Accident event cause specifying system and accident event cause specifying method

Abstract

The invention provides an accident cause specifying system and an accident cause specifying method. The accident cause specifying system and the accident cause specifying method can efficiently perform cause specifying aiming at an accident. An accident cause specifying system is provided with: a device log information holding unit that holds log information of a target device; a causal relationship graph holding unit that holds a causal relationship graph in which the relationship between the accident event and the cause thereof is associated; an accident detection processing unit that detects an accident in the target device; a necessary log information determination processing unit that extracts a causal relationship graph of the corresponding category for the accident event detected by the accident detection processing unit, and determines device log information necessary for specifying a cause on the basis of the extracted causal relationship graph; a necessary log information collection processing unit that collects the device log information determined by the necessary log information determination processing unit; and a cause analysis processing unit that identifies the cause of the accident event using the device log information collected by the necessary log information collection processing unit and the cause-and-effect relationship graph.

Description

Technical Field

[0001] The invention relates to an accident event cause determination system and an accident event cause determination method. Background Art

[0002] In recent years, cyber attacks on various control systems have occurred frequently. When certain accidents are detected in the control system, it is important to correctly determine whether the accident is caused by the cyber attack or a failure of the system itself.

[0003] That is, when an accident is detected, the SOC (Security Operation Center) that monitors accidents in the control system determines whether the detected accident is caused by a network failure or a mechanical failure, and needs to escalate it to the appropriate department and take appropriate measures. In particular, in order to prevent the damage and impact caused by cyber attacks from expanding, it is important to correctly determine the cause of the accident at the beginning.

[0004] Patent document 1 describes the following technology: by classifying a group of alarms that occur when an industrial control system is assumed to be attacked by a cyber attack according to a sequence along the time phases of the cyber attack and a sequence along the spatial phases of the assets attacked by the cyber attack, one or more attack patterns of the obtained types are stored, and based on the consistency between the group of alarms and the attack patterns, the presence or absence of a cyber attack on the industrial control system is diagnosed.

[0005] Patent Document 1: Japanese Patent Application Publication No. 2022-86181 Summary of the invention

[0006] According to the technology described in Patent Document 1, by pre-defining the chain relationship of alarms as an attack mode and a failure mode, it is possible to determine whether it is an attack alarm or a failure alarm.

[0007] However, in real systems, among the information that can be output by devices related to the system, the information that can be monitored by alarm monitoring is often small. That is, in real systems, there are not only systems with many types of alarms, but also systems without enough types of alarms to create chain relationships in advance.

[0008] In addition, the logs of unmonitored devices cannot be used for analysis, and the use of these logs for analysis depends on the knowledge of the analyst.

[0009] In view of this, an object of the present invention is to provide an accident cause determination system and an accident cause determination method capable of efficiently determining the cause of an accident.

[0010] In order to solve the above-mentioned problems, for example, the configuration described in the scope of claims is adopted.

[0011] The present application includes multiple means for solving the above-mentioned problems. If one example is cited, as a system for determining the cause of an accident event, it includes: a device log information holding unit, which holds log information output by the device that becomes the object; a cause-effect graph holding unit, which pre-holds a cause-effect graph that associates the relationship between the accident event and its cause; an accident detection processing unit, which detects the accident event in the device that becomes the object; a necessary log information determination processing unit, which extracts the cause-effect graph of the corresponding category for the accident event detected by the accident detection processing unit, and determines the device log information required for determining the cause based on the extracted cause-effect graph; a necessary log information collection processing unit, which collects the device log information determined by the necessary log information determination processing unit; a cause analysis processing unit, which uses the device log information and the cause-effect graph collected by the necessary log information collection processing unit to analyze the cause of the accident event; and an output unit, which outputs the cause of the accident event determined by the cause analysis processing unit.

[0012] According to the present invention, only the information required for the alarm can be extracted from the log information available in the device to identify the cause. This shortens the time for detailed information checking, optimizes the storage capacity of information, and enables efficient identification of the cause of the accident.

[0013] The other problems, structures, and effects than those described above will become clear from the following description of the embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a diagram showing an example of the overall configuration of an accident cause identification system according to an embodiment of the present invention.

[0015] Figure 2 This is a block diagram showing a configuration example of a cause analysis device according to an embodiment of the present invention.

[0016] Figure 3 This is a flowchart showing an overall processing example of the cause analysis device according to one embodiment of the present invention.

[0017] Figure 4 This is a flowchart showing an example of cause analysis processing according to one embodiment of the present invention.

[0018] Figure 5 This is a flowchart showing an example of a cause possibility score calculation process according to an embodiment of the present invention.

[0019] Figure 6 This is a diagram showing a cause-and-effect relationship graph (an example of attack causes) according to an embodiment of the present invention.

[0020] Figure 7This is a diagram showing a cause-and-effect relationship graph (an example of a cause of a failure) according to an embodiment of the present invention.

[0021] Figure 8 This is a diagram showing an example of a log information table according to an embodiment of the present invention.

[0022] Fig. 9 This is a diagram showing an example of a cause-effect relationship graph information table according to an embodiment of the present invention.

[0023] Fig.10 This is a diagram showing an example of a cause-effect relationship graph setting screen according to an embodiment of the present invention.

[0024] Fig.11 It is a diagram showing an example of a cause analysis result presentation screen according to an embodiment of the present invention.

[0025] Explanation of symbols

[0026] 1…cause analysis device, 2a~2n…device (object device), 20…processing unit, 21…cause-effect graph generation processing unit, 22…accident detection processing unit, 23…necessary log information determination processing unit, 24…necessary log information collection processing unit, 25…cause analysis processing unit, 30…storage unit, 31…cause-effect graph holding unit, 32…device log information holding unit, 40…input / output unit, 50…communication unit. DETAILED DESCRIPTION

[0027] Hereinafter, an accident cause identification system and an accident cause identification method according to an embodiment example (hereinafter referred to as “this example”) of the present invention will be described with reference to the drawings.

[0028] [Overall structure of the accident cause determination system]

[0029] Figure 1 An example of the overall structure of the accident cause determination system of this example is shown.

[0030] The accident cause identification system of this example is configured by connecting one or more target devices (A device 2a, B device 2b, ..., N device 2n: N is an arbitrary integer) to a cause analysis device 1 via a network.

[0031] The cause analysis device 1 detects the occurrence of an accident in each of the devices 2a to 2n, collects device log information, and analyzes the cause.

[0032] [Structure of cause analysis device]

[0033] Figure 2 A configuration example of the cause analysis device 1 is shown.

[0034] The cause analysis device 1 includes a processing unit 20 , a storage unit 30 , an input / output unit 40 , and a communication unit 50 .

[0035] The processing unit 20 includes a cause-effect relationship graph generation processing unit 21, an accident detection processing unit 22, a necessary log information determination processing unit 23, a necessary log information collection processing unit 24, and a cause analysis processing unit 25. Each of these processing units 21 to 25 is configured on a working memory (not shown) provided in the processing unit 20, for example, by the processing unit 20 executing a program stored in the processing unit 20 or the storage unit 30, that is, a program that implements the accident event cause determination method. The processing unit 20 is configured by, for example, a computing device (computer) including a CPU (Central Processing Unit) and the like.

[0036] The cause-effect relationship graph generation processing unit 21 generates a cause-effect relationship graph related to the accident, which is information that associates the relationship between the accident event and its cause. A specific example of the cause-effect relationship graph will be described later. The cause-effect relationship graph is generated by classifying the phenomena representing attacks and failures, namely, detection nodes and cause nodes, into a plurality of categories. The categories here include, for example, the possibility of failure related to commands, the possibility of failure related to device status grasp, and the like.

[0037] The cause-effect relationship graph can be created in advance by an analyst or a person in charge of the SOC monitoring the accident inputting from an input terminal, or can be automatically created by reading in publicly known information summarizing the causes of the accident.

[0038] In addition, each cause node and its judgment condition of the created cause-effect relationship diagram is basically a parameter adjustment part, which can be changed at any time by the person in charge of the SOC. For example, the person in charge of the SOC can add or modify the detection node and cause node when a new threat is discovered.

[0039] The cause-effect relationship graph generated by the cause-effect relationship graph generation processing unit 21 is stored in the cause-effect relationship graph storage unit 31 of the storage unit 30 .

[0040] The accident detection processing unit 22 detects the occurrence of an accident in the target device (A device 2a, B device 2b, ..., N device 2n) and sends the information of the detected accident to the necessary log information determination processing unit 23.

[0041] The necessary log information determination processing unit 23 acquires a cause-effect relationship graph corresponding to the type of the detected accident, and determines the device logs necessary for analysis.

[0042] The necessary log information collection processing unit 24 collects device logs necessary for accident analysis from target devices (A device 2a, B device 2b, . . . , N device 2n).

[0043] The cause analysis processing unit 25 executes cause analysis processing using the cause-effect relationship graph and device log information.

[0044] The storage unit 30 includes a cause-effect relationship graph storage unit 31 and a device log information storage unit 32 .

[0045] The cause-effect relationship graph storage unit 31 performs a cause-effect relationship graph storage process of storing the cause-effect relationship graph generated by the cause-effect relationship graph generation processing unit 21 as a cause-effect relationship table. The cause-effect relationship graph is generated in advance and stored by the cause-effect relationship graph storage unit 31. An example of a cause-effect relationship table is shown in FIG. Fig. 9 To be described later.

[0046] The device log information storage unit 32 performs a device log information storage process of classifying the log information of each target device by category and storing it in a log information table. For example, the device log information storage unit 32 includes an AA log storage unit 33 storing the AA log of the A device 2a and an AB log storage unit 34 storing the AB log of the A device 2a.

[0047] In addition, the device log information storage unit 32 includes a BA log storage unit 35 for storing the BA log of the B device 2b and a BB log storage unit 36 ​​for storing the BB log of the B device 2b. The device log information storage unit 32 collects and stores the device log information in sequence. An example of a log information table is shown in Figure 8 To be described later.

[0048] The input / output unit 40 performs output processing of the analysis result in the cause analysis processing unit 25. The output processing performed by the input / output unit 40 includes, for example, processing of displaying the analysis result on a display. In addition, the input / output unit 40 performs input processing of information required for analysis and the like.

[0049] The communication unit 50 performs communication between the cause analysis device 1 and the target device (A device 2a, B device 2b, ..., N device 2n) and performs processing for transmitting the analysis result to other devices.

[0050] [Overall Processing Example of Cause Analysis Device]

[0051] Figure 3 It is a flowchart showing the flow of processing performed by each unit of the cause analysis device 1 .

[0052] First, the accident detection processing unit 22 performs a detection process on the occurrence of an accident in the target device, and transmits information on the detected accident to the necessary log information determination processing unit 23 (step S101 ).

[0053] The necessary log information determination processing unit 23 that has received the accident information acquires the cause-effect relationship graph corresponding to the type of the detected accident from the cause-effect relationship graph storage unit 31 (step S102 ).

[0054] Then, the necessary log information determination processing unit 23 determines the device log required for cause analysis based on the accident information (step S103). After the determination, the necessary log information collection processing unit 24 collects the necessary device log information from the device log information storage unit 32 (step S104). This collection process is called necessary log information collection processing.

[0055] Then, the necessary log information determination processing unit 23 sends the acquired cause-effect relationship graph and the collected necessary device log information to the cause analysis processing unit 25 (step S105 ).

[0056] The cause analysis processing unit 25 that has received these information thus performs cause analysis processing using the received cause-effect relationship graph and device log information (step S106 ).

[0057] Then, the cause analysis processing unit 25 sends the analysis processing result of the cause of the accident to the input / output unit 40 (step S107). The input / output unit 40 performs output processing (display, etc.) of the analysis processing result of the cause of the accident. Fig.11 To be described later.

[0058] [Details of cause analysis processing]

[0059] Figure 4 2 is a flowchart showing the details of the cause analysis process in the cause analysis processing unit 25 .

[0060] The cause analysis processing unit 25 first obtains a cause-effect relationship graph of the detected accident type and a device log group collected based on determinations required for analysis (step S201 ).

[0061] Then, the cause analysis processing unit 25 calculates the score of the possibility of the cause of the failure of the device (step S202). Furthermore, the cause analysis processing unit 25 calculates the score of the possibility of the cause of the network attack (step S203). The details of these score calculation processes are described in Figure 5 To be described later.

[0062] Then, the cause analysis processing unit 25 compares the fault cause possibility score obtained in step S202 with the network attack cause possibility score obtained in step S20. Through this comparison, the cause analysis processing unit 25 determines whether the fault cause possibility score is greater than the network attack cause possibility score (step S204).

[0063] In the judgment in step S204, if the fault cause possibility score is greater than the network attack cause possibility score ("Yes" in step S204), the cause analysis processing unit 25 judges that it is an accident caused by a fault (step S205). In addition, in the judgment in step S204, if the fault cause possibility score is not greater than the network attack cause possibility score ("No" in step S204), the cause analysis processing unit 25 judges that the accident is not caused by the fault (step S206).

[0064] Figure 5 is the calculation of a score indicating the probability of the cause of a device failure ( Figure 4 Step S202) and calculation of the score of the likelihood of the cause of the network attack ( Figure 4 The calculation of the score of the possibility of the cause of the failure of the device and the calculation of the score of the possibility of the cause of the network attack are performed in the same processing order.

[0065] First, the cause analysis processing unit 25 acquires a cause-effect relationship graph of the detected accident type and a device log group determined to be necessary for analysis and collected (step S301 ).

[0066] Then, the cause analysis processing unit 25 selects a device log information from the collected device log group and obtains the corresponding log information group of the specified range (step S302). The range of the log information group to be obtained is pre-specified (specified range). Alternatively, the specified range can also be specified each time the operation is performed.

[0067] The cause analysis processing unit 25 obtains the judgment condition of the corresponding log information from the obtained cause-effect relationship graph (step S303). Thereafter, the cause analysis processing unit 25 searches the corresponding log information group for logs that match the judgment condition and calculates the degree of association specified by the cause-effect relationship graph (step S304).

[0068] When the correlation degree calculation in step S304 is performed, the cause analysis processing unit 25 determines whether there is device log information for which the score calculation has not been performed (step S305). If there is device log information for which the score calculation has not been performed in step S305 ("Yes" in step S305), the cause analysis processing unit 25 returns to step S302 and performs processing on other device log information.

[0069] If there is no device log information for which a score has not been calculated in step S305 (No in step S305 ), the cause analysis processing unit 25 obtains relationship conditions (AND / OR) between device log information from the cause-effect relationship graph (step S306 ).

[0070] Then, the cause analysis processing unit 25 calculates the relevance of the device log information according to the obtained relationship conditions and calculates the cause possibility score (step S307). Here, the cause possibility score includes the fault cause possibility score and the network attack cause possibility score. In the calculation method of the score here, for example, as a calculation method of the association conditions between the device log information, in the case of the AND condition, the minimum value of each correlation degree is taken as the score. In addition, in the case of the OR condition, the maximum value of each correlation degree is taken as the score.

[0072] [Example of a cause and effect diagram]

[0073] Figure 6 and Figure 7 Example of a diagram representing cause and effect relationships. Figure 6 is a cause-and-effect diagram of the cause of the failure, Figure 7 It is a cause and effect diagram of the causes of cyber attacks.

[0074] Figure 6 In the causal relationship graph of the cause of the fault shown, as a detection node of one type of accident, there are fault 411 of the command issuing source, fault 412 of the transmission device, fault 413 of the command receiving device, fault 414 of the command executing device, etc. Under the conditions of these events, the fault occurrence 431 related to the command issuance is recorded as the cause node, and as its upper level, the issuance of an illegal command 441 is registered.

[0075] In addition, if Figure 6 As shown, as other types of detection nodes of accidents, there are failure 421 of the device for judging the state, failure 422 of the state sensor, etc. Under the or conditions of these failure events, as the cause node, a failure occurrence 432 related to state control becomes, and as its upper level, illegal terminal state control 442 is registered.

[0076] Furthermore, under the OR condition of the issuance of an illegal command 441 and the grasp of an illegal terminal state 442, the accident category "detection of issuance of a command that does not match the terminal state" 400a is registered in the cause-effect relationship graph.

[0077] Figure 7 The causal relationship diagram of the cause of the network attack shown has, as a detection node of a category of accidents, function rewriting 451, illegal authentication 452, malware mixing 453, etc. Under the conditions of these categories of events, the execution trial 481 of the illegal command becomes the cause node.

[0078] In addition, as detection nodes for other types of accidents, there are parameter range scanning function 461 of illegal commands, parameter range scanning 462 of sensor values / control values, etc.

[0079] Under these types of events or conditions, as the cause node, a trial 482 of the design that escapes functional safety becomes available.

[0080] Then, as a higher level of the cause node of the execution of the illegal command 481, the issuance of a command not related to functional safety 491 is obtained.

[0081] Alternatively, under the condition of the trial execution 481 of the illegal command and the trial execution 482 of the design that evades performance safety, the execution 492 of the command related to functional safety is obtained.

[0082] In addition, as detection nodes of other types of accidents, there are mixing of illegal control values / sensor values ​​into the network (NW) 471, tampering of data holding terminal status 472, tampering of sensor functions 473, etc. Under the or conditions of these types of events, the cause node becomes a tampering trial of the terminal status 483, and further, as the upper level of the cause node, the tampering of the terminal status 493 is obtained.

[0083] Furthermore, under the conditions of issuance of commands unrelated to functional safety 491, execution of commands related to functional safety 492, and tampering of terminal status 493, the accident category "Detection of issuance of commands that do not match terminal status" 400b is registered in the causal relationship graph.

[0084] [Log information table example]

[0085] Figure 8 An example of the log information table held by the device log information holding unit 32 is shown.

[0086] Log information table according to Figure 2 The log information holding units 33 , 34 , 35 , and 36 shown generate an arbitrary number of AA log information tables 500 a to ZZ log information tables 500 z .

[0087] like Figure 8 As shown, one log information table includes a log information table ID 501 , device information 502 , date information 503 , log information 504 , and corresponding department information 505 .

[0088] The log information table ID 501 is an identification number assigned to each log information table.

[0089] The device information 502 is the address of the target device which is the collection source of the device log information.

[0090] The date information 503 is the date and time when the device log information is collected.

[0091] The log information 504 is the device log information actually collected.

[0092] The corresponding department information 505 is department information that can determine the corresponding device log information.

[0093] By associating the relevant department information 505 with the relevant department information, the relevant department can make a detailed judgment on the accident. For example, if the cause is a failure, the department information that can judge the failure is recorded, and the failure can be handled.

[0094] [Example of a Cause and Effect Diagram Information Sheet]

[0095] Fig. 9 An example of the cause-effect relationship graph information table 600 held by the cause-effect relationship graph holding unit 31 is shown.

[0096] The cause-effect relationship graph information table 600 includes accident type information 601 , a graph ID 602 ​​, device log information 603 , a log table ID 604 , a determination condition 605 , and a correlation calculation coefficient 606 .

[0097] The accident category information 601 is the accident category. Fig. 9 As shown, accident categories such as "detection of command issuance that does not match the terminal state" are stored.

[0098] The graph ID 602 ​​is an identification number assigned to each cause-and-effect relationship graph.

[0099] The device log information 603 is the device log information of the cause-effect relationship determination source, for example, information such as the AB log of the A device.

[0100] The log table ID 604 is a log table ID that holds the device log information indicated by the device log information 603 .

[0101] The determination condition 605 indicates the detection parameters required for the determination.

[0102] The correlation calculation coefficient 606 indicates a coefficient value for calculating the correlation.

[0103] Based on the information in the cause-effect relationship graph information table 600, a Figure 6 or Figure 7 Cause and effect diagram shown.

[0104] [Example of the cause-effect relationship graph setting screen]

[0105] Fig.10An example of a cause-effect relationship graph setting screen 700 displayed on the display unit of the input / output unit 40 constituting the cause analysis device 1 when the cause-effect relationship graph generation processing unit 21 generates the cause-effect relationship graph is shown.

[0106] As the cause and effect diagram setting screen 700, as shown on the left side of the screen, there are input fields for accident name, details of device log settings, and input fields for judgment conditions as setting value inputs, and the person in charge (analyst) who performs the work in the setting screen 700 can input these details.

[0107] In addition, as shown on the right side of the cause-effect relationship graph setting screen 700, a column for the person in charge to create a graph is prepared, and the person in charge who works in the setting screen 700 can input the details of the detection node, the details of the cause node, and the details of the accident category. Then, the person in charge can input the judgment conditions (AND conditions, or conditions, etc.) of these nodes and the connection lines indicating the connection relationship between each node to create a graph. Figure 6 , Figure 7 Cause and effect diagram shown.

[0108] There are a “Set OK” button and a “Cancel” button at the lower right of the cause-effect relationship graph setting screen 700 . When the person in charge selects the “Set OK” button, the cause-effect relationship graph created in the cause-effect relationship graph setting screen 700 is stored in the cause-effect relationship graph storage unit 31 .

[0109] Then, when the person in charge selects the “Cancel” button, the creation of the cause-effect relationship graph created on the cause-effect relationship graph setting screen 700 is canceled.

[0110] [Example of the cause analysis result display screen]

[0111] Fig.11 An example is shown in which the cause analysis result screen 800 in the cause analysis processing unit 25 is displayed on the display unit constituting the input / output unit 40 .

[0112] The cause analysis result screen 800 has a display column for the cause of the detected accident, a display column for the fault cause score, and a display column for the network attack cause score. Each score is a score obtained during the cause analysis process in the cause analysis processing unit 25, and the cause of the network attack is determined based on the values ​​of the two scores. Figure 4 The determination in step S204 of the flowchart is made, and the cause of the detected accident (failure cause or network attack cause) is displayed in the display column of the cause of the detected accident.

[0113] In addition, the cause analysis result screen 800 displays the analysis cause and effect relationship graph ( Fig.11 ), and displays a list of analyzed device logs ( Fig.11 In addition, Fig.11 The text in the cause-effect diagram is omitted in the analysis, but in fact Figure 6 , Figure 7 The manner shown shows the details of the analytical cause and effect diagram.

[0114] A download button is displayed at the display location of the analysis cause-effect relationship graph and the device log. Then, the person in charge can perform the analysis cause-effect relationship graph details (e.g. Fig. 9 information shown) and device log details (e.g. Figure 8 The information shown in the figure is downloaded and displayed on the screen.

[0115] In addition, a result print button is provided in the cause analysis result screen 800, and the cause analysis result can be printed by an operation of the person in charge.

[0116] As described above, according to the accident cause determination system of this example, it is possible to extract only the information required for the alarm from the various log information available in the device to determine the cause. As a result, the time for detailed information inspection is shortened, the storage capacity of information is optimized, and the cause of the accident can be determined efficiently. In addition, appropriate cause determination can be performed without being affected by the skills of the person in charge (analyst).

[0117] Here, the cause analysis processing unit 25 uses the device log information collected by the necessary log information determination processing unit 23 and the prepared cause-effect relationship graph to calculate the fault cause possibility score and the attack cause possibility score to determine the cause of the accident event. In this way, it is possible to appropriately determine whether the cause of the accident event is a fault cause or a network attack cause.

[0118] Specifically, the cause analysis processing unit 25 determines that the cause is not the cause of the failure when the attack cause possibility score is greater than the failure cause possibility score, and determines that the cause is the cause of the failure when the attack cause possibility score is not greater than the failure cause possibility score.

[0119] In addition, when the cause analysis processing unit 25 calculates the fault cause possibility score and the attack cause possibility score, as shown in FIG. Figure 5 As described in the flowchart of , the judgment condition of the device log information is obtained from the cause-effect relationship graph of the detected accident category, and the logs that match the judgment condition are searched from the device log group that is determined to be necessary for analysis and collected, and the correlation degree specified in the cause-effect relationship graph is calculated. In this way, each score can be appropriately calculated based on the correlation degree specified in the cause-effect relationship graph, and the accuracy of cause judgment can be improved.

[0120] In addition, if Figure 8As described in , the cause-effect relationship graph has the identifiable department information in association, so that the department that handles the corresponding accident can be determined, and the accident response can be carried out quickly.

[0121] Furthermore, the cause-effect relationship graph generation processing unit 21 that generates the cause-effect relationship graph held by the cause-effect relationship graph holding unit 31 is provided, and the generated cause-effect relationship graph is held in the cause-effect relationship graph holding unit 31 , thereby making it possible to easily create or modify the cause-effect relationship graph.

[0122] In addition, regarding the cause-effect relationship diagram, in addition to the analyst and SOC manager Fig.10 In addition to creating a cause-effect relationship graph by inputting in the cause-effect relationship graph setting screen 700 as shown, it is also possible to automatically create a cause-effect relationship graph by reading in a summary of known information on the causes of accidents, thereby creating an appropriate cause-effect relationship graph.

[0123] In addition, the input / output unit 40 is configured as follows: Fig.11 As shown, the cause-effect relationship graph and necessary log information are output as the analysis status, so that the details of the determination reason of the cause can be known.

[0124] [Modifications]

[0125] In addition, the embodiment examples described so far are described in detail in order to explain the present invention in an easily understandable manner, and are not necessarily limited to those having all the described configurations.

[0126] For example, in the above-mentioned embodiment, the cause analysis processing unit 25 determines the cause as the cause analysis result and outputs the determination result. In contrast, the cause analysis processing unit 25 may not determine the cause, but may calculate the fault cause possibility score and the attack cause possibility score and display the respective scores. The person in charge (analyst) who has confirmed the display can infer the cause based on the score.

[0127] In addition, Figure 2 In the structural diagram of the cause analysis device 1 shown, only those control lines and information lines that are considered necessary for explanation are shown, and not all control lines and information lines may be shown in the product. In fact, it can be considered that almost all structures are connected to each other.

[0128] in addition, Figure 3 to Figure 5 The process flow shown in the flowchart is also an example, and if the process results are the same, the process order may be partially changed or a plurality of processes may be executed simultaneously.

[0129] Fig.10 , Fig.11 The display examples shown are merely examples, and the display is not limited to these.

[0130] In addition, as Figure 2 The cause analysis device 1 shown includes the processing unit 20 which is a computer installed with a program (a program for realizing the accident cause identification method), which is also an example, and the cause analysis device 1 may be realized by other structures.

[0131] For example, part or all of the cause analysis device 1 may be realized by dedicated hardware such as FPGA (Field Programmable Gate Array) or ASIC (Application Specific Integrated Circuit).

[0132] Furthermore, part of the structure of the cause analysis device 1 may be placed in another processing device such as a server connected via a network, and data may be exchanged among a plurality of processing devices to perform the same analysis processing as the cause analysis device 1 .

[0133] In addition, the program for executing the accident cause determination method can be prepared in a storage device within a computer, or placed in an external memory, IC card, SD card, optical disk or other recording medium for transmission.

Claims

1. A system for determining the cause of an accident, characterized in that: have: a device log information storage unit that stores log information output by the target device; a cause-effect relationship graph storage unit that stores in advance a cause-effect relationship graph that associates the relationship between accident events and their causes; An accident detection processing unit that detects an accident event in a target device; a necessary log information determination processing unit, which extracts the cause-effect relationship graph of a corresponding category for the accident event detected by the accident detection processing unit, and determines the device log information required for cause determination based on the extracted cause-effect relationship graph; a necessary log information collection processing unit that collects the device log information determined by the necessary log information determination processing unit; a cause analysis processing unit that uses the device log information collected by the necessary log information collection processing unit and the cause-effect relationship graph to analyze the cause of the accident event; as well as An output unit outputs the cause or analysis status determined by the cause analysis processing unit.

2. The accident cause determination system according to claim 1, characterized in that: The cause analysis processing unit calculates a fault cause possibility score and an attack cause possibility score using the device log information collected by the necessary log information determination processing unit and the cause-effect relationship graph, and determines the cause of the accident event.

3. The accident cause determination system according to claim 2, characterized in that: When calculating the fault cause possibility score and the attack cause possibility score, the cause analysis processing unit obtains the judgment condition of the device log information from the cause-effect relationship graph of the detected accident category, searches for logs that are consistent with the judgment condition from the device log group that is determined to be required for analysis and collected, and calculates the correlation specified by the cause-effect relationship graph.

4. The accident cause determination system according to claim 3, characterized in that: The cause analysis processing unit determines that the cause is not the cause of the failure when the attack cause possibility score is greater than the failure cause possibility score, and determines that the cause is the cause of the failure when the attack cause possibility score is not greater than the failure cause possibility score.

5. The accident cause determination system according to claim 1, characterized in that: The cause-effect relationship graph is associated with the decidable department information.

6. The accident cause determination system according to claim 1, characterized in that: The accident event cause identification system further includes a cause-effect relationship graph generation processing unit that generates a cause-effect relationship graph held by the cause-effect relationship graph holding unit, and holds the generated cause-effect relationship graph in the cause-effect relationship graph holding unit.

7. The accident cause determination system according to claim 1, characterized in that: The output unit outputs a cause-effect relationship graph and necessary log information as an analysis status.

8. A method for determining the cause of an accident, characterized in that: Including the following processing: Device log information storage processing, storing the log information output by the target device; A cause-effect relationship diagram storage process is to store a cause-effect relationship diagram that associates the accident events and their causes in advance; An accident detection process for detecting an accident event in a target device; Necessary log information determination processing, for the accident event detected by the accident detection processing, extracting the cause-effect relationship graph of the corresponding category, and determining the device log information required for the cause determination based on the extracted cause-effect relationship graph; necessary log information collection processing, collecting device log information determined by the necessary log information determination processing; a cause analysis process for analyzing the cause of the accident event using the device log information collected by the necessary log information collection process and the cause-effect relationship graph; as well as An output process is performed to output the cause or analysis status determined by the cause analysis process.

Images