Anomaly detection method, monitoring device, and program

Abstract

The abnormality detection method according to the present disclosure is executed in a monitoring device that monitors communication between a first power device and a second power device, the first power device being configured to be capable of performing at least one of power supply and power reception with a connected charge / discharge device, the second power device controlling the first power device. The abnormality detection method includes performing abnormality detection based on transceiving information that is transceived between the first power device and the second power device. The abnormality detection method includes determining an analysis priority for analyzing a detection event based on an abnormality score of the detection event and information on power tightness, the detection event being a safety event detected by the abnormality detection, the power tightness indicating a degree of tightness of a power demand at a detection time point.

Description

Technical Field

[0001] This disclosure relates to anomaly detection methods, monitoring devices, and procedures. Background Technology

[0002] In power equipment (facilities) such as power plants and electric vehicle charging stations, cyberattacks could potentially cause damage due to excessive load or errors (unauthorized access). Therefore, as countermeasures against cyberattacks targeting power equipment, efforts are underway to install intrusion detection systems (IDS) to detect cyberattacks, implement security monitoring systems, or conduct research on these measures.

[0003] For example, Patent Document 1 discloses a technology that aims to determine the priority of a cyberattack in real time based on the evolving situation of the cyberattack, making it easier to determine the best countermeasure to minimize the damage caused by the cyberattack.

[0004] Existing technical documents

[0005] Patent documents

[0006] Patent Document 1: Japanese Patent Application Publication No. 2022-191649 Summary of the Invention

[0007] In this context, if a cyberattack on power equipment occurs during a power shortage (power supply and demand imbalance) where electricity demand is high and supply is low, the damage could be amplified. However, countermeasures for security incidents such as cyberattacks on power equipment do not take into account the degree of power shortage, which indicates the extent of the power shortage, and there is room for improvement in handling anomalies in power equipment.

[0008] One of the purposes of this disclosure is to enable the proper handling of anomalies in electrical equipment, even in situations of power shortage.

[0009] The anomaly detection method disclosed herein is executed in a monitoring device that monitors communication between a first power device and a second power device, the first power device being configured to perform at least one of supplying or receiving power with a connected charging / discharging device, and the second power device controlling the first power device. The anomaly detection method includes detecting anomalies based on transmitted and received information between the first and second power devices. The anomaly detection method further includes determining the analysis priority of the detected event based on an anomaly score and information regarding power scarcity, the detected event being a security event detected through the anomaly detection, the power scarcity indicating the degree of power demand scarcity at the detection time. Attached Figure Description

[0010] Figure 1 This is a diagram illustrating an example of the configuration of the charging system according to the first embodiment.

[0011] Figure 2 This diagram illustrates an example of the configuration of the security monitoring server according to the first embodiment.

[0012] Figure 3 This diagram illustrates an example of the configuration of the charging station management server according to the first embodiment.

[0013] Figure 4 This is a diagram illustrating an example of the configuration of the charging device according to the first embodiment.

[0014] Figure 5 This is a diagram illustrating an example of the hardware structure of the information processing device for implementing the charging system according to the first embodiment.

[0015] Figure 6 This is a diagram illustrating an example of the structure of the charging history table according to the first embodiment.

[0016] Figure 7 This is a diagram illustrating an example of the structure of the anomaly detection result table according to the first embodiment.

[0017] Figure 8 This is a timing diagram illustrating an example of the flow of anomaly detection processing performed in the charging system according to the first embodiment.

[0018] Figure 9 This is a flowchart illustrating an example of the process of calculating a corrected score based on power scarcity, performed in the security monitoring server according to the first embodiment.

[0019] Figure 10 This is a diagram used to illustrate the calculation of the correction score corresponding to the power shortage level involved in the first embodiment.

[0020] Figure 11 This is a diagram illustrating an example of the configuration of the charging system according to the fourth embodiment.

[0021] Figure 12 This diagram illustrates an example of the configuration of the security monitoring server according to the fifth embodiment.

[0022] Figure 13 This is a diagram illustrating an example of the structure of the anomaly detection result table according to the fifth embodiment.

[0023] Figure 14 This is a timing diagram illustrating an example of the flow of anomaly detection processing performed in the charging system according to the fifth embodiment.

[0024] Figure 15 This is a flowchart illustrating an example of a process for determining the analysis priority based on power scarcity, executed in the security monitoring server according to the fifth embodiment.

[0025] Figure 16 This is a diagram illustrating an example of an event management screen displayed in the security monitoring server according to the sixth embodiment. Detailed Implementation

[0026] Hereinafter, with reference to the accompanying drawings, various embodiments of the charging control method (abnormal detection method), charging control device (monitoring device), charging system (monitoring system), program, and recording medium involved in this disclosure will be described.

[0027] Furthermore, in the description of this disclosure, components having the same or substantially the same function as those described with respect to the preceding figures are labeled with the same reference numerals, and descriptions are sometimes appropriately omitted. Additionally, even when indicating the same or substantially the same parts, there are cases where their dimensions and ratios differ according to the accompanying drawings. Furthermore, for example, from the viewpoint of ensuring the visual recognizability of the drawings, reference numerals are used only for the main components in the description of each drawing, and reference numerals are sometimes omitted even for components having the same or substantially the same function as those described with respect to the preceding figures.

[0028] Furthermore, in the description of this disclosure, constituent elements having the same or substantially the same function are sometimes distinguished by appending alphanumeric characters to the end of the reference symbol. Alternatively, when multiple constituent elements having the same or substantially the same function are not distinguished, the alphanumeric characters appended to the end of the reference symbol are sometimes omitted for uniformity.

[0029] In the description of this disclosure, a charging system is illustrated that provides charging and discharging services to a mobile vehicle, such as an electric vehicle, which is configured to be driven by power from an onboard battery, by means of electrical equipment installed at a charging station (electrical infrastructure).

[0030] Here, charging service refers to a service that supplies electricity from a charging station to a mobile device, such as selling electricity to a user of the mobile device, to charge the battery carried in the mobile device. Discharging service refers to a service that, such as purchasing electricity from a user of the mobile device, discharges the battery carried in the mobile device, uses the electricity from the mobile device to charge the battery at a charging station, or further supplies electricity from the mobile device to the upstream power grid (electricity transmission system).

[0031] Here, the mobile body is an example of a charging and discharging device that carries a battery (storage battery) and is configured to perform charging of the battery using externally supplied power and discharging of the battery to receive power from the external source. As the battery for this charging and discharging device, any type of battery, such as a lithium-ion battery, nickel-metal hydride battery, or all-solid-state battery, can be appropriately used. Furthermore, the mobile body can be various electric vehicles, including electric vehicles (EV vehicles) powered by an electric motor, and hybrid vehicles powered by both an internal combustion engine and an electric motor. Additionally, the mobile body can be, for example, a passenger car, a truck, a motorized two-wheeler, or other automobile, but can also be an electric bicycle, an electric scooter, an electric wheelchair, construction machinery, agricultural machinery, a ship, a train, an airplane, etc. Furthermore, the mobile body is not limited to passenger vehicles; it can also be a freight vehicle, such as a cargo transport vehicle. Moreover, the mobile body can be configured to move autonomously or to move according to the direct or remote operation of a driver.

[0032] Furthermore, the technology disclosed herein is not limited to mobile bodies such as electric vehicles, but also includes various power devices and equipment that can be applied to energy storage devices, power generation devices, charging devices in charging stations, etc., to control the output or input of electricity through communication.

[0033] (First Embodiment)

[0034] Figure 1 This is a diagram illustrating an example of the configuration of the charging system 1 according to the first embodiment. (See diagram for example.) Figure 1 As shown, the charging system 1 includes a security monitoring server 3, a charging station 5, and an analyst terminal 7. Additionally, the charging station 5 is a facility (electrical infrastructure) used to provide charging or discharging services to visiting vehicles 9 (mobile vehicles), such as... Figure 1 As shown, it includes a charging station management server 51 and a charging device 52.

[0035] like Figure 1 As shown, the security monitoring server 3, the charging station management server 51, and the charging device 52 are communicatively connected, for example, via a network N, such as the Internet, which serves as a telecommunications line. Additionally, the security monitoring server 3 and the analyst terminal 7 are communicatively connected via the network N. Furthermore, the charging device 52 is connected to an upstream power grid (not shown), for example, via a power grid such as a power line, in a manner capable of transmitting and receiving power.

[0036] As an example, in charging system 1, charging device 52 is controlled by communicating with charging station management server 51. Additionally, security monitoring server 3 monitors the bidirectional communication between charging station management server 51 and charging device 52. Furthermore, security monitoring server 3 detects security events indicating anomalies or the possibility of network attacks based on control messages exchanged through this communication, and calculates, for example, an anomaly score indicating normality or abnormality as a detection result. Furthermore, security monitoring server 3 performs correction score calculation processing on the anomaly score indicating whether the detected security event (detected event) is abnormal, by adjusting for power scarcity. Additionally, analyst terminal 7 prompts the detected events to the analysis manager (analyst) with a priority corresponding to the correction score, for example, in descending order of correction score, and obtains the analyst's analysis results of the detected events, thereby performing analysis of the detected events. The detected events prompted to the analyst can be all detected security events, or only security events judged as abnormal, i.e., attack events with an anomaly score or correction score greater than "0". In addition, an attack event can also be a collection of multiple attack messages, including various attack messages and alerts.

[0037] Furthermore, the charging system 1 may include two or more charging stations 5. Additionally, in the charging system 1, at least one charging station 5 may each include two or more charging devices 52. Furthermore, the charging system 1 may include two or more analyst terminals 7. Additionally, at least one analyst terminal 7 may be an information processing device located externally to the charging system 1. Furthermore, each of the at least one charging device 52 is connected to the vehicle 2 visiting the charging station 5 in a manner capable of receiving power via, for example, a detachable charging cable (not shown) mounted on the vehicle 9 or the charging device 52. Furthermore, the number of vehicles 9 connected to or capable of being connected to a charging device 52 may be two or more. The vehicle 9 connected to the charging device 52 is a mobile body configured to be driven by power from its mounted battery (not shown), and is capable of receiving charging and discharging services at the charging station 5. Furthermore, at least one vehicle 9 may each be included in the charging system 1.

[0038] The security monitoring server 3 is an example of a monitoring device that monitors the communication between the charging station management server 51 and the charging device 52. The security monitoring server 3 is configured to perform the anomaly detection method according to the embodiments. For example, the security monitoring server 3 is configured to perform the correction score calculation process based on power scarcity according to the embodiments. Figure 2 This diagram illustrates an example of the configuration of the security monitoring server 3 according to the first embodiment. (See diagram below.) Figure 2As shown, the security monitoring server 3 has an anomaly detection unit 31, a score correction unit 32, a storage unit 33, a communication unit 34, and a display unit 35.

[0039] The anomaly detection unit 31 performs anomaly detection regarding charging or discharging in the charging station 5 based on the transmitted and received information between the charging station management server 51 and the charging device 52. For example, the anomaly detection unit 31 determines whether the received message (transmitted and received information) from the charging device 52 is normal; if it is abnormal, it detects a security event. Furthermore, for each detected security event (detection event), the anomaly detection unit calculates an anomaly score, indicating normality or abnormality, based on the received message. Additionally, in the event of a detected security event, the anomaly detection unit 31 outputs information indicating the detection result (e.g., anomaly score) to the storage unit 33 or an external device. As an example, the anomaly detection unit 31 determines that the controlled object based on the received message deemed abnormal is an attack target, and calculates the anomaly score by referring to, for example, the score value, formula, and / or parameters predetermined for each attack target and stored in the storage unit 33.

[0040] Furthermore, the anomaly detection unit 31 is not limited to receiving messages from the charging device 52, but can also perform anomaly detection based on sending messages (transmission and reception information) sent from this device to the charging device 52, etc. Additionally, the anomaly detection unit 31 is not limited to the controlled object (attack target), and can perform anomaly detection or calculate anomaly scores based on any transmission and reception information represented by the transmitted and received messages, such as control content, control value, observed value (measured value), and / or predicted value. In this case, the transmission and reception information used for anomaly detection and the transmission and reception information used for calculating the anomaly score can be the same information or different information. Furthermore, the anomaly detection unit 31 is not limited to being based on the attack target, but can also calculate anomaly scores based on the type of network attack, the number of attack targets, and / or the degree of damage caused by the attack. Additionally, the anomaly detection unit 31 can, for example, be mounted externally to the security monitoring server 3, such as the charging station management server 51 and / or the charging device 52.

[0041] The score correction unit 32 is configured to determine the analysis priority for analyzing the detected event based on the anomaly score of the detected event and information related to the power shortage at the detection time. Specifically, the score correction unit 32 performs a correction score calculation process for the anomaly score of the detected event, which indicates whether it is normal or abnormal, by calculating a correction score based on the power shortage. The score correction unit 32 determines the analysis priority corresponding to the calculated correction score. Details regarding the correction score calculation process will be explained later.

[0042] Here, information related to power scarcity refers to information indicating the degree of power scarcity at the detection time, such as information indicating the charging control mode (operation (working) mode) of the charging device 52. The charging control mode of the charging device 52 includes at least a normal mode and a suppression mode for the actions involved in providing charging services within the charging device 52. Additionally, the charging control mode of the charging device 52 may also include a discharge mode for the actions involved in providing discharging services within the charging device 52.

[0043] For example, the normal mode refers to an operation mode in which charging is performed without any upper limit on charging. Specifically, the normal mode refers to an operation mode in which electricity is supplied to vehicle 9 when there is no shortage of electricity demand, and in a state where there is no limitation on the electricity supply associated with a shortage of electricity. Here, the limitation on the electricity supply associated with a shortage of electricity refers to setting an upper limit (threshold) for the amount of electricity supplied, the speed of electricity supplied, the number of times electricity is supplied, and / or the frequency of electricity supplied, or reducing the set upper limit.

[0044] For example, suppression mode refers to the operation mode of charging under conditions where a limit on the charging capacity is imposed. Specifically, suppression mode refers to the operation mode of supplying power to vehicle 9 under conditions of power shortage, such as when power demand is scarce, for example, upon request from charging station management server 51 and / or the power grid side, and under conditions of power supply restrictions accompanying power shortage.

[0045] For example, the discharge mode refers to the operating mode in which power is supplied from vehicle 9 to charging device 52. Specifically, the discharge mode refers to the operating mode in which, in situations of power shortage, such as when a request is received from charging station management server 51 and / or the power grid side, the battery mounted on vehicle 9 connected to charging device 52 is discharged, and the power supplied from the discharged battery is received.

[0046] Storage unit 33 is a storage medium or storage device that stores control programs, parameters, data during processing, and / or data of processing results related to each process executed by security monitoring server 3. As an example, storage unit 33 stores an anomaly detection result table 331 containing the output results of anomaly detection unit 31 and score correction unit 32. Details regarding anomaly detection result table 331 will be explained later.

[0047] The communication unit 34 is a communication circuit for communicating with the external security monitoring server 3. The communication unit 34 can appropriately utilize wired or wireless communication circuits. As a wireless communication circuit, it can appropriately utilize communication circuits compatible with various standards such as 4G, 5G, 6G, Wi-Fi, Bluetooth, and infrared communication.

[0048] Display unit 35 is a display that shows various images. As this display, display devices such as liquid crystal displays (LCDs), organic EL (electro-luminescence) displays, and projectors can be appropriately utilized. For example, display unit 35 displays the determination results stored in storage unit 33. For instance, based on anomaly detection result table 331, display unit 35 displays a screen showing a list of detected events. Furthermore, this screen may also include a display of the person in charge of the analysis (analyst) and / or the response status.

[0049] The charging station management server 51 is an example of a second electrical device that controls the charging device 52. For example, the charging station management server 51 is configured to control the power supply from the charging device 52 to the vehicle 9 and the power discharge from the vehicle 9, i.e., the power reception from the vehicle 9. Figure 3 This diagram illustrates an example of the configuration of the charging station management server 51 according to the first embodiment. Figure 3 As shown, the charging station management server 51 has a charging control instruction unit 511, a storage unit 512, and a communication unit 513.

[0050] The charging control instruction unit 511 controls the operation of the charging device 52 through communication with the charging device 52. For example, the charging control instruction unit 511 sends control messages (transmit / receive information) for controlling the operation of the charging device 52 via the communication unit 513. Additionally, for example, the charging control instruction unit 511 receives messages (transmit / receive information) from the charging device 52 via the communication unit 513. As an example, the messages sent to the charging device 52 include control messages for controlling the supply of power to the connected vehicle 9. As an example, the messages sent to the charging device 52 include control messages for controlling the discharge from the connected vehicle 9. As an example, the messages received from the charging device 52 include messages indicating that the sent control messages have been received. As an example, the messages received from the charging device 52 include messages indicating the power supply or discharge status, such as the electrical force, start time, end time, duration, and / or remaining battery level. As an example, the messages received from the charging device 52 include messages indicating the status of the charging device 52 during power supply or discharge, such as observed values ​​like temperature and communication frequency band. In addition, these messages (send and receive information) may also include messages for instructing the charging device 52 on the charging control mode (operation mode), or messages for notifying the charging device 52 of the charging control mode being executed or already executed.

[0051] Storage unit 512 is a storage medium or storage device that stores control programs, parameters, data during processing, and / or data of processing results related to the various processes executed by the charging station management server 51. As an example, storage unit 512 stores a charging history table 5121 containing information indicating the charging and discharging history of the charging device 52 under management. Details regarding the charging history table 5121 will be explained later.

[0052] The communication unit 513 is a communication circuit for communicating with the external charging station management server 51. The communication unit 513 can utilize either wired or wireless communication circuits. For wireless communication, it can utilize communication circuits compatible with various standards such as 4G, 5G, 6G, Wi-Fi, Bluetooth, and infrared communication.

[0053] Furthermore, the charging station management server 51 can be installed inside the charging station 5 along with the charging device 52, or it can be installed outside the charging station 5. Additionally, the charging station management server 51 can also control the charging devices 52 of other charging stations 5. In this case, the other charging stations 5 may not need to have a charging station management server 51 installed.

[0054] The charging device 52 is configured to operate according to instructions (control messages) from the charging station management server 51. The charging device 52 is an example of a first electrical device configured to perform at least one of supplying or receiving power between itself and the connected vehicle 9. For example, the charging device 52 is configured to perform actions related to a charging service, such as supplying power to the connected vehicle 9 (selling power) and charging the battery installed in the vehicle 9, upon request from a user of the vehicle 9. Alternatively, for example, the charging device 52 is configured to perform actions related to a discharging service, such as accepting power discharged from the battery installed in the connected vehicle 9 (purchasing power) and discharging the battery installed in the vehicle 9, upon request from the charging station management server 51 and / or the power grid side. Furthermore, the discharging service can also be performed upon request from a user of the vehicle 9. Additionally, the charging device 52 capable of operating in normal mode and suppression mode, and the charging device 52 capable of operating in discharging mode, can also be configured as separate devices. Figure 4 This diagram illustrates an example of the configuration of the charging device 52 according to the first embodiment. Figure 4 As shown, the charging device 52 includes a charging control unit 521 and a communication unit 522.

[0055] The charging control unit 521 controls the charging and discharging of the connected vehicle 9 according to the control of the charging station management server 51. The charging control unit 521 causes the charging device 52 to operate in any of a plurality of charging control modes, including at least a normal mode, a suppression mode, and a discharge mode. Thus, the charging control unit 521 realizes the charging and discharging function of the charging device 52. As an example, the charging control unit 521 controls the charging control mode of the charging device 52 according to the instructions (control messages) from the charging control instruction unit 511 mounted on the charging station management server 51.

[0056] The communication unit 522 is a communication circuit for communicating with the outside of the charging device 52. The communication unit 522 can appropriately utilize communication circuits for wired or wireless communication. As a wireless communication circuit, it can appropriately utilize communication circuits compatible with various standards such as 4G, 5G, 6G, Wi-Fi, Bluetooth, and infrared communication.

[0057] The analyst terminal 7 is an information processing device used by the analysis manager who performs the analysis. The analyst terminal 7 is configured to perform analysis processing of the determination results, i.e., the detection events, related to the anomaly detection processing involved in the implementation method. For example, the analyst terminal 7 receives an analysis request from the security monitoring server 3. For instance, the analysis request is sent to the analyst terminal 7 used by the analysis manager assigned (distributed) by the security monitoring server 3. The analysis request may contain various information related to the detection event of the analysis object. For example, the analysis request may also contain part or all of the items in the anomaly detection result table 331 and the charging history record table 5121. Additionally, the analysis request may also contain information related to the device where the detection event of the analysis object occurred and / or the device connected to that device, such as the name, type, installed application, and / or version of the charging station management server 51, charging device 52, and / or vehicle 9. For example, the analyst terminal 7 displays various display screens, such as a notification screen that notifies the analyst of the detection event of the analysis object and / or an input screen that accepts the analyst's input of the analysis results, through its onboard display and / or connected display. As an example, the analyst terminal 7 sends the analysis results input by the analyst to the security monitoring server 3.

[0058] Furthermore, the analyst terminal 7 can be configured to perform analysis itself or to perform analysis assistance by generating information to assist the person in charge of the analysis. In this case, the analyst terminal 7 can also use a machine learning model whose parameters are determined by inputting information related to the detection events of the analysis object to output analysis results or information to assist the analysis, and then perform analysis or analysis assistance. This machine learning model can, for example, determine its parameters by using accumulated information related to past detection events and the analyst's past analysis results for each detection event as teacher data for learning. As this machine learning model, any machine learning model such as CNN (Convolutional Neural Network) can be used. In addition, the analyst terminal 7 can also be installed outside the charging system 1.

[0059] Furthermore, the charging system 1 described in the above embodiments may also include two or more devices that are integrated into one unit. For example, the charging station management server 51 and the charging device 52 may be integrated into one unit. Alternatively, the charging station management server 51 may be implemented through the cooperation of two or more charging devices 52. For example, the security monitoring server 3 and the analyst terminal 7 may also be integrated into one unit. Alternatively, the security monitoring server 3 may be implemented through the cooperation of two or more analyst terminals 7.

[0060] Figure 5 This diagram illustrates an example of the hardware structure of the information processing device 8, which shows the various devices (security monitoring server 3, charging station management server 51, charging device 52, and analyst terminal 7) implementing the charging system 1 according to the first embodiment. Figure 5 As shown, the information processing apparatus 8 includes a processor 81, a main storage device 82, an auxiliary storage device 83, and an I / F (interface) circuit 84. The processor 81, main storage device 82, auxiliary storage device 83, and I / F circuit 84 are connected to each other in a manner that enables communication, for example, via a bus 89. Furthermore, each component of the information processing apparatus 8 can also be implemented by combining two or more components.

[0061] The information processing device 8 has at least one processor 81 and at least one main storage device 82 (memory), thus utilizing a typical computer hardware structure. For example, the at least one processor 81 implements the various functions of each device by loading a program stored in the auxiliary storage device 83 into the main storage device 82 and executing the loaded program. Furthermore, the at least one processor 81 of the information processing device 8 may also be configured as a dedicated hardware circuit.

[0062] For example, in the security monitoring server 3, at least one processor 81 implements the functions of the security monitoring server 3, including the anomaly detection unit 31 and the score correction unit 32. Furthermore, the anomaly detection unit 31 may perform some or all of the functions of the score correction unit 32, or the anomaly detection unit 31 and the score correction unit 32 may be implemented as a single function. For example, in the charging station management server 51, at least one processor 81 implements the functions of the charging station management server 51, including the charging control instruction unit 511. For example, in the charging device 52, at least one processor 81 implements the functions of the charging device 52, including the charging control unit 521. For example, in the charging device 52, at least one processor 81 implements the functions of the analyst terminal 7.

[0063] As at least one processor 81, it can appropriately utilize various processors such as CPU (Central Processing Unit), GPU (Graphics Processing Unit), ASIC (Application Specific Integrated Circuit), and FPGA (Field Programmable Gate Array).

[0064] As the main storage device 82, various types of memory, such as RAM (Random Access Memory), can be appropriately utilized.

[0065] As an auxiliary storage device 83, various recording media and recording devices such as ROM (Read Only Memory), HDD (Hard Disk Drive), SSD (Solid State Drive), and flash memory can be appropriately utilized.

[0066] For example, in the security monitoring server 3, at least one main storage device 82 and an auxiliary storage device 83 implement the storage unit 33. For example, in the charging station management server 51, at least one main storage device 82 and an auxiliary storage device 83 implement the storage unit 512. For example, in both the charging device 52 and the analyst terminal 7, at least one main storage device 82 and an auxiliary storage device 83 implement their respective storage units (not shown).

[0067] The I / F circuit 84 is an interface used to implement input / output related functions, connect external devices, and / or communicate with the outside world. Furthermore, the I / F circuit 84 can also be an output interface for connecting or implementing output devices that output sound, images, and / or video, an input interface for connecting or implementing input devices that obtain user input, or an interface for these devices to perform their functions. As output devices, various displays such as LCD monitors, OLED displays, and projectors, as well as speakers, can be appropriately utilized. As input devices, keyboards, mice, touch panels, microphones, etc., can be appropriately utilized.

[0068] For example, in the security monitoring server 3, the I / F circuit 84 implements an output interface (display unit 35) for connecting or implementing an output device, an input interface (not shown) for connecting or implementing an input device, and a communication interface (communication unit 34) for communicating with the outside world. For example, in the charging station management server 51, the I / F circuit 84 implements a communication interface (communication unit 513) for communicating with the outside world. For example, in the charging device 52, the I / F circuit 84 implements a power interface for connecting to the power grid (power transmission system) and / or vehicle 9, and a communication interface (communication unit 513) for communicating with the outside world. For example, in the analyst terminal 7, the I / F circuit 84 implements an output interface (not shown) for connecting or implementing an output device, an input interface (not shown) for connecting or implementing an input device, and a communication interface (not shown) for communicating with the outside world.

[0069] Furthermore, regarding the various devices included in the charging system 1 according to the above-described embodiments, only the configurations required for explaining the main parts of this embodiment are illustrated, but the configurations of these devices are not limited thereto.

[0070] Here, with reference to the accompanying drawings, the management of the charging and discharging history records of the charging devices 52 under management by the charging station management server 51 according to this embodiment will be described. Figure 6 This is a diagram illustrating an example of the structure of the charging history table 5121 according to the first embodiment. (See diagram below.) Figure 6As shown, the charging history table 5121 includes at least the items "Charging Start Time", "Charging End Time", "Charging Device ID", "Power Supplied (kW)", "Power Consumed (kW)", and "Charging Control Mode". The items "Charging Start Time" and "Charging End Time" store information indicating the start and end times of charging and discharging, respectively. The item "Charging Device ID" stores identification information used to uniquely identify the charging device 52 that underwent charging and discharging. The item "Power Supplied (kW)" stores the value of the electrical force of the power used during charging from the power grid (electricity transmission system). Therefore, in the item "Power Supplied (kW)", values ​​greater than 0 are stored during charging, while zero values ​​are stored during discharging. The item "Power Consumed (kW)" stores the value of the electrical force of the power supplied from the charging device 52 to the battery of the vehicle 9 during charging and discharging. Therefore, in the item "Power Consumed (kW)", positive values ​​greater than 0 are stored during charging, while negative values ​​are stored during discharging. Here, the power consumed by the vehicle 9 during charging can be all or a portion of the supplied power. In other words, all the electricity supplied from the power grid to the charging device 52 may not be directly supplied to the vehicle 9, and the power consumption becomes the value of the electrical force with the supplied power as the upper limit. The "Charging Control Mode" item stores information indicating which charging control mode the charging device 52 is in during charging and discharging. Here, the information indicating which charging control mode the charging device 52 is in is information about the degree of power shortage in the upstream power grid, including this station, and / or other charging stations 5 within the shared power grid; it is an example of information about power shortage.

[0071] Furthermore, when a portion of the power supplied during the charging of vehicle 9 is used as consumed power, the remaining power can be stored by the battery mounted or attached to the charging device 52. Similarly, the consumed power, which is negative when vehicle 9 is discharging, may be supplied to the power grid, but it can also be partially or entirely stored by the battery of the charging device 52. Furthermore, when the power discharged from vehicle 9 is stored by the battery of the charging device 52, the power supplied item may not contain a "0" but instead contain a negative value. Additionally, the power supplied to the battery of vehicle 9 from the power grid, or the power supplied from vehicle 9 to the power grid, may or may not be supplied via the battery of the charging device 52. Moreover, the power supplied to vehicle 9 as consumed power during charging can be based on or replace the power from the power grid, using power from the battery of the charging device 52. The battery mounted or attached to the charging device 52 can be any type of battery, such as a lithium-ion battery, a nickel-metal hydride battery, or a solid-state battery.

[0072] In the charging station management server 51, the charging control instruction unit 511 manages the charging and discharging history of the managed charging device 52 by storing it in the charging history table 5121 stored in the storage unit 512. For example, whenever the managed charging device 52 is charged or discharged, the charging control instruction unit 511 stores information related to each charge / discharge in the charging history table 5121. For example, whenever the charging control mode is switched in the managed charging device 52, the charging control instruction unit 511 stores information related to each charge / discharge in the charging history table 5121. Alternatively, it may be possible to record other items of the "charging control mode" whenever the managed charging device 52 is charged or discharged, and to record the "charging control mode" item whenever the charging control mode is switched.

[0073] Here, the judgment result output in the anomaly detection processing of the security monitoring server 3 according to this embodiment will be explained with reference to the accompanying drawings. Figure 7 This is a diagram illustrating an example of the structure of the anomaly detection result table 331 according to the first embodiment. (See diagram for example.) Figure 7 As shown, the anomaly detection result table 331 includes at least the items "Message ID," "Timestamp," "Charging Device ID," and "Correction Score." The "Message ID" item stores identification information for uniquely identifying the message that detected the anomaly (security event). The "Timestamp" item stores information indicating the time the anomaly was detected. The "Charging Device ID" item stores identification information for uniquely identifying the charging device 52 that sent or received the message indicating the anomaly. Alternatively, instead of the "Charging Device ID" item, or based on the "Charging Device ID" item, an item "Charging Station Management Server ID" can be set to store identification information for uniquely identifying the charging station management server 51 of the receiving / receiving object. The "Correction Score" item stores information representing the correction score calculated in the correction score calculation process.

[0074] In the security monitoring server 3, the anomaly detection unit 31 and / or the score correction unit 32 manage the judgment results of the anomaly detection process by storing them in the anomaly detection result table 331 stored in the storage unit 33. For example, during anomaly detection processing, whenever the anomaly detection unit 31 calculates an anomaly score for a detected event, that is, whenever it outputs a normal or anomaly judgment result, it saves information related to the detected event in the anomaly detection result table 331. Similarly, whenever the score correction unit 32 calculates a correction score for a detected event, it saves information related to the detected event in the anomaly detection result table 331. Alternatively, it could be done as follows: whenever an anomaly score is calculated, other items in the "correction score" are recorded; whenever a correction score is calculated, the item "correction score" is recorded.

[0075] Hereinafter, an example of the operation of the charging system 1 according to the embodiment will be described with reference to the accompanying drawings. Furthermore, the process described below is just one example; changes to the processing order, deletion of some processes, and / or addition of other processes are also possible.

[0076] Figure 8 This is a timing diagram illustrating an example of the flow of anomaly detection processing performed in the charging system 1 according to the first embodiment.

[0077] When messages are sent and received between the charging station management server 51 and the charging device 52 (S101), the anomaly detection unit 31 of the security monitoring server 3 observes the sent and received messages (S102). The anomaly detection unit 31 can observe the sent and received messages based on notifications from at least one of the charging station management server 51 and the charging device 52, or it can observe the sent and received messages by monitoring the sending and receiving itself, for example, by referring to communication logs. The anomaly detection unit 31 performs anomaly detection processing based on the observed messages and outputs the anomaly score calculated in the anomaly detection processing to the score correction unit 32 (S103). In addition, the anomaly detection unit 31 stores the record of the detected event in the anomaly detection result table 331 of the storage unit 33. In this way, the anomaly detection unit 31 performs anomaly detection based on the communication data, communication volume, etc. of the sent and received messages and outputs a judgment result (detection result).

[0078] Regarding the detected event, the score correction unit 32 of the security monitoring server 3 queries the charging station management server 51 for the charging control mode of the target charging device 52 (S104). In the charging station management server 51, based on the query from the security monitoring server 3 and referring to the charging history record table 5121, it outputs information indicating the charging control mode of the corresponding charging device 52 to the security monitoring server 3 (S105). Afterwards, the score correction unit 32 performs a correction score calculation process based on the power shortage level, correcting the abnormal score according to the notified information indicating the charging control mode, and calculating a correction score (S106). Furthermore, the score correction unit 32 stores information indicating the correction score in the record of the detected event in the abnormality detection result table 331. Thus, if the determination result based on the abnormality detection of communication data, traffic, etc., of the transmitted and received messages is abnormal, the score correction unit 32 queries the charging station management server 51 for the charging control mode of the target charging device 52.

[0079] The anomaly detection unit 31 of the security monitoring server 3 outputs a judgment result (S107) through the display unit 35, for example, based on the anomaly detection result table 331, which stores records of each detected event. The output method of this judgment result is arbitrary; for example, the detected events can be displayed in a list, with higher correction scores ranking higher. Afterwards, the analyst terminal 7 performs analysis-related processing based on the analysis request from the security monitoring server 3 (S108). For example, in the analysis-related processing, the analyst terminal 7 prompts the analysis manager (analyst) with the detected events in descending order of correction scores, obtains the analyst's analysis results for the detected events, and outputs the obtained analysis results to the security monitoring server 3. For example, the user of the security monitoring server 3 accepts the output of the judgment result, for example, assigning each detected event to an analyst in descending order of correction scores. Then, the security monitoring server 3 sends an analysis request for the corresponding detected event to the analyst terminal 7 of the assigned analyst. Furthermore, for example, the person in charge of the analysis or the allocation rules can be determined in advance during the stage of calculating the abnormal score. Alternatively, the analyst terminal 7 can be notified of the composition of the analysis assignment at any time, such as during the stage of calculating the corrected score. The analyst terminal 7 prompts the analyst about the detection events assigned to it, obtains the analyst's analysis results, and outputs the obtained analysis results to the security monitoring server 3.

[0080] Here, regarding Figure 8 The process of calculating the corrected score during anomaly detection is explained. Figure 9 This is a flowchart illustrating an example of the process of calculating a corrected score based on power shortage, performed in the security monitoring server 3 according to the first embodiment. Figure 9 This example illustrates how to calculate a corrected score by replacing the outlier score with a correction value corresponding to information about the power shortage. Furthermore, Figure 9 The illustrated corrected score values ​​corresponding to each charging control mode are examples that can be appropriately set within the range of maintaining their magnitude relationship.

[0081] In the security monitoring server 3, the score correction unit 32 obtains the judgment result of the anomaly detection unit 31, namely the anomaly score indicating normal "0" or abnormal "1", as well as information indicating the charging control mode from the charging station management server 51 (S201). In addition, the score correction unit 32 determines whether the judgment result of the anomaly detection unit 31 is normal (S202).

[0082] If the anomaly detection unit 31 determines that the result is normal (S202: Yes), the score correction unit 32 outputs a normal determination, i.e., a correction score of "0", as the determination result based on the power shortage level (S203). Afterwards, Figure 9 The process is complete, proceed to... Figure 8 The processing of S107. That is, the score correction unit 32 outputs a corrected score of "0" indicating a normal determination based on the power shortage, regardless of the shortage state, for the abnormal score "0" indicating a normal determination based on the message.

[0083] If the anomaly detection unit 31 determines that the anomaly is present (S202: No), the score correction unit 32 determines whether the charging control mode is a discharge mode (S204). If the charging control mode is a discharge mode (S204: Yes), the score correction unit 32 outputs a correction score "100" indicating anomaly based on power scarcity, for the anomaly score "1 (>0)" indicating a normal determination based on the message (S205). Afterwards, Figure 9 The process is complete, proceed to... Figure 8 The processing of S107. Furthermore, the charging control mode being a discharge mode refers to a particularly severe power shortage state (high shortage state), such as when power is scarce and vehicle 9 needs to discharge to supply power. In other words, in the case of a discharge mode representing a high shortage state, the score correction unit 32 outputs the highest correction score "100" considering the power shortage, based on the anomaly score "1>0" indicating anomaly determination based on the message. Therefore, in a configuration where a higher correction score results in a higher analysis priority, a higher analysis priority is determined in the discharge mode than in the suppression mode and normal mode.

[0084] If the charging control mode is a mode other than the discharging mode (S204: No), the score correction unit 32 determines whether the charging control mode is a suppression mode (S206). If the charging control mode is a suppression mode (S206: Yes), the score correction unit 32 outputs a correction score "80" indicating an anomaly judgment based on power scarcity, for the anomaly score "1 (>0)" indicating a normal judgment based on the message (S207). Afterwards, Figure 9 The process is complete, proceed to... Figure 8 The processing of S107. Furthermore, the charging control mode being a suppression mode refers to a situation where, for example, due to power shortages, although the vehicle 9 is not yet required to discharge, power supply needs to be limited; this is a power shortage state, second only to a high shortage state, but still a medium shortage state (medium shortage state). In other words, in the case of the suppression mode representing a medium shortage state, which is second only to a high shortage state, the score correction unit 32 outputs a higher correction score "80" than the discharge mode, considering the power shortage, for the anomaly score "1>0" indicating anomaly determination based on the message. Therefore, in a configuration where a higher correction score results in a higher analysis priority, in the suppression mode, an analysis priority that is lower than the discharge mode but higher than the normal mode is determined.

[0085] When the charging control mode is other than the suppression mode, i.e., the normal mode (S206: No), the score correction unit 32 outputs a correction score "50" (S208) indicating an anomaly judgment based on power scarcity, for the anomaly score "1 (>0)" indicating a normal judgment based on the message. Afterwards, Figure 9 The process is complete, proceed to... Figure 8 The processing of S107. Furthermore, the charging control mode is the normal mode, which refers to the lowest level of power shortage (low shortage state), such as when the power shortage is not severe enough to require limiting power supply, or when there is no power shortage at all. In other words, in the normal mode representing the low shortage state, the score correction unit 32, considering the power shortage level, outputs a correction score "50" that is lower than the suppression mode, taking into account the anomaly score "1>0" representing the message-based anomaly determination. Therefore, in a configuration where a higher correction score results in a higher analysis priority, in the normal mode, a lower analysis priority is determined than in the discharge mode and suppression mode.

[0086] (Application example)

[0087] Here, an application example of the charging system 1 according to the embodiment will be described with reference to the accompanying drawings. Figure 10 This is a diagram used to illustrate the calculation of the correction score corresponding to the power shortage level involved in the first embodiment. Figure 10 Examples are given for each of the message-based detection events A through D, with the corrected score calculated taking into account the degree of power shortage. Figure 10 The vertical and horizontal axes of the chart represent the power shortage level [%] and the time period, respectively. Figure 10 In the example, time periods T1 and T5 represent low-shortage conditions such as early morning and late night when power shortages are at their lowest, and the charging device 52 operates in normal mode. Conversely, time periods T2 and T4 represent moderate-shortage conditions such as morning and evening when power shortages are somewhat higher, and the charging device 52 operates in suppression mode. Furthermore, time period T3 represents high-shortage conditions such as daytime when power shortages are particularly high, and the charging device 52 operates in discharge mode. Additionally, the messages exchanged between the charging station management server 51 and the charging device 52 include information indicating the device temperature of the charging device 52 and information indicating the operating status of the air-cooling device mounted on the charging device 52.

[0088] For example, in detection event B, where the equipment temperature is at its normal state (30 degrees Celsius) and the air cooling device is on, the security monitoring server 3 determines it as normal and outputs an anomaly score of "0". Similarly, in detection event D, where the equipment temperature is at a high temperature (70 degrees Celsius) and the air cooling device is on, the security monitoring server 3 determines it as normal and outputs an anomaly score of "0". Furthermore, although in Figure 10While not explicitly shown, for detection events where the equipment temperature is normal (30 degrees Celsius) and the air cooling device is off, the security monitoring server 3 also classifies it as normal and outputs an anomaly score of "0". For security events such as B and D, which are classified as normal in message-based anomaly detection, the security monitoring server 3 outputs a corrected score of "0" indicating a normal judgment based on power shortage, regardless of their shortage status.

[0089] On the other hand, for example, regarding detection events A and C where the equipment temperature is at a high temperature (70 degrees Celsius) and the air cooling device is off, the security monitoring server 3 determines them as abnormal and outputs an abnormality score of "1". For detection event A, which is determined to be abnormal in message-based anomaly detection, the security monitoring server 3 outputs a correction score of "50" based on the low power shortage state, which has the lowest power shortage level. Furthermore, for detection event C, which is determined to be abnormal in message-based anomaly detection, the security monitoring server 3 outputs a correction score of "100" based on the high power shortage state, which has the highest power shortage level.

[0090] In the charging system 1 of this embodiment, when the security monitoring server 3 observes messages exchanged between the charging station management server 51 and the charging device 52, an anomaly score (corrected score) is calculated based on the power shortage for the detected event based on the message. In other words, in the anomaly detection processing of this embodiment, a corrected score corresponding to the power shortage is output as the detection result (judgment result), thus enabling the detection of anomalies in power equipment, such as security events accompanied by network attacks, by taking power shortage into account.

[0091] Furthermore, by outputting a corrected score corresponding to the power shortage level as the detection result (judgment result), the risk and analysis priority can be evaluated higher for detected events during power shortages. Therefore, attacks and events that cause significant damage can be prioritized for notification to analysts. Additionally, since the risk and analysis priority are evaluated higher during power shortages, the analysis of attacks and events that cause significant damage can be prioritized. Therefore, based on the above-described configuration of calculating a corrected score considering power shortage levels for anomaly detection results, the potential for increased losses or reduction in human resources can be minimized for anomalies (attack events) in power equipment accompanied by cyberattacks. In other words, in the anomaly detection processing described in this embodiment, anomalies in power equipment can be appropriately handled even in a power shortage situation.

[0092] Furthermore, in the charging system 1 according to this embodiment, information indicating the power shortage level is used, specifically information indicating the charging control mode of the charging device 52. Generally, the power shortage level depends on the region and / or time period. Therefore, in determining the power shortage level by simply quantifying it, multiple charging devices 52 at a charging station 5 may receive the same detection result (determination result). On the other hand, in the charging system 1 according to this embodiment, a correction score considering the power shortage level is calculated using different charging control modes envisioned in each charging device 52, based on user consent, settings, etc. This enables more accurate detection of anomalies in the actual power shortage situation.

[0093] Hereinafter, other embodiments of the charging system 1 involved in this disclosure will be described with reference to the accompanying drawings. Furthermore, in the descriptions relating to each of the following embodiments, the differences will be mainly explained, and content that is repeated above will be appropriately omitted.

[0094] (Second Implementation)

[0095] In the charging system 1 described in the above-described embodiments, the anomaly detection unit 31 of the safety monitoring server 3 is not limited to calculating a binary anomaly score such as normal "0" or abnormal "1". For example, it can also calculate anomaly scores such as 0 to 100 that represent the level of the detected event.

[0096] Furthermore, the score correction calculation process based on power shortage degree performed by the score correction unit 32 in this embodiment can be as simple as correcting the abnormal score by adjusting it according to the power shortage degree. It is not limited to replacing the abnormal score with a correction value corresponding to the power shortage degree; it can also multiply the abnormal score by a correction coefficient corresponding to the power shortage degree, or add a correction value corresponding to the power shortage degree to the abnormal score. The correction coefficient and / or correction amount are, for example, predetermined and stored in the storage unit 33.

[0097] As an example, in the case of a discharge mode representing a high power shortage, the score correction unit 32 multiplies the largest correction coefficient "1.2" with the abnormal score "1>0" and outputs it, taking into account the power shortage level. Similarly, in the case of a suppression mode representing a medium power shortage, the score correction unit 32 multiplies the largest correction coefficient "1.0" (second only to the discharge mode) with the abnormal score "1>0" and outputs it, taking into account the power shortage level. Similarly, in the case of a normal mode representing a low power shortage, the score correction unit 32 multiplies the smallest correction coefficient "0.8" (smaller than the suppression mode) with the abnormal score "1>0" and outputs it, taking into account the power shortage level. Furthermore, the values ​​of the correction coefficients corresponding to each charging control mode can be appropriately set within a range that maintains their magnitude relationship.

[0098] As an example, in the case of a discharge mode representing a high power shortage, the score correction unit 32 adds the correction value "100", which is the largest correction amount, to the abnormal score "1>0" and outputs it, taking into account the power shortage level. Similarly, in the case of a suppression mode representing a medium power shortage, the score correction unit 32 adds the correction value "80", which is the largest correction amount after the discharge mode, to the abnormal score "1>0" and outputs it, taking into account the power shortage level. Similarly, in the case of a normal mode representing a low power shortage, the score correction unit 32 adds the correction value "50", which is the smallest correction amount than the suppression mode, to the abnormal score "1>0" and outputs it, taking into account the power shortage level. Furthermore, the magnitude (correction amount) of the correction value corresponding to each charging control mode can be appropriately set within a range that maintains their magnitude relationship.

[0099] In this way, by constructing an anomaly score that represents the level of the detected event, anomaly detection can be performed more realistically based on the actual power shortage situation. Therefore, according to the charging system 1 of this embodiment, anomalies in power equipment can be appropriately handled even in a power shortage situation.

[0100] (Third implementation)

[0101] In the charging system 1 described in the above embodiments, the safety monitoring server 3 can use the charging control mode index as information indicating the power shortage. On the other hand, the safety monitoring server 3 in this embodiment can also query the charging station management server 51, for example, to obtain information indicating the requested and supplied power during charging and discharging, instead of the charging control mode information. Furthermore, the safety monitoring server 3 can also determine the power shortage based on the power ratio (requested power / supplied power), which represents the magnitude of the requested power from the vehicle 9 relative to the supplied power from the power grid to the charging device 52. Alternatively, the safety monitoring server 3 can determine the power shortage based on a combination of the charging control mode and the power ratio.

[0102] As an example, when the power supply ratio of security monitoring server 3 is, for example, 90% or higher, it is determined to be in a high shortage state. Similarly, when the power supply ratio of security monitoring server 3 is, for example, 70% or higher, it is determined to be in a medium shortage state. Likewise, when the power supply ratio of security monitoring server 3 is, for example, less than 70%, it is determined to be in a low shortage state. The range of power supply ratio values ​​for each state is predetermined and stored in the storage unit 33, etc. Furthermore, the range of power supply ratio values ​​for each state is just one example, and can be appropriately set within a range that maintains their magnitude relationship.

[0103] Thus, even if the power ratio, which represents the magnitude of the requested power relative to the supplied power, is used as information indicating the degree of power scarcity, and a higher power ratio determines a higher analysis priority, the same effect as the above-described embodiment can be achieved. Furthermore, the technology involved in this embodiment can be appropriately applied to the charging system 1 involved in each of the above-described embodiments.

[0104] (Fourth implementation)

[0105] In the above embodiments, an example is illustrated where, in a security monitoring server 3 connected via network N to both the charging station management server 51 and the charging device 52 in a manner enabling mutual communication, information transmitted and received between the charging station management server 51 and the charging device 52 via network N is obtained from at least one of them. However, this is not a limitation. The charging system 1 according to this embodiment is the same as the charging system 1 according to the above embodiments, except that the communication methods between the charging station management server 51 and the charging device 52 and between the security monitoring server 3 and the analyst terminal 7 are different. Figure 11 This diagram illustrates an example of the configuration of the charging system 1 according to the fourth embodiment. Figure 11 As shown, in the charging system 1 of this embodiment, the charging device 52 can also be connected directly to the charging station management server 51 without going through network N. That is, the security monitoring server 3 can also be connected to the charging station management server 51, which is communicatively connected to the charging device 52, via network N. In this case, the security monitoring server 3 can also obtain the transmission and reception information exchanged between the charging station management server 51 and the charging device 52 from the charging station management server 51 via network N. Furthermore, in the charging system 1 of this embodiment, the analyst terminal 7 can also be connected directly to the security monitoring server 3 without going through network N. Moreover, communication between either the charging station management server 51 and the charging device 52, or between the security monitoring server 3 and the analyst terminal 7, can also be conducted via network N in the same manner as in the embodiments described above.

[0106] Thus, even if a portion of the structure of the charging system 1 is not connected via network N, the same effects as in the embodiments described above can be achieved. Furthermore, according to this configuration, for example, communication regarding each path can be made faster and more stable, and intrusion paths to the charging device 52 via network N can be limited, thereby improving the security related to charging control. Moreover, the technology according to this embodiment can be appropriately applied to the charging system 1 according to the various embodiments described above.

[0107] (Fifth implementation)

[0108] In the above embodiments, examples are shown of calculating a corrected score based on the power shortage level, i.e., outputting the anomaly detection result (judgment result) considering the power shortage level, but this is not limited to this. The charging system 1 according to this embodiment can also be configured to determine the analysis priority based on the anomaly score considering the power shortage level.

[0109] The security monitoring server 3 in this embodiment is configured to determine the analysis priority by judging the analysis priority among two or more detection events with the same anomaly score based on information related to power scarcity. Specifically, the security monitoring server 3 is configured to perform the power scarcity-based analysis priority determination process described in this embodiment. Figure 12 This diagram illustrates an example of the configuration of the security monitoring server 3 according to the fifth embodiment. (See diagram below.) Figure 12 As shown, the security monitoring server 3 according to this embodiment has an analysis priority determination unit 36 ​​instead of a score correction unit 32, and an anomaly detection result table 332 is stored in its storage unit 33 instead of an anomaly detection result table 331. Apart from this, it is similar to the security monitoring server 3 according to the above embodiments (see reference...). Figure 2 () is the same.

[0110] For example, in the security monitoring server 3 according to this embodiment, at least one processor 81 (refer to...) Figure 5 The security monitoring server 3 implements the functions of the anomaly detection unit 31 and the analysis priority determination unit 36. Furthermore, the anomaly detection unit 31 may perform some or all of the functions of the analysis priority determination unit 36, or the anomaly detection unit 31 and the analysis priority determination unit 36 ​​may be implemented as a single function. The analysis priority determination unit 36 ​​performs power shortage-based analysis priority determination processing on messages that have been assigned the same anomaly score based on the result of the anomaly detection processing. In other words, the analysis priority determination unit 36 ​​determines the analysis priority of the detected event through the analysis priority determination processing. Details regarding the analysis priority determination processing will be explained later.

[0111] The storage unit 33 stores an anomaly detection result table 332, which contains the output results of the anomaly detection unit 31 and the analysis priority determination unit 36. In other words, the anomaly detection result table 332 stores the determination results output during the anomaly detection processing of the security monitoring server 3 according to this embodiment. Figure 13 This is a diagram illustrating an example of the structure of the anomaly detection result table 332 according to the fifth embodiment. (See diagram for example.) Figure 13 As shown, the anomaly detection result table 332 includes the anomaly detection result table 331 according to the first embodiment (refer to...). Figure 7The project "Corrected Score" has been changed to "Abnormal Score," and a structure for "Analysis Priority" has been added. The "Abnormal Score" project stores information representing the abnormal score calculated during abnormal detection performed by the abnormality detection unit 31. The "Analysis Priority" project stores information representing the analysis priority set during the analysis priority determination process performed by the analysis priority determination unit 36.

[0112] In the security monitoring server 3, the anomaly detection unit 31 and / or the analysis priority determination unit 36 ​​manage the judgment results of the anomaly detection process by storing them in the anomaly detection result table 332 stored in the storage unit 33. For example, during anomaly detection processing, whenever the anomaly detection unit 31 calculates an anomaly score for a detected event, that is, whenever it outputs a normal or abnormal judgment result, it stores information related to the detected event in the anomaly detection result table 332. Similarly, whenever the analysis priority determination unit 36 ​​sets an analysis priority for a security event (attack event) that is determined to be abnormal among the detected events, it stores information related to the attack event, such as information indicating the analysis priority, in the record of the corresponding detected event in the anomaly detection result table 332.

[0113] Figure 14 This is a timing diagram illustrating an example of the anomaly detection processing flow performed in the charging system according to the fifth embodiment. Here, the flow of the anomaly detection processing according to the first embodiment (see reference) will be mainly discussed. Figure 8 Explain the differences between them.

[0114] In the security monitoring server 3, the anomaly detection unit 31 and Figure 8 The process similarly performs anomaly detection processing based on observed messages and outputs the anomaly score calculated in the anomaly detection processing (S103). Furthermore, the anomaly detection unit 31 can calculate binary anomaly scores such as "normal" or "abnormal," three-value anomaly scores such as "high," "medium," or "low," and even four-value or higher anomaly scores such as 0 to 100. Afterwards, the analysis priority determination unit 36 ​​obtains attack events from past detection events that have the same anomaly score as the current attack event (S301). This attack event refers to a security event in the detection events that is determined to be abnormal in anomaly detection, i.e., an anomaly score greater than "0." Here, "same anomaly score" does not necessarily require identical anomaly scores; it can also be anomaly scores that meet predetermined conditions (threshold ranges) and are stored in the storage unit 33. Furthermore, the acquisition of attack events with the same anomaly score can also be performed in the analysis priority determination processing described later (see [reference]). Figure 15 ) is executed.

[0115] Furthermore, the priority determination unit 36 ​​queries the charging station management server 51 regarding the detected event to determine the power shortage level of the target charging device 52 (S302). In the charging station management server 51, based on the query from the security monitoring server 3 and referring to the charging history record table 5121, information indicating the power shortage level of the corresponding charging device 52 is output to the security monitoring server 3 (S303). Thus, the priority determination unit 36 ​​obtains the power shortage level for multiple attack events, including the currently detected attack event, that have been assigned the same anomaly score. Furthermore, information indicating the power shortage level of previously detected attack events can also be stored in the storage unit 33, etc., at a stage where it was previously obtained. Therefore, in Figure 13 The anomaly detection result table 332 may also include an item for storing information indicating the acquired power shortage level. Alternatively, the storage unit 33 may store information indicating the acquired power shortage level separately from the anomaly detection result table 332 for each attack event. Furthermore, the acquisition of the power shortage level can also be handled in the analysis priority determination process described later (see [reference]). Figure 15 ) is executed.

[0116] Subsequently, the analysis priority determination unit 36 ​​performs analysis priority determination processing based on power shortage (see...). Figure 15 The analysis priority is set based on the notified information indicating power shortage (S304). Specifically, the analysis priority determination unit 36 ​​determines the analysis priority corresponding to the anomaly score. This analysis priority corresponding to the anomaly score is, for example, the lowest priority, "low," for a detection event with an anomaly score of "0" that is judged as normal in anomaly detection. Alternatively, the analysis priority corresponding to the anomaly score is, for example, an attack event with an anomaly score greater than "0" that is judged as abnormal in anomaly detection, where the higher the anomaly score, the higher the priority, and it is arbitrarily divided into "medium," "high," and "highest" based on the anomaly score. Then, regarding the attack events in the detection events, the analysis priority determination unit 36, based on information related to power shortage, determines the analysis priority between two or more attack events with the same anomaly score, such as "high-1" or "high-2." Furthermore, the analysis priority determination unit 36 ​​stores the information indicating the set priority in the record of the corresponding detection event in the anomaly detection result table 332. Additionally, the anomaly detection unit 31 of the security monitoring server 3 and... Figure 8The process is similarly based on the anomaly detection result table 332, which stores records of each detected event, and outputs the judgment result via the display unit 35 (S107). Furthermore, regarding analysis-related processing (S108), the person in charge of the analysis or the rules for assignment can be determined in advance at the stage of calculating the anomaly score and / or at the stage of setting or updating the analysis priority. For example, the analysis assignment can be notified to the analyst terminal 7 at any time during the stage of setting or updating the analysis priority. Thus, the analysis priority determination unit 36 ​​determines the analysis priority based on power scarcity and sets priorities for attack events.

[0117] Here, regarding Figure 14 The analysis priority determination process performed in the anomaly detection process is explained. Figure 15 This is a flowchart illustrating an example of the process for determining the analysis priority based on power shortage, executed in the security monitoring server 3 according to the fifth embodiment. Figure 15 Example in Figure 14 The process without S301 processing in the process.

[0118] The analysis priority determination unit 36, based on the anomaly score of the current attack event, extracts attack events that were assigned the same anomaly score from past detected events (S301). Furthermore, this step is related to... Figure 14 The process is the same as the S301 process performed before querying the power shortage status from the charging station management server 51 in this step. Figure 14 This can be executed in any step of S301. Additionally, the analysis priority determination unit 36 ​​acquires unanalyzed attack events from past attack events (S402). Regarding these acquired unanalyzed attack events, their analysis priority is reset at this point in time for subsequent processing; for example, they are processed together with the currently detected attack events as attack events with unset analysis priorities. In other words, Figure 15 The process of determining analysis priorities includes re-prioritizing past detection events that have not yet been analyzed.

[0119] The analysis priority determination unit 36 ​​obtains the attack event with the highest abnormal score among the attack events for which the analysis priority has not been set, including the attack event detected in this instance (S403). Additionally, the analysis priority determination unit 36 ​​obtains the power scarcity level at the time the attack event occurred from the storage unit 33 or the charging station management server 51 (S404), and sets the analysis priority in descending order of power scarcity level (S405). In other words, the analysis priority determination unit 36 ​​sets analysis priorities such as "high-1", "high-2", ... for multiple attack events with "high" abnormal scores in descending order of power scarcity level, sorting them among attack events with the same abnormal score. Then, the analysis priority determination unit 36 ​​determines whether an analysis priority has been set for all attack events (S406). If no analysis priority has been set for all attack events (S406: No), the processing in S403 to S406 is performed on the attack event with the second highest abnormal score among the attack events for which the analysis priority has not been set. On the other hand, if an analysis priority has been set for all attack events (S406: Yes),... Figure 15 The process is complete, proceed to... Figure 14 The processing of S107.

[0120] The anomaly detection unit 31 of the security monitoring server 3 is in Figure 14 In the S107 processing, based on the anomaly detection result table 332 which stores records of each detection event, the determination result is output via the display unit 35, for example (S107). The output method of the determination result is arbitrary; as an example, the detection events can be displayed in a list according to their analysis priority, with higher priority events appearing earlier.

[0121] In the charging system 1 according to this embodiment, the security monitoring server 3 is configured to determine the analysis priority of unanalyzed events considering the power shortage state. Based on this configuration, a higher analysis priority can be set for attack events occurring under power shortage conditions, thus enabling priority analysis of attack events under power shortage conditions, and allowing for appropriate handling of anomalies in power equipment even under power shortage conditions.

[0122] Specifically, the analysis priority determination unit 36 ​​assigns analysis priorities to unanalyzed attack events within the same anomaly score range, according to the power shortage level at the time of occurrence, from highest to lowest, until analysis priorities are assigned to all attack events. For example, even when the analysis priorities based on anomaly scores are all determined to be "high," from the perspective that higher power shortage levels indicate higher urgency, the events are ranked as "high-1," "high-2," etc. Thus, for attack events with the same anomaly score, it is possible to clearly identify the events that require priority analysis from the perspective of power shortage and reflect this in their analysis priorities.

[0123] Furthermore, the analysis priority determination unit 36 ​​acquires unanalyzed attack events, including those received in the past, and sets an analysis priority for each. Based on this structure of acquiring a list of unanalyzed past events, since past detected attack events are included in the priority setting during subsequent processing, it is also possible to handle situations where, compared to past detected attack events, the power shortage factor is considered to prioritize the current attack event.

[0124] Furthermore, the technology involved in this embodiment can be appropriately applied to the charging system 1 involved in each of the above embodiments. For example, the charging system 1 involved in the first embodiment, which performs an absolute evaluation based on power scarcity, and the charging system 1 involved in this embodiment, which evaluates power scarcity using a relative evaluation with past attack events in the form of analysis priority, can also be combined. For example, in the correction score calculation process involved in the first embodiment, a correction score can be calculated using a correction coefficient based on power scarcity, and in the analysis priority determination process involved in this embodiment, an analysis priority based on power scarcity can be set. According to this combination, even with the same correction score, if the details of the abnormal score part and the correction part are different, an analysis priority that is more in line with the actual power scarcity can be set.

[0125] (Sixth implementation)

[0126] In the charging system 1 described in the above embodiments, an example is shown where each record of a detected event is sequentially stored in an anomaly detection result table 331, 332, but this is not the only example. Additionally, an example is shown where, based on the anomaly detection result tables 331, 332, a display screen is shown on the display unit 35, displaying the detected events in an order based on correction scores, analysis priorities, etc., but this is not the only example.

[0127] For example, detection events related to power equipment, including the charging station management server 51 and the charging device 52, can include power system security events and non-power system security events. Here, power system security events refer to detection events related to power control, such as power control protocols being included in the attack target. Non-power system security events refer to detection events that can be analyzed by ordinary IT personnel, such as DoS (Denial of Service) attacks. For example, if power system security events are not handled properly, there is a high risk of escalating damage and equipment failure; therefore, it is preferable to assign them to analysts with expertise in power equipment. Furthermore, from the perspective of understanding the occurrence and response status of security events, assigning appropriate analysts, and monitoring the progress of analysis and response, detection events related to power equipment are preferably managed separately for power system and non-power system events.

[0128] For example, in the charging system 1 according to this embodiment, the safety monitoring server 3 may also generate different anomaly detection result tables 331 and 332 for power system detection events and non-power system detection events in the anomaly detection result tables 331 and 332. Alternatively, the anomaly detection result tables 331 and 332 may also include items that store information indicating whether a detection event is a power system detection event or a non-power system detection event.

[0129] Figure 16 This diagram illustrates an example of an event management screen (display screen 410) displayed in the security monitoring server 3 according to the sixth embodiment. For example, such as Figure 16 As shown, the security monitoring server 3 can also display a screen 410 on the display unit 35 that shows the lists of power systems and non-power systems in order of correction score, analysis priority, etc., based on the list of detected events being divided into power systems and non-power systems, or output it to an external device. Furthermore, the display screen 410 can also be displayed on an external monitor or analyst terminal 7 connected to the security monitoring server 3.

[0130] exist Figure 16 In the display screen 410, the display of each detection event in the power system and non-power system includes at least the items "Event ID", "Analysis Priority", and "Response Status". In addition, the display of each detection event in the power system and non-power system may also include the items "Time of Occurrence" and "Analysis Responsible Person".

[0131] The "Event ID" item displays identification information used to uniquely identify the detected event. The "Message ID" can also be used as the "Event ID". The "Analysis Priority" item, for example, displays... Figure 15 The analysis priority is set during the analysis priority determination process. Furthermore, the "Analysis Priority" item can be dynamically updated based on the results of analysis priority determination for new security events. Along with this update, the display order of detected event records can also be dynamically changed, etc. Additionally, the "Analysis Priority" item can also be displayed, for example, in... Figure 9The corrected score is calculated during the corrected score calculation process or analyzed according to the priority of the corrected score. The "Analysis Supervisor" item displays information such as the name of the analyst assigned to analyze each detection event. In addition, the display of the "Analysis Supervisor" item can also function as an input field for receiving input from the analysis supervisor. The "Response Status" item displays information such as "Waiting for Analysis", "Analysis in Progress", and "Analysis Completed" to indicate that the analysis of events has not yet started. In addition, when the analysis of a detection event is completed, the corresponding detection event can be deleted from the list in the display screen 410 instead of displaying "Analysis Completed" in the "Response Status" item.

[0132] Thus, in the charging system 1 according to this embodiment, detected events are managed separately for power system and non-power system events. With this configuration, it is easy to identify and assign power system security events to analysts with expertise in power equipment, allowing for analysis by appropriate analysts. Furthermore, it is easy to identify non-power system security events that can be assigned to any analyst, improving allocation efficiency and enabling rapid processing of detected events. Therefore, the charging system 1 according to this embodiment can appropriately handle anomalies in power equipment even under power shortage conditions. Moreover, the technology according to this embodiment can be appropriately applied to the charging systems 1 according to the various embodiments described above.

[0133] Furthermore, in the above embodiments, "whether it is A" refers to at least one of "is A" and "is not A". That is, in the above embodiments, the determination of "whether it is A" can be achieved by determining only "is A", by determining only "is not A", or by determining both.

[0134] The programs executed by each device of the charging system 1 in the above embodiments can also be provided as installable or executable files recorded on computer-readable recording media (Computer Program Product) such as CD-ROM, FD, CD-R, DVD.

[0135] Alternatively, the programs executed by each device of the charging system 1 according to the above embodiments can be stored on a computer connected to a network such as the Internet, and provided by downloading via the network. Alternatively, the programs executed by each device of the charging system 1 according to the above embodiments can be provided or distributed via a network such as the Internet.

[0136] Alternatively, the program executed by each device of the charging system 1 of the above embodiments may be pre-loaded into a ROM or the like.

[0137] According to at least one embodiment described above, abnormalities in electrical equipment can be properly handled even in situations of power shortage.

[0138] Several embodiments of the present invention have been described, but these embodiments are given by way of example and are not intended to limit the scope of the invention. These embodiments can be implemented in various other ways, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their variations are included in the scope and spirit of the invention, as well as in the scope of the invention as set forth in the claims and their equivalents.

[0139] (Postscript)

[0140] The following technology has been disclosed through the above description of the embodiments.

[0141] (1) An anomaly detection method is an anomaly detection method executed in a monitoring device that monitors communication between a first power device and a second power device, the first power device being configured to perform at least one of supplying and receiving power with a connected charging and discharging device, the second power device controlling the first power device, the anomaly detection method comprising: performing anomaly detection based on transmitted and received information between the first power device and the second power device; and determining the analysis priority of the detected event based on anomaly score of the detected event and information about power scarcity, the detected event being a security event detected by the anomaly detection, the power scarcity indicating the degree of power demand scarcity at the detection time.

[0142] (2) According to the anomaly detection method described in (1) above, determining the analysis priority includes: calculating a correction score by correcting the anomaly score of the detected event based on the information about power shortage; and setting the analysis priority corresponding to the correction score.

[0143] (3) According to the anomaly detection method described in (2) above, the calculation of the correction score includes: replacing the anomaly score with a correction value corresponding to the information on power shortage for correction.

[0144] (4) According to the anomaly detection method described in (2) above, the calculation of the correction score includes: multiplying the anomaly score by a correction coefficient of a magnitude corresponding to the information on power shortage to make correction.

[0145] (5) According to the anomaly detection method described in (2) above, the calculation of the correction score includes: adding a correction value corresponding to the correction amount of the information on power shortage to the anomaly score for correction.

[0146] (6) The anomaly detection method according to any one of (1) to (5) above, determining the analysis priority includes: determining the analysis priority between two or more detection events with the same anomaly score based on the information about power shortage.

[0147] (7) According to the anomaly detection method described in (6) above, determining the analysis priority includes: for attack events that are determined to be abnormal by the anomaly detection in the detection events, based on the information about power shortage, determining the analysis priority between two or more attack events with the same anomaly score, and determining the analysis priority includes: for other detection events besides the attack events, setting the analysis priority corresponding to the anomaly score.

[0148] (8) Determining the analysis priority according to the anomaly detection method described in (6) or (7) above includes: re-determining the analysis priority for past detection events that have not yet been analyzed.

[0149] (9) In the anomaly detection method according to any one of (1) to (8) above, the information about power shortage is information indicating the operating mode of the first power device, the operating mode including at least a normal mode and a suppression mode, the normal mode being a mode in which power is supplied from the first power device to the charging and discharging device when the power supply is unrestricted, and the suppression mode being a mode in which power is supplied from the first power device to the charging and discharging device when the power supply is restricted, and determining the analysis priority includes: determining the analysis priority higher than that in the case of the suppression mode than in the case of the normal mode.

[0150] (10) According to the anomaly detection method described in (9) above, the operation mode further includes a discharge mode, which is the mode in which the first power device receives power from the charging and discharging device. Determining the analysis priority includes: determining the analysis priority to be higher than that in the case of the suppression mode in the case of the discharge mode.

[0151] (11) In any one of (1) to (10) above, the information about power shortage is information representing the power ratio, which is the magnitude of the requested power from the charging and discharging equipment relative to the supplied power from the power grid to the first power equipment. The determination of the analysis priority includes: the larger the power ratio, the higher the analysis priority.

[0152] (12) According to any one of (1) to (11) above, the monitoring device is connected to the first power device and the second power device via a network in a manner that enables them to communicate with each other, and the anomaly detection includes: obtaining the aforementioned transmission and reception information transmitted and received between the first power device and the second power device via the network from at least one of the first power device and the second power device via the network.

[0153] (13) According to any one of (1) to (11) above, the monitoring device is connected to the second power device, which is connected to the first power device in a communicable manner, via a network in a communicable manner, and the anomaly detection includes: obtaining the transmission and reception information transmitted and received between the first power device and the second power device from the second power device via the network.

[0154] (14) A monitoring device for monitoring communication between a first power device and a second power device, the first power device being configured to perform at least one of supplying and receiving power with a connected charging and discharging device, the second power device controlling the first power device, the monitoring device having at least one processor configured to perform anomaly detection based on transmitted and received information between the first power device and the second power device; and to determine the analysis priority of the detected event based on anomaly scores of the detected event and information about power scarcity, the detected event being a security event detected by the anomaly detection, the power scarcity indicating the degree of power demand scarcity at the detection time.

[0155] (15) A monitoring device comprising: at least one processor; and a memory storing at least one program executed by the at least one processor, wherein the at least one processor is configured to implement the anomaly detection method described in any one of (1) to (13) above by executing the at least one program.

[0156] (16) A program for causing a computer implementing a monitoring device to perform processing of communication between a first power device and a second power device, the first power device being configured to perform at least one of supplying and receiving power with a connected charging and discharging device, the second power device controlling the first power device, the processing comprising: performing anomaly detection based on transmitted and received information between the first power device and the second power device; and determining the analysis priority of the detected event based on an anomaly score of the detected event and information about power scarcity, the detected event being a security event detected by the anomaly detection, the power scarcity indicating the degree of power demand scarcity at the time of detection.

[0157] (17) A program for causing a computer implementing a monitoring device to execute the anomaly detection method described in any one of (1) to (13) above, the monitoring device monitoring communication between a first power device and a second power device, the first power device being configured to perform at least one of supplying power and receiving power with a connected charging and discharging device, the second power device controlling the first power device.

[0158] (18) A recording medium containing a program executed by a computer, the program being the program described in (16) or (17) above.

[0159] Explanation of reference numerals in the attached figures

[0160] 1 Charging system; 3 Safety monitoring server (monitoring device); 31 Anomaly detection unit; 32 Score correction unit; 33 Storage unit; 331 Anomaly detection result table; 34 Communication unit; 35 Display unit; 36 Analysis priority determination unit; 5 Charging station; 51 Charging station management server (second power equipment); 511 Charging control instruction unit; 512 Storage unit; 5121 Charging history record table; 513 Communication unit; 52 Charging device (first power equipment); 521 Charging control unit; 522 Communication unit; 7 Analyst terminal; 8 Information processing device; 81 Processor; 82 Main storage device; 83 Auxiliary storage device; 84 I / F circuit; 89 Bus; 9 Vehicle (charging and discharging equipment); N Network.

Claims

1. An anomaly detection method, executed in a monitoring device, the monitoring device monitoring communication between a first power device and a second power device, the first power device being configured to perform at least one of supplying and receiving power with a connected charging / discharging device, the second power device controlling the first power device, the anomaly detection method comprising: Anomaly detection is performed based on the transmitted and received information between the first power device and the second power device; as well as Based on the anomaly score of the detected event and information about the power shortage, the analysis priority of the detected event is determined. The detected event is a security event detected through anomaly detection, and the power shortage indicates the degree of power shortage at the detection time.

2. The anomaly detection method according to claim 1, Determining the analysis priority includes: A corrected score is calculated by adjusting the anomaly score of the detected event based on the information about the power shortage. as well as Set the analysis priority corresponding to the corrected score.

3. The anomaly detection method according to claim 2, The calculation of the corrected score includes: The abnormal score is replaced with a correction value corresponding to the information about the power shortage.

4. The anomaly detection method according to claim 2, The calculation of the corrected score includes: The abnormal score is corrected by multiplying it by a correction factor of a magnitude corresponding to the information regarding the power shortage.

5. The anomaly detection method according to claim 2, The calculation of the corrected score includes: The abnormal score is corrected by adding a correction value corresponding to the information about the power shortage.

6. The anomaly detection method according to claim 1, Determining the analysis priority includes: Based on the information regarding power shortage, the analysis priority is determined among two or more detection events that have the same anomaly score.

7. The anomaly detection method according to claim 6, Determining the analysis priority includes: Regarding attack events identified as anomalous through the anomaly detection process, based on the information regarding power scarcity, the analysis priority among two or more attack events with the same anomaly score is determined. Determining the analysis priority includes setting the analysis priority corresponding to the anomaly score for other detection events besides the attack event.

8. The anomaly detection method according to claim 6, Determining the analysis priority includes: For past detection events that have not yet been analyzed, the analysis priority is reassessed.

9. The anomaly detection method according to any one of claims 1 to 8, The information regarding power shortage refers to information indicating the operating mode of the first power equipment. The operating mode includes at least a normal mode and a suppression mode. The normal mode is the mode in which power is supplied from the first power device to the charging / discharging device when the power supply is unrestricted. The suppression mode is the mode in which power is supplied from the first power device to the charging / discharging device when the power supply is restricted. Determining the analysis priority includes: In the case of the suppression mode, the analysis priority is determined to be higher than that in the case of the normal mode.

10. The anomaly detection method according to claim 9, The operating mode also includes a discharge mode, which is a mode in which the first power device receives power from the charging and discharging device. Determining the analysis priority includes: In the case of the discharge mode, a higher analysis priority is determined than in the case of the suppression mode.

11. The anomaly detection method according to any one of claims 1 to 8, The information regarding power shortage is information representing the power ratio, which is the magnitude of the requested power from the charging / discharging equipment relative to the supplied power from the power grid to the first power equipment. Determining the analysis priority includes: The higher the electrical force ratio, the higher the analysis priority.

12. The anomaly detection method according to any one of claims 1 to 8, The monitoring device is connected to the first power device and the second power device via a network in a manner that enables them to communicate with each other. Performing the anomaly detection includes: The transmitted and received information exchanged between the first power device and the second power device via the network is obtained from at least one of the first power device and the second power device.

13. The anomaly detection method according to any one of claims 1 to 8, The monitoring device is connected via a network to the second power device, which is communicatively connected to the first power device, in a manner that enables mutual communication. Performing the anomaly detection includes: The transmitted and received information between the first and second power devices is obtained from the second power device via the network.

14. A monitoring device for monitoring communication between a first power device and a second power device, the first power device being configured to perform at least one of supplying or receiving power in relation to a connected charging or discharging device, the second power device controlling the first power device. The monitoring device includes at least one processor, and the at least one processor is configured to... Anomaly detection is performed based on the transmitted and received information between the first power device and the second power device; and Based on the anomaly score of the detected event and information about the power shortage, the analysis priority of the detected event is determined. The detected event is a security event detected through anomaly detection, and the power shortage indicates the degree of power shortage at the detection time.

15. A program for causing a computer implementing a monitoring device to perform processing, the monitoring device monitoring communication between a first power device and a second power device, the first power device being configured to perform at least one of supplying and receiving power with a connected charging / discharging device, the second power device controlling the first power device, the processing comprising: Anomaly detection is performed based on the transmitted and received information between the first power device and the second power device; as well as Based on the anomaly score of the detected event and information about the power shortage, the analysis priority of the detected event is determined. The detected event is a security event detected through anomaly detection, and the power shortage indicates the degree of power shortage at the detection time.

Images