it based on the OUI of the MAC address. For example, if the User-Agent contained in the communication packet is parsed, the OS name or OS version can be determined.

[0239] (S11035) The device status acquisition unit 110 registers the device status based on the response result of the target device. For the target device, the device status acquisition unit 110 may, for example, set the device status to "power on" and register it in the device status data. The device status acquisition unit 110 can set a device that returned a response to "power on," or it can set the application used by the device by parsing the communication packets used by the device. For example, if the device status acquisition unit 110 parses the User-Agent contained in the communication packets, it can determine the browser in use, etc.

[0240] (S11036) For devices that are not responding among those already registered in the device status data, i.e., devices that were previously connected to the home network 11 but are not currently connected to the home network 11, the device status acquisition unit 110 sets the device status to "power off" and updates the device status. Alternatively, the device status acquisition unit 110 may set the device status to "not connected" instead of "power off" and update the device status.

[0241] [1.3.2 Actions during in-room condition assessment and processing]

[0242] Figure 13 This is a flowchart illustrating an example of the in-room status determination process (S802 (S802a, S802b)) of this embodiment. Figure 13 This indicates the processing of the indoor condition assessment unit 120.

[0243] (S1201) The indoor status determination unit 120 obtains the current equipment status of all equipment in the equipment status data stored in the equipment status storage unit 200.

[0244] (S1202) The presence status determination unit 120 compares the status represented by the device status data stored in the device status storage unit 200 with the combination of device statuses registered in the presence status data stored in the presence status storage unit 210 to determine whether the person is in the room or not, that is, to determine whether there is someone in the residence. For example, the device status data stored in the device status storage unit 200 is... Figure 3 Under the indicated conditions (air conditioner 30 is "power on", electronic lock 32 is "unlocked", television 40 is "power off", smartphone 60 is "power on"), it is determined that the room status data stored in the room status storage unit 210 is used as a reference. Figure 4The combination of device statuses shown indicates an "occupancy" status. Furthermore, the occupancy status determination unit 120 can either infer and register the occupancy status data based on the combination of device statuses, or it can set whether the occupant is indoors or not. The occupancy status determination unit 120 is not limited to determining occupancy based on device status; it can also use various sensor information such as human presence sensors, or determine occupancy based on water / electricity / gas usage, or add online information in addition to device status to determine occupancy.

[0245] [1.3.3 Actions during communication log collection and processing]

[0246] Figure 14 This is a flowchart illustrating an example of the communication log collection and processing (S803 (S803a, S803b)) of this embodiment. Figure 14 This indicates the processing of the communication log collection unit 130.

[0247] (S1301) The communication log collection unit 130 receives the contents of communication packets flowing in the communication line connected to the home gateway 20 via the communication unit 100.

[0248] (S1302) The communication log collection unit 130 determines the destination of the received communication packet. If the destination identifier (FQDN or domain name, MAC address, IP address, etc.) of the received communication packet is a device destination within the home network 11, the communication log collection unit 130 performs step S1303. If the destination identifier is a server or site destination on the Internet 10, the communication log collection unit 130 performs step S1304.

[0249] (S1303) If the destination identifier is a device destination within the home network 11, the communication log collection unit 130 sets the online type of the received communication packet to "local communication".

[0250] (S1304) If the destination identifier is a server or site destination on the Internet 10, the communication log collection unit 130 sets the online type of the received communication packet to "global communication".

[0251] (S1305) The communication log collection unit 130 records the date and time of the communication, the source identifier (MAC address, IP address, etc.), the destination identifier, the communication protocol, the online type and the amount of communication as a communication log in the communication log storage unit 220 from the received communication packets.

[0252] [1.3.4 Actions during learning processing]

[0253] Figure 15 This is a flowchart illustrating an example of the learning process (S804) in this embodiment. Figure 15 This indicates the processing of the Learning Department 140. Figure 15 The process shown is implemented separately for multiple devices, including the first device.

[0254] (S1401) The data used in the calculation of the threshold by the learning unit 140 is the learning data.

[0255] (S1402) The learning unit 140 sets a threshold based on the learning data produced.

[0256] exist Figure 15 In this process, the learning unit 140 sequentially performs the processing steps S1401 and S1402, but these processes can also be performed in parallel.

[0257] The following is for reference Figure 16 and Figure 17 The processing of steps S1401 and S1402 will be explained separately.

[0258] [1.3.4.1 Detailed information on the creation and processing of learning data]

[0259] Figure 16 This is a flowchart illustrating an example of the learning data creation and processing (S1401) of this embodiment.

[0260] (S14011) The learning unit 140 obtains the communication log stored in the communication log storage unit 220. Specifically, the learning unit 140 obtains the sender identifier, traffic, and online type in the current communication from the communication log stored in the communication log storage unit 220. The learning unit 140 obtains the current communication log, but it can also obtain the communication log at a specified time, the communication log of a specific device, or obtain the communication log at a glance. If the learning unit 140 obtains the communication log at a glance, it repeatedly performs the processing steps S14012 to S14014.

[0261] (S14012) The learning unit 140 obtains the device status data stored in the device status storage unit 200. Specifically, the learning unit 140 obtains all device types and device statuses stored in the device status storage unit 200. The learning unit 140 can include date and time information in the device status data and obtain the device status by specifying a date and time.

[0262] (S14013) The learning unit 140 acquires the room status data stored in the room status storage unit 210. Specifically, the learning unit 140 acquires the room status from the room status data stored in the room status storage unit 210 based on the device status data acquired in step S14012. For example, if the device status data acquired in step S14012 is "power on" for the air conditioner, "unlocked" for the electronic lock, and "power off" for the television, the learning unit 140 can acquire "room status" as room status. Furthermore, the learning unit 140 can also include date and time information in the room status data and acquire the device status by specifying a date and time.

[0263] (S14014) The learning unit 140 establishes a correspondence between the source identifier, communication volume and online type obtained in step S14011, the device type and device status obtained in step S14012, and the on-site status obtained in step S14013, and registers this as learning data in the learning data storage unit 230. For example, when registering learning data from the communication log at the time "2020 / 11 / 4 16:45:00", the learning unit 140, in step S14011... Figure 5 The communication log stored in the communication log storage unit 220 shown obtains the sender identifier "11:11:11:11:11:11", the communication volume "15,000 bytes", and the online type "global communication" from the communication log. In step S14012, it retrieves... Figure 3 The device status data stored in the device status storage unit 200 shown obtains the device status "Power On" of the device (air conditioner) with device identifier "11:11:11:11:11:11". In step S14013, "Indoor" is obtained as the indoor status. As learning data, the communication date and time "2020 / 11 / 4 16:45:00", device identifier "11:11:11:11:11:11", device status "Power On", indoor status "Indoor", communication volume "15,000 bytes", and online type "Global Communication" are established and registered.

[0264] The registration time (timing) from the learning unit 140 to the learning data storage unit 230 can be the same as the time (timing) at which the communication log is saved to the communication log storage unit 220, or it can be registered at any time. In the case of registration at any time, the learning unit 140 needs to save the device status and on-site status of the communication log at the communication date and time.

[0265] Furthermore, when registering learning data, the learning unit 140 is not limited to using all the data obtained in steps S14011, S14012, and S14013 to generate learning data. For example, the learning unit 140 may also perform deviation value exclusion processing on at least one of the communication logs, device status data, and room status data. Any existing processing method can be used for deviation value exclusion, such as processing using the interquartile range (IQR).

[0266] [1.3.4.2 Details of Threshold Setting Processing]

[0267] Figure 17 This is a flowchart illustrating an example of the threshold setting process (S1402) of this embodiment.

[0268] (S14021) The learning unit 140 obtains the device status data stored in the device status storage unit 200. Specifically, the learning unit 140 obtains the device identifier (MAC address, etc.) and device type from the device status data stored in the device status storage unit 200. The learning unit 140 can obtain the device identifier and device type of a specific device, or it can obtain all devices registered in the device status data at a glance. In the case of obtaining the data at a glance, the learning unit 140 repeatedly performs the processing of steps S14022 to S14027 on a device-by-device basis.

[0269] (S14022) The learning unit 140 determines whether there is learning data for a matching device based on the learning data stored in the learning data storage unit 230. Specifically, the learning unit 140 uses the acquired device identifier (MAC address, etc.) to search for learning data for a matching device from the learning data stored in the learning data storage unit 230. If the learning data for the device is found (if "Yes" in S14022), the learning unit 140 proceeds to step S14023; if not found (if "No" in S14022), the learning unit 140 proceeds to step S14024.

[0270] (S14023) The learning unit 140 obtains the communication volume for each combination of device status / in-room status / online type contained in the learning data, and calculates a threshold for each combination. The learning unit 140 calculates a threshold corresponding to the number of combinations.

[0271] For example, the learning data stored in the learning data storage unit 230 is Figure 6In the case shown, when the "Device Status / In-Room Status / Online Type" of the device identifier "11:11:11:11:11:11" is "Power On / In-Room / Global Communication", the communication volume is obtained as "7500 bytes" and "15000 bytes". Here, when setting "Minimum / Maximum" as the threshold, "7500 / 15000 bytes" is set as the threshold. When more than three communication volumes are obtained when the "Device Status / In-Room Status / Online Type" of the device identifier "11:11:11:11:11:11" is "Power On / In-Room / Global Communication", the learning unit 140 sets the communication volume with the least communication volume among the three or more communication volumes as the minimum value of the threshold, and sets the communication volume with the most communication volume as the maximum value of the threshold. In addition, the learning unit 140 is not limited to calculating both the minimum and maximum values ​​as the threshold, and may calculate at least one of the minimum and maximum values ​​as the threshold. Furthermore, setting the minimum threshold value for the least amount of communication and the maximum threshold value for the most amount of communication is one example of threshold calculation. Additionally, the learning unit 140 can also determine the threshold by setting the minimum threshold value for the least amount of communication and the maximum threshold value for the most amount of communication.

[0272] Furthermore, the combination quantity of device status / in-room status / online type can be calculated by multiplying the number of device status patterns by the number of in-room status patterns by the number of online type patterns. For example, in the case of two patterns for device status "power on / power off", two patterns for in-room status "not present / in-room", and two patterns for online type "local communication / global communication", the combination is 2 (number of device status patterns) × 2 (number of in-room status patterns) × 2 (number of online type patterns) = 8 patterns. The threshold data for these 8 patterns are set as the threshold for this device.

[0273] Furthermore, when the presence of a person includes information on more than one activity, the learning unit 140 can calculate a threshold for each of those activities. Also, as described above, when the presence of a person includes both their presence and absence, the learning unit 140 can calculate a threshold for each of those activities. Additionally, when the presence of a person includes at least one of the number of people or their location within the residence, the learning unit 140 can calculate a threshold for each of those factors.

[0274] Additionally, in step S14023, the learning unit 140 can acquire communication data for each combination of device status / in-room status / online type, and perform a process to exclude deviation values ​​from the acquired communication data. The process of excluding deviation values ​​can use any existing process, such as a process using interquartile range (IQR).

[0275] (S14024) The learning unit 140 uses the acquired device type and determines, based on the threshold data stored in the learning data storage unit 230, whether there is already registered threshold data in the same device type. If it is determined that threshold data of the same device type exists (if "yes" in S14024), the learning unit 140 performs step S14025; if it is determined that threshold data of the same device type does not exist (if "no" in S14024), the learning unit 140 performs step S14026.

[0276] (S14025) The learning unit 140 sets the threshold data for the same type of equipment to the threshold data for that type of equipment. Specifically, for example, when a new air conditioner is purchased, the threshold data for the air conditioner that has already been set is used. Setting this threshold data does not necessarily need to be implemented; it can be selected whether to implement it depending on the type of equipment, and the method of setting the threshold can also be changed.

[0277] (S14026) The learning unit 140 sets an initial threshold as the threshold for the acquired device types. The initial threshold can be set to the maximum and minimum values ​​of all communication traffic, or it can be an initial threshold set by the device manufacturer. Furthermore, if "No" is selected in step S14024, the learning unit 140 may not set a threshold. Additionally, the anomaly detection device may set a learning period during which compatible devices are excluded from the anomaly detection list.

[0278] (S14027) The learning unit 140 registers the generated threshold data to the learning data storage unit 230.

[0279] As described above, the learning unit 140 calculates a threshold for detecting anomalies in the communication log (i.e., communication) based on actual data of past communication volumes that are the same as those in the room state when the communication log, the object of detection by the anomaly determination device, is acquired (i.e., communication has occurred).

[0280] [1.3.5 Anomaly Detection and Handling Actions]

[0281] Figure 18 This is a flowchart illustrating an example of the anomaly detection processing (S805) of this embodiment. Figure 18This indicates the operation of the anomaly detection unit 150 (anomaly detection method).

[0282] (S1501) The anomaly detection unit 150 obtains the communication log of the target being detected from the communication log stored in the communication log storage unit 220. For example, the anomaly detection unit 150 obtains the sender identifier (MAC address, etc.), traffic volume, and online type in the current communication from the communication log stored in the communication log storage unit 220. The target being detected is an anomaly, which is an example of the second period.

[0283] (S1502) The anomaly detection unit 150 obtains device status data that includes at least the device status of the second device. In addition, the anomaly detection unit 150 may also use a source identifier (MAC address, etc.) to obtain the current device status of the target device from the device status data stored in the device status storage unit 200.

[0284] (S1503) The anomaly detection unit 150 obtains the room status data. For example, the anomaly detection unit 150 obtains the current room status from the room status data stored in the room status storage unit 210.

[0285] (S1504) The anomaly detection unit 150 acquires threshold data. Based on the device status acquired in step S1502 and the room condition acquired in step S1503, the anomaly detection unit 150 selects a threshold corresponding to the device status and the room condition from the threshold data, thereby acquiring a threshold. For example, the anomaly detection unit 150 uses the source identifier, online type, device status, and room condition as keys to acquire a suitable threshold from the threshold data stored in the learning data storage unit 230. For example, if using… Figure 7 If the threshold data is such that the device identifier of the device in the current communication is "11:11:11:11:11", the device status is "power on", the online type is "local communication", and the current indoor status is "not in", the anomaly detection unit 150 obtains "0 / 1234" as the threshold (minimum / maximum value).

[0286] In this way, the anomaly detection unit 150 selects a threshold corresponding to the current (an example of the second period) device status and on-site status from the respective thresholds of the combination of device status / in-room status / online type calculated for the learning unit 140 (threshold calculation device), and detects the abnormal communication of the current first device based on the selected threshold and the current communication log (e.g., communication volume).

[0287] (S1505) The anomaly detection unit 150 determines whether the communication volume is within a threshold. Specifically, the anomaly detection unit 150 determines whether the acquired communication volume is contained between the minimum and maximum values ​​of the threshold. If it is determined that the acquired communication volume is contained between the minimum and maximum values ​​of the threshold (if "Yes" in S1505), the anomaly detection unit 150 ends the anomaly detection process. If it is determined that the acquired communication volume is not contained between the minimum and maximum values ​​of the threshold (if the acquired communication volume exceeds the threshold) (if "No" in S1505), the anomaly detection unit 150 implements step S1506. For example, in step S1505, the anomaly detection unit 150 determines whether the acquired communication volume is within the range of the minimum value 0 to the maximum value 1234.

[0288] (S1506) The anomaly detection unit 150 determines that the communication is abnormal and notifies the anomaly monitoring device 80 on the Internet 10 via the home gateway 20. The anomaly detection unit 150 compares the selected threshold with the communication log. If the communication log does not meet the threshold, it determines that the communication is abnormal and outputs the determination result to the anomaly monitoring device 80.

[0289] The anomaly detection unit 150 can also perform separate detection on multiple devices, including the first device. Figure 18 The anomaly detection and handling are shown.

[0290] [1.4 Effects of the Implementation Method]

[0291] In this embodiment, the status of each device is inferred based on the communication logs received by the home gateway 20, and the status of the people in the residence is inferred based on the information from each device. An anomaly detection threshold corresponding to the status of the devices and the status of the people is set (selected). This can reduce the missed detection of abnormal actions of devices when they are not present, which could not be detected in the past, or the false detection when the number of people in the house increases compared to the usual number of visitors.

[0292] [2. Other variations]

[0293] This disclosure is not limited to the embodiments described above. For example, the following variations are also included in this disclosure.

[0294] (1) In the above embodiments, the anomaly detection system targets a home network, but this is one form of the anomaly detection system disclosed herein, and is not limited to home networks. For example, any system that connects multiple devices to a network such as a building network, factory network, or vehicle network, and can obtain the status and on-site status of the devices through the network, can be used as the target, and other network domains can also be used. Home networks, building networks, factory networks, and vehicle networks are examples of facility-internal networks. Furthermore, in the above embodiments, the example of a person being a resident is described, but it is not limited to this, and can also be the user of the facility where the device to be detected by the anomaly detection system is installed.

[0295] (2) In the above embodiment, it is assumed that the anomaly detection system is configured to connect each device including the anomaly detection processing device 70 to the home gateway 20. However, the home gateway 20 may also have the function of the anomaly detection processing device 70, or a relay device such as a hub may be set between the home gateway 20 and the device.

[0296] (3) In the above embodiments, the connection to the home network 11 can be made by wired communication such as Ethernet (registered trademark), wireless communication such as Wi-Fi (registered trademark) and Bluetooth (registered trademark), or a combination thereof.

[0297] (4) In the above embodiment, it is assumed that the anomaly detection unit 150 of the anomaly detection system notifies the anomaly monitoring device 80 when an anomaly is detected, but the destination of the notification is not limited to this. For example, it may also notify the device that is determined to be abnormal, or it may notify other devices connected to the home network 11.

[0298] (5) Specifically, each device in the above-described embodiments is a computer system composed of a microprocessor, ROM, RAM, hard disk unit, display unit, keyboard, mouse, etc. A computer program is recorded in the RAM or hard disk unit. The microprocessor operates according to the computer program, thereby enabling each device to perform its function. Here, the computer program is composed of multiple command codes that combine instructions for the computer to achieve a specified function.

[0299] (6) In each of the above-described embodiments, some or all of its constituent elements may be constituted by a single system LSI (Large Scale Integration). A system LSI is a multifunctional LSI manufactured by integrating multiple components onto a single chip; specifically, it is a computer system comprising a microprocessor, ROM, RAM, etc. The computer program is recorded in the RAM. The system LSI performs its functions by operating according to the computer program through the microprocessor.

[0300] (7) Some or all of the constituent elements of the above-described devices may also be composed of IC cards or individual modules that are detachable from each device. An IC card or module is a computer system composed of a microprocessor, ROM, RAM, etc. An IC card or module may also include the aforementioned multi-functional LSI. The IC card or module performs its functions by operating according to a computer program via a microprocessor. The IC card or module may also be tamper-resistant.

[0301] (8) This disclosure may also be the method shown above. In addition, it may be a computer program that implements these methods by a computer, or a digital signal composed of the computer program.

[0302] (9) Furthermore, this disclosure may also involve recording the aforementioned computer program or digital signal onto a recording medium readable by a computer, such as a floppy disk, hard disk, CD-ROM, MO, DVD, DVD-ROM, DVD RAM, BD (Blu-ray Disc), semiconductor memory, etc. Alternatively, the aforementioned digital signal may be recorded on these recording media.

[0303] (10) In addition, this disclosure may also be in the form of transmitting the above-mentioned computer program or the above-mentioned digital signal via electrical communication lines, wireless or wired communication lines, networks represented by the Internet, data broadcasting, etc.

[0304] (11) In addition, this disclosure may also be a computer system having a microprocessor and a memory containing the above-described computer program, and the microprocessor operating according to the computer program.

[0305] (12) Alternatively, the above-mentioned program or digital signal may be recorded in a recording medium and transferred, or the program or digital signal may be transferred via the network, etc., so that it can be implemented by an independent computer system.

[0306] (13) In addition, the division of functional blocks in the block diagram is an example. Multiple functional blocks can be implemented as one functional block, or one functional block can be divided into multiple functional blocks, or a part of the function can be transferred to other functional blocks. Furthermore, the functions of multiple functional blocks with similar functions can be processed in parallel or time-division by a single hardware or software.

[0307] (14) Furthermore, the order of the multiple processes described in the above embodiments is just one example. The order of the multiple processes can be changed, and the multiple processes can be implemented in parallel. In addition, it is also possible not to implement a portion of the multiple processes.

[0308] (15) Furthermore, the anomaly detection processing apparatus described in the above embodiments can be implemented as a single device or by multiple devices. When the anomaly detection processing apparatus is implemented by multiple devices, the various components of the anomaly detection processing apparatus can be distributed among the multiple devices in any way. When the anomaly detection processing apparatus is implemented by multiple devices, the communication method between the multiple devices is not particularly limited; it can be wireless communication or wired communication. Furthermore, wireless communication and wired communication can be combined between the devices. In the anomaly detection processing apparatus, for example, a threshold calculation device and an anomaly detection device can be implemented by different devices.

[0309] (16) Furthermore, when the threshold calculation device and the anomaly detection device are implemented by different devices, the threshold calculation device can... Figure 7 The threshold data shown is sent to the anomaly detection device. Alternatively, the device status and in-room status can be obtained when the anomaly detection device obtains the communication volume of the detected object. The threshold corresponding to the obtained device status and in-room status can be selected from the threshold data, and only the selected threshold can be sent to the anomaly detection device.

[0310] (17) Furthermore, an example was described where the threshold calculation device calculates the threshold for at least the combination of device status and room condition, but it is not limited thereto. The threshold calculation device may also obtain the device status and room condition when the anomaly detection device communicates with the detection object, calculate the threshold for the obtained device status and room condition based on the learning data, and send the calculated threshold to the anomaly detection device. That is, generating threshold data is not a necessary process.

[0311] (18) In addition, this disclosure also includes forms obtained by applying various modifications to the implementation methods as conceived by those skilled in the art, or forms achieved by arbitrarily combining the constituent elements and functions of each implementation method without departing from the spirit of this disclosure.

[0312] Industrial applicability

[0313] This disclosure can detect abnormal communication with various devices within a home based on the operational status of the devices and the occupant's presence at home. Furthermore, outside the home, it can also detect abnormal communication with devices connected to a local network via routers or other devices in buildings, shops, factories, vehicles, etc., that are connected to the Internet.

[0314] Label Explanation

[0315] 1. Anomaly Detection System; 10. Internet; 11. Home Network (In-Facility Network); 20. Home Gateway; 30. Air Conditioner; 31. Gas Water Heater; 32. Electronic Lock; 33. Lighting; 40. Television; 41. Recorder; 50. Controller; 60. Smartphone; 61. Personal Computer; 70. Anomaly Detection and Processing Device; 80. Anomaly Monitoring Device; 100. Communication Unit; 110. Equipment Status Acquisition Unit; 120. On-site Status Determination Unit; 130. Communication Log Collection Unit; 140. Learning Unit (Computing Unit); 150. Anomaly Detection Unit; 200. Equipment Status Storage Unit; 210. On-site Status Storage Unit; 220. Communication Log Storage Unit; 230. Learning Data Storage Unit.

Claims

1. A threshold value calculation apparatus that calculates a threshold value used in an abnormality detection apparatus connected to an in-facility network, the abnormality detection apparatus detecting an abnormal communication of a first device in a facility provided with the in-facility network, the threshold value calculation apparatus characterized by comprising: a second device different from the first device provided in the facility; a first device state acquisition section that acquires a device state of the first device for a first period; a first in-room situation determination section that determines an in-room situation of a person in the facility during the first period based on information acquired from the second device; a first communication log collection section that collects a communication log generated based on a communication transmitted and received by the first device during the first period; and a calculation section that calculates a threshold value for a communication of the first device in a second period subsequent to the first period based on the device state, the in-room situation, and the communication log, wherein the device state includes one or more states of the first device, the in-room situation includes one or more situations of the person, and the calculation section calculates the threshold value for each combination of the one or more states and the one or more situations.

2. The threshold value calculation apparatus according to claim 1, wherein the first device state acquisition section acquires at least one of a power state and a setting value of the first device based on a communication including a device control command that controls the first device, as the device state.

3. The threshold value calculation apparatus according to claim 1 or 2, wherein the first in-room situation determination section determines the in-room situation based on information acquired from the first device or a third device other than the first device and the second device.

4. The threshold value calculation apparatus according to claim 1 or 2, wherein the communication log includes category information indicating an online category determined based on a destination identifier of the communication log, the category information includes one or more online categories in the communication log, and the calculation section calculates the threshold value for each combination of the one or more online categories.

5. The threshold value calculation apparatus according to claim 1 or 2, wherein the calculation section generates learning data in which the device state, the in-room situation, and the communication log are associated with each other, and calculates the threshold value based on the learning data.

6. The threshold value calculation apparatus according to claim 1 or 2, wherein the in-room situation includes presence or absence of the person in the facility, and the calculation section calculates the threshold value for each of the presence and the absence of the person.

7. The threshold value calculation apparatus according to claim 1 or 2, wherein the in-room situation includes at least one of a number of persons and a position of the person in the facility, and the calculation section calculates the threshold value for each of the at least one.

8. The threshold value calculation apparatus according to claim 1 or 2, wherein the in-room situation includes one or more activity information of the person during the first period, and the calculation section calculates the threshold value based on the one or more activity information. ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ 9. The threshold value calculation device according to claim 1 or 2, wherein the threshold value is a threshold value for a communication volume of the first device, the threshold value including a maximum value and a minimum value of the communication volume.

10. An abnormality detection device connected to an in-facility network, the abnormality detection device detecting an abnormal communication of a first device in a facility provided with the in-facility network, the abnormality detection device comprising: a second device different from the first device provided in the facility; a second device state acquisition section that acquires a device state of the first device in a second period after a first period; a first in-room condition determination section that determines an in-room condition of a person in the facility in the second period based on information acquired from the second device; a second communication log collection section that collects a communication log generated based on a communication transmitted and received by the first device in the second period; and an abnormality detection section that selects a threshold value corresponding to the device state and the in-room condition in the second period from among threshold values calculated by the threshold value calculation device according to any one of claims 1 to 9 for combinations of one or more states and one or more conditions of the first device, and detects the abnormal communication of the first device in the second period based on the selected threshold value and the communication log in the second period.

11. The abnormality detection device according to claim 10, wherein the abnormality detection section compares the selected threshold value with the communication log, determines that an abnormality exists when the communication log does not satisfy the threshold value, and outputs a determination result.

12. A threshold value calculation method of calculating a threshold value used in an abnormality detection device connected to an in-facility network, the abnormality detection device detecting an abnormal communication of a first device in a facility provided with the in-facility network, the threshold value calculation method comprising: a second device different from the first device provided in the facility; acquiring a device state of the first device in a first period; determining an in-room condition of a person in the facility in the first period based on information acquired from the second device; collecting a communication log generated based on a communication transmitted and received by the first device in the first period; and calculating a threshold value for a communication of the first device in a second period after the first period based on the device state, the in-room condition, and the communication log, the device state including one or more states of the first device, the in-room condition including one or more conditions of the person, and the threshold value being calculated for combinations of the one or more states and the one or more conditions.

13. An abnormality detection method of detecting an abnormal communication of a first device connected to an in-facility network and provided in a facility with the in-facility network, the abnormality detection method comprising: a second device different from the first device provided in the facility; acquiring a device state of the first device in a second period after a first period; ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ ​ determining the in-house state of the person in the facility during the second period based on the information acquired from the second device, collecting a communication log generated based on the communication transmitted and received by the first device during the second period; selecting a threshold value corresponding to the device state and the in-house state during the second period from among the threshold values calculated by the threshold value calculation method of claim 12 for each combination of the one or more states and the one or more conditions of the first device, and detecting the abnormal communication of the first device during the second period based on the selected threshold value and the communication log during the second period.

Images