Alarm response notification method, alarm response notification device, and program

Abstract

An alarm notification method receives an alarm indicating an abnormality occurring in an OT environment (S671), specifies confirmation information corresponding to the type of the alarm on the basis of a plurality of pieces of confirmation information each indicating the content of status confirmation performed with respect to the corresponding type of alarm and the received alarm (S672), and notifies the type of the alarm according to the confirmation information (S672). Each of the plurality of pieces of confirmation information includes a first item associated with the first weight and indicating content of a first situation confirmation performed by the first coping person, and a second item associated with the second weight and indicating content of a second situation confirmation performed by the second coping person, and the first item and the second item are determined using the first weight and the second weight determined on the basis of the determined confirmation information. And a notification unit that determines, from among the first responder and the second responder, a responder that prioritizes confirmation of the status of the received alarm (S673), and notifies the first responder of the first item if the first responder is determined as the responder, and notifies the second responder of the second item if the second responder is determined as the responder (S674).

Description

Technical Field

[0001] The present disclosure relates to an alarm response notification method, an alarm response notification device, and a program for effectively executing a treatment for an alarm (alert) occurring in a control system. Background Art

[0002] Patent Document 1 determines whether a detected alarm is a security incident and determines the priority of the incident. It also discloses a method of not notifying an operator of an IT system of an incident that does not require notification, and notifying an operator of an incident that requires notification as an alarm along with the priority.

[0003] Prior art literature

[0004] Patent Document 1: Japanese Patent Application Publication No. 2019-175070 Summary of the invention

[0005] Problem that the invention aims to solve

[0006] The present disclosure provides an alarm response notification method and the like capable of providing notification for effectively handling a detected alarm.

[0007] Means used to solve problems

[0008] An alarm response notification method of an alarm response notification device of a technical solution of the present disclosure is an alarm response notification method executed by the alarm response notification device, comprising: receiving an alarm response notification in OT (Operation Technology) environment, determine confirmation information corresponding to the type of the alarm based on a plurality of confirmation information stored in a storage unit of the alarm response notification device, each of which indicates the content of a status confirmation performed on an alarm of a corresponding type, and the received alarm, wherein each of the plurality of confirmation information includes: a first item associated with a first weight and indicating the content of a first status confirmation performed by a first responder, and a second item associated with a second weight and indicating the content of a second status confirmation performed by a second responder, use the first weight and the second weight determined based on the determined confirmation information to determine a responder between the first responder and the second responder who is to perform status confirmation of the received alarm with priority, and when the first responder is determined to be the responder, notify the first responder of the first item, and when the second responder is determined to be the responder, notify the second responder of the second item.

[0009] In addition, an alarm response notification device of a technical solution of the present disclosure comprises: a communication unit, which receives an alarm indicating an abnormality occurring in an OT (Operation Technology) environment; a storage unit, which stores multiple confirmation information, each of which indicates the content of the status confirmation of the corresponding type of alarm; a decision unit, which determines a responder, between a first responder and a second responder, who gives priority to confirming the status of the received alarm, each of the multiple confirmation information includes: a first item associated with a first weight and indicating the content of the first status confirmation performed by the first responder, and a second item associated with a second weight and indicating the content of the second status confirmation performed by the second responder, the decision unit uses the first weight and the second weight determined based on the confirmation information corresponding to the type of the received alarm to determine the responder, and the communication unit notifies the first responder of the first item when the first responder is determined as the responder, and notifies the second responder of the second item when the second responder is determined as the responder.

[0010] Effects of the Invention

[0011] According to the alarm response notification device of the present disclosure, each responder can perform status confirmation on the alarm for which the status confirmation should be performed first, thereby making it possible to improve the efficiency of status confirmation on the alarm. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a diagram showing the overall configuration of the alarm response system in this embodiment.

[0013] Figure 2 It is a diagram showing the configuration of the alarm response notification device in this embodiment.

[0014] Figure 3 It is a diagram showing the flow of the response priority calculation process in this embodiment.

[0015] Figure 4 This is a diagram showing alarm information included in an alarm in this embodiment.

[0016] Figure 5 1 is a diagram showing the flow of the cause ratio calculation process in this embodiment.

[0017] Figure 6 It is a diagram showing the configuration of each detection model in this embodiment.

[0018] Figure 7 This is a diagram showing an example of a confirmation item list of the detection model A in this embodiment.

[0019] Figure 8This is a diagram showing an example of the alarm score for each severity level in this embodiment.

[0020] Fig. 9 It is a diagram showing the calculation process and calculation result of the response priority calculation process performed on the first alarm in this embodiment.

[0021] Fig.10 This is a diagram showing an example of output results to a manager up to the first alarm in this embodiment.

[0022] Fig.11 It is a diagram showing the calculation process and calculation result of the response priority calculation process performed on the second alarm in this embodiment.

[0023] Fig.12 It is a diagram showing the calculation process and calculation result of the response priority calculation process performed on the third alarm in this embodiment.

[0024] Fig.13 This is a diagram showing an example of output results to a manager regarding the third alarm in this embodiment.

[0025] Fig.14 It is a diagram showing the flow of confirmation item input processing in this embodiment.

[0026] Fig.15 This is a diagram showing an example of a UI display for inputting a confirmation result in this embodiment.

[0027] Fig.16 It is a diagram showing the configuration of a confirmed item storage unit and a confirmed item list in this embodiment.

[0028] Fig.17 This is a diagram showing the flow of the priority update process in this embodiment.

[0029] Fig.18 : is a figure which shows the flow of the cause location rate update process in this embodiment.

[0030] Fig.19 It is a diagram showing the calculation process and calculation result of the response priority in the first response priority update process in this embodiment.

[0031] Fig. 20 This is a diagram showing an example of the output result to the administrator after the first response priority update process in this embodiment.

[0032] Fig.21 It is a diagram showing the calculation process and calculation results of the response priority in the response priority update process in this embodiment.

[0033] Fig. 22 This is a diagram showing an example of the output result to the analyst after the second response priority level update process in the present embodiment.

[0034] Fig.23 It is a diagram showing the flow of weight updating processing in this embodiment.

[0035] Fig.24 This is a diagram showing an example of changes in the weights of the confirmation item list achieved by the weight update process in this embodiment.

[0036] Fig.25 It is a diagram showing the flow of the alarm response notification method in this embodiment.

[0037] Fig.26 This is a diagram showing a confirmation item list in which confirmation items are integrated as a modification example of the configuration of the confirmation item list.

[0038] Fig. 27 This is a diagram showing a confirmation item list in which confirmation items are grouped as a modification example of the structure of the confirmation item list.

[0039] Fig.28 This is a diagram showing a modification of the UI display as the output result, and an example of output in a bar format.

[0040] Fig.29 This is a diagram showing an example of a bar format output output together with a trajectory as a modification of the UI display of the output result. DETAILED DESCRIPTION

[0041] (Insights that form the basis of this disclosure)

[0042] In recent years, cyber attacks on control systems such as factories, buildings, and power systems have increased and become more sophisticated, and security countermeasures (measures) against such cyber attacks are gradually being implemented. As security countermeasures, in addition to conventional countermeasures such as IPS (Intrusion Prevention System) and IDS (Intrusion Detection System), there are also countermeasures that utilize the characteristics of control systems.

[0043] For example, in a control system network (hereinafter referred to as a control network), the communication destination or communication content of the management device is static and can be grasped in advance. Therefore, the anomaly detection used in the control network includes anomaly detection using a white list of communication pairs, anomaly detection by grasping the behavior of the device based on the communication content, and the like.

[0044] As an organization that analyzes the alerts caused by these multiple anomaly detections and comprehensively detects cyber attacks, there is a SOC (Security Operation Center). In the SOC, security alerts from multiple systems are collected and analyzed in an integrated monitoring system called SIEM (Security Information and Event Management) to perform SOC analysis to determine whether it is a cyber attack.

[0045] In the abnormality detection that utilizes the characteristics of the control system, advanced network attacks such as instruction commands to control devices under legal (regular) protocols and / or illegal (abnormal, unauthorized) operations on control devices are detected.

[0046] Thus, as with IT (Internet Technology), the threat of cyber attacks is also imminent in OT (Operation Technology) environments such as factories and buildings, and the introduction of SIEM is being promoted from a security perspective. In SIEM, it is expected that by collecting device logs and / or communication logs of the control system and centrally managing and analyzing them, signs of cyber attacks can be identified and detected early.

[0047] Specifically, by building a SOC, SIEM detects anomalies, and SOC analysts analyze the notified alarms to respond. The analysts analyze whether the alarms are cyber attacks, and if they are determined to be cyber attacks, they report (escalation) to the SIRT (Security Incident Response Team) to implement incident response.

[0048] In the OT environment, the communication pairs and / or communication protocols between devices are static and are defined as a whitelist. The whitelist is used as an anomaly detection rule in SIEM to monitor communications and detect communications outside the whitelist as anomalies.

[0049] However, in a control system, when an unexpected maintenance operation such as regular equipment maintenance or equipment replacement when an equipment failure occurs, or when an operator monitoring the operation of the control system intentionally performs a manual operation, the abnormality detection system may over-detect it as an abnormality, causing an alarm.

[0050] Therefore, when responding to an alarm notified from SIEM, analysts need to determine whether the alarm is caused by a cyber attack or by excessive detection caused by equipment maintenance of the control system or the operator's operation. In the case where the alarm is caused by a cyber attack, analysts can determine that the cause of the alarm is from a cyber attack by analyzing communication logs, control logs, etc. In contrast, in the case where the alarm is caused by excessive detection, in order to find out the cause of the alarm, maintenance implementation information of the on-site control equipment, etc. that is the cause of the excessive detection, etc. is required. However, at the start time of the analysis, there is no information related to the cause of the alarm, and it is impossible to determine whether the alarm is caused by a cyber attack or excessive detection. In other words, as long as the on-site managers are not asked and the managers do not perform confirmation operations, it is difficult to determine whether the alarm is caused by a cyber attack or excessive detection.

[0051] In the above-mentioned prior art, it is assumed that in determining the priority of responses to detected alarms, analysts implement all alarm responses without considering the priority selection of responders based on the type and / or content of the alarm. For example, at the start time of the analysis of the alarm notified by the SIEM, it is impossible to determine whether the alarm is caused by a network attack or by over-detection, so the analyst first performs analysis within the possible scope. And only after the result of the analysis determines that there is a possibility of over-detection, the on-site manager is asked, and another analysis is performed based on the on-site information obtained. Therefore, the analyst performs analysis when there is insufficient information related to the site, which is very inefficient.

[0052] Therefore, in order to perform effective (efficient) alarm response, it is necessary to determine a priority responder based on the type and / or content of the alarm detected by the SIEM.

[0053] In order to solve the above problem, the first technical solution of the present disclosure is an alarm response notification method executed by an alarm response notification device, receiving an alarm response notification device indicating that an OT (Operation Technology) environment, determine confirmation information corresponding to the type of the alarm based on a plurality of confirmation information stored in a storage unit of the alarm response notification device, each of which indicates the content of status confirmation of the corresponding type of alarm, and the received alarm, each of the plurality of confirmation information includes: a first item associated with a first weight and indicating the content of a first status confirmation performed by a first responder, and a second item associated with a second weight and indicating the content of a second status confirmation performed by a second responder, use the first weight and the second weight determined based on the determined confirmation information to determine a responder between the first responder and the second responder who is to prioritize the status confirmation of the received alarm, and when the first responder is determined to be the responder, notify the first responder of the first item, and when the second responder is determined to be the responder, notify the second responder of the second item.

[0054] Thus, an appropriate responder can be determined each time an alarm is issued, and the responder can be notified together with information for confirming the situation, so that alarm response can be performed efficiently.

[0055] The alarm response notification method of the second technical solution of the present disclosure is the alarm response notification method of the first technical solution, and also includes: upon receiving the first completion information indicating that the first responder has completed the confirmation of the first situation, notifying the second responder of the second item, and upon receiving the second completion information indicating that the second responder has completed the confirmation of the second situation, notifying the first responder of the first item.

[0056] Thus, in response to an alarm in which the status check has been completed by one responder, the details of the status check can be immediately notified to the other responder.

[0057] The alarm response notification method of the third technical solution of the present disclosure is the alarm response notification method of the first technical solution, and each of the multiple confirmation information also includes: a third item associated with a third weight and indicating the content of the third status confirmation performed by the first responder, and a fourth item associated with a fourth weight and indicating the content of the fourth status confirmation performed by the second responder. In the decision, the responder is determined using the first weight, the second weight, the third weight, and the fourth weight determined based on the confirmation information corresponding to the type of the received alarm. In the notification of the first item, the first item and the third item are notified to the first responder in descending order of weight, and in the notification of the second item, the second item and the fourth item are notified to the second responder in descending order of weight.

[0058] Thus, even when the content of the status confirmation performed by each responder in response to the alarm includes multiple items, it is possible to determine which of the first responder and the second responder first performs the status confirmation for the alarm. In addition, the items of status confirmation can be notified to the responder in descending order of the weight associated with each item, so that the responder can effectively perform status confirmation.

[0059] The alarm response notification method of the fourth technical solution of the present disclosure is the alarm response notification method of the third technical solution, and also includes: when receiving completion information indicating that one of the first status confirmation, the second status confirmation, the third status confirmation and the fourth status confirmation has been completed, using the weight obtained by removing the weight associated with the item indicating the content of the status confirmation shown by the completion information from the first weight, the second weight, the third weight, and the fourth weight, the responder is determined again, and the items obtained by removing the items indicating the content of the status confirmation shown by the completion information from the first item, the second item, the third item and the fourth item are notified to the responder.

[0060] This makes it possible to dynamically determine the responder according to the progress of the alarm status confirmation, and to successively notify the responder.

[0061] The alarm response notification method of the fifth technical solution of the present disclosure is the alarm response notification method of any one of the first to fourth technical solutions, wherein the first responder is an analyst who analyzes the cause of the alarm, and the second responder is a manager who manages the OT (Operation Technology) environment. In the notification of the second item, the second responder is also notified to the first responder of the fact that the second responder first confirms the status of the alarm.

[0062] Thus, the analyst can recognize that the administrator has previously performed status confirmation on the issued alarm. That is, the analyst can recognize the current situation even on the alarm for which the analyst should not have previously performed status confirmation.

[0063] The alarm response notification method of the sixth technical solution of the present disclosure is the alarm response notification method of the fifth technical solution, and each of the multiple confirmation information also includes: a third item associated with a third weight and indicating the content of the third status confirmation performed by the first responder, and a fourth item associated with a fourth weight and indicating the content of the fourth status confirmation performed by the second responder, and the alarm response notification method also includes: when receiving completion information indicating that the second status confirmation or the fourth status confirmation is completed, using the second weight and the fourth weight, the item indicating that the completion is indicated by the completion information is removed. The respondent is determined again based on the weight obtained by associating the item of the content of the status confirmation shown in the completion information, and the item indicating the content of the status confirmation completed by the completion information and the confirmation result of the status confirmation are notified to the first respondent; if the first respondent is determined as the respondent in the re-determination, the first item is notified to the first respondent; and if the second respondent is determined as the respondent in the re-determination, the item obtained by removing the item indicating the content of the status confirmation completed by the completion information is notified to the second respondent.

[0064] Thus, the analyst can be notified of the item whose status is confirmed by the manager and the on-site information obtained as a result of the status confirmation for the item. Therefore, the analyst can perform alarm response such as status confirmation and / or cause analysis based on the on-site information.

[0065] The alarm response notification method of the 7th technical solution of the present disclosure is the alarm response notification method of the 6th technical solution, and also includes: receiving a true cause item from the first responder, the true cause item representing an item related to the cause of the alarm, determining the item represented by the true cause item from the first item, the second item, the third item and the fourth item, and updating the weight associated with the determined item in a manner that is further increased.

[0066] Thus, when the same type of alarm is issued and notified next time, the updated weight can be used to determine which of the first responder and the second responder should first perform the status confirmation. That is, the determination can be made based on the response history of the alarm that occurred previously, and an effective alarm response can be performed.

[0067] The alarm response notification method of the 8th technical solution of the present disclosure is the alarm response notification method of the 1st technical solution, and in determining the responder, the first weight and the second weight are used to calculate the first priority indicating the degree to which the first responder prioritizes confirming the status of the alarm, and the second priority indicating the degree to which the second responder prioritizes confirming the status of the alarm, and when the first priority is higher than the second priority, the first responder is determined to be the responder, and when the second priority is higher than the first priority, the second responder is determined to be the responder.

[0068] The alarm response notification method of the 9th technical solution of the present disclosure is the alarm response notification method of the 8th technical solution. In the reception of the alarm, when multiple alarms are received, the following are further performed: for each of the multiple alarms received, the first priority of the alarm is calculated, and the first priority for implementing the status confirmation of the multiple alarms is determined in descending order of the first priority; for each of the multiple alarms received, the second priority of the alarm is calculated, and the second priority for implementing the status confirmation of the multiple alarms is determined in descending order of the second priority; the first priority and the first item corresponding to the alarm with the highest first priority among the multiple alarms are notified to the first responder, and the second priority and the second item corresponding to the alarm with the highest second priority among the multiple alarms are notified to the second responder.

[0069] Thus, when multiple alarms are received, by comparing the calculated multiple first priorities, the priority of the status confirmation for the first responder can be determined and notified. Similarly, by comparing the calculated multiple second priorities, the priority of the status confirmation for the second responder can be determined and notified. Therefore, even in a situation where multiple alarms are issued, each responder can grasp the priority of the status confirmation and can effectively respond to the alarm.

[0070] The alarm response notification method of the 10th technical solution of the present disclosure is the alarm response notification method of the 8th technical solution. In the reception of the alarm, when multiple alarms are received, each of the multiple alarms includes a degree indicating the magnitude of the impact caused by the alarm, that is, the severity. The alarm response notification method also includes: for each of the multiple alarms received, a third priority is calculated by multiplying the first priority of the alarm by the severity, and the first priority for implementing status confirmation of the multiple alarms is determined in descending order of the third priority. For each of the multiple alarms received, a fourth priority is calculated by multiplying the second priority of the alarm by the severity, and a second priority for implementing status confirmation of the multiple alarms is determined in descending order of the fourth priorities, and the first priority and the first item corresponding to the alarm with the highest first priority among the multiple alarms are notified to the first responder, and the second priority and the second item corresponding to the alarm with the highest second priority among the multiple alarms are notified to the second responder.

[0071] Thus, the priority of the situation confirmation can be determined taking into account the severity of the alarm. Therefore, for alarms with high severity, the priority of the situation confirmation can be determined to be higher than that of alarms with low severity, so that responders can prioritize the situation confirmation, thereby suppressing the impact of the alarm.

[0072] The alarm response notification method of the 11th technical solution of the present disclosure is the alarm response notification method of the 8th technical solution, and each of the multiple confirmation information also includes: a third item associated with a third weight and indicating the content of the third status confirmation performed by the first responder, and a fourth item associated with a fourth weight and indicating the content of the fourth status confirmation performed by the second responder. The alarm response notification method also includes: when receiving completion information indicating that one of the first status confirmation, the second status confirmation, the third status confirmation and the fourth status confirmation has been completed, the first priority and the second priority are calculated again using the weight obtained from the first weight, the second weight, the third weight, and the fourth weight, excluding the weight associated with the item indicating the content of the status confirmation shown by the completion information.

[0073] The alarm response notification method of the 12th technical solution of the present disclosure is the alarm response notification method of the 10th technical solution, and each of the multiple confirmation information also includes: a third item associated with a third weight and indicating the content of the third status confirmation performed by the first responder, and a fourth item associated with a fourth weight and indicating the content of the fourth status confirmation performed by the second responder. The alarm response notification method also includes: when receiving completion information indicating that one of the first status confirmation, the second status confirmation, the third status confirmation and the fourth status confirmation has been completed, using the weight obtained from the first weight, the second weight, the third weight, and the fourth weight, excluding the weight associated with the item indicating the content of the status confirmation shown by the completion information, to recalculate the first priority and the second priority, and using the recalculated first priority and the second priority for the alarm, to recalculate the third priority and the fourth priority.

[0074] As a result, the priority of the alarm status confirmation can be dynamically updated according to the progress of the responder's status confirmation, so the alarm response can be made more efficient as a whole.

[0075] A program according to a thirteenth aspect of the present disclosure is a program for causing a computer to execute the alarm response notification method according to any one of the first to twelfth aspects.

[0076] The alarm response notification device of the 14th technical solution of the present disclosure comprises: a communication unit, which receives an alarm indicating an abnormality occurring in an OT environment, i.e., an operational technology environment; a storage unit, which stores a plurality of confirmation information, each of which indicates the content of a status confirmation performed on an alarm of a corresponding type; and a decision unit, which determines a responder, among a first responder and a second responder, who performs the status confirmation of the received alarm with priority, each of the plurality of confirmation information including: a first item associated with a first weight and indicating the content of a first status confirmation performed by the first responder, and a second item associated with a second weight and indicating the content of a second status confirmation performed by the second responder, the decision unit determines the responder using the first weight and the second weight determined based on the confirmation information corresponding to the type of the received alarm, the communication unit notifies the first responder of the first item when the first responder is determined as the responder, and notifies the second responder of the second item when the second responder is determined as the responder.

[0077] As a result, an appropriate responder can be determined each time an alarm is issued, and the responder can be notified together with information for confirming the situation, thereby making it possible to more efficiently respond to the alarm.

[0078] The embodiments described below all represent a specific example of the present disclosure. The numerical values, shapes, constituent elements, steps, the order of steps, etc. shown in the following embodiments are examples and are not intended to limit the present disclosure. In addition, the constituent elements in the following embodiments that are not recorded in the independent claims representing the highest concept are described as arbitrary constituent elements. In addition, in all embodiments and variations, the respective contents can also be combined.

[0079] (Implementation Method)

[0080] In this embodiment, the description is given with reference to the drawings. In addition, the same reference numerals are used for the same components in each drawing.

[0081] [Overall composition]

[0082] Figure 1 FIG. 2 is a diagram showing the overall structure of an example of an alarm response system in this embodiment. Figure 1 In the embodiment, the alarm response system includes: a control system 120 , an abnormality detection device 500 , and an alarm response notification device 200 .

[0083] The control system 120 controls various devices, systems, etc. set up in an OT environment such as a factory or a building, i.e., the site 110. The control system 120 is connected to the abnormality detection device 500 in a communicative manner via a communication network (not shown). The communication network can be either the general Internet or a dedicated communication line. In the control system 120, the abnormality detection device 500 can also obtain log information including device logs and / or communication logs generated by the control of various devices, systems, etc. set up at the site 110 via the communication network using a mirror. In addition, the log information can also be sent to the abnormality detection device 500 via the communication network.

[0084] In addition, as long as the control system 120 can control various devices and systems installed at the site 110, Figure 1 As shown, it is set inside the site 110, but it can also be set outside the site 110.

[0085] The abnormality detection device 500 collects log information generated by the control system 120 and detects abnormality using device logs and communication logs included in the collected log information.

[0086] The abnormality detection device 500 can communicate with the alarm response notification device 200 via a communication network, and when an abnormality is detected, an alarm 501 related to the detected abnormality is notified to the alarm response notification device 200.

[0087] In addition, as long as the anomaly detection device 500 can detect anomalies based on log information, it can be Figure 1 Although shown as being provided in the SOC 140 , it may be provided outside the SOC 140 . The abnormality detection device 500 may be configured to include the alarm response notification device 200 .

[0088] The analyst 150 of the SOC 140 analyzes the abnormality detected by the abnormality detection device 500 by confirming the status for determining the cause of the notified alarm 501, determining the real cause (root cause), etc. In addition, the manager 130 of the site 110 confirms the status for determining the cause of the notified alarm 501. In this embodiment, the analyst 150 is an example of a first responder. The manager 130 is an example of a second responder.

[0089] The alarm response notification device 200 calculates the cause location rate indicating the possibility that the administrator 130 on the site 110 side and the analyst 150 on the SOC 140 side can determine the cause of the alarm, and the response priority indicating the priority of the alarms that each responder should handle in at least one of the notified alarms 501, and notifies the calculated results to the abnormality detection device 500.

[0090] Furthermore, the alarm response notification device 200 receives the confirmation results of the alarm 501 from the manager 130 and the analyst 150 via the abnormality detection device 500 .

[0091] When the manager 130 or the analyst 150 inputs the confirmation result via the abnormality detection device 500 , the alarm response notification device 200 notifies the analyst 150 or the manager 130 of the confirmation result via the abnormality detection device 500 .

[0092] Furthermore, the alarm response notification device 200 receives the true cause of the alarm 501 from the manager 130 or the analyst 150 via the abnormality detection device 500 .

[0093] The manager 130 and the analyst 150 communicate with the abnormality detection device 500 via the information communication network using an information terminal such as a personal computer or a tablet computer. That is, the abnormality detection device 500 may receive information indicating the input of the manager 130 or the input of the analyst 150 from the information terminal that receives the input of the manager 130 or the information terminal that receives the input of the analyst 150. In addition, the analyst 150 may directly operate the abnormality detection device 500 without using the information terminal. That is, the abnormality detection device 500 may directly receive the input of the analyst 150.

[0094] Furthermore, the manager 130 and the analyst 150 may communicate with the alarm response notification device 200 without going through the abnormality detection device 500 .

[0095] Figure 2 2 is a diagram showing the overall configuration of the alarm response notification device 200 in this embodiment. Figure 2 In the present invention, the alarm response notification device 200 comprises: a true cause input unit 210, a weight update processing unit 220, a confirmation result input unit 230, an alarm receiving unit 240, a cause location rate calculation unit 250, a response priority calculation unit 260, an output unit 270, a communication unit 280, an alarm importance score storage unit 400, and a storage unit 300.

[0096] The alarm importance score storage unit 400 stores an alarm score (score) corresponding to the severity (Severity) assigned to the alarm 501 .

[0097] The storage unit 300 includes a detection model storage unit 320 and a confirmed item storage unit 310 .

[0098] The detection model storage unit 320 stores a plurality of detection models corresponding to the names of the alarms 501. The names of the alarms 501 correspond to the types of the alarms. The detection models corresponding to the names of the alarms 501 include a field side confirmation item list including a plurality of items indicating the contents of the status confirmation performed by the manager 130 on the alarms 501, and an SOC side confirmation item list including a plurality of items indicating the contents of the status confirmation performed by the analyst 150 on the alarms 501.

[0099] In this embodiment, the plurality of items included in the SOC side confirmation item list indicating the items that the analyst 150 should confirm in response to the alarm 501 are examples of the first item and the third item. The plurality of items included in the field side confirmation item list indicating the items that the manager 130 should confirm in response to the alarm 501 are examples of the second item and the fourth item.

[0100] The confirmed item storage unit 310 stores: a field-side confirmed item list indicating confirmed items included in the confirmation item list of the manager 130 for the alarm 501 as confirmed items, and an SOC-side confirmed item list indicating confirmed items included in the confirmation item list of the alarm 501 as confirmed items. These confirmed item lists are stored for each alarm 501.

[0101] The communication unit 280 communicates with the abnormality detection device 500 .

[0102] The alarm receiving unit 240 receives the alarm 501 notified from the abnormality detection device 500 from the communication unit 280 .

[0103] The determination unit 290 includes a cause ratio calculation unit 250 and a response priority calculation unit 260 .

[0104] The cause location rate calculation unit 250 acquires the alarm 501 received by the alarm reception unit 240 , and specifies a detection model corresponding to the name of the alarm included in the alarm 501 from among the plurality of detection models stored in the detection model storage unit 320 .

[0105] The cause location rate calculation unit 250 obtains the on-site confirmation item list for the administrator 130 and the SOC side confirmation item list for the analyst 150 stored in the determined detection model from the detection model storage unit 320, and calculates the on-site cause location rate and the SOC side cause location rate for the alarm 501 using the confirmation items in the obtained confirmation item list.

[0106] The cause location rate indicates the degree of possibility that the cause of the alarm can be identified on the site 110 side and the SOC 140 side respectively in response to the alarm 501 (confirmation of the situation). The site side cause location rate is calculated based on the site side confirmation item list used by the manager 130, and the SOC side cause location rate is calculated based on the SOC side confirmation item list of the SOC 140 side.

[0107] In the present embodiment, the SOC-side cause location rate is an example of the first priority, and the field-side cause location rate is an example of the second priority.

[0108] The response priority calculation unit 260 obtains the alarm score for the Severity included in the alarm 501 from the alarm importance score storage unit 400. The response priority calculation unit 260 uses the obtained alarm score of the Severity and the field side cause location rate and the SOC side cause location rate calculated by the cause location rate calculation unit 250 to calculate the field side response priority and the SOC side response priority. Specifically, the field side response priority is calculated by multiplying the field side cause location rate and the alarm score of the Severity. In addition, the SOC side response priority is calculated by multiplying the SOC side cause location rate and the alarm score of the Severity.

[0109] The response priority calculation unit 260 notifies the calculated field-side response priority and SOC-side response priority to the output unit 270. The response priority indicates the priority of the alarms to be processed among the at least one alarm 501 as the cause of analysis. The field-side response priority is the priority of the alarms to be processed by the field 110 side (that is, the alarms to be processed by the manager 130), and the SOC-side response priority is the priority of the alarms to be processed by the SOC 140 side (that is, the alarms to be processed by the analyst 150).

[0110] In the present embodiment, the SOC-side response priority is an example of the third priority, and the field-side response priority is an example of the fourth priority.

[0111] The output unit 270 outputs the notified on-site response priority and SOC side response priority. The output unit 270 may output information including the on-site response priority and SOC side response priority to at least one of the abnormality detection device 500, the information terminal of the analyst 150, and the information terminal of the manager 130 via the communication unit 280, and display the on-site response priority and SOC side response priority on the UI (User Interface) of these devices or terminals, or notify each responder using tools such as emails.

[0112] The confirmation result input unit 230 receives the result of confirming the confirmation items in the confirmation item list for the alarm 501 from the information terminal of the manager 130 or the information terminal of the analyst 150 from the communication unit 280 via the abnormality detection device 500. The received result is stored in the confirmed item storage unit 310 for each alarm.

[0113] True cause input unit 210 receives input of a true cause from information terminal of analyst 150 via abnormality detection device 500 from communication unit 280 as an analysis result of alarm 501. True cause input unit 210 notifies weight update processing unit 220 of the input true cause.

[0114] The weight update processing unit 220 updates the weight of the confirmation item list of the corresponding detection model stored in the detection model storage unit 320 using the notified true reason.

[0115] [action]

[0116] Figure 3 This is a flowchart of the response priority calculation process performed by the alarm response notification device 200 in this embodiment.

[0117] (S611) The alarm receiving unit 240 determines whether a new alarm 501 is notified by the abnormality detection device 500 via the communication unit 280. When a new alarm 501 is notified ("Yes" in step S611), the alarm response notification device 200 performs the process of step S612, and when a new alarm 501 is notified ("No" in step S611), the alarm response notification device 200 returns to the process of step S611.

[0118] ( S612 ) The alarm receiving unit 240 receives the notified alarm 501 .

[0119] Here, the details of the alarm 501 are described. Figure 4 FIG. 1 is a diagram showing an example of an alarm in this embodiment. Figure 4 In the example, alarm 501 includes: Name, Severity, TimeStamp, Src_iP, Src_port, DSt_iP, DSt_port, Protocol, and Service.

[0120] Name indicates the name of the alarm, Severity indicates the severity of alarm 501, TimeStamp indicates the time when the abnormality of alarm 501 is detected, Src_iP indicates the source IP address of the communication in which the abnormality is detected, Src_port indicates the source port number of the communication in which the abnormality is detected, DSt_iP indicates the destination IP address of the communication in which the abnormality is detected, DSt_port indicates the destination port number of the message in which the abnormality is detected, Protocol indicates the sending protocol of the communication in which the abnormality is detected, and Service indicates the service content of the communication in which the abnormality is detected.

[0121] exist Figure 4 In the example, alarm 501 indicates that an abnormality with the name of the alarm "BACnet Anomaly Write Cmd" was detected at the time "2021-12-27 10:33:23" and the severity is "High".

[0122] Furthermore, the alarm 501 only needs to include a Name and a Severity.

[0123] Back to Figure 3 Description of the response priority calculation process.

[0124] (S613) The cause ratio calculation unit 250 identifies the received alarm 501 and assigns identification numbers 1, 2, 3, and 4 in the order in which the alarms were received. That is, the identification numbers may also indicate the order in which the alarms were received.

[0125] The cause rate calculation unit 250 performs a cause rate calculation process using the received alarm 501. The cause rate calculation unit 250 notifies the response priority calculation unit 260 of the field cause rate and the SOC cause rate for the alarm 501 calculated by the cause rate calculation process.

[0126] Here, the details of the cause ratio calculation process in step S613 will be described. Figure 5 This is a flowchart of the cause ratio calculation process in this embodiment.

[0127] ( S621 ) The cause location ratio calculation unit 250 specifies a detection model that matches the Name of the received alarm 501 .

[0128] Here, the details of the detection model are described. Figure 6 FIG. 1 is a diagram showing an example of a detection model in this embodiment. Figure 6 In the example, the detection models include: detection model A, detection model B, ..., and detection model N, and each detection model is stored in the detection model storage unit 320. Each detection model corresponds to the Name (that is, the type) of the alarm 501, and includes a list of items confirmed by the SOC side and a list of items confirmed by the field side. The list of items confirmed by the SOC side is a list of items confirmed by the analyst 150. The list of items confirmed by the field side is a list of items confirmed by the manager 130. The list of items confirmed by the SOC side and the list of items confirmed by the field side each include at least one item.

[0129] Figure 7 FIG. 1 is a diagram showing an example of a detection model A in this embodiment. Figure 7 In the example, detection model A corresponds to the Name "BACnet Anomaly Write Cmd" of alarm 501.

[0130] The SOC side confirmation item list and the field side confirmation item list respectively include an item number (No.), an item name, confirmation content, and a weight.

[0131] The item name and confirmation content respectively indicate an item that the manager 130 or the analyst 150 should confirm and the content corresponding to the item.

[0132] For example, in Figure 7 No. 1 in the on-site confirmation item list includes: weight "45", item name "source maintenance confirmation", and confirmation content "confirm whether the maintenance of the source equipment has been implemented, and further confirm the content if it has been implemented".

[0133] The weight is obtained based on the history of past analysis results, and indicates the degree of probability of being the cause of the alarm, and is associated with each item. The weight value can be 1 or more. For example, in Figure 7 In the on-site confirmation item list, item No. 1 is associated with a weight of "45", item No. 2 is associated with a weight of "40", and item No. 3 is associated with a weight of "10". The manager 130 or the analyst 150 confirms the confirmation items in descending order starting from the confirmation items with the largest weight values.

[0134] In this embodiment, the first alarm 501 notified is Figure 4 The alarm named "BACnet AnomalyWrite Cmd" is for the detection model Figure 7 The example of the detection model A shown in the figure will be described below. The cause ratio calculation unit 250 specifies "detection model A" as the detection model corresponding to the alarm based on the Name of the alarm.

[0135] Back to Figure 5 Explanation of the reason for the rate calculation process.

[0136] (S622) The cause ratio calculation unit 250 obtains the determined Figure 7 The detection model A shown includes a SOC side confirmation item list and a field side confirmation item list.

[0137] (S623) The cause location rate calculation unit 250 uses the weights of the acquired on-site confirmation item list and the weights of the SOC confirmation item list to calculate the on-site cause location rate and the SOC cause location rate of the first notified alarm 501. The on-site cause location rate is calculated by (Formula 1), and the SOC cause location rate is calculated by (Formula 2).

[0138]

Number 1

[0139]

[0140]

Number 2

[0141]

[0142] The total weight of the on-site confirmation items is obtained by the total of the multiple weights associated with the multiple items included in the on-site confirmation item list. The multiple weights associated with the multiple items included in the on-site confirmation item list are examples of the second weight and the fourth weight. Similarly, the total weight of the SOC side confirmation items is obtained by the total of the multiple weights associated with the multiple items included in the SOC side confirmation item list. The multiple weights associated with the multiple items included in the SOC side confirmation item list are examples of the first weight and the third weight.

[0143] The weights of the confirmation items in the on-site confirmation item list of detection model A are 45, 40, 10, 2, and 5 in order, and the total weights of the on-site confirmation items are 102. The weights of the confirmation items in the SOC side confirmation item list of detection model A are 30, 2, 10, 2, and 4 in order, and the total weights of the SOC side confirmation items are 48.

[0144] According to (Formula 1), the cause rate on the field side is 102 / (48+102)=0.68, which is calculated as 68%. According to (Formula 2), the cause rate on the SOC side is 48 / (48+102)=0.32, which is calculated as 32%.

[0145] Back to Figure 3 Description of the response priority calculation process.

[0146] ( S614 ) The response priority calculation unit 260 obtains the alarm score corresponding to the Severity of the alarm 501 from the alarm importance score storage unit 400 .

[0147] Here, the details of the alert score are described.

[0148] Figure 8 This is a diagram showing an example of the correspondence (relationship) between the severity of an alarm and the alarm score (alert score) stored in the alarm importance score storage unit 400. The alarm score represents the severity of an alarm as a numerical value, and a larger numerical value is set as the severity of an alarm is higher.

[0149] exist Figure 8 In the figure, Severity is divided into four types, namely, Critical, High, Medium, and Low, from the top, and each indicates the degree of influence of the notified alarm 501.

[0150] exist Figure 8In the example, the score of an alarm with a Severity of "Critical" is "1400", the score of an alarm with a Severity of "High" is "1100", the score of an alarm with a Severity of "Medium" is "800", and the score of an alarm with a Severity of "Low" is "500".

[0151] Since the severity of the first alarm 501 notified is “High”, the response priority calculation unit 260 obtains “1100”, which is the “High” alarm score, from the alarm importance score storage unit 400 .

[0152] Furthermore, Severity is not limited to four types, and the alarm score corresponding to each Severity may not be as described above, but may be set to a larger value as the degree of influence of the alarm 501 indicated by the Severity increases.

[0153] ( S615 ) The response priority calculation unit 260 calculates the response priority on the site and the response priority on the SOC using the calculated cause location ratio on the site and the cause location ratio on the SOC, and the acquired alarm score. Fig. 9 1 is a diagram showing the calculation process and calculation results of the response priority calculation process for the first alarm in this embodiment. The on-site response priority is calculated by (Formula 3), and the SOC response priority is calculated by (Formula 4).

[0154]

Number 3

[0155] On-site response priority = On-site cause rate × alarm score (Formula 3)

[0156]

Number 4

[0157] SOC side response priority = SOC side cause rate × alarm score (Formula 4)

[0158] By (Formula 3), the on-site response priority is calculated as 0.68×1100=748, and by (Formula 4), the SOC response priority is calculated as 0.32×1100=352. Since there is one alarm 501 notified, the priority order of giving priority to the response of the administrator 130 of the on-site 110 is the first, and the priority order of giving priority to the response of the analyst 150 of the SOC 140 is also the first.

[0159] Here, in the case where the notified alarm 501 is the only first alarm, the priority for giving priority to the response (that is, status confirmation) of the manager 130 and the priority for giving priority to the response (that is, status confirmation) of the analyst 150 are both the first alarm. In such a case, the field-side response priority corresponding to the alarm with the highest priority is compared with the SOC-side response priority, and it is determined that the response should be implemented first from the larger one. For example, the field-side response priority for the first alarm in the present embodiment is 748, and the SOC-side response priority is 352, so it is determined that the field-side manager 130 with the larger response priority should first implement the response to the first alarm. That is, the responder who gives priority to confirming the status of the alarm among the manager 130 and the analyst 150 is determined using the field-side response priority and the SOC-side response priority. In addition, if it is the same alarm, the alarm score is also the same value, so the above comparison can also be performed by comparing the field-side cause location rate with the SOC-side cause location rate.

[0160] The response priority calculation unit 260 notifies the output unit 270 of the calculated field-side response priority and SOC-side response priority, and the priority order of responses of the manager 130 and the analyst 150 .

[0161] (S616) The output unit 270 outputs the response priority calculated in step S615 and the priority order of the alarm response, and ends the response priority calculation process. The output result is displayed on at least one UI of the abnormality detection device 500, the information terminal of the analyst 150, and the information terminal of the manager 130 via the communication unit 280. The output result is notified to at least one of the manager 130 and the analyst 150 through the UI display. In addition, the output result can also be notified to the manager 130 and the analyst 150 directly from the output unit 270 through tools such as email.

[0162] In the present embodiment, as described above, since the responder who should first perform the status confirmation in response to the first alarm is determined to be the manager 130 on the site 110 side, the output result is notified to the manager 130 .

[0163] Furthermore, when it is determined that the output result is to be notified to the administrator 130, information indicating that the administrator 130 has first confirmed the status of the first alarm may be notified to the analyst 150. Thus, even if the analyst 150 has not first confirmed the status of the first alarm, he or she can recognize that the administrator 130 has first confirmed the status of the first alarm.

[0164] The output is except Fig. 9In addition to the calculation process and / or calculation results of the response priority calculation process shown, Figure 4 The alarm information of the alarm 501 and / or the corresponding alarm Figure 7 The contents of the confirmation item list shown. In addition, the contents included in the output result may also vary depending on the output object. For example, the field side confirmation item list may be output in the output to the manager 130, and both the field side confirmation item list and the SOC side confirmation item list may be output in the output to the analyst 150. In addition, the output result may also be output in a JSON format such as {Site Possible Cause: 0.68, SOC Possible Cause: 0.32, Site Priority Value: 748, SOC Priority Value: 352}.

[0165] As an example of output, the output result notified to the administrator 130 is Fig.10 In Fig.10 Next, as the alarm with the first priority on the field side, the calculation results of the cause rate and the response priority for the first alarm, the alarm information, and the field side confirmation item list for the alarm are respectively shown.

[0166] In addition, the confirmation result and its details at the notification time for each confirmation item in the on-site confirmation item list are shown. At the time when the output result is first notified to the manager 130, since the confirmation item has not been confirmed, there is no record of the confirmation result and its details. Fig.10 Since this is an output result to be notified to the manager 130 , the SOC-side confirmation item list is not shown.

[0167] Next, use Fig.11 as well as Fig.12 The following describes the response priority calculation process when the second and third alarms 501 are notified subsequently to the first alarm 501 . Fig.11 It shows the calculation process and calculation result of the response priority calculation process for the second alarm in this embodiment. Fig.12 It is a diagram showing the calculation process and calculation results of the response priority calculation process for the third alarm in this embodiment.

[0168] exist Fig.11 In the figure, the Severity of the second alarm is "Low" and the alarm score is "500", the total weights of the corresponding detection model's on-site confirmation item list are "56", and the total weights of the SOC side confirmation item list are "84".

[0169] The cause ratio on the field side is 56 / (84+56)=0.4, which is calculated to be 40%, and the cause ratio on the SOC side is 84 / (84+56)=0.6, which is calculated to be 60%.

[0170] The on-site side response priority is calculated as 0.4×500=200, and the SOC side response priority is calculated as 0.6×500=300.

[0171] Therefore, the priority order of response of the manager 130 of the site 110 is: the first alarm, then the second alarm. The priority order of response of the analyst 150 is: the first alarm, then the second alarm.

[0172] exist Fig.12 In the figure, the Severity of the third alarm is "Medium" and the alarm score is "800". The total weights of the corresponding detection model's on-site confirmation item list are "82", and the total weights of the SOC confirmation item list are "48".

[0173] The cause rate on the field side is 82 / (48+82)=0.631··, which is calculated to be 63%, and the cause rate on the SOC side is 48 / (48+82)=0.369··, which is calculated to be 37%.

[0174] The on-site side response priority is calculated as 0.63×800=505, and the SOC side response priority is calculated as 0.37×800=295.

[0175] Therefore, the response priority of the administrator 130 of the site 110 is the first alarm, the third alarm, and the second alarm, and the response priority of the analyst 150 of the SOC 140 is the third alarm, the first alarm, and the second alarm.

[0176] When the number of notified alarms 501 is one, the calculated result is displayed on at least one UI of the abnormality detection device 500, the information terminal of the analyst 150, and the information terminal of the manager 130 from the output unit 270 via the communication unit 280, and is notified to the manager 130 and the analyst 150. In addition to the calculated result of the cause rate and the response priority for the determined alarm, the alarm information, the list of confirmation items for the alarm, and the like are output to the manager 130 and the analyst 150.

[0177] Here, the output results notified to the manager 130 and the analyst 150 are at least the output results for the alarms with the highest priority. In this embodiment, the calculation results of the cause location rate and the response priority for the first alarm and / or the list of on-site confirmation items are output to the manager 130. The calculation results of the cause location rate and the response priority for the third alarm and / or the list of SOC confirmation items are output to the analyst 150.

[0178] As an example of an output after the third alarm is notified and the response priority is calculated, the output result notified to the manager 130 is shown in Fig.13 In Fig.13 In the example, the priority of alarm response is shown first. Next, the cause rate and response priority calculation results of the first alarm, alarm information, and a list of on-site confirmation items for the alarm are shown. In addition, the confirmation results and details of each confirmation item in the on-site confirmation item list at the time of output are shown. In addition, in this embodiment, when the on-site confirmation item is output, Fig.13 At the time of the output shown, the confirmation items have not yet been confirmed, so the confirmation results and details are not recorded.

[0179] [Confirmation of project and update of response priorities]

[0180] In this embodiment, the response priorities for up to the third alarm are calculated and the calculation results are output. Fig.12 As shown, the analyst 150 of the SOC 140 is notified to start taking action from the third alarm, and the manager 130 of the site 110 is notified to start taking action from the first alarm.

[0181] That is, the manager 130 and the analyst 150 can each check the confirmation items listed in the confirmation item list corresponding to the alarm from the alarm with the highest priority. The status check is performed in descending order of the weight given to each confirmation item.

[0182] For example, the administrator 130 Fig.13 As shown, the administrator 130 is informed that the response should be taken from the first alarm, as well as the alarm information and the on-site confirmation item list. Here, the administrator 130 first confirms the confirmation content of the No. 1 item "Sending source maintenance confirmation" which is the confirmation item with the highest weight in the on-site confirmation item list of the first alarm. The confirmation content is "confirm whether the maintenance of the sending source equipment has been implemented, and further confirm the content if it has been implemented."

[0183] Next, the confirmation item input process of the alarm response notification device 200 will be described. Fig.14 This is a flowchart for confirming the item input process.

[0184] (S631) The alarm response notification device 200 waits until the administrator 130 and the analyst 150 confirm the confirmation item and input the confirmation result to the confirmation result input unit 230. If the confirmation result is input, the process of step S632 is performed. Here, the confirmation result is input by inputting to the UI displayed on the information terminal of the administrator 130 or the analyst 150, and / or directly inputting to the UI of the abnormality detection device 500, etc. The input information is input to the confirmation result input unit 230 via the abnormality detection device 500 and the communication unit 280. Here, an example of the UI used for input is shown in Fig.15 Shown in.

[0185] Fig.15 This is a UI displayed on the information terminal of the manager 130 and used by the manager 130 to input the confirmation result, and displays a list of on-site confirmation items and an input field for the confirmation result and details of each item in the on-site confirmation item list.

[0186] exist Fig.15 In the confirmation result column and detail column of each item, the administrator 130 can input content. For example, when the administrator 130 confirms the confirmation item, if an event matching the confirmation content is found, "0: Match" is entered in the confirmation result column, and if no matching event is found, "×: Not Match" is entered in the confirmation result column. In addition, the reason and / or condition entered as the confirmation result is entered in the detail column. For example, the details of the confirmation result such as "No maintenance performed", "Maintenance performed (restarting the equipment)", and "Other" are entered.

[0187] The input in the confirmation result column and the detail column may be performed by selecting from preset items or by entering a character string representing a preset item through an input device such as an information terminal.

[0188] Fig.15 The UI is contained in Fig.13 In the UI of the output result displayed to the administrator 130 as shown. That is, the display of the output result and the input of the confirmation result are performed in the same UI. In addition, it is also possible to output the abnormality detection device 500 separately from the display of the output result. Fig.15 The user interface of the computer can be used to accept input on the user interface, and input can also be accepted through tools such as email.

[0189] Fig.13 as well as Fig.15The UI displayed to the manager 130 is a UI displayed to the analyst 150. However, the UI displayed to the analyst 150 displays the SOC side confirmation item list instead of the field side confirmation item list, and further includes a UI for inputting the confirmation result of the SOC side confirmation item list. When the analyst 150 performs the confirmation of the confirmation item, the confirmation result is input through the above UI, similarly to the manager 130.

[0190] In the present embodiment, the manager 130 performs confirmation of the confirmation items, and the following description will be made of a case where "×: not in compliance" is input as the confirmation result of the item No. 1 and "maintenance not performed" is input as the details.

[0191] ( S632 ) The confirmed item storage unit 310 stores the confirmed items input to the confirmation result input unit 230 as confirmed items.

[0192] Here we explain the details of the confirmed completion items. Fig.16 FIG. 2 is a diagram showing an example of a confirmation completion item in this embodiment. Fig.16 In the , confirmed completed items are stored independently for each alarm, and the confirmed completed items for the first alarm, the second alarm, and the Nth alarm are stored in the confirmed completed item storage unit 310. In addition, the confirmed completed items for one alarm include a list of confirmed completed items on the SOC side and a list of confirmed completed items on the field side. The list of confirmed completed items on the SOC side is the items that have been confirmed completed by the analyst 150. The list of confirmed completed items on the field side is the items that have been confirmed completed by the manager 130. The list of confirmed completed items is updated when the confirmation result of the confirmation item is input into the confirmation result input unit 230. Fig.16 In the on-site side confirmed item list, the No. 1 confirmed item input by the manager 130 as the confirmed item is stored.

[0193] Next, the updating process of the response priority level performed by the alarm response notification device 200 will be described. Fig.17 This is a flowchart of the priority update process in this embodiment.

[0194] (S641) After the manager 130 or the analyst 150 confirms the confirmation item, the alarm response notification device 200 waits until the confirmation item is updated in step S632 of the confirmation item input process. If the confirmation item is updated, the process of step S642 is performed.

[0195] (S642) The cause location rate calculation unit 250 performs a cause location rate calculation process on the alarm 501 whose confirmation completion item is updated as a result of the confirmation item input process. Furthermore, the cause location rate calculation unit 250 notifies the response priority calculation unit 260 of the field side cause location rate and the SOC side cause location rate for the alarm 501 updated by the cause location rate update process.

[0196] Here, the details of the cause ratio update process in step S642 are described. Fig.18 This is a flowchart of the cause ratio calculation process in this embodiment.

[0197] (S651) The cause location rate calculation unit 250 obtains the alarm number and the detection model as information for the alarm for which the confirmation result is input in the confirmation item input process. In the present embodiment, the cause location rate calculation unit 250 obtains information indicating the first alarm, that is, the alarm number is "1" and the detection model is the detection model A "BACnet Anomaly Write Cmd", and processes the first alarm as the update target of the cause location rate.

[0198] (S652) The cause location rate calculation unit 250 determines the detection model of the alarm 501 to be updated from the detection model storage unit 320, and obtains the confirmed items included in the detection model. In addition, the confirmed items corresponding to the alarm No. of the alarm 501 to be updated are obtained from the confirmed item storage unit 310. Then, based on the difference between the obtained confirmed items and the confirmed items, the unconfirmed items on the site 110 side and the SOC 140 side are extracted.

[0199] Here, the unconfirmed items are items obtained by removing the confirmed items input into the confirmed item list from the confirmed items included in the confirmed item list of the alarm 501 to be updated. Figure 7 As shown, confirm that the completed project list is as follows Fig.16 That is, since the confirmation items have not been input to the SOC side confirmation completed items, the SOC side unconfirmed items are No. 1, 2, 3, 4, and 5. In addition, since the confirmation item No. 1 has been input to the field side confirmation completed items, the field side unconfirmed items are No. 2, 3, 4, and 5.

[0200] (S653) The cause location rate calculation unit 250 calculates and updates the cause location rate on the field side and the cause location rate on the SOC side of the update target alarm No. 1 using the unconfirmed items on the field side and the unconfirmed items on the SOC side. The cause location rate on the field side is calculated by (Formula 5), ​​and the cause location rate on the SOC side is calculated by (Formula 6).

[0201]

Number 5

[0202]

[0203]

Number 6

[0204]

[0205] The total weights of the on-site unconfirmed items are obtained by the total weights of the confirmed items stored in the on-site confirmed item list. Similarly, the total weights of the SOC confirmed items are obtained by the total weights of the confirmed items stored in the SOC confirmed item list.

[0206] Since the unconfirmed items on the field side of the first alarm to be updated are No. 2, 3, 4, and 5, the total weight of the unconfirmed items on the field side is 57. Furthermore, since the unconfirmed items on the SOC side are No. 1, 2, 3, 4, and 5, the total weight of the unconfirmed items on the SOC side is 48.

[0207] Through (Formula 5), ​​the cause rate on the field side is 57 / (48+57)=0.543··, which is calculated to be 54%. Through (Formula 6), the cause rate on the SOC side is 48 / (48+57)=0.447··, which is calculated to be 46%.

[0208] That is, the on-site cause ratio of the first alarm is updated to 54%, and the SOC cause ratio is updated to 46%.

[0209] Back to Fig.17 Description of the priority update process.

[0210] (S643) The response priority calculation unit 260 obtains the alarm score corresponding to the Severity of the alarm No. 1 to be updated from the alarm importance score storage unit 400. Then, the response priority calculation unit 260 calculates the response priority on the field side and the response priority on the SOC side using the updated cause location rate on the field side and the cause location rate on the SOC side and the obtained alarm score, and updates both.

[0211] Fig.19 It is a diagram showing the calculation process and calculation results of the response priority update process for the first alarm that is the update target in this embodiment.

[0212] The priority calculation unit 260 and Fig.15Similarly, in step S615, the field side response priority is calculated by (Formula 3), and the SOC side response priority is calculated by (Formula 4). That is, the field side response priority is calculated as 0.543×1100=597 by (Formula 3), and the SOC side response priority is calculated as 0.447×1100=503 by (Formula 4).

[0213] When the field response priority and the SOC response priority are updated, the priority of each alarm for the manager 130 and the analyst 150 is also updated. If the priority is updated and changed, the alarm that the manager 130 and the analyst 150 will respond to next may also change. Fig.19 As shown, after the response priority is updated, the response priority of the administrator 130 of the site 110 becomes: the first alarm, the third alarm, the second alarm, and the response priority of the analyst 150 of the SOC 140 becomes: the third alarm, the first alarm, the second alarm. That is, it is shown that since there is no change caused by the update of the priority order this time, the administrator 130 will prioritize the response to the first alarm next, and the analyst 150 should prioritize the response to the third alarm.

[0214] Furthermore, the response priority calculation unit 260 notifies the output unit 270 of the updated (updated) field-side response priority and SOC-side response priority, and the priority order of responses of the manager 130 and the analyst 150 .

[0215] (S644) The output unit 270 outputs the response priority and the priority order of the alarm response updated in step S643, and the response priority update process is terminated. The output result is displayed on at least one UI of the abnormality detection device 500, the information terminal of the analyst 150, and the information terminal of the manager 130 via the communication unit 280, similarly to step S616. Then, at least one of the manager 130 and the analyst 150 is notified through the UI display.

[0216] The output results include Fig.19 In addition to the calculation process and / or calculation results of the priority update processing shown, it can also include Figure 4 The alarm information of the alarm 501 and / or the corresponding alarm Figure 7 The displayed confirmation item list contains the confirmation results and their details at the current time.

[0217] In addition, when the result of the response priority update processing is that the on-site side response priority and the SOC side response priority are both 0, that is, when the analyst 150 has confirmed all the confirmation items included in the SOC side confirmation item list, and the manager 130 has confirmed all the confirmation items included in the on-site side confirmation item list, the result is output to the analyst 150.

[0218] Next, a description will be given of a response priority update process when the administrator 130 confirms the confirmation item for the first alarm whose response priority is updated. Fig. 20 This is an update result of the response priority for the first alarm, which is output to the administrator 130 after the response priority is updated. Fig. 20 In addition to the updated results for the response priority of the first alarm, it also includes the priority order of alarm response, Figure 4 The alarm information for the alarm, the list of on-site confirmation items, and the confirmation results and details up to the current time point are recorded. Fig. 20 It also serves as a UI for the administrator 130 to input the confirmation results and their details.

[0219] like Fig. 20 As shown, the manager 130 should then respond to the first alarm, which is the first in priority. Here, the manager 130 confirms the contents of the No. 2 item, which is the largest weighted confirmation item, among the items in the on-site confirmation item list for the first alarm, except for the confirmation item No. 1 that has been confirmed. Here, the item name is "Confirmation of maintenance of the destination", and the confirmation content is "Confirm whether the maintenance of the destination equipment has been implemented, and further confirm the contents if it has been implemented".

[0220] In this embodiment, the manager 130 performs confirmation of the confirmation item, and enters "0: Compliance" in the confirmation result for item No. 2, and enters "Maintenance (restarting the device)" in the details. In this case, the alarm response notification device 200 stores item No. 2 of the field side confirmation item list as a confirmation completed item through the confirmation item input process. In conjunction with this, the alarm response notification device 200 performs the second response priority update process for the first alarm.

[0221] Fig.21 It is a diagram showing the calculation process and calculation results of the second response priority update process for the first alarm in this embodiment.

[0222] Since the result of the confirmation item input processing is that the unconfirmed items on the SOC side have not changed, the total weight of the unconfirmed items on the SOC side remains unchanged at 48. In contrast, since the confirmed items on the field side include items No. 1 and 2, the unconfirmed items on the field side are items No. 3, 4, and 5, and the total weight of the unconfirmed items on the field side becomes 17. Therefore, in the cause location rate update processing of step S642, through (Formula 5), ​​the cause location rate on the field side is: 17 / (48+17)=0.262, which is calculated as 26%, and through (Formula 6), the cause location rate on the SOC side is: 48 / (48+17)=0.738, which is calculated as 74%. That is, the cause location rate on the field side of the first alarm is updated to 52%, and the cause location rate on the SOC side is updated to 48%.

[0223] Next, in step S643 of the response priority update process, the on-site response priority is calculated as 0.26×1100=288 by (Formula 3), and the SOC response priority is calculated as 0.74×1100=812 by (Formula 4). That is, the on-site response priority of the first alarm is updated to 288, and the SOC cause rate is updated to 812.

[0224] In addition, along with the update of the response priority, the priority of each alarm by the manager 130 and the analyst 150 is also further updated. Fig.21 As shown, after the second response priority update, the response priority of the administrator 130 of the site 110 becomes: the third alarm, the first alarm, the second alarm in order, and the response priority of the analyst 150 of the SOC 140 becomes: the first alarm, the third alarm, the second alarm in order. Therefore, since the priority order has changed due to the second update, the alarms that the administrator 130 and the analyst 150 will respond to next also change. That is, it is shown that the administrator 130 should give priority to responding to the third alarm next, and the analyst 150 should give priority to responding to the first alarm next. Therefore, as a result of the update of the priority order, the analyst 150 responds to the first alarm based on the confirmation result of the administrator 130 of the site 110.

[0225] Next, the response of the analyst 150 to the alarm will be described. The analyst 150, like the manager 130, usually responds in descending order from the highest priority alarm. Here, in the case where the alarm to be responded is a new alarm, or in the case where an event that matches the confirmation content that has been confirmed by the manager 130 at the site 110 does not exist and the confirmation result is "×: non-compliance", the SOC side confirmation item is confirmed as an alarm response in the same way as the manager 130. Moreover, in the process of confirming the SOC side confirmation item, if an event that matches the confirmation content exists and the confirmation result is "0: compliance", the analyst 150 determines the true cause. Alternatively, in the case where an alarm that has been confirmed by the manager 130, an event that matches the confirmation content exists and the confirmation result is "0: compliance" becomes the response target of the analyst 150, the true cause is immediately determined. In addition, when confirmation of all confirmation items included in the SOC side confirmation item list is completed and confirmation of all confirmation items included in the on-site side confirmation item list is performed by the manager 130, even if none of the confirmation results is "0: compliance", the true cause is immediately determined.

[0226] Fig. 22 In the present embodiment, after the response priority updating process is performed twice on the first alarm, the output result is notified to the analyst 150 . Fig. 22 In addition to the updated results of the second response priority for the first alarm, it also includes the priority of alarm response, the priority of Figure 4 The alarm information, SOC side confirmation item list, field side confirmation item list, and confirmation results and details up to the current time point are recorded. Fig. 22 This also serves as a UI for the analyst 150 to input the item determined as the real cause. Fig. 22 In the verification result of item No. 2 of the field side verification completed item list, "0: Compliance" is input. That is, since the first alarm is an alarm that has been confirmed by the manager 130 and an event that matches the confirmed content exists, the analyst 150 immediately determines the real cause.

[0227] The determination of the true cause is usually performed by the analyst 150 through log analysis of the communication log and / or the control log, etc., to confirm that the item that exists in the event that matches the confirmation content is the cause of the alarm. For example, in the present embodiment, for the first alarm that is notified as confirmed by the manager 130 and that matches the event No. 2 in the field-side confirmation item list, it is confirmed whether the event "maintenance of the destination device was performed and the destination device was restarted" indicated by the confirmation result is the cause of the issuance of the first alarm. Moreover, in the case where it is confirmed by the confirmation with the help of log analysis that the first alarm was issued due to the maintenance of the destination device, the item No. 2 in the field-side confirmation item list is determined as the true cause of the first alarm. On the contrary, in the case where the result of the confirmation is that the item is not confirmed to be the cause of the issuance of the first alarm, the analyst 150 interrupts the determination of the true cause and confirms the SOC-side confirmation item list.

[0228] In the event that the analyst 150 determines the true cause, use Fig. 22 The UI for inputting the true cause shown is used to input the item identified as the true cause as the true cause. The input information is input to the true cause input unit 210 from the information terminal of the analyst 150 displaying the UI via the abnormality detection device 500 and the communication unit 280 .

[0229] When the true cause of alarm issuance is input by the analyst 150, the alarm notification device 200 performs weight update processing for the confirmation items of the alarm for which the true cause is input. The weight update processing will be described in detail. Fig.23 This is a flowchart of the weight updating process in this embodiment.

[0230] (S661) The alarm response notification device 200 waits until the real cause of the alarm is input to the real cause input unit 210 by the analyst 150. If the real cause of the alarm is input, the process of step S662 is performed. Here, the real cause is input by the analyst 150, for example, to the UI displayed on the information terminal of the analyst 150 and / or the UI displayed on the abnormality detection device 500. In this embodiment, the confirmation obtained by the log analysis performed by the analyst 150 after the confirmation of the administrator 130 determines that Fig. 22 The field side confirmation item No. 2 is the real cause of the first alarm. Therefore, the analyst 150 inputs that the real cause is the field side confirmation item No. 2, and the input information is input to the real cause input unit 210 via the communication unit 280.

[0231] (S662) The weight update processing unit 220 obtains the true cause information input from the true cause input unit 210. The true cause information includes alarm information of the alarm whose true cause is input, confirmation items input as the true cause, and information on the detection model including the confirmation items.

[0232] (S663) The weight update processing unit 220 updates the weights of the list of confirmation items included in the detection model that responds to the alarm and stored in the detection model storage unit 320 based on the information obtained in step S662. The items whose weights are updated are applied to the situation where an alarm of the same detection model occurs after the next time. The weight update is performed on the weight of the confirmation item input as the true cause, for example, by adding 1 to the current weight. The added value may be a value other than 1, such as 2 or 3, or the value may be set according to the organization's operation policy. In addition, the update of the weight is not limited to addition, but may also be performed by multiplication. That is, in the update of the weight, if the update is performed in a manner that increases the weight corresponding to the item determined as the true cause, it can be performed by addition of a determined value or by multiplication of a value greater than 1.

[0233] Fig.24 An example of updating the weights of the confirmation item list of the detection model A in the present embodiment is shown. Fig.24 The figure shows that the item "Sending destination maintenance confirmation" is the real cause as the confirmation item No. 2 in the on-site confirmation item list of the detection model A. Before the update, the weight of the item "Sending destination maintenance confirmation" was 40, and after the update, it became 41. In addition, usually, the items whose weights are updated by the update are only the items input as the real cause, but when there are multiple real causes, multiple items can be updated.

[0234] (S664) The alarm response notification device 200 closes the alarm for which the real cause has been input, and ends the response to the alarm. In addition, according to the output results notified to the manager 130 and the analyst 150, the display of the cause rate, response priority, priority order, etc. for the closed alarm is deleted.

[0235] The manager 130 and the analyst 150 do not confirm the confirmation items after the alarm is closed. In this embodiment, No. 2 input as the field side confirmation item list is the real reason for closing the first alarm. Therefore, for the first alarm, the manager 130 may not confirm the items No. 3, 4, and 5 of the field side confirmation item list, and the analyst 150 may not confirm the items No. 1-5 of the SOC side confirmation item list.

[0236] (Effects of Embodiments)

[0237] According to the alarm response notification device 200 of the present embodiment, when an alarm 501 is issued, the cause rate is calculated based on the weights of the confirmation items obtained by reflecting the analysis results of past alarms, thereby making it possible to determine which of the administrator 130 on the site 110 side and the analyst 150 on the SOC 140 side should first perform status confirmation for the alarm 501, and to make a notification together with the information used for status confirmation.

[0238] The notification from the alarm response notification device 200 allows the analyst 150 to recognize whether it is better to immediately start the confirmation of the confirmation items as the status confirmation for the notified alarm, or whether it is better to wait for the manager 130 to confirm the confirmation items and be notified of the information for the site 110. In addition, the manager 130 can recognize whether it is necessary to confirm the confirmation items for the notified alarm and whether it is necessary to input the confirmation results.

[0239] In this way, since the analyst 150 and the manager 130 can mutually recognize whether or not to perform status confirmation in advance for the notified alarm, the alarm response can be made more efficient.

[0240] In addition, according to the alarm response notification device 200 of the present embodiment, it is also possible to notify the administrator 130 and the analyst 150 of the cause location rate and the response priority calculated based on the degree indicating the magnitude of the impact of the alarm 501. The response priority is a degree indicating the priority of the alarm to be processed among at least one alarm 501 that is the object of cause analysis.

[0241] Therefore, when multiple alarms are notified, the manager 130 and the analyst 150 can identify which alarm to respond to. For example, the analyst 150 can recognize that since the information of the site 110 is required, the SOC side cause rate is low, so it is better to respond to the alarm with a high SOC side cause rate and a high SOC side response priority, which can be analyzed immediately, rather than the alarm with a low SOC side response priority. In addition, for example, even if the cause rates of multiple alarms are the same, the response priority changes when the size of the impact of each alarm is different, so it is possible to identify which alarm has a greater impact and respond in order.

[0242] Thus, the manager 130 and the analyst 150 can improve the efficiency of alarm response and suppress the influence on the control system 120 and the like by performing alarm response in the order of priority indicated by the response priority.

[0243] Furthermore, according to the alarm response notification device 200 of the present embodiment, the cause rate and the response priority can be dynamically updated according to the progress of the alarm response, and the update can be notified to the manager 130 and the analyst 150. Therefore, for example, the analyst 150 can recognize whether to continue the analysis or obtain information related to the site 110 for the alarm being analyzed, and the manager 130 can recognize whether to continue the confirmation work with the site 110 and the provision of information to the analyst 150 or return to normal business.

[0244] Thus, the manager 130 and the analyst 150 can select the most appropriate response at that point in time for the alarm being responded to, such as whether to continue the response, to interrupt the response and switch to another alarm, or to end the response.

[0245] In addition, according to the alarm response notification device 200 of this embodiment, it is possible to update the degree of possibility of being the cause of the alarm, that is, the weight, every time the analysis of the alarm is completed. The weight represents the priority of the confirmation of each confirmation item in the confirmation item list for a certain alarm 501, and is used to calculate the cause location rate.

[0246] This allows the analysis results of past trends and / or causes of the same type of alarm to be reflected in the priority order of confirmation of each confirmation item and / or the cause location rate, thereby making alarm response more efficient.

[0247] The alarm response notification method of this embodiment can also be as follows Fig.25Executed as shown. The alarm response notification method is an alarm response notification method executed by the alarm response notification device 200. In the alarm response notification method, the alarm response notification device 200 receives an alarm indicating an abnormality that has occurred in the OT environment (S671). Next, the alarm response notification device 200 determines the confirmation information corresponding to the type of alarm based on the multiple confirmation information stored in the storage unit 300 of the alarm response notification device 200, which respectively indicates the content of the status confirmation of the corresponding type of alarm, and the received alarm (S672). Here, the multiple confirmation information respectively includes: a first item (an item included in the SOC side confirmation item list) associated with the first weight and indicating the content of the first status confirmation performed by the first responder, and a second item (an item included in the field side confirmation item list) associated with the second weight and indicating the content of the second status confirmation performed by the second responder. Next, the alarm response notification device 200 uses the first weight and the second weight determined based on the determined confirmation information to determine the responder who has priority in confirming the status of the received alarm (S673). The alarm response notification device 200 notifies the items corresponding to the determined responders (S674). Specifically, when the first responder is determined as the responder, the alarm response notification device 200 notifies the first responder of the first item, and when the second responder is determined as the responder, the alarm response notification device 200 notifies the second responder of the second item.

[0248] As a result, an appropriate responder can be determined each time an alarm is issued, and the responder can be notified together with information for confirming the situation, thereby making it possible to more efficiently respond to the alarm.

[0249] The alarm response notification method of this embodiment also includes: when receiving the first completion information indicating that the first responder has completed the first status confirmation, notifying the second item to the second responder; when receiving the second completion information indicating that the second responder has completed the second status confirmation, notifying the first item to the first responder.

[0250] Thus, in response to an alarm in which the status check has been completed by one responder, the details of the status check can be immediately notified to the other responder.

[0251] In the alarm response notification method of the present embodiment, each of the multiple confirmation information also includes: a third item associated with a third weight and indicating the content of the third condition confirmation performed by the first responder (other items included in the SOC side confirmation item list), and a fourth item associated with a fourth weight and indicating the content of the fourth condition confirmation performed by the second responder (other items included in the field side confirmation item list). In the decision, the responder is determined using the first weight, the second weight, the third weight, and the fourth weight determined based on the confirmation information corresponding to the type of the received alarm. In the notification of the first item, the first item and the third item are notified to the first responder in the order of weight from large to small. In the notification of the second item, the second item and the fourth item are notified to the second responder in the order of weight from large to small.

[0252] Thus, even when the content of the status confirmation performed by each responder in response to the alarm includes multiple items, it is possible to determine which of the first responder and the second responder first performs the status confirmation for the alarm. In addition, the status confirmation items can be notified to the responder in descending order of the weight associated with each item, so that the responder can effectively perform the status confirmation.

[0253] The alarm response notification method of the present embodiment also includes: when receiving completion information indicating the completion of one of the first status confirmation, the second status confirmation, the third status confirmation and the fourth status confirmation, using the weight obtained by removing the weight associated with the item indicating the content of the status confirmation shown in the completion information from the first weight, the second weight, the third weight, and the fourth weight, the responder is determined again, and the item obtained by removing the item indicating the content of the status confirmation shown in the completion information from the first item, the second item, the third item, and the fourth item is notified to the responder.

[0254] This makes it possible to dynamically determine the responder according to the progress of the alarm status confirmation, and to successively notify the responder.

[0255] In the alarm response notification method of this embodiment, the first responder is an analyst who analyzes the cause of the alarm. The second responder is a manager who manages the OT environment. In the notification of the second item, the second responder is also notified to the first responder that the second responder first confirms the status of the alarm.

[0256] Thus, the analyst can recognize that the administrator has previously performed status confirmation on the issued alarm. That is, the analyst can recognize the current situation even on the alarm for which the analyst should not have previously performed status confirmation.

[0257] In the alarm response notification method of the present embodiment, each of the plurality of confirmation information further includes: a third item associated with a third weight and indicating the content of the third status confirmation performed by the first responder, and a fourth item associated with a fourth weight and indicating the content of the fourth status confirmation performed by the second responder. The alarm response notification method further includes: when receiving completion information indicating that the second status confirmation or the fourth status confirmation is completed, using the weight obtained by removing the weight associated with the item indicating the content of the status confirmation shown to be completed by the completion information from the second weight and the fourth weight, re-determining the responder, notifying the first responder of the item indicating the content of the status confirmation shown to be completed by the completion information and the confirmation result of the status confirmation, notifying the first responder of the first item when the first responder is determined as the responder in the re-determination, and notifying the second responder of the item obtained by removing the item indicating the content of the status confirmation shown to be completed by the completion information when the second responder is determined as the responder in the re-determination.

[0258] Thus, the analyst can be notified of the item whose status is confirmed by the manager and the on-site information obtained as a result of the status confirmation for the item. Therefore, the analyst can perform alarm response such as status confirmation and / or cause analysis based on the on-site information.

[0259] The alarm response notification method of the present embodiment also includes: receiving a true cause item representing an item related to the cause of the alarm from the first responder, determining the item represented by the true cause item from the first item, the second item, the third item, and the fourth item, and updating the weight associated with the determined item in a manner that is further increased.

[0260] Thus, when the same type of alarm is issued and notified next time, the updated weight can be used to determine which of the first responder and the second responder should first perform the status confirmation. That is, the determination can be made based on the response history of the alarm that occurred previously, and an effective alarm response can be performed.

[0261] In the alarm response notification method of the present embodiment, the first weight and the second weight are used to calculate the first priority (SOC side cause location rate) indicating the degree to which the first responder prioritizes confirming the alarm status, and the second priority (field side cause location rate) indicating the degree to which the second responder prioritizes confirming the alarm status. When the first priority is higher than the second priority, the first responder is determined as the responder, and when the second priority is higher than the first priority, the second responder is determined as the responder.

[0262] In the alarm response notification method of the present embodiment, when multiple alarms are received during alarm reception, the following are further performed: for each of the multiple alarms received, the first priority of the alarm is calculated, and in descending order of the first priorities, the first priority for implementing status confirmation of the multiple alarms is determined; for each of the multiple alarms received, the second priority of the alarm is calculated, and in descending order of the second priorities, the second priority for implementing status confirmation of the multiple alarms is determined; the first priority and the first item corresponding to the alarm with the highest first priority among the multiple alarms are notified to the first responder, and the second priority and the second item corresponding to the alarm with the highest second priority among the multiple alarms are notified to the second responder.

[0263] Thus, when multiple alarms are received, by comparing the calculated multiple first priorities, the priority of the status confirmation for the first responder can be determined and notified. Similarly, by comparing the calculated multiple second priorities, the priority of the status confirmation for the second responder can be determined and notified. Therefore, even in a situation where multiple alarms are issued, each responder can grasp the priority of the status confirmation and can effectively respond to the alarm.

[0264] In the alarm response notification method of the present embodiment, when a plurality of alarms are received in the alarm reception, each of the plurality of alarms includes a degree of severity indicating the magnitude of the impact caused by the alarm. The alarm response notification method further includes: for each of the plurality of received alarms, a third priority (SOC side response priority) is calculated by multiplying the first priority of the alarm by the severity, and a first priority for confirming the status of the plurality of alarms is determined in descending order of the third priorities; for each of the plurality of received alarms, a fourth priority (field side response priority) is calculated by multiplying the second priority of the alarm by the severity, and a second priority for confirming the status of the plurality of alarms is determined in descending order of the fourth priorities; the first priority and a first item corresponding to the alarm with the highest first priority among the plurality of alarms are notified to the first responder, and the second priority and a second item corresponding to the alarm with the highest second priority among the plurality of alarms are notified to the second responder.

[0265] Thus, the priority of the situation confirmation can be determined taking into account the severity of the alarm. Therefore, for alarms with high severity, the priority of the situation confirmation can be determined to be higher than that of alarms with low severity, so that responders can prioritize the situation confirmation, thereby suppressing the impact of the alarm.

[0266] In the alarm response notification method of the present embodiment, each of the plurality of confirmation information further includes: a third item associated with a third weight and indicating the content of a third status confirmation performed by a first responder, and a fourth item associated with a fourth weight and indicating the content of a fourth status confirmation performed by a second responder. The alarm response notification method further includes: upon receiving completion information indicating completion of one of the first status confirmation, the second status confirmation, the third status confirmation, and the fourth status confirmation, recalculating the first priority and the second priority using a weight obtained by removing the weight associated with the item indicating the content of the status confirmation completed by the completion information from the first weight, the second weight, the third weight, and the fourth weight.

[0267] In the alarm response notification method of the present embodiment, each of the plurality of confirmation information further includes: a third item associated with a third weight and indicating the content of a third status confirmation performed by a first responder, and a fourth item associated with a fourth weight and indicating the content of a fourth status confirmation performed by a second responder. The alarm response notification method further includes: upon receiving completion information indicating completion of one of the first status confirmation, the second status confirmation, the third status confirmation, and the fourth status confirmation, recalculating the first priority and the second priority using a weight obtained by removing the weight associated with the item indicating the content of the status confirmation indicated by the completion information from the first weight, the second weight, the third weight, and the fourth weight, and recalculating the third priority and the fourth priority using the recalculated first priority and second priority for the alarm.

[0268] As a result, the priority of the alarm status confirmation can be dynamically updated according to the progress of the responder's status confirmation, so the alarm response can be made more efficient as a whole.

[0269] (Variation Example)

[0270] The above is an example of the technology disclosed in the present invention. However, the technology disclosed in the present invention is not limited thereto, and can also be applied to embodiments that have been appropriately changed, replaced, added, omitted, etc. For example, the following modified examples are also included in an embodiment of the present invention.

[0271] (1) In the above embodiment, the output result of the alarm response notification device 200 is displayed on at least one UI in the information terminal of the analyst 150 or the information terminal of the manager 130 via the abnormality detection device 500, but the alarm response notification device 200 may output the result to an external server and / or cloud via the information communication network. In addition, when the manager 130 and the analyst 150 obtain the output result output to the abnormality detection device 500 and / or the external server, cloud, etc. through communication using the information terminal, user authentication may be requested of the manager 130 and the analyst 150. In addition, output corresponding to the determined user may be performed through user authentication. For example, when the output result is requested from the manager 130 through authentication, the output to the manager 130 may be performed such as displaying the on-site confirmation item list, and when the output result is requested from the analyst 150 through authentication, the output to the analyst 150 may be performed such as displaying both the on-site confirmation item list and the SOC side confirmation item list, and the output content may be changed.

[0272] (2) In the above-mentioned embodiment, the response priority update process is implemented every time the confirmation item input process is performed and the confirmation completion item is updated, but it can also be implemented at each certain period regardless of the update of the confirmation completion item. The certain period can be set to tens of minutes and / or hours, or it can be set to daily. In addition, for example, the response priority update process can be implemented sequentially for all notified alarms at each certain period, or the response priority update process can be implemented successively for alarms that have been notified or that have passed a certain period since the last response priority was updated.

[0273] (3) In the above embodiment, in each confirmation item list included in the detection model, one confirmation item includes one confirmation matter, but the structure of the confirmation item list is not limited to this. For example, one confirmation item may also include multiple confirmation matters. Fig.26 An example is shown in the on-site confirmation item list. Fig.26 The list of on-site confirmation items in Figure 7 A modified example of the on-site confirmation item list shown in FIG. Figure 7 A modified example is obtained by integrating the two confirmation items No. 1 and 2 in the on-site confirmation item list, namely the item names "sending source maintenance confirmation" and "sending destination maintenance confirmation" into one confirmation item. Fig.26In the example, the two items are combined, and the weights assigned to the confirmation items are also integrated, so that the weights of "45" and "40" respectively become "85". By configuring the confirmation item list in this way, the manager 130 or the analyst 150 can recognize that multiple confirmation items with similar confirmation contents and / or multiple confirmation items that are more efficient to be confirmed together than to be confirmed independently should be confirmed together, thereby further improving the efficiency of alarm response.

[0274] (4) In the above-mentioned embodiment, in the confirmation of confirmation items performed by the manager 130 and the analyst 150, the confirmation result is input each time a confirmation item is confirmed, and the response priority after the result is updated is referred to to determine whether to confirm the next confirmation item or to interrupt the confirmation. However, it is also possible to perform confirmation of multiple confirmation items at once instead of just one confirmation item and then input the confirmation result. For example, in addition to multiple confirmation items with similar confirmation contents, and / or multiple confirmation items that are more efficient to confirm together than to confirm independently, multiple confirmation items that are assigned weights greater than a certain size may also be confirmed at once and then the confirmation result may be input. In addition, the multiple confirmation items that are more efficient to confirm at one time as described above may be grouped and displayed in a confirmation item list, etc. Fig. 27 An example is shown in the on-site confirmation item list. Fig. 27 The list of on-site confirmation items in Figure 7 The modification example of the field side confirmation item list shown in FIG. 1 is a modification example obtained by grouping the confirmation items with a weight of 15 or more, the confirmation items with a weight of less than 15, and the other three. That is, the confirmation items No. 1 and 2 are grouped, the confirmation items No. 3 and 4 are grouped, and the confirmation item No. 5 (others). Therefore, the manager 130 can recognize that the confirmation items No. 1 and 2 only need to be confirmed in a batch. By setting the configuration of the confirmation item list as such, the manager 130 and the analyst 150 can recognize the confirmation items that are best confirmed in a batch at once, so that the alarm response can be further efficient.

[0275] (5) When there is only one alarm to be notified, the alarm response notification device 200 may immediately notify the second responder of the second item when the first responder has first confirmed the status of the first item, and may immediately notify the first responder of the first item when the second responder has first confirmed the status of the second item. In the above embodiment, for example, when the analyst 150 first confirms the status, the alarm response notification device 200 may immediately notify the manager 130 together with the confirmation item that the manager 130 should next confirm when the analyst 150 has confirmed all the confirmation items included in the SOC-side confirmation item list. In addition, when the manager 130 first confirms the status, the alarm response notification device 200 may immediately notify the manager 130 of the confirmation that the analyst 150 should next confirm, the confirmation items, and the confirmation result by the manager 130 when the manager 130 has confirmed all the confirmation items included in the field-side confirmation item list. Thus, when one responder has no items to confirm, the other responder can quickly start confirmation.

[0276] (6) In the above embodiment, the output results of the cause rate and / or the response priority, priority order, etc. are notified to the manager 130 and the analyst 150. Fig.10 , Fig.13 , Fig. 20 As shown, the list is displayed in the UI in the form of a list, and then displayed together with the alarm information and / or the confirmation item list for the scheduled alarm, but the display of the output result is not limited to this, and it can also be replaced or omitted as appropriate. For example, in the output to the manager 130, if the priority of the alarm response can be identified, the display of the cause rate and / or the response priority for the scheduled alarm can also be omitted. In addition, as a matter that is not directly related to the confirmation content of the on-site confirmation item list, the alarm information such as Name, Severity, etc. can also be omitted.

[0277] (7) In addition, the output results of the cause rate and / or the response priority, priority order, etc. may be displayed in a UI in a bar format, for example, in addition to a list format. An example of a UI display in a bar format is shown in FIG. Fig.28 Shown in. Fig.28 In this embodiment, Fig.12 Graph showing the cause ratio, alarm score, and response priority of each alarm from the 1st to the 3rd alarm in a bar format.

[0278] exist Fig.28In the example, each alarm is represented by a bar, and the bar is composed of three bars representing the first, second, and third alarms and a baseline. Here, the length of each bar corresponds to the alarm score assigned to each alarm. The length of the bar for the first alarm is 1100, the length of the bar for the second alarm is 500, and the length of the bar for the third alarm is 800.

[0279] In addition, the bars are arranged at equal intervals in the vertical direction of the drawing, for example, in the order of the alarm No., and in the horizontal direction, sandwiching the reference line and corresponding to the ratio of the SOC side cause location rate and the field side cause location rate. Fig.28 When the left side of the reference line is shown as the area on the SOC 140 side and the right side is shown as the area on the site 110 side, the SOC side cause location rate of the first alarm is 32% and the site side cause location rate is 68%, so the arrangement is such that 32% of the area from the left end of the bar of the first alarm is located on the SOC 140 side and 68% of the area from the right end is located on the site 110 side. That is, the arrangement of the bars in the left and right directions shows the SOC side cause location rate and the site side cause location rate of the alarm represented by the bar.

[0280] In addition, the length from the baseline to the left end of each bar, and the length to the right end are respectively shown on the left and right of each bar. In the bar of the first alarm, the length from the baseline to the left end of the bar is 0.32×1100=352, and the length from the baseline to the right end of the bar is 0.68×1100=748. These equations and values ​​are respectively consistent with the calculation equation of the SOC side response priority shown in (Equation 3) and the calculation equation of the field side response priority shown in (Equation 4), as well as the various response priorities for the first alarm. That is, the length from the baseline to the left and right ends of each bar shows the SOC side response priority and the field side response priority of the alarm represented by the bar. Therefore, as Fig.28 As shown, in the case of bars displaying more than one alarm, the bar with the longest length from the baseline to the left end of the bar indicates the alarm for which the response priority on the SOC 140 side is the first, and the bar with the longest length from the baseline to the right end of the bar indicates the alarm for which the response priority on the site 110 side is the first.

[0281] Thus, by showing the cause rate, response priority, and priority order in a bar format, the manager 130 and the analyst 150 can visually recognize the priority order of the alarm and / or the response status of multiple alarms without viewing the detailed values. In addition, the configuration of the bar of each alarm can be updated when various values ​​are updated by the response priority update process or at any other timing. Fig.28In the figure, the right side area may be set as the area on the SOC 140 side, and the left side area may be set as the area on the site 110 side. In addition, the display of the ratio of the cause rate and / or the value indicating the priority of the response may be omitted.

[0282] In addition, when any alarm bar is selected, alarm information about the alarm, a list of confirmation items, confirmation results and details of each item in the confirmation item list, etc. may be displayed. Furthermore, these displays may also be combined with a UI for inputting confirmation results and details and / or a UI for inputting the real cause. In addition, the highest priority alarms on the site 110 side and the SOC 140 side may be always displayed without selecting any alarm bar. In addition, the above display may exist in the same Fig.28 The bar format output can be displayed at any position of the same UI, or it can be displayed on a UI different from the bar format output.

[0283] (8) In the above modification (7), the update history and change information of the response priority of each alarm may be further displayed as a track together with each bar. An example of track display is shown in Fig.29 Shown in. Fig.29 In this embodiment, the response priorities of the first, second, and third alarms are output in a bar format after the second response priority update process for the first alarm is performed, and are displayed together with Fig.21 The status shown corresponds to Fig.29 In the example, the first alert bar is processed through 2 response priority updates, from Fig.28 The configuration of the first alarm shown has changed. Here, Fig.28 The configuration of the first alarm shown, that is, the historical record information indicating the initial state at the time when the alarm was notified is shown as a trajectory with a dotted line. By displaying it together with the trajectory in a bar format output, for example, the manager 130 can recognize that the result of the confirmation work on the first alarm is that the priority on the site 110 side has become lower, and the analyst 150 can recognize that the change is in the situation that the response to the first alarm should be given priority. That is, changes in the response history and / or response status of the alarm can be visually recognized. In addition, in addition to indicating the initial response priority at the time when the alarm was notified, the displayed trajectory can also indicate the response priority until the most recent response priority update process was performed, and can also indicate the response priority at a certain period of time ago. In addition, the displayed trajectory is not limited to only one, and multiple trajectories can be displayed such that a trajectory is displayed every time an update is performed.

[0284] Industrial Applicability

[0285] The present disclosure is useful for selecting a response priority for efficient analysis in response to an alarm occurring in a control system.

[0286] Description of symbols

[0287] 110 Scene

[0288] 120 Control System

[0289] 130 Manager

[0290] 140SOC

[0291] 150 Analysts

[0292] 200 Alarm response notification device

[0293] 210 True reason input section

[0294] 220 Weight update processing unit

[0295] 230 Confirmation result input section

[0296] 240 Alarm receiving unit

[0297] 250 Cause rate calculation department

[0298] 260 Response Priority Calculation Department

[0299] 270 Output

[0300] 280 Ministry of Communications

[0301] 290 Decision Department

[0302] 300 Storage

[0303] 310 Confirmation of completion of project storage department

[0304] 320 Detection model storage unit

[0305] 400 Alarm importance score storage unit

[0306] 501 Alert.

Claims

1. An alarm response notification method is an alarm response notification method performed by an alarm response notification device, comprising: Receive alerts indicating anomalies that have occurred in the OT environment, i.e. the operational technology environment, Based on a plurality of confirmation information stored in a storage unit possessed by the alarm response notification device, each of which indicates the content of a status confirmation performed on an alarm of a corresponding type, and the received alarm, the confirmation information corresponding to the type of the alarm is determined, each of the plurality of confirmation information including: a first item associated with a first weight and indicating the content of a first status confirmation performed by a first responder, and a second item associated with a second weight and indicating the content of a second status confirmation performed by a second responder, using the first weight and the second weight determined based on the determined confirmation information, to determine a responder, of the first responder and the second responder, who is to prioritize in confirming the status of the received alarm; When the first responder is determined as the responder, notifying the first responder of the first item, and When the second respondent is determined as the respondent, the second item is notified to the second respondent.

2. The alarm response notification method according to claim 1, further comprising: Upon receiving first completion information indicating that the first responder has completed the first status confirmation, notifying the second responder of the second item, When receiving second completion information indicating that the second respondent has completed the second status confirmation, the first item is notified to the first respondent.

3. The alarm response notification method according to claim 1, Each of the plurality of confirmation information further includes: a third item associated with a third weight and indicating the content of a third status confirmation performed by the first responder, and a fourth item associated with a fourth weight and indicating the content of a fourth status confirmation performed by the second responder, In the determination, the responder is determined using the first weight, the second weight, the third weight, and the fourth weight determined based on confirmation information corresponding to the type of the received alarm, In the notification of the first item, the first item and the third item are notified to the first respondent in descending order of weight, In the notification of the second item, the second item and the fourth item are notified to the second respondent in descending order of weight.

4. The alarm response notification method according to claim 3, further comprising: When completion information indicating completion of one of the first status confirmation, the second status confirmation, the third status confirmation, and the fourth status confirmation is received, re-determining the responder using a weight obtained by excluding a weight associated with an item indicating content of status confirmation indicated as completed by the completion information from among the first weight, the second weight, the third weight, and the fourth weight; and The responder is notified of the items obtained by removing the items indicating the status confirmation that the completion information indicates completion from the first item, the second item, the third item, and the fourth item.

5. The alarm response notification method according to claim 1, The first responder is an analyst who analyzes the cause of the alarm. The second responder is the manager who manages the OT environment, i.e., the operational technology environment. In the notification of the second item, the first responder is further notified that the second responder has previously confirmed the status of the alarm.

6. The alarm response notification method according to claim 5, Each of the plurality of confirmation information further includes: a third item associated with a third weight and indicating the content of a third status confirmation performed by the first responder, and a fourth item associated with a fourth weight and indicating the content of a fourth status confirmation performed by the second responder, The alarm response notification method further includes: When receiving completion information indicating completion of the second status confirmation or the fourth status confirmation, The responder is determined again using a weight obtained by removing a weight associated with an item indicating content of status confirmation indicated as completed by the completion information from the second weight and the fourth weight, notifying the first responder of items indicating the contents of the status confirmation completed by the completion information and the confirmation result of the status confirmation, When the first respondent is determined as the respondent in the re-determination, notifying the first respondent of the first item, and When the second respondent is determined as the respondent in the re-determination, the second respondent is notified of items excluding items indicating the status confirmation that the completion information indicates completion.

7. The alarm response notification method according to claim 6, further comprising: receiving a true cause item from the first responder, the true cause item indicating an item related to the cause of the alarm, Determine the item indicated by the true cause item from among the first item, the second item, the third item, and the fourth item, and The weight associated with the identified item is updated so as to become larger.

8. The alarm response notification method according to claim 1, In the respondent's decision, Using the first weight and the second weight, a first priority indicating the degree to which the first responder prioritizes confirmation of the alarm status and a second priority indicating the degree to which the second responder prioritizes confirmation of the alarm status are calculated, When the first priority is higher than the second priority, determining the first responder as the responder, and When the second priority is higher than the first priority, the second responder is determined as the responder.

9. The alarm response notification method according to claim 8, In the receiving of the alarm, when multiple alarms are received, the method further includes: For each of the plurality of received alarms, the first priority of the alarm is calculated, and a first priority for confirming the status of the plurality of alarms is determined in descending order of the first priority. For each of the plurality of received alarms, the second priority of the alarm is calculated, and a second priority for confirming the status of the plurality of alarms is determined in descending order of the second priority. notifying the first responder of the first priority and the first item corresponding to the alarm having the highest first priority among the plurality of alarms, and The second responder is notified of the second priority and the second item corresponding to the alarm having the highest second priority among the plurality of alarms.

10. The alarm response notification method according to claim 8, In receiving the alarm, when a plurality of alarms are received, each of the plurality of alarms includes a degree indicating a magnitude of an impact caused by the alarm, that is, a severity. The alarm response notification method further includes: For each of the plurality of received alarms, a third priority is calculated by multiplying the first priority of the alarm by the severity, and a first priority for implementing status confirmation of the plurality of alarms is determined in descending order of the third priorities, For each of the plurality of received alarms, a fourth priority is calculated by multiplying the second priority of the alarm by the severity, and a second priority for status confirmation of the plurality of alarms is determined in descending order of the fourth priorities, notifying the first responder of the first priority and the first item corresponding to the alarm having the highest first priority among the plurality of alarms, and The second responder is notified of the second priority and the second item corresponding to the alarm having the highest second priority among the plurality of alarms.

11. The alarm response notification method according to claim 8, Each of the plurality of confirmation information further includes: a third item associated with a third weight and indicating the content of a third status confirmation performed by the first responder, and a fourth item associated with a fourth weight and indicating the content of a fourth status confirmation performed by the second responder, The alarm response notification method further includes: When completion information indicating completion of one of the first status confirmation, the second status confirmation, the third status confirmation, and the fourth status confirmation is received, The first priority and the second priority are calculated again using the weights obtained by excluding the weights associated with the items indicating the contents of the status confirmation indicated as completed by the completion information from the first weight, the second weight, the third weight, and the fourth weight.

12. The alarm response notification method according to claim 10, Each of the plurality of confirmation information further includes: a third item associated with a third weight and indicating the content of a third status confirmation performed by the first responder, and a fourth item associated with a fourth weight and indicating the content of a fourth status confirmation performed by the second responder, The alarm response notification method further includes: When completion information indicating completion of one of the first status confirmation, the second status confirmation, the third status confirmation, and the fourth status confirmation is received, recalculating the first priority and the second priority using the weight obtained by removing the weight associated with the item indicating the content of the status confirmation indicated as completed by the completion information from the first weight, the second weight, the third weight, and the fourth weight, and The third priority level and the fourth priority level are calculated again using the recalculated first priority level and the second priority level for the alarm.

13. A program for causing a computer to execute the alarm response notification method according to any one of claims 1 to 12.

14. An alarm response notification device, comprising: A communication unit that receives an alarm indicating an abnormality that has occurred in the OT environment, i.e., the operational technology environment; a storage unit storing a plurality of confirmation information each indicating the content of status confirmation performed on an alarm of a corresponding type; and a decision unit that decides a responder, among a first responder and a second responder, that is to prioritize the status of the received alarm; Each of the plurality of confirmation information includes: a first item associated with a first weight and indicating the content of a first status confirmation performed by the first respondent, and a second item associated with a second weight and indicating the content of a second status confirmation performed by the second respondent, The decision unit decides the responder using the first weight and the second weight determined based on confirmation information corresponding to the type of the received alarm, The communication unit notifies the first responder of the first item when the first responder is determined as the responder, and notifies the second responder of the second item when the second responder is determined as the responder.

Images