Abnormal communication discrimination device, abnormal communication discrimination method, and abnormal communication countermeasure system

Abstract

To easily and rationally determines that an abnormality when generated in a communication in regard to a business is caused by a cyber attack or a failure of a device.SOLUTION: An abnormal communication determination device is configured to: hold an event characteristic table evaluated by an event character for each abnormal communication detection event, and a statistic evaluation character table that performs an evaluation from a statistic character for each establishment condition of a statistic amount of the abnormal communication; calculate an event evaluation value from the number of matching of a record of the abnormal communication detection event in the event character table; calculate a statistic evaluation value from the number of matching of the record that is matched to the condition of the statistic amount of the abnormal communication; calculate a determination result evaluation value by a weight liner sum of the event evaluation value and the statistic evaluation value; and determine whether the abnormal communication is caused by a cyber attack or a failure of a device of a monitoring object system by the determination result evaluation value.SELECTED DRAWING: Figure 17

Description

[Technical field]

[0001] The present invention relates to an anomalous communication detection device, an anomalous communication detection method, and an anomalous communication handling system, and in particular to an anomalous communication detection device, an anomalous communication detection method, and an anomalous communication handling system that are suitable for determining whether an abnormality occurs in business-related communications and is due to a cyber attack or a device malfunction. [Background technology]

[0002] With the explosive growth of the Internet and the rapid evolution of hardware such as PCs and smartphones, communications have become indispensable to the social lives of companies and individuals.

[0003] In this situation, cyber attacks have become a major risk in the information society. A cyber attack is an act of falsifying, destroying, or stealing data stored on computers such as servers, PCs, and smartphones via networks such as the Internet. be. In particular, cyber attacks in recent years have become more complex and sophisticated, posing a threat to any company that could fall victim to them. Therefore, countermeasures against such cyber attacks (cybersecurity) are not something that can be tackled only by the information systems department, but are a management issue, that is, an important matter that needs to be addressed by the entire company.

[0004] Technologies relating to countermeasures against cyber attacks are disclosed, for example, in Patent Document 1. The anomaly cause determination device described in Patent Document 1 is provided in a control system including a control device, saves control state data (Fig. 2, paragraph

[0021] ) including a control state indicating the operating state of the control device, and determines whether the cause of an anomaly that has occurred in the control system is an attack via a network or a device failure based on the control state data (Fig. 3, paragraphs

[0024] and

[0025] ). [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2019-205125 A Summary of the Invention [Problem to be solved by the invention]

[0006] The technology described in Patent Document 1 discloses a method for determining whether the cause of an abnormality that has occurred in a control system is an attack via a network or a malfunction of the equipment, based on a control state that indicates the operating status of a control device.

[0007] However, in the judgment of communication anomalies described in Patent Document 1, anomaly detection and cause judgment are performed taking into account the control state of the control device (paragraph

[0024] ). For example, even if the control device is "stopped," if the control device is the starting point of communication, the cause of the attack is "spoofing," and if the control device is "starting" and communication requesting program rewriting is detected, it is judged to be unauthorized operation (paragraph

[0025] ).

[0008] Therefore, in the case of an attack that exploits control communications or communications such as sensor output that occur during business operations, such as a DoS attack / DDoS attack against a specific target, the communication anomaly determination described in Patent Document 1 cannot determine whether the anomaly is due to a cyber attack or equipment failure.

[0009] In addition, paragraph

[0026] of Patent Document 1 states that "the analysis unit 142 detects anomalies by analyzing the matching of network data with abnormal patterns and the degree of deviation from normal times, and if an abnormality is detected, may determine whether the cause is an attack or a malfunction," however, this is an analysis of whether communication is normal or abnormal, and does not determine whether the abnormal communication is due to a cyber attack or equipment malfunction.

[0010] The object of the present invention is to provide an anomalous communication detection device, an anomalous communication detection method, and an anomalous communication handling system that can easily and rationally determine whether an anomaly in business-related communications is due to a cyber attack or a device malfunction. [Means for solving the problem]

[0011] The configuration of the anomalous communication discrimination device of the present invention is preferably an anomalous communication discrimination device that discriminates the cause of anomalous communication detected in a monitored system in which the device operates, and holds a phenomenon feature table that stores, for each anomalous communication detection event, a record that stores a discrimination event class that indicates whether the anomalous communication is due to a cyber attack or a malfunction of a device in the monitored system, and a statistical feature table that stores, for each condition under which statistics of anomalous communication are established, a record that stores a discrimination event class that indicates whether the anomalous communication is due to a cyber attack or a malfunction of a device in the monitored system, and receives anomalous communication detection information in the monitored system, and based on the received anomalous communication detection information, the value of the discrimination event class of the record corresponding to the anomalous communication detection information in the phenomenon feature table is An event evaluation value is calculated from the number of cases in which abnormal communication is caused by a cyber-attack or by a malfunction of an equipment in the monitored system, a statistics amount of abnormal communication is calculated from the received abnormal communication detection information, and based on the calculated statistics amount of abnormal communication, a statistical evaluation value is calculated from the number of cases in which abnormal communication is caused by a cyber-attack or by a malfunction of an equipment in the monitored system for records in which the condition for the statistics amount of abnormal communication in the statistical feature table is met, and a discrimination result evaluation value indicating whether the abnormal communication is caused by a cyber-attack or by a malfunction of an equipment in the monitored system is calculated based on the event evaluation value and the statistical evaluation value, and a discrimination is made as to whether the abnormal communication is caused by a cyber-attack or by a malfunction of an equipment in the monitored system based on the discrimination result evaluation value. Effect of the Invention

[0012] According to the present invention, it is possible to provide an anomalous communication detection device, an anomalous communication detection method, and an anomalous communication handling system that can easily and rationally determine whether an anomaly in business-related communications is due to a cyber attack or a device malfunction. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is a configuration diagram of an abnormal communication handling system. [Diagram 2] FIG. 2 is a functional configuration diagram of the communication monitoring device. [Diagram 3] FIG. 2 is a functional configuration diagram of the abnormal communication determination device. [Figure 4] FIG. 2 is a functional configuration diagram of an administrator terminal. [Diagram 5] FIG. 2 is a functional configuration diagram of an abnormal communication handling device. [Figure 6A] FIG. 2 is a diagram illustrating the hardware and software configuration of the communication monitoring device. [Figure 6B] FIG. 2 is a diagram illustrating the hardware and software configuration of the abnormal communication handling device. [Figure 6C] FIG. 2 is a diagram showing the hardware and software configuration of an administrator terminal. [Figure 6D] FIG. 2 is a diagram illustrating the hardware and software configuration of the anomalous communication determination device. [Figure 7] FIG. 11 illustrates an example of a device information table. [Figure 8] FIG. 13 is a diagram showing an example of a white communication table. [Figure 9] FIG. 11 illustrates an example of a business information table. [Figure 10] FIG. 11 illustrates an example of a control information table. [Figure 11] FIG. 11 is a diagram illustrating an example of a control command. [Figure 12] FIG. 13 is a diagram showing an example of a phenomenon characteristic information table. [Figure 13] FIG. 11 is a diagram illustrating an example of a statistical characteristic information table. [Figure 14] FIG. 11 is a diagram showing an example of discrimination result information data. [Figure 15]FIG. 13 illustrates an example of an abnormal communication handling information table. [Figure 16] FIG. 11 is a sequence diagram showing the processing of the abnormal communication handling system. [Figure 17] 10 is a flowchart showing details of an event category determination process for abnormal communication. [Figure 18] FIG. 13 is a diagram showing an example of an abnormal communication handling screen displayed on the administrator terminal. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] This invention relates to the second phase of the Cross-ministerial Strategic Innovation Promotion Program (SIP) of the Council for Science, Technology and Innovation, promoted by NEDO, titled "Cyber-Physical Security for an IoT Society."

[0015] Hereinafter, one embodiment of the present invention will be described with reference to FIGS. First, the configuration of an abnormal communication handling system according to an embodiment will be described with reference to Figs. 1 to 6D.

[0016] The anomaly communication handling system of this embodiment is a system that determines whether an anomaly detected in an anomalous communication in a cyber-physical system is caused by a cyber-attack or by a malfunction.

[0017] Here, a cyber-physical system is a system in which information from the real physical world is collected on a computer system in the cyber world, analyzed, and then the analysis results are fed back to the physical world for use. In this embodiment, a factory IoT system that analyzes information collected from sensors and controls production will be taken as an example of a cyber-physical system and explained. Note that IoT (Internet of Things) refers to a mechanism in which various "things" are connected to the Internet and mutually controlled by exchanging information.

[0018] As shown in FIG. 1, the anomalous communication handling system 1 includes a monitored system 5, a communication monitoring device 20, an anomalous communication handling device 30, a network switch 40, an administrator terminal 60, and an anomalous communication determination device 100.

[0019] The anomalous communication handling system 1 has a function of evaluating anomalous communication detected by the communication monitoring device 20 in the monitored system 5, and determining, based on the evaluation result, whether the anomalous communication is due to a cyber attack or a malfunction of a device constituting the monitored system 5. The logic for evaluating anomalous communication will be described in detail later.

[0020] The monitored system 5 is an IoT system, and includes one or more controllers 61, one or more actuators 71, one or more sensors 72, and a control server 50.

[0021] The devices included in the monitored system 5 function as information processing devices capable of two-way communication via a communication network.

[0022] The control server 50 and each controller 61 are connected by a first network N1 so that they can communicate with each other. In addition, each controller 61 is connected by a second network N2 so that they can communicate with each other. When the monitored system 5 is an industrial IoT system, the first network N1 is a control network using a communication protocol such as Modbus, and the second network N2 is a field network using a communication protocol such as MQTT (Message Queuing Telemetry Transport). In the FA (Factory Automation) industry, the field network refers to a network that connects a host computer / server that aggregates operation status, controllers such as PLCs (Programmable Logic Controllers) that control devices, sensors and measuring instruments that monitor status, and driving devices such as servo motors used for positioning.

[0023] The control server 50 is a server device having a function of monitoring the operation of the entire monitored system 5 via the first network N1. The control server 50 may include a function of changing and updating the logic of a control program running on the server or in the controller 61.

[0024] The controller 61 controls the operation of each actuator 71 and each sensor 72 connected via the second network N2 in accordance with a command received via the first network N1 from the control server 50. The controller 61 is, for example, a PLC that sets operation setting values ​​such as the number of rotations of a motor for the actuators 71 in accordance with a command from the control server, and collects information output by the sensors 72.

[0025] The actuator 71 is a mechanical element that actively performs physical movement based on a command from the controller 61. The actuator 71 is, for example, a device that actually moves a valve, a motor, an electric motor, or the like in accordance with a set value that is set based on a command from the controller 61.

[0026] The sensor 72 is a device that measures temperature, flow rate, pressure, or the like, and outputs the measured value.

[0027] As shown in Figure 1, the communication monitoring device 20, the anomalous communication handling device 30, the administrator terminal 60, and the anomalous communication discrimination device 100 are all connected via the management network N3 in a state where two-way communication is possible with each actuator 71 and each sensor 72.

[0028] The first network N1 and the second network N2are connected to monitor ports 41a and 42a of the network switch 40, and the communication monitoring device 20 is connected to mirror ports 41b and 42b of the network switch 40. The network switch 40 copies (mirrores) packets of the first network N1 received at the monitor port 41a and transmits them to the communication monitoring device 20 from the mirror port 41b, and copies communication packets of the second network N2 received at the monitor port 42a and transmits them to the communication monitoring device 20 from the mirror port 42b.

[0029] The communication monitoring device 20 is a mirror port 41. b , 42 b The monitoring target system 5 detects abnormal communications in the first network N1 and the second network N2 by collecting and analyzing communication packets in the first network N1 and the second network N2 of the monitoring target system 5 via the network.

[0030] The abnormal communication handling device 30 is connected to the monitored system 5 and the abnormal communication discrimination device 100 via the management network N3 and communicates with both. The abnormal communication handling device 30 has processing authority for each device of the monitored system 5, receives a handling command from the administrator terminal 60, converts the received handling command into a control command or control logic program that can be executed or processed by the target device, and transmits the converted control command or control logic program to the devices (controller 61, actuator 71, sensor 72) of the monitored system 5, causing the devices to execute processing for handling the abnormal communication.

[0031] The anomalous communication discrimination device 100 evaluates the anomalous communication detection information received from the communication monitoring device 20 from two perspectives: an event perspective and a statistical perspective, and based on the evaluation results, discriminates whether the anomalous communication is due to a cyber attack or an equipment malfunction, generates discrimination result information including the discrimination result, and transmits it to the administrator terminal 60.

[0032] The manager terminal 60 is connected to the anomalous communication discrimination device 100 and the anomalous communication handling device 30 via the management network N3 and communicates with both. The manager terminal 60 is a terminal that displays and presents to the manager 2 countermeasures appropriate for the cause of anomalous communication and the discrimination result based on the abnormal communication discrimination result received from the anomalous communication discrimination device 100. Also, in accordance with the operator's selection of a countermeasure for the presented content, the manager terminal 60 transmits information on handling the anomalous communication to the anomalous communication handling device 30.

[0033] The first network N1, the second network N2, and the management network N3 can be configured as, for example, a LAN (Local Area Network), a WAN (Wide Area Network) such as the Internet, or a wired or wireless communication network such as a dedicated line.

[0034] Next, the functional configuration of each device in the abnormal communication handling system will be described with reference to FIG. 2 to FIG.

[0035] The communication monitoring device 20 is a device that collects and analyzes communication packets of the monitored system 5 to detect anomalous communication, and transmits anomalous communication detection information to the anomalous communication determination device 100.

[0036] As shown in FIG. 2, the communication monitoring device 20 includes, as its functional components, an anomalous communication detection unit 21, a system information management unit 22, an anomalous communication detection information transmission unit 23, and a storage unit 24.

[0037] The anomalous communication detection unit 21 collects communication packets flowing in the first network N1 and the second network N2 of the monitored system 5 from the mirror ports 41b and 42b of the network switch 40, respectively. Then, the anomalous communication detection unit 21 analyzes the collected communication packets and obtains (1) header information (IP addresses of the data source device and the data destination device, communication protocol, port number, etc.) and (2) control commands and (3) parameters contained in the payload. In addition, the anomalous communication detection unit 21 generates (4) statistical information such as changes in the number of communications regarding the control commands.

[0038] Then, the anomalous communication detection unit 21 determines whether the communication in the monitored system 5 is anomalous by comparing the specifications of the monitored system 5 indicated in the system information tables 220 accessed via the system information management unit 22 described later with the analysis information (1) to (4) above, and if it determines that the communication is anomalous, transmits anomalous communication information including information on the anomalous communication to the anomalous communication detection information transmission unit 23.

[0039] Abnormal communication is determined by, for example, an abnormally large number of communication packets being sent from a particular line or device, or an operating parameter of a device being outside of a normal range.

[0040] The information regarding anomalous communication includes general information about the communication, information that anomalous communication has been detected, and information about the detection event detected by the system.

[0041] The abnormal communication detection information transmitting unit 23 transmits the received abnormal communication information to the abnormal communication determination device 100 via the management network N3.

[0042] The storage unit 24 is a functional unit that holds the system information tables 220. The system information tables 220 include a device information table 221, a white communication table 222, a business information table 223, and a control information table 224. Details of each of the system information tables 220 will be described later.

[0043] The system information management unit 22 is a functional unit that accesses the system information tables 220 held in the storage unit 24 .

[0044] Based on the abnormal communication information received from the communication monitoring device 20, the abnormal communication discrimination device 100 evaluates the abnormal communication detected in the system from two perspectives, namely, an event perspective and a statistical perspective, and based on the evaluation results, discriminates whether the abnormal communication has been caused by a cyber attack or a malfunction of a system equipment, generates discrimination result information including the discrimination result, and transmits it to the administrator terminal 60.

[0045] As shown in FIG. 3, the anomalous communication discrimination device 100 has a functional configuration including an anomalous communication detection information receiving unit 120, an event evaluation unit 130, a statistical evaluation unit 140, an anomalous communication category discrimination unit 150, a communication unit 160 with the administrator terminal, a characteristic information management unit 110, and a memory unit 170.

[0046] The anomalous communication detection information receiving unit 120 receives the anomalous communication detection information detected by the communication monitoring device 20 via the management network N3.

[0047] The event evaluation unit 130 refers to the event feature information table 111 using the function of the feature information management unit 110, and determines the abnormal communication from the event features in the cyber attack linked to the detected event and the number of matches with the event features in the failure. but It evaluates whether the problem was caused by a cyber attack or a malfunction of the system's equipment (detailed logic is described below).

[0048] The statistical evaluation unit 140, using the function of the characteristic information management unit 110, refers to the statistical characteristic information table 112, and evaluates whether the detected event is due to abnormal communication, a cyber attack, or a malfunction of a system device based on the number of matches between the statistical characteristics of the cyber attack linked to the detected event and the statistical characteristics of the malfunction (detailed logic will be described later).

[0049] The abnormal communication category discrimination unit 150 determines the cause of the abnormal communication based on the evaluation results of the event evaluation unit 130 and the statistical evaluation unit 140. but It determines whether the problem is due to a cyber attack or a malfunction of the system's equipment (detailed logic is described below).

[0050] The manager terminal communication unit 160 generates discrimination result information including the discrimination result of the anomalous communication category discrimination unit 150 and anomalous communication detection event information, and transmits the information to the manager terminal 60.

[0051] The storage unit 170 is a functional unit that holds the phenomenon characteristic information table 111 and the statistical characteristic information table 112 .

[0052] The feature information management unit 110 is a functional unit for accessing the phenomenon feature information table 111 and the statistical feature information table 112 held in the storage unit 170 .

[0053] The administrator terminal 60 is a terminal that receives information about abnormal communication, presents it to the administrator 2, and allows the administrator 2 to select a measure to deal with it. As shown in FIG. 4, the administrator terminal 60 has, as its functional parts, a determination result receiving part 68 , an abnormal communication handling processing unit 62 , an abnormal communication handling information presentation unit 63 , an abnormal communication handling command generation unit 64 , an abnormal communication handling command transmission unit 65 , an abnormal communication handling information management unit 66 , and a memory unit 67 .

[0054] Receiving unit for discrimination results 68 receives the abnormal communication determination result from the abnormal communication determination device 100 via the management network N3.

[0055] The abnormal communication handling processing unit 62 extracts abnormal communication handling information from the abnormal communication handling information table 400 and sends it to the abnormal communication handling information presentation unit 63, and sends information regarding the measures for dealing with the abnormal communication selected by the administrator 2 to the abnormal communication handling command generation unit 64.

[0056] The abnormal communication handling information presentation unit 63 presents the abnormal communication handling information to the manager 2, and transmits information regarding measures for handling the abnormal communication selected by the manager 2 to the handling command generation unit 64. Note that a user interface by which the manager terminal presents the abnormal communication handling information to the manager 2 and allows the manager 2 to select measures for handling the abnormal communication will be described later.

[0057] The abnormal communication handling command generating unit 64 generates an abnormal communication handling command based on the information on the measures for handling the abnormal communication sent from the abnormal communication handling processing unit 62, Abnormal communication response command transmission unit 65 Send to.

[0058] The abnormal communication handling command transmitting unit 65 transmits the abnormal communication handling command sent from the abnormal communication handling command generating unit 64 to the abnormal communication handling device 30 via the management network N3.

[0059] The storage unit 67 is a functional unit that holds the abnormal communication handling information table 400 .

[0060] The abnormal communication handling information management unit 66 is a functional unit that accesses the abnormal communication handling information table 400 held in the storage unit 67 .

[0061] The abnormal communication handling device 30 receives information relating to handling of abnormal communication from the administrator terminal 60 via the management network N3, and transmits a control command or a control logic program to devices (controller 61, actuator 71, sensor 72) of the monitored system 5 for which the abnormal communication handling device 30 has processing authority based on the received information relating to handling of abnormal communication. Note that the control logic program is, for example, control processing software for the sequence of the controller that is realized by executing a predetermined process or calculation.

[0062] As shown in FIG. 5, the anomalous communication handling device 30 has, as its functional configuration, an anomalous communication handling information receiving unit 31, a control logic configuration unit 32, a control information transmitting unit 33, a control logic management unit 34, and a storage unit 35.

[0063] The abnormal communication handling information receiving unit 31 receives information on handling of abnormal communication from the manager terminal 60 via the management network N3, and transmits it to the control logic configuration unit 32.

[0064] The control logic configuration unit 32 is controlled by the control logic management unit 34. Command Data 301 , Parameter Data 302 , Logic Data 303 The logic data 303 is data describing an algorithm for control, such as the order in which control commands are issued, to be transmitted to a device in the monitored system 5 corresponding to the information on how to deal with the abnormal communication, and transmits the generated control information to the control information transmitting unit 33. The logic data 303 is data describing an algorithm for control, such as the order in which control commands are issued.

[0065] The control information transmitting unit 33 transmits control information, such as a control command or a control logic program, constructed by the control logic constructing unit 32 to the devices of the monitored system 5, thereby causing them to execute control processing.

[0066] Thereafter, the control information transmitting unit 33 receives return information on the execution result of the control process from the device of the monitored system 5 , and transmits the received return information to the anomalous communication handling information receiving unit 31 .

[0067] The control logic management unit 34 is a functional unit that accesses the command data 301 , the parameter data 302 , and the logic data 303 held in the storage unit 35 .

[0068] The storage unit 35 holds command data 301, parameter data 302, and logic data 303 for configuring the control logic program and control commands compatible with each device in the monitored system 5.

[0069] A specific example of the control command transmitted to the device of the monitored system 5 will be described later.

[0070] Next, the hardware and software configuration of each component of the devices constituting the abnormal communication handling system will be described with reference to FIGS. 6A to 6D.

[0071] As shown in FIG. 6A, the communication monitoring device 20 includes a processor 201, Storage‎ 202, network I / F 203, auxiliary memory I / F 204, auxiliary memory device 210 These are connected to each other via internal communication lines such as a bus.

[0072] The processor 201 is, for example, a semiconductor device called a CPU (Central Processing Unit) or MPU (Micro Processing Unit), and executes various programs loaded from the auxiliary storage device 210 to the main memory 202, realizes various functions of the device, and controls the entire device. The main memory 202 is a semiconductor device that stores programs and work data, and is, for example, a ROM that is a non-volatile storage element and a RAM that is a volatile storage element. Here, the ROM stores immutable programs (for example, BIOS, Firmware), and the RAM is, for example, a high-speed and volatile storage element such as a DRAM (Dynamic Random Access Memory), and temporarily stores programs executed by the processor 201 and data used when the programs are executed.

[0073] The network I / F 203 is an interface circuit that connects to a network, and collects communication packets from devices of the monitored system 5 connected to the first network N1 and the second network N2 from the network switch 40 in accordance with a specified protocol, and transmits and receives communication packets to and from each device connected to the management network N3.

[0074] The auxiliary storage device 210 is a device that stores programs executed by the processor 201 and data used during execution, and is, for example, a non-volatile storage device such as a magnetic storage device (HDD: Hard Disk Drive) or a flash memory (SSD: Solid State Drive).

[0075] An anomalous communication detection program 211, a system information management program 212, and an anomalous communication detection information transmission program 213 are installed in the auxiliary storage device 210.

[0076] The abnormal communication detection program 211, the system information management program 212, and the abnormal communication detection information transmission program 213 are programs that realize the functions of the abnormal communication detection unit 21, the system information management unit 22, and the abnormal communication detection information transmission unit 23, respectively.

[0077] The auxiliary storage device 210 also stores system information tables 220 .

[0078] In the above explanation, the communication monitoring device 20 is an example of a general-purpose information processing device that realizes each function using software, but it may also be a dedicated device realized using an FPGA (Field-Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit).

[0079] 6B, the hardware configuration of the anomalous communication handling device 30 is similar to that of the above-described communication monitoring device 20. The anomalous communication handling device 30 may also be implemented by a general-purpose information processing device that implements each function by software, or may be implemented by a dedicated device.

[0080] An abnormal communication handling information receiving program 311, a control logic configuration program 312, a control information transmission program 313, and a control logic management program 314 are installed in the auxiliary storage device 310 of the abnormal communication handling device 30.

[0081] The abnormal communication handling information receiving program 311, the control logic configuration program 312, the control information transmitting program 313, and the control logic management program 314 are programs which respectively realize the functions of the abnormal communication handling information receiving unit 31, the control logic configuration unit 32, the control information transmitting unit 33, and the control logic management unit 34.

[0082] In addition, the auxiliary storage device 310 of the abnormal communication handling device 30 stores command data 301, parameter data 302, and logic data 303.

[0083] 6C, the hardware configuration of the anomalous communication determination device 100 is similar to that of the above-described communication monitoring device 20. The anomalous communication determination device 100 may also be implemented by a general-purpose information processing device that implements each function by software, or may be implemented by a dedicated device.

[0084] The auxiliary memory device 1010 of the anomalous communication discrimination device 100 has installed therein a characteristic information management program 1011, an anomalous communication information receiving program 1012, an event evaluation program 1013, a statistical evaluation program 1014, an anomalous communication category discrimination program 1015, and an administrator terminal communication program 1016.

[0085] The characteristic information management program 1011, the anomalous communication information receiving program 1012, the event evaluation program 1013, the statistical evaluation program 1014, the anomalous communication category discrimination program 1015, and the administrator terminal communication program 1016 are programs that respectively realize the functions of the characteristic information management unit 110, the anomalous communication detection information receiving unit 120, the event evaluation unit 130, the statistical evaluation unit 140, the anomalous communication category discrimination unit 150, and the administrator terminal communication unit 160.

[0086] In addition, the abnormal communication discrimination device 100 The auxiliary storage device 1010 includes: A phenomenon characteristic information table 111 and a statistical characteristic information table 112 are stored.

[0087] The hardware configuration of the administrator terminal 60 can be realized with the same configuration as the communication monitoring device 20 described above, such as a general PC, workstation, or tablet, as shown in FIG. 6D.

[0088] The auxiliary memory device 610 of the administrator terminal 60 has installed therein a discrimination result receiving program 611, an abnormal communication handling processing program 612, an abnormal communication handling information presentation program 613, an abnormal communication handling command generation program 614, an abnormal communication handling command transmission program 615, and an abnormal communication handling information management program 616.

[0089] The discrimination result receiving program 611, the abnormal communication handling processing program 612, the abnormal communication handling information presentation program 613, the abnormal communication handling command generation program 614, the abnormal communication handling command transmission program 615, and the abnormal communication handling information management program 616 are each a discrimination result receiving unit. 68 , an abnormal communication handling processing unit 62 , an abnormal communication handling information presentation unit 63 , an abnormal communication handling command generation unit 64 , an abnormal communication handling command transmission unit 65 , and an abnormal communication handling information management unit 66 .

[0090] In addition, the auxiliary storage device 610 of the administrator terminal 60 stores an abnormal communication handling information table 400.

[0091] The manager terminal 60 also has a display I / F 606 and an input / output I / F 607 .

[0092] The display I / F 606 is an interface for connecting a display device 620 such as an LCD (Liquid Crystal Display).

[0093] The input / output I / F 607 is an interface for connecting an input / output device, and is connected to, for example, a keyboard 630 and a mouse 632 which is a pointing device.

[0094] Next, abnormal communication will be handle The data structures used in the system are explained.

[0095] The system information tables 220 are a group of tables held by the communication monitoring device 20, and are used to determine whether or not there is an abnormality in communication. The system information tables 220 include a device information table 221, a white communication table 222, a business information table 223, and a control information table 224.

[0096] The device information table 221 is a table that holds information about devices within the monitored system 5, and as shown in Figure 7, has the following fields: device ID 221a, device name 221b, IP address 221c, alternative device ID 221d, model information 221e, device specification information 221f, execution environment requirement information 221g, and business ID 221h.

[0097] The device ID 221a stores an identifier for uniquely identifying the device. The device name 221b stores the device name. The IP address 221c stores an IP address assigned to the device. The alternative device ID 221d stores an identifier of an alternative device that will replace the device and continue the business in the event of an abnormality in the device. The model information 221e stores the model number of the device assigned by the manufacturer. The device specification information 221f stores information on the specifications of the device (e.g., memory capacity and operating clock for the controller 61, operating speed for the actuator 71, measurement range and measurement capability for the sensor 72, etc.). The execution environment requirement information 221g stores information on the environment in which the device is used (e.g., operating voltage, temperature for normal operation, etc.). The business ID 221h stores a business identifier of the business handled by the device.

[0098] The white communication table 222 is a table for storing communication information for performing whitelist communication regarding communication within the monitored system 5, and has fields for a white communication ID 222a, a communication protocol 222b, a source IP address 222c, a destination IP address 222d, a source port number 222e, and a destination port number 222f, as shown in Fig. 8. Here, whitelist communication refers to a communication method in which only permitted communication is permitted to be performed, or in which abnormality determination regarding communication is relaxed.

[0099] The white communication ID 222a stores an ID that uniquely identifies a white communication. The communication protocol 222b stores an identifier or name (such as "TCP / IP") that identifies the communication protocol. The source IP address 222c and destination IP address 222d store the IP addresses of the source and destination of the communication packet, respectively. The source port number 222e and The destination port number 222f stores the port numbers of the source and destination of a communication packet.

[0100] The task information table 223 is a table that stores information about tasks performed within the monitored system 5, and as shown in FIG. 9, has fields for a task ID 223a, a task name 223b, operation time 223c, a priority order 223d, and a communication ID list 223e.

[0101] The task ID 223a stores an identifier that uniquely identifies the task. The task name 223b stores the name of the task. The operation time 223c stores information on the operation time that indicates the time period during which the task is executed. The priority order 223d stores information indicating the priority order of the task, such as a number. The communication ID list 223e stores a list of communication IDs that handle the task.

[0102] The control information table 224 is a table for storing control information of devices used in a business, and as shown in FIG. 10, has fields for a communication ID 224a, a control protocol 224b, a control command 224c, a control parameter 224d, and a communication cycle 224e.

[0103] The communication ID 224a stores an ID that uniquely represents communication with a device. The control protocol 224b stores an identifier or name that represents a protocol related to communication for control. The control command 224c stores information (such as a command name and a command identifier) ​​related to a control command to be provided to a device of the monitored system 5. The control parameter 224d stores information on parameters of the control command. The communication cycle 224e stores a cycle at which control communication packets are transmitted and received.

[0104] The control command 80 is a command for controlling a device of the monitored system 5, and in this embodiment, is information that is given from the anomalous communication handling device 30 to the device of the monitored system 5 in order to handle anomalous communication, and is stored in the payload of a communication packet.

[0105] As shown in FIG. 11, the control command 80 includes, for example, a control protocol 80a, a control command 80b, control It consists of fields of parameter 80c.

[0106] In the example of FIG. 11, the protocol 80a is "Modbus / TCP", which is a command for controlling the controller 61 such as a PLC. 80a However, the example of "MQTT" is intended for commands to control actuators 71 and sensors 72 such as PLCs.

[0107] The event characteristic information table 111 is a table that stores information used when the anomalous communication discrimination device 100 evaluates anomalous communication from event characteristics (details will be described later), and as shown in Figure 12, it consists of fields for anomalous communication detection event ID 111a, anomalous communication detection event 111b, discrimination event 111c, and discrimination event category 111d.

[0108] The abnormal communication detection event ID 111a stores an identifier for uniquely identifying the abnormal communication detection event. The abnormal communication detection event 111b stores text explaining the abnormal communication detection event. The discrimination event 111c stores Monitored Systems The discrimination event category 111d stores a flag indicating whether the abnormal communication is due to a cyber attack or a device failure.

[0109] The text of the anomalous communication detection event 111b and the discrimination event 111c can be used to be displayed as the contents of an anomalous communication handling screen (described in detail later) of the manager terminal 60 shown to the manager 2.

[0110] The statistical feature information table 112 is a table that stores information used when the anomalous communication discrimination device 100 evaluates anomalous communication from statistical characteristics (details will be described later), and as shown in Figure 13, it consists of fields for statistical feature ID 112a, statistical feature 112b, discrimination condition 112c, condition equation 112d, and discrimination event category 112e.

[0111] The statistical feature 112a stores an identifier for uniquely identifying the statistical feature. The statistical feature 112b stores text explaining the statistical feature. The discrimination condition 112c stores a discrimination condition for statistically analyzing the received detection information and determining which statistical feature the anomalous communication matches from the statistics indicated by the anomalous communication. The conditional expression 112d stores a discrimination expression constructed based on the conditions indicated by the discrimination condition 112c. The discrimination event classification 112e stores a flag indicating whether the anomalous communication is due to a cyber attack or a device failure.

[0112] Here, in the record with statistical feature ID 112a "SP1", the number of sources of homogeneous anomalous communication per unit time is within the range of a specified threshold, and the number of occurrences of homogeneous anomalous communication per unit time is smaller than the specified threshold, so it is determined that the anomalous communication is due to an equipment failure, rather than a cyber attack.

[0113] The discrimination result information data 500 is data transmitted from the anomalous communication discrimination device 100 to the manager terminal 60, and as shown in FIG. 14, is made up of anomalous communication detection event information 500a and discrimination information 500b.

[0114] The anomalous communication detection event information 500a includes information on the anomalous communication detection event, anomalous communication information, and device information as shown in FIG. 14, and the discrimination information 500b includes event characteristic evaluation results, statistical characteristic evaluation results, and discrimination result information.

[0115] The anomalous communication handling information table 400 is a table that stores information on handling measures based on anomalous communication detection events and the event classification of anomalous communication determined by the anomalous communication discrimination device, and as shown in Figure 15, it consists of fields for handling information ID 400a, anomalous communication detection event 400b, event classification 400c, and handling measure 400d.

[0116] The handling information ID 400a stores an identifier for uniquely identifying the anomalous communication handling information. The anomalous communication detection event 400b stores text explaining the anomalous communication detection event. The event category 400c stores a flag indicating whether the anomalous communication determined by the anomalous communication determination device is due to a cyber attack or a device malfunction. The handling measure 400d stores text indicating the handling measure to be taken by the management system corresponding to the anomalous communication detection event 400b and the event category 400c.

[0117] Next, the processing of the abnormal communication handling system will be described with reference to the already mentioned Figs. 12, 13, 16 and 17.

[0118] First, the communication monitoring device 20 receives communication packets of the first network N1 and the second network N2 from the network switch 40 and monitors for abnormal communication ( A01 , S101). Then, when abnormal communication is detected (S102), the abnormal communication detection information data is transmitted to the abnormal communication determination device 100 (A02).

[0119] Next, the anomalous communication discrimination device 100 performs an event classification discrimination process for the anomalous communication based on the received anomalous communication detection information data (S111), and transmits discrimination result information data (details will be described later) including the anomalous communication detection information and the event classification discrimination result information to the administrator terminal 60 (A03).

[0120] The process of determining the event category of abnormal communication will be described in detail later.

[0121] Next, the administrator terminal 60 edits the anomalous communication detection information and event classification discrimination result information data based on the discrimination result information data received from the anomalous communication discrimination device 100 and the anomalous communication handling information table 400, and displays an anomalous communication handling screen (a specific example will be described later) on the display device 620 (S121) and presents it to the administrator 2.

[0122] When the administrator 2 selects a countermeasure for abnormal communication displayed on the abnormal communication handling screen (A04), the administrator terminal 60 acquires information on the countermeasure for abnormal communication (S122), generates abnormal communication handling information data accordingly (S123), and transmits the abnormal communication handling information data including the abnormal communication detection information and the countermeasure to the abnormal communication handling device 30 (A05).

[0123] Based on the transmitted abnormal communication handling information data, the abnormal communication handling device 30 identifies the corresponding device in the monitored system 5 (S131), generates a control command to be sent (S132), and sends it to the corresponding device in the monitored system 5 (A06).

[0124] Next, the event classification determination process for abnormal communication will be described in detail with reference to FIG.

[0125] First, the event evaluation unit 130 of the anomalous communication discrimination device 100 refers to the event characteristic information table 111, extracts a record from the event characteristic information table 111 of the anomalous communication detection event 111b that matches the content of the received anomalous information detection information, obtains the value of the discrimination event category 111d of that record, and counts the number of times that the value is either a "cyber attack" or a "failure" (S201).

[0126] Then, an event evaluation value EventEval of the abnormal communication is calculated by the following (Equation 1) (S202). EventEval=e c ×EC+e f ×EF…(Formula 1) Here, EC is the number of records in which the value of the discrimination event class 111d of the acquired records is “cyber attack”, EF is the number of records in which the value of the discrimination event class 111d of the acquired records is “failure”, and ec , e f is the optimization factor for the evaluation.

[0127] The optimization coefficient for the evaluation is e c >e f (For example, e c =1, e f =-1). The optimization coefficient for this evaluation can be weighted based on the know-how of the system engineer and the status of the system equipment. For example, when there are many cyber attacks on a specific date, e c When the equipment's service life exceeds a specified period, e f For example, by increasing the size of the

[0128] e c =1, e f If we take e = -1, then if the event evaluation value EventEval is a positive value, it indicates that the possibility of a cyber attack is high, and the higher the value, the higher the possibility of a cyber attack. c =1, e f If we take e = -1, a negative value for the event evaluation value EventEval indicates a high possibility of failure, and the smaller the value, the higher the possibility of failure. c =1, e f =-1, a negative value for the event evaluation value EventEval means that it is difficult to determine whether the abnormal communication is due to a cyber attack or a device failure.

[0129] Next, the statistical evaluation unit 140 of the anomalous communication discrimination device 100 acquires statistical information on communication from the received anomalous communication detection information (S203). Specifically, the statistical information on communication is the statistics of various anomalous communications, that is, the increase in anomalous communications per unit time, the increase in anomalous communications of a specific communication per unit time, the number of sources of the same type of anomalous communication per unit time, the number of occurrences of the same type of anomalous communication per unit time, etc.

[0130] Next, the statistical evaluation unit 140 of the anomalous communication discrimination device 100 acquires a record in which the statistical information calculated in S203 satisfies the contents of the discrimination condition 112c and the conditional expression 112d stored in the statistical feature information table 112, acquires the value of the discrimination event classification 112e of that record, and counts the number of times that the value is either a "cyber attack" or a "failure" (S204).

[0131] Then, a statistical evaluation value StatEval of the abnormal communication is calculated by the following (Equation 2) (S205). StatEval=s c ×SC+s f ×SF…(Formula 2) Here, SC is the number of records in which the value of the discrimination event class 112e of the acquired records is “cyber attack”, SF is the number of records in which the value of the discrimination event class 112e of the acquired records is “failure”, and s c , s f is the optimization factor for the evaluation.

[0132] The optimization coefficients for evaluation are s c >s f (For example, s c =1, s f =-1). Similarly, with regard to the optimization coefficient for this evaluation, a method of weighting based on the know-how of the system engineer and the status of the system device can be considered.

[0133] Optimization coefficients for evaluation and cyber attack probability of the equipment Broken The probability is the same as that explained for the eventual rating value.

[0134] Next, the anomalous communication category discrimination unit 150 of the anomalous communication discrimination device 100 calculates a discrimination result evaluation value Eval based on the event evaluation value EventEval calculated in S202 and the statistical evaluation value StatEval calculated in S205 using the following (Equation 3) (S206). Eval=k E ×EventEval+k S ×StatEval …(Formula 3) where k E , k S are the weighting coefficients for the event-based and statistical evaluations, respectively.

[0135] Weighting factor k for evaluation E , k S The value of is a coefficient indicating whether to give weight to event-based or statistical evaluation. In the case of equality, k E = 1, k S = 1. In addition, it can be determined based on whether the manager 2 places importance on event-based evaluation or statistical evaluation.

[0136] In addition, the optimization coefficient e for event-based evaluation c , e f , optimization coefficients for statistical evaluation s c , s f , the weighting factor k of the final classification result E , k S may be determined by learning using training data.

[0137] Next, the anomalous communication category discrimination unit 150 of the anomalous communication discrimination device 100 calculates the discrimination result evaluation Result by (Equation 4) based on the discrimination result evaluation value Eval calculated in S206, as described below. The discrimination result evaluation is a textual representation of the evaluation of the anomalous communication based on the discrimination result evaluation value Eval.

[0138] The discrimination result evaluation value Eval is the optimal coefficient e in the event evaluation value EventEval. c , e f , the optimization coefficient s in the statistical evaluation value StatEval c , s f , the weighting coefficient k of the discrimination result evaluation value Eval E , k S Depending on how , is taken, the larger the value of the discrimination result evaluation value Eval, the more likely it is that the abnormal communication is due to a cyber attack and not due to equipment failure.

[0139] Therefore, when evaluating on a five-point scale, the four thresholds (Th1, Th2, Th3, Th4) are set in the order Th1>Th2>Th3>Th4, If Eval≧Th1, Result=”cyber attack” If Th2≧Eval>Th1, Result="Possibility of cyber attack" If Th3≧Eval>Th2, Result="cyber attack / failure" When Th4≧Eval>Th3, Result="Possible malfunction" When Eval>Th4, Result="Failure" …(Formula 4)

[0140] Next, the abnormal communication handling screen displayed on the administrator terminal will be described with reference to FIG. FIG. 18 is a diagram showing an example of an abnormal communication handling screen displayed on the administrator terminal.

[0141] The abnormal communication handling screen 900 is a screen displayed by the administrator terminal 60 to allow the administrator to select how to handle the abnormal communication based on the abnormal communication detection information detected by the communication monitoring device 20 and the results of the abnormal communication discrimination device 100 determining whether the abnormal communication is due to a cyber attack or equipment failure.

[0142] 18, the abnormal communication handling screen 900 has a detected abnormal communication information display field 910 and a countermeasure selection field 920 in which the contents of the countermeasure 400d in the abnormal communication handling information table 400 are edited, and one or more countermeasures are displayed, such as "[Countermeasure 1] Switch Controller 1 to alternative device Controller 2." The countermeasure selection field 920 has an Implement button 921 and a Do Not Implement button 922 for selecting each countermeasure. The Implement button 921 and the Do Not Implement button 922 are exclusive toggle buttons.

[0143] When the administrator 2 selects the countermeasure, he / she clicks the Implement button 921 to select it, and when he / she does not select the countermeasure, he / she clicks the Do not Implement button 922 to select it, and finally clicks the OK button 930. Also, when he / she wants to cancel the input contents, he / she clicks the Cancel button 931.

[0144] As described above, in the anomalous communication handling system according to this embodiment, for anomalous communication detected on a device of the system, an evaluation based on event characteristics and a statistical evaluation are performed based on the number of matches between cyber-attack characteristics and fault characteristics to evaluate the cause. Furthermore, a discrimination result value for discriminating between a cyber-attack and a fault is obtained based on these two evaluation values. This makes it possible to provide an anomalous communication discrimination device that can discriminate whether anomalous communication detected in a monitored system is due to a cyber-attack or a fault of the device.

[0145] In this way, when abnormal communication occurs, it is possible to distinguish between a cyber attack and a malfunction, and propose countermeasures appropriate to the incident. The administrator can select the appropriate response, and the system can quickly implement countermeasures that correspond to the abnormal communication, which is expected to have the effect of minimizing damage caused by cyber attacks and malfunctions. [Explanation of symbols]

[0146] 1 ... abnormal communication handling system, 5 ... monitored system, 20 ... communication monitoring device, 30 ... abnormal communication handling device, 40 ... network switch, 60 ... administrator terminal, 100 ... abnormal communication determination device, 220...system information tables, 221...device information table, 222...white communication table, 223...business information table, 224...control information table, 80...control command, 111...event characteristic information table, 112...statistical characteristic information table, 500...discrimination result information data, 400...abnormal communication handling information table

Claims

1. An anomalous communication determination device that determines a cause of anomalous communication detected in a monitored system in which the device operates, comprising: a phenomenon characteristic table for storing, for each abnormal communication detection event, a record that stores a discrimination event classification that indicates whether the abnormal communication is due to a cyber attack or a malfunction of a device in the monitored system; A statistical feature table is stored in which, for each condition under which the statistics of anomalous communication are established, a record is stored which stores a discrimination event classification which indicates whether the anomalous communication is due to a cyber attack or a malfunction of a device in the monitored system; receiving abnormal communication detection information in the monitored system; Based on the received anomalous communication detection information, a catastrophic evaluation value is calculated from the number of times that the anomalous communication is caused by a cyber attack or a malfunction of a device in the monitored system, based on the value of a discrimination event category of a record corresponding to the anomalous communication detection information in the catastrophic feature table; Calculates statistics on abnormal communication from the received abnormal communication detection information, Based on the calculated anomalous communication statistics, a statistical evaluation value is calculated from the number of anomalous communications caused by cyber attacks or by equipment failures in the monitored system for records in which the condition for the anomalous communication statistics in the statistical feature table is satisfied; and An abnormal communication discrimination device characterized by calculating a discrimination result evaluation value indicating whether abnormal communication is due to a cyber attack or a malfunction of an equipment in the monitored system based on the event evaluation value and the statistical evaluation value, and discriminating whether abnormal communication is due to a cyber attack or a malfunction of an equipment in the monitored system based on the discrimination result evaluation value.

2. The abnormal communication discrimination device as described in claim 1, characterized in that the event evaluation value is calculated by a weighted linear sum of the number of records indicating whether the abnormal communication is due to a cyber attack or a malfunction of equipment in the monitored system.

3. The anomalous communication discrimination device as described in claim 1, characterized in that the statistical evaluation value is calculated by a weighted linear sum of the number of records indicating whether the anomalous communication is due to a cyber attack or a malfunction of equipment in the monitored system.

4. 2. The abnormal communication detection device according to claim 1, wherein the detection result evaluation value is calculated as a weighted linear sum of the event evaluation value and the statistical evaluation value.

5. An anomalous communication discrimination method for discriminating a cause of anomalous communication detected in a monitored system in which the device operates, comprising: The abnormal communication determination device includes an event feature table for storing a record that stores a determination event classification indicating whether the abnormal communication is due to a cyber attack or a malfunction of a device in a monitored system for each abnormal communication detection event; A statistical feature table is stored in which, for each condition under which the statistics of anomalous communication are established, a record is stored which stores a discrimination event classification which indicates whether the anomalous communication is due to a cyber attack or a malfunction of a device in the monitored system; receiving abnormal communication detection information in the monitored system by the abnormal communication determination device; A step in which the anomalous communication discrimination device calculates an event evaluation value from the number of times that the anomalous communication is caused by a cyber attack or a malfunction of a device in the monitored system, based on the received anomalous communication detection information, in the discrimination event category value of the record corresponding to the anomalous communication detection information in the event feature table; a step of the anomalous communication determination device calculating a statistic of anomalous communication from the received anomalous communication detection information; The abnormal communication discrimination device calculates a statistical evaluation value based on the calculated abnormal communication statistics from the number of abnormal communications caused by cyber attacks or the number of abnormal communications caused by failures of devices in the monitored system for which the condition for the abnormal communication statistics in the statistical feature table is satisfied. The abnormal communication discrimination method is characterized in that the abnormal communication discrimination device calculates a discrimination result evaluation value indicating whether the abnormal communication is due to a cyber-attack or a malfunction of an equipment of the monitored system based on the event evaluation value and the statistical evaluation value, and discriminates whether the abnormal communication is due to a cyber-attack or a malfunction of an equipment of the monitored system based on the discrimination result evaluation value.

6. An abnormal communication handling system that determines a cause of an abnormal communication detected in a monitored system in which a device operates, comprising: A communication monitoring device that monitors abnormal communication in the monitored system; an abnormal communication handling device that transmits control information to a device of the monitored system; an administrator terminal that displays network information of the monitored system and receives instructions from an administrator; and an abnormal communication determination device that evaluates the abnormal communication detection information and determines whether the abnormal communication is due to a cyber attack or a device failure based on the evaluation result. The communication monitoring device transmits abnormal communication detection information to the abnormal communication determination device, The abnormal communication determination device includes: A phenomenon feature table is stored for storing, for each abnormal communication detection event, a record that stores a discrimination event class that indicates whether the abnormal communication is due to a cyber attack or a malfunction of a device in the monitored system, and a statistical feature table is stored for storing, for each condition under which the statistics of the abnormal communication are established, a record that stores a discrimination event class that indicates whether the abnormal communication is due to a cyber attack or a malfunction of a device in the monitored system, The anomalous communication determination device calculates an event evaluation value from the number of occurrences of the anomalous communication caused by a cyber attack or a malfunction of a device in the monitored system, based on the received anomalous communication detection information, in the event characteristic table, of the determination event classification value of the record corresponding to the anomalous communication detection information; the abnormal communication determination device calculates a statistical amount of abnormal communication from the received abnormal communication detection information; The anomalous communication determination device calculates a statistical evaluation value from the number of anomalous communications caused by cyber attacks or malfunctions of devices in the monitored system for records that satisfy the condition for the anomalous communication statistics in the statistical feature table based on the calculated anomalous communication statistics, and The anomalous communication discrimination device calculates a discrimination result evaluation value indicating whether the anomalous communication is due to a cyber-attack or a malfunction of a device in the monitored system based on the event evaluation value and the statistical evaluation value, and generates a discrimination result evaluation of a text that evaluates whether the anomalous communication is due to a cyber-attack or a malfunction of a device in the monitored system based on the discrimination result evaluation value; the anomalous communication determination device transmits determination result information including the anomalous communication detection information and the determination result evaluation to the administrator terminal; The administrator terminal holds an abnormal communication handling information table that stores records of the abnormal communication detection information and measures against the abnormal communication, for each of whether the abnormal communication is due to a cyber attack or a malfunction of a device in the monitored system. The manager terminal displays an abnormal communication handling screen that displays the abnormal communication detection information, the discrimination result evaluation, and a countermeasure plan for the abnormal communication based on the received discrimination result information, and the manager terminal receives a selection of a countermeasure plan for the abnormal communication from the manager, generates abnormal communication handling information based on the selection of the countermeasure plan, and transmits the abnormal communication handling information to the abnormal communication handling device; The abnormal communication handling system is characterized in that the abnormal communication handling device transmits control information to a device of the monitored system based on the received abnormal communication handling information.

Images