Diagnostic device and diagnostic method

Abstract

To provide a diagnostic device and a diagnostic method capable of appropriately determining whether or not a cyber attack has occurred and whether or not equipment has malfunctioned.SOLUTION: A computing device provided in a diagnostic device calculates an instantaneous attack probability, which is the probability that a cyber-attack has been carried out on equipment to be diagnosed at a specified time, and calculates an instantaneous malfunction probability, which is the probability that a malfunction has occurred in the equipment to be diagnosed at a specified time, and determines whether or not a cyber-attack has been carried out on the equipment to be diagnosed and whether or not a malfunction has occurred in the equipment to be diagnosed at the specified time based on the instantaneous attack probability and the instantaneous malfunction probability.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a diagnostic device and a diagnostic method. [Background technology]

[0002] A control system that requires stable operation needs to deal with both equipment failures and cyber attacks. So-called binary diagnosis, which diagnoses the state of an equipment as a binary value between normal and abnormal, has problems such as being unable to distinguish between an abnormality as a cyber attack and an equipment failure, and being unable to distinguish a cyber attack that appears to be normal. Patent Document 1 describes a diagnostic method for diagnosing the state of an equipment using a method other than binary diagnosis. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2019-194830 A Summary of the Invention [Problem to be solved by the invention]

[0004] The technology described in Patent Document 1 had the problem that accurate diagnosis was not possible because there was a mutual dependency between the probability of being under cyber-attack and the probability of equipment failure.

[0005] The present invention aims to provide a diagnostic device and a diagnostic method that can appropriately determine whether or not a cyber attack has occurred and whether or not an equipment malfunctions. [Means for solving the problem]

[0006] A diagnostic device according to one embodiment of the present invention includes a calculation device that calculates an instantaneous attack probability, which is the probability that a cyber-attack has been carried out on a device to be diagnosed at a specified time, calculates an instantaneous failure probability, which is the probability that a failure has occurred in the device to be diagnosed at the specified time, and determines whether or not a cyber-attack has been carried out on the device to be diagnosed and whether or not a failure has occurred in the device to be diagnosed at the specified time based on the instantaneous attack probability and the instantaneous failure probability. Effect of the Invention

[0007] According to the present invention, it is possible to appropriately determine whether or not a cyber attack has occurred and whether or not equipment has malfunctioned. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a block diagram showing a schematic hardware configuration of a diagnostic device according to the first embodiment. [Diagram 2] FIG. 2 is a block diagram showing the functional configuration of the diagnostic device according to the first embodiment. [Diagram 3] FIG. 3 is a flowchart of an instantaneous failure probability calculation process executed by the instantaneous failure probability calculation unit. [Figure 4] FIG. 4 is a flowchart of an instantaneous attack probability calculation process executed by the instantaneous attack probability calculation unit. [Diagram 5] FIG. 5 is a flowchart of the probability adjustment process executed by the probability adjustment unit. [Figure 6] FIG. 6 is a graph illustrating the adjusted instantaneous failure probability and the adjusted instantaneous attack probability. [Figure 7] FIG. 7 is a flowchart of the discrimination process executed by the discriminating unit. [Figure 8] FIG. 8 is a schematic diagram illustrating a display screen of the display device. [Figure 9] FIG. 9 is a block diagram showing the functional configuration of a diagnostic device according to the second embodiment. [Figure 10] FIG. 10 is a flowchart of the instantaneous attack probability calculation process executed by the instantaneous attack probability calculation unit. [Figure 11] FIG. 11 is a graph illustrating the adjusted instantaneous failure probability and the adjusted instantaneous attack probability. [Figure 12] FIG. 12 is a block diagram showing the functional configuration of a diagnostic device according to the third embodiment. [Figure 13] FIG. 13 is a graph illustrating the adjusted instantaneous failure probability and the adjusted instantaneous attack probability. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] A diagnostic device according to an embodiment of the present invention will be described with reference to FIGS. 1 to 8.

[0010] First Embodiment 1 is a block diagram showing a schematic hardware configuration of a diagnostic device 1 according to the first embodiment. The diagnostic device 1 is a device that diagnoses the soundness of a device to be diagnosed (not shown, for example, a control device included in a control system) and notifies a user of the diagnosis result. The user can diagnose the device to be diagnosed using the diagnostic device 1 at any timing (for example, a specific time every day), and can take necessary measures for the device to be diagnosed by referring to the diagnosis result.

[0011] The diagnostic device 1 is composed of a computer having an arithmetic device 11 such as a CPU (Central Processing Unit), an MPU (Micro Processing Unit), a DSP (Digital Signal Processor), etc., a non-volatile memory 12 such as a ROM (Read Only Memory), a flash memory, a hard disk drive, etc., a volatile memory 13 called a RAM (Random Access Memory), an input / output interface 14, and other peripheral circuits. These hardware components work together to operate software and realize multiple functions. The diagnostic device 1 may be composed of one computer or multiple computers. Also, the arithmetic device 11 may be an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), etc.

[0012] The non-volatile memory 12 stores programs capable of executing various calculations. In other words, the non-volatile memory 12 is a storage medium (storage device) capable of reading programs that realize the functions of this embodiment. The volatile memory 13 is a storage medium (storage device) that temporarily stores the results of calculations performed by the calculation device 11 and signals input from the input interface 14. The calculation device 11 is a device that loads the programs stored in the non-volatile memory 12 into the volatile memory and executes calculations, and performs predetermined calculation processing on data taken from the input / output interface 14, the non-volatile memory 12, and the volatile memory 13 in accordance with the programs.

[0013] The diagnostic device 1 is connected to a parameter database 2, a vulnerability database 3, and a display device 4 via an input / output interface 14. The parameter database 2 and the vulnerability database 3 are storage devices in which predetermined data is stored. The data stored in the parameter database 2 and the vulnerability database 3 will be described in detail later. The display device 4 is a device having a display screen such as a liquid crystal monitor.

[0014] An input section of the input / output interface 14 converts signals input from the parameter database 2 and the vulnerability database 3 into data that can be calculated by the arithmetic device 11. In addition, an output section of the input / output interface 14 generates an output signal according to the calculation result in the arithmetic device 11, and outputs the signal to the display device 4.

[0015] FIG. 2 is a block diagram showing a functional configuration of the diagnostic device 1 according to the first embodiment. The diagnostic device 1 includes a time input unit 41, an instantaneous failure probability calculation unit 42, an instantaneous attack probability calculation unit 43, a probability adjustment unit 44, a discrimination unit 45, and an output unit 46. The time input unit 41 inputs a diagnosis time to the instantaneous failure probability calculation unit 42 and the instantaneous attack probability calculation unit 43. The instantaneous failure probability calculation unit 42 calculates the instantaneous failure probability of the diagnostic target device at the diagnosis time. The instantaneous attack probability calculation unit 43 calculates the instantaneous attack probability of the diagnostic target device at the diagnosis time. The probability adjustment unit 44 performs adjustment to make the instantaneous failure probability and the instantaneous attack probability into the same dimension. The discrimination unit 45 uses the instantaneous failure probability and the instantaneous attack probability adjusted by the probability adjustment unit 44 to discriminate whether or not there is a possibility of a cyber attack on the diagnostic target device and whether or not there is a possibility of a failure of the diagnostic target device. The output unit 46 outputs the result of the discrimination by the discrimination unit 45 to the display device 4 and notifies the user of the content.

[0016] The parameter database 2 stores shape parameters 21, scale parameters 22, and position parameters 23. Furthermore, the vulnerability database 3 stores publication date data 31 and device data 32. These data will be explained together with the processes that use the data.

[0017] The diagnosis of the diagnosis target device by the diagnosis device 1 is realized by an instantaneous failure probability calculation process, an instantaneous attack probability calculation process, a probability adjustment process, and a discrimination process. Below, these processes will be explained in order.

[0018] [Instantaneous failure probability calculation process] 3 is a flowchart of the instantaneous failure probability calculation process executed by the instantaneous failure probability calculation unit 42. In step S100, the time input unit 41 inputs the diagnosis time to the instantaneous failure probability calculation unit 42. In step S110, the instantaneous failure probability calculation unit 42 acquires the shape parameter 21, the scale parameter 22, and the position parameter 23 from the parameter database 2. Each of these parameters is set to a predetermined value according to the number of past failures of the device to be diagnosed and the time until the failure. In step S120, the instantaneous failure probability calculation unit 42 substitutes the shape parameter 21, the scale parameter 22, and the position parameter 23 into the failure density function f(t).

[0019] The failure density function f(t) is a function that represents the failure probability of the diagnosed device over time. In other words, the failure density function f(t) is a function that represents a probability distribution that changes over time. The failure density function f(t) is expressed as the product of the hazard function h(t) and the reliability function R(t). Here, the variable t represents the operating time of the diagnosed device, and t=0 corresponds to the time when the diagnosed device started operating. The hazard function h(t) is a function that represents the probability that a failure occurs in the diagnosed device at time t, regardless of whether the diagnosed device has actually failed by time t. In other words, the hazard function h(t) is a conditional probability density that the diagnosed device will fail at time t under the condition that the diagnosed device has not failed until time t. If the shape parameter 21 is represented by the symbol m, the scale parameter 22 is represented by the symbol n, and the location parameter 23 is represented by the symbol Γ, the hazard function h(t) is expressed by the following equation (1). h(t)=m / n {(t-Γ) / n}^(m-1) ···(1) The reliability function R(t) is a function that represents the probability that the device to be diagnosed will not fail until time t, and is expressed by the following equation (2). R(t)=Exp{-(t-Γ / n)^m} ···(2) The failure density function f(t) is a function that represents the probability that a failure will first occur in the device to be diagnosed at time t, and is expressed by the following equation (3). f(t) = h(t) R(t) (3) The failure density function f(t) is generally a downwardly convex function over time, such as a Weibull distribution.

[0020] The shape parameter 21, represented by the letter m, is a parameter that determines the increase or decrease of the failure density function f(t) over time, that is, the shape of the probability distribution represented by the failure density function f(t). For example, when m<1, the failure density function f(t) decreases over time. When m>1, the failure density function f(t) increases over time. When m=0, the failure probability is constant regardless of time. The scale parameter 22, represented by the letter n, is a parameter that determines the magnitude of the failure density function f(t), that is, the scale of the probability distribution represented by the failure density function f(t). For example, the maximum value of the failure density function f(t) when n=1 is twice the maximum value of the failure density function f(t) when n=2. The position parameter 23, represented by the letter Γ, is a parameter that determines the phase of the failure density function f(t), that is, the position of the probability distribution represented by the failure density function f(t). For example, the initial position on the horizontal axis of the failure density function f(t) when Γ=2 is translated by 2 compared to the initial position of the failure density function f(t) when Γ=0.

[0021] 3, the instantaneous failure probability calculation unit 42 substitutes the shape parameter 21, the scale parameter 22, and the position parameter 23 into the failure density function f(t) of the above formula (3). In the following step S130, the instantaneous failure probability calculation unit 42 calculates the instantaneous failure probability using the failure density function f(t) after the substitution of each parameter and the diagnosis time. A cumulative failure distribution function F(t) defined as the following formula (4) is introduced. F(t) = ∫f(t)dt (4) If the diagnosis time is t1, the instantaneous failure probability calculation unit 42 calculates the instantaneous failure probability by time integrating the cumulative failure distribution function F(t) from t=0 to t=t1.

[0022] [Instant attack probability calculation process] 4 is a flowchart of the instantaneous attack probability calculation process executed by the instantaneous attack probability calculation unit 43. In step S200, the time input unit 41 inputs a diagnosis time to the instantaneous attack probability calculation unit 43. In step S210, the instantaneous attack probability calculation unit 43 acquires the publication date data 31 and the device data 32 from the vulnerability database 3.

[0023] The vulnerability database 3 holds vulnerability information of software and hardware constituting the diagnosis target device. The publication date data 31 indicates the date on which vulnerability information of software and hardware related to the diagnosis target device was published. The device data 32 indicates network connection information of the diagnosis target device and program information held and used inside the diagnosis target device. These data are set by collecting vulnerability information published by security-related organizations in each country in advance using the Internet, for example. For example, the publication date data 31 is generated from vulnerability information published based on the CVSS (Common Vulnerability Scoring System), known as the Common Vulnerability Scoring System, and stored in the vulnerability database 3. In addition, by comparing such vulnerability information with the device data 32, vulnerabilities that affect the diagnosis target device can be identified.

[0024] In step S220, the instantaneous attack probability calculation unit 43 calculates a security evaluation value of the diagnosis target device. The security evaluation value is a numerical value that indicates the level of risk of the diagnosis target device against a cyber-attack, and is set to be larger, for example, as the diagnosis target device has higher resistance to cyber-attacks and as the damage to the diagnosis target device when it is hit by a cyber-attack becomes greater.

[0025] The instantaneous attack probability calculation unit 43 in the first embodiment calculates the security evaluation value Risk by the following formula (5). Risk=Impact·Likelihood···(5) Here, Impact represents the degree of influence (magnitude of influence) on the device to be diagnosed, and Likelihood represents the ease of attacking the device to be diagnosed.

[0026] For example, the aforementioned CVSS determines the security assessment score on the day the vulnerability was disclosed based on the basic characteristics of the vulnerability itself as follows: The basic characteristics of the vulnerability itself include attack source category X, which is an index of from where the vulnerable component can be attacked, Y, which is an index of the complexity of the conditions required to attack the vulnerable component, privilege level Z required to attack the vulnerable component, and user involvement level W required to attack the vulnerable component, all of which measure the ease of attack. Additionally, there are impact level C on confidentiality, impact I on integrity, and impact A on availability, all of which measure the degree of impact on the device being diagnosed.

[0027] Here, Impact can be expressed as the following equation (6) using availability A, integrity I, and confidentiality C. Impact=1-(1-A)×(1-I)×(1-C) ···(6) In addition, the likelihood can be expressed as the following formula (7) using the attack source category X, the complexity of the attack conditions Y, the required privilege level Z, and the required user involvement level W. Likelihood=8.22×X×Y×Z×W ···(7) By substituting equations (6) and (7) into equation (5), we obtain the following equation (8) for calculating the security evaluation value Risk. Risk=(1-(1-A)×(1-I)×(1-C))×8.22×X×Y×Z×W ···(8) In step S220 of FIG. 4, the instantaneous attack probability calculation unit 43 calculates the security evaluation value Risk using equation (8).

[0028] In step S230, the instantaneous attack probability calculation unit 43 determines an attack density function a(t). The attack density function a(t) is a function that represents the probability of being first attacked by a cyber attack at time t. That is, the attack density function a(t) is a function that represents a probability distribution that changes over time. The attack density function a(t) is set separately (independently) from the fault density function f(t), so there is usually no correlation between the two. In other words, the attack density function a(t) and the fault density function f(t) are functions that represent different probability distributions. The instantaneous attack probability calculation unit 43 assumes a probability distribution having the above-mentioned security evaluation value as a parameter, and determines an attack density function a(t) that represents the probability distribution. For example, the attack density function a(t) is a function that is upwardly convex with respect to time or a function that monotonically decreases, and an example of such a function is a Gaussian distribution.

[0029] The instantaneous attack probability calculation unit 43 in the first embodiment uses an attack density function a(t) expressed by the following equation (9). a(t)=1 / √(2πσexp{-(t-μ)^2 / 2σ^2}) ···(9) Here, μ represents the mean, σ represents the standard deviation, and 2σ^2 represents the variance.

[0030] In step S240, the instantaneous attack probability calculation unit 43 calculates the instantaneous attack probability using the diagnosis time input in step S200 and the attack density function a(t) determined in step S230. A cumulative attack distribution function A(t) defined as the following equation (10) is introduced. A(t) = ∫a(t)dt (10) If the diagnosis time is t1, the instantaneous attack probability calculation unit 43 calculates the instantaneous attack probability by time integrating the cumulative attack distribution function A(t) from t=0 to t=t1.

[0031] [Probability adjustment process] 5 is a flowchart of the probability adjustment process executed by the probability adjustment unit 44. In the probability adjustment process, the probability adjustment unit 44 makes the probability distributions of failures and cyber attacks at the time of diagnosis into the same dimension to make them comparable. In the first embodiment, a method using a probability distance measure is adopted as a method for making different probability distributions into the same dimension.

[0032] In step S300, the probability adjustment unit 44 acquires the cumulative failure distribution function F(t) derived in the instantaneous failure probability calculation process by the instantaneous failure probability calculation unit 42, and the cumulative attack distribution function A(t) derived in the instantaneous attack probability calculation process by the instantaneous attack probability calculation unit 43. In step S310, the probability adjustment unit 44 calculates a probability distance measure between the cumulative failure distribution function F(t) and the cumulative attack distribution function A(t).

[0033] The probability distance measure means the distance between different probability distributions (for example, a Weibull distribution and a Gaussian distribution), such as the Kullback-Leibler divergence. The probability distance measure DKL is calculated by the following formula (11). DKL(F(t)||A(t))=∫F(t)log{A(t) / F(t)}dt ···(11) In this manner, in the first embodiment, the Kullback-Leibler divergence is adopted as the probabilistic distance measure.

[0034] In step S320, the probability adjustment unit 44 calculates the adjusted instantaneous failure probability and the adjusted instantaneous attack probability at the diagnosis time. The probability adjustment unit 44 multiplies the instantaneous failure probability at the diagnosis time (the value calculated in step S130 of FIG. 3) by the probability distance measure calculated in step S310 to obtain the adjusted instantaneous failure probability. Similarly, the probability adjustment unit 44 multiplies the instantaneous attack probability at the diagnosis time (the value calculated in step S240 of FIG. 4) by the probability distance measure calculated in step S310 to obtain the adjusted instantaneous attack probability.

[0035] For example, if the adjusted instantaneous failure probability is F'(t) and the adjusted instantaneous attack probability is A'(t), the adjusted instantaneous failure probability and the adjusted instantaneous attack probability can be calculated using the following equations (12) and (13). F'(t)=DKL(F(t)||A(t))·F(t) ···(12) A'(t)=DKL(F(t)||A(t))·A(t) ···(13) Once the adjusted instantaneous failure probability F'(t) and the adjusted instantaneous attack probability A'(t) are calculated in step S320, the process proceeds to step S330.

[0036] In step S330, the probability adjustment unit 44 outputs to the discrimination unit 45 the adjusted instantaneous failure probability F′(t) and the adjusted instantaneous attack probability A′(t) at the diagnosis time t1 calculated in step S320.

[0037] FIG. 6 is a graph illustrating the adjusted instantaneous failure probability F'(t) and the adjusted instantaneous attack probability A'(t). In FIG. 6, reference numeral 62 denotes the adjusted instantaneous failure probability F'(t), and reference numeral 63 denotes the adjusted instantaneous attack probability A'(t). In FIG. 6, the horizontal axis denotes the elapsed time t, and the vertical axis denotes the respective probabilities at the elapsed time. In FIG. 6, the elapsed time t on the horizontal axis is divided into three phases: initial operation, mid-term operation, and final operation. These phases refer to the phases after the diagnosis target device is introduced and operation is started. That is, the initial operation phase represents a period of time immediately after the diagnosis target device is put into operation, the mid-term operation phase represents a period of time after operation is on track, and the final operation phase represents the final stage of operation. Reference numeral 60 represents the date and time when a vulnerability is discovered in the diagnosis target device, and reference numeral 61 represents the time when the diagnosis is performed by the diagnosis device 1 (diagnosis time t1). Reference numeral 64 denotes the adjusted instantaneous failure probability F'(t) at the diagnosis time, and reference numeral 65 denotes the adjusted instantaneous attack probability A'(t) at the diagnosis time. For example, in Fig. 6, at diagnosis time t1, the adjusted instantaneous failure probability F'(t) = 0.3, and the adjusted instantaneous attack probability A'(t) = 0.2.

[0038] [Discrimination process] 7 is a flowchart of the discrimination process executed by the discrimination unit 45. The discrimination unit 45 outputs the presence or absence of a breakdown and a cyber attack by comparing the adjusted instantaneous failure probability F'(t) and the adjusted instantaneous attack probability A'(t) output by the probability adjustment unit 44 with predetermined thresholds f and a, respectively. The predetermined threshold f is a value based on the fault density function f(t), and the predetermined threshold a is a value based on the attack density function a(t). These thresholds f and a may be statistical values ​​such as the mode, average, or median of the fault density function f(t) or the attack density function a(t), or may be values ​​designated by the designer of the diagnostic device 1 separately from these statistical values.

[0039] In step S400, the discrimination unit 45 compares the value of the adjusted instantaneous failure probability F'(t) with a threshold value f. If the value of the adjusted instantaneous failure probability F'(t) is equal to or greater than the threshold value f, the process proceeds to step S410. In step S410, the discrimination unit 45 compares the value of the adjusted instantaneous attack probability A'(t) with a threshold value a. If the value of the adjusted instantaneous attack probability A'(t) is equal to or greater than the threshold value a, the process proceeds to step S420. In step S420, the discrimination unit 45 determines that it is highly likely that both a failure and a cyber attack have occurred simultaneously. If the value of the adjusted instantaneous attack probability A'(t) is less than the threshold value a in step S410, the process proceeds to step S430. In step S430, the discrimination unit 45 determines that it is highly likely that a failure has occurred. If the value of the adjusted instantaneous failure probability F'(t) is less than the threshold value f in step S400, the process proceeds to step S440. In step S440, the discrimination unit 45 compares the value of the adjusted instantaneous attack probability A'(t) with the threshold value a. If the value of the adjusted instantaneous attack probability A'(t) is equal to or greater than the threshold value a, the process proceeds to step S450. In step S450, the discrimination unit 45 discriminates that there is a high possibility that a cyber-attack has occurred. If the value of the adjusted instantaneous attack probability A'(t) is less than the threshold value a in step S440, the process proceeds to step S460. In step S460, the discrimination unit 45 discriminates that there is a low possibility that a malfunction has occurred and that a cyber-attack has occurred, i.e., the diagnosis target device is in a normal state.

[0040] For example, consider a case where the designer has given threshold values ​​of f=0.4 and a=0.3, and the adjusted instantaneous failure probability F'(t)=0.3 and the adjusted instantaneous attack probability A'(t)=0.2 as shown in Fig. 6. In this case, since the adjusted instantaneous failure probability F'(t) is less than the threshold value f in step S400, the process proceeds to step S440, and since the adjusted instantaneous attack probability A'(t) is less than the threshold value a, the process proceeds to step S460. As a result, the discrimination unit 45 discriminates that the device to be diagnosed is in a normal state (no failure has occurred and no cyber attack has been performed).

[0041] Fig. 8 is a schematic diagram illustrating an example of a display screen of the display device 4. The output unit 46 outputs the result of the discrimination by the discrimination unit 45, i.e., the diagnosis result, to the display device 4. Based on this diagnosis result, the display device 4 displays a screen as illustrated in Fig. 8.

[0042] The display screen of the display device 4 is provided with a diagnosis date and time display area 90, a diagnosis result display area 91, a diagnosis result detail display area 92, a diagnosis graph display area 93, and a re-diagnosis button 94. The diagnosis date and time display area 90 displays the date and time when the diagnosis was performed (diagnosis time t1). The diagnosis result display area 91 is an area for displaying the diagnosis result of the diagnosis target device. In the diagnosis result display area 91, the diagnosis result is displayed in one of the following forms: normal, failure, attack (cyber attack), and failure & attack. The diagnosis result detail display area 92 is an area for displaying the breakdown (details) of the results displayed in the diagnosis result display area 91. The diagnosis graph display area 93 displays the failure probability distribution and attack probability distribution up to the diagnosis time, and for example, the probability distribution is displayed as in the graph illustrated in FIG. 6. The re-diagnosis button 94 is a button for executing a re-diagnosis. By pressing the re-diagnosis button 94, the diagnosis of the diagnosis target device at the time the button was pressed is executed again, and the result of the re-diagnosis can be displayed on the display screen of the display device 4.

[0043] According to the above-described first embodiment, the following advantageous effects are achieved.

[0044] (1) The instantaneous attack probability calculation unit 43 (arithmetic device) calculates the instantaneous attack probability, which is the probability that a cyber-attack was carried out on the diagnosis target device at the diagnosis time (predetermined time), and the instantaneous failure probability calculation unit 42 (arithmetic device) calculates the instantaneous failure probability, which is the probability that a failure occurred in the diagnosis target device at the diagnosis time (predetermined time). After that, the discrimination unit 45 (arithmetic device) judges whether or not there is a cyber-attack on the diagnosis target device and whether or not there is a failure in the diagnosis target device at the diagnosis time (predetermined time) based on the instantaneous attack probability and the instantaneous failure probability. In this way, it is possible to appropriately judge whether or not there is a cyber-attack and whether or not there is a failure in the device. In addition, since the instantaneous attack probability and the instantaneous failure probability are calculated separately and are not correlated with each other, one is not influenced by the other, and the probability of a cyber-attack and the probability of a failure can be judged independently.

[0045] (2) The discrimination unit 45 (arithmetic device) judges the presence or absence of a cyber-attack on the diagnosis target device and the presence or absence of a malfunction in the diagnosis target device by comparing the instantaneous attack probability and the instantaneous malfunction probability with respective predetermined thresholds. In this way, the presence or absence of a cyber-attack and the presence or absence of a malfunction can be judged independently without one being influenced by the other.

[0046] (3) The instantaneous attack probability calculation unit 43 (arithmetic device) calculates the instantaneous attack probability using an attack density function a(t) (first probability distribution) that represents a time-varying probability distribution. Also, the instantaneous failure probability calculation unit 42 (arithmetic device) calculates the instantaneous failure probability using a failure density function f(t) (second probability distribution) that represents a time-varying probability distribution and is different from the attack density function a(t) (first probability distribution). In this way, the presence or absence of a cyber attack and the presence or absence of a failure can be determined independently, without one being influenced by the other.

[0047] (4) The instantaneous failure probability calculation unit 42 (arithmetic device) calculates the instantaneous failure probability using at least one of the shape parameter 21, the scale parameter 22, and the position parameter 21, which represent the shape, scale, and position characteristics of the probability distribution of the probability that the diagnosed device will fail. This makes it possible to accurately determine whether or not the diagnosed device has a failure.

[0048] (5) The instantaneous attack probability calculation unit 43 (arithmetic device) calculates the instantaneous attack probability using the vulnerability database 3 (vulnerability information) related to the hardware or software constituting the diagnosis target device. This makes it possible to accurately determine whether or not a cyber attack has occurred on the diagnosis target device.

[0049] (6) The probability adjustment unit 44 (arithmetic device) adjusts the instantaneous attack probability and the instantaneous failure probability to have the same dimension. This makes it possible to determine the threshold values ​​for comparing the instantaneous attack probability and the instantaneous failure probability on a common scale, making it easier to set the threshold values.

[0050] (7) The output unit 46 (arithmetic device) causes the display device 4 to display the presence or absence of a cyber attack on the device to be diagnosed determined by the discrimination unit 45 (arithmetic device) and the presence or absence of a malfunction in the device to be diagnosed determined by the discrimination unit 45 (arithmetic device). This allows the user of the diagnostic device 1 to accurately grasp the diagnosis results.

[0051] <Second embodiment> A diagnostic device according to a second embodiment of the present invention will be described with reference to Figures 9 to 11. Note that configurations that are the same as or equivalent to those described in the first embodiment are given the same reference symbols, and differences will be mainly described.

[0052] Fig. 9 is a block diagram similar to Fig. 2, showing a functional configuration of a diagnostic device 100 according to a second embodiment. The diagnostic device 100 includes a maintenance risk assessment value calculation unit 47 in addition to the units of the diagnostic device 1 according to the first embodiment. The maintenance risk assessment value calculation unit 47 calculates a maintenance risk assessment value that is a numerical value that quantifies a risk related to the maintenance of the device to be diagnosed. A maintenance inspection database 5 is connected to the diagnostic device 100 in addition to the parameter database 2 and vulnerability database 3 similar to those of the first embodiment.

[0053] The maintenance and inspection database 5 stores maintenance and inspection data 51, maintenance worker data 52, and operation log data 53. The maintenance and inspection data 51 is, for example, information on the date and location of maintenance inspection of the equipment to be diagnosed by the maintenance worker. The maintenance worker data 52 is information on the maintenance worker himself, for example, the age and years of service of the maintenance worker. The operation log data 53 is, for example, information on the maintenance time and the number of operation commands.

[0054] A description will now be given of an example of a method for calculating a maintenance risk evaluation value by the maintenance risk evaluation value calculation unit 47. The maintenance risk evaluation value L is expressed by the following formula (14). L = T C (14) Here, T represents the ratio of the actual operation time to the specified operation time, and C represents the ratio of the number of actual operation commands to the specified number of operation commands.

[0055] By comparing the value of the ratio T of operation time and the ratio C of the number of operation commands with a predetermined value, the degree of familiarity of the maintenance personnel with the operation can be quantitatively measured. For example, if C is greater than 1, it can be determined that the maintenance personnel is not familiar with maintenance operations, and if C is less than 1, it can be determined that the maintenance personnel is familiar with maintenance operations. Similarly, for T, if T is greater than 1, it can be determined that the maintenance personnel is not familiar with maintenance operations, and if T is less than 1, it can be determined that the maintenance personnel is familiar with maintenance operations.

[0056] In addition to the rule-based indicators described above, whether or not a maintenance technician is familiar with maintenance operations can also be determined by machine learning using the maintenance technician's age and years of service contained in the maintenance technician data 52, and the operation time contained in the operation log data 53, as input data sets.

[0057] Fig. 10 is a flowchart of the instantaneous attack probability calculation process executed by the instantaneous attack probability calculation unit 43, which is similar to Fig. 4. In the flowchart of Fig. 10, the process of step S225 is added between steps S220 and S230 of the flowchart of Fig. 4. In step S225, the instantaneous attack probability calculation unit 43 adds the maintenance risk assessment value calculated by the maintenance risk assessment value calculation unit 47 to the security assessment value determined in step S220. As a result, the subsequent processes targeting the security assessment value take into account the maintenance risk assessment value.

[0058] As shown in formula (5), the security evaluation value is determined by the degree of impact (magnitude of impact) on the diagnosis target device and the likelihood of attack on the diagnosis target device. The maintenance risk evaluation value is reflected in the likelihood of attack among these values. As shown in formula (7), the likelihood is a value based on the attack source category X, the complexity of the attack condition Y, the required privilege level Z, and the required user involvement level W. The instantaneous attack probability calculation unit 43 adds (reflects) the maintenance risk evaluation value to the security evaluation value by varying the values ​​of the attack source category X and the required privilege level Z according to the maintenance risk evaluation value. For example, the larger the maintenance risk evaluation value is, the higher the values ​​of the attack source category X and the required privilege level Z are, and the smaller the maintenance risk evaluation value is, the lower the values ​​of the attack source category X and the required privilege level Z are.

[0059] The method of adding the maintenance risk evaluation value to the security evaluation value is not limited to the above-mentioned method. For example, the maintenance risk evaluation value may be evaluated on the same 10-point scale as the security risk evaluation value, and added to the security risk evaluation value.

[0060] FIG. 11 is a graph similar to FIG. 6, illustrating the adjusted instantaneous failure probability F'(t) and the adjusted instantaneous attack probability A'(t). Reference numeral 1360 denotes the adjusted instantaneous failure probability F'(t), and reference numeral 1370 denotes the adjusted instantaneous attack probability A'(t). In FIG. 11, the horizontal axis denotes the elapsed time t, and the vertical axis denotes the respective probabilities at the elapsed time. Reference numeral 1300 denotes the date and time when a vulnerability was discovered in the device to be diagnosed, and reference numeral 1310 denotes the time when the diagnosis was performed by the diagnosis device 1 (diagnosis time t1). Reference numeral 1330 denotes the adjusted instantaneous attack probability A'(t) without taking into account the maintenance risk evaluation value at the diagnosis time, and reference numeral 1340 denotes the adjusted instantaneous attack probability A'(t) with the maintenance risk evaluation value at the diagnosis time taken into account. Reference numeral 1350 denotes the adjusted instantaneous failure probability F'(t) at the diagnosis time.

[0061] The adjusted instantaneous attack probability A'(t) fluctuates due to the maintenance work by the maintenance personnel in addition to the conventional security factors. For example, in FIG. 6, the case where the adjusted instantaneous attack probability A'(t)=0.2 at the diagnosis time is considered, but in FIG. 11, the case where A'(t)=0.3 is considered. This is to take into consideration that the maintenance factor is reflected in the adjusted instantaneous attack probability A'(t) in addition to the vulnerability factor. In the adjusted instantaneous attack probability A'(t) reflecting this maintenance factor, for example, consider the output result when A'(t)=0.3 and threshold value a=0.2. However, the adjusted instantaneous failure probability F'(t)=0.3 and threshold value f=0.4 are the same as in FIG. 6. At this time, the discrimination unit 45 first determines that the possibility of failure is low because F'(t) is smaller than f. After that, the discrimination unit 45 determines that the possibility of cyber attack is high because A'(t) is equal to or larger than a. As a result, the diagnosis result is that the possibility of cyber attack is high. In this way, the adjusted instantaneous attack probability A'(t) becomes larger by taking into account the maintenance risk assessment value, and as a result, the diagnosis result changes from the content described in FIG.

[0062] According to the above-described second embodiment, the following advantageous effects are achieved.

[0063] (1) The instantaneous attack probability calculation unit 43 (arithmetic device) calculates the instantaneous attack probability using a maintenance risk assessment value based on at least one of the maintenance inspection data 51, which is information regarding the maintenance inspection of the diagnosis target device, the maintenance staff data 52, which is information regarding the maintenance staff who perform the maintenance inspection of the diagnosis target device, and the operation log data 53, which is information regarding the operation log of the operation performed in the maintenance inspection of the diagnosis target device. In this way, it becomes possible to perform a diagnosis that takes into account the life cycle of the diagnosis target device.

[0064] <Third embodiment> A diagnostic device according to a third embodiment of the present invention will be described with reference to Figures 12 and 13. Note that the same reference symbols are used for configurations that are the same as or equivalent to those described in the first embodiment, and differences will be mainly described.

[0065] Fig. 12 is a block diagram similar to Fig. 2, showing a functional configuration of an assessment device 200 according to a third embodiment. A physical information database 7 and an access information database 8 are connected to the assessment device 200 in addition to the parameter database 2 and vulnerability database 3 similar to those in the first embodiment.

[0066] The physical information database 7 stores temperature data 71, humidity data 72, and vibration data 73. The temperature data 71 is data relating to the temperature of the environment of the diagnosis target device, for example, whether the diagnosis target device is operating under high temperature or under cooling. The humidity data 72 is data relating to the humidity of the environment of the diagnosis target device, for example, whether the environment in which the diagnosis target device is installed is humid or low. The vibration data 73 is data relating to the magnitude of vibration in the environment in which the diagnosis target device is installed. In addition to these, the physical information database 7 may also store data relating to the wind (air volume and wind speed), radioactivity, dust, etc. in the environment of the diagnosis target device.

[0067] The access information database 8 stores physical access data 81 and network data 82. The physical access data 81 is data on the security status of the installation location of the diagnosis target device, i.e., data indicating the physical safety of the environment in which the diagnosis target device is installed, such as data that the room in which the diagnosis target device is installed is locked, or that physical security is established such that only specific people can enter the room, or that the diagnosis target device is secured with a wire lock or the like. The network data 82 is data on the security status of a path for accessing the diagnosis target device from the outside via a network, i.e., data indicating the ease of intrusion into the diagnosis target device from the outside, such as debug port information and shell information of the diagnosis target device, and port information used for network communication.

[0068] The instantaneous failure probability calculation unit 42 of the third embodiment calculates the instantaneous failure probability using not only various parameters in the parameter database 2 but also various data in the physical information database 7. The instantaneous attack probability calculation unit 43 of the third embodiment calculates the instantaneous attack probability using not only various data in the vulnerability database 3 but also various data in the access information database 8.

[0069] FIG. 13 is a graph similar to FIG. 6, illustrating the adjusted instantaneous failure probability F'(t) and the adjusted instantaneous attack probability A'(t). Reference numeral 1550 denotes the adjusted instantaneous failure probability F'(t), and reference numeral 1540 denotes the adjusted instantaneous attack probability A'(t). In FIG. 13, the horizontal axis denotes the elapsed time t, and the vertical axis denotes the respective probabilities at the elapsed time. Reference numeral 1500 denotes the date and time when a vulnerability was discovered in the diagnostic target device, and reference numeral 1510 denotes the time when the diagnostic device 200 performed the diagnosis (diagnosis time t1). Reference numeral 1530 denotes the adjusted instantaneous failure probability F'(t) taking into account various data in the physical information database 7 at the diagnosis time, and reference numeral 1520 denotes the adjusted instantaneous attack probability A'(t) taking into account various data in the access information database 8 at the diagnosis time.

[0070] For example, in FIG. 6, we consider a case where the adjusted instantaneous failure probability at the diagnosis time is F'(t)=0.3, but in FIG. 13, we consider a case where the adjusted instantaneous failure probability is F'(t)=0.45. Also, in FIG. 6, we consider a case where the adjusted instantaneous attack probability at the diagnosis time is A'(t)=0.2, but in FIG. 13, we consider a case where A'(t)=0.25. These mean that the influence of physical factors (various data in the physical information database 7) on the diagnosis target device is large, while the influence of security factors due to external access to the diagnosis target device (various data in the access information database 8) is small. In this way, by biasing the probability distribution itself based on physical factors and security factors due to external access, a more accurate diagnosis can be performed.

[0071] For example, consider the output result when F'(t) = 0.45, threshold value f = 0.4, A'(t) = 0.25, and threshold value a = 0.35. In this case, the discrimination unit 45 first determines that there is a high possibility of a malfunction because F'(t) is equal to or greater than f. Then, the discrimination unit 45 determines that there is a low possibility of a cyber attack because A'(t) is less than a. This results in the diagnosis result being that there is a high possibility of a malfunction. In this way, the diagnosis result has changed from the content described in FIG. 6 due to the inclusion of physical factors and security factors due to external access.

[0072] According to the above-described third embodiment, the following advantageous effects are achieved.

[0073] (1) The instantaneous failure probability calculation unit 42 (arithmetic device) calculates the instantaneous failure probability using the physical information database 7, which contains information on at least one of the temperature, humidity, vibration, wind, radioactivity, and dust of the physical environment in which the device to be diagnosed operates. This improves the accuracy of the instantaneous failure probability, making it possible to more accurately diagnose the presence or absence of a failure.

[0074] (2) The instantaneous attack probability calculation unit 43 (arithmetic device) calculates the instantaneous attack probability using physical access data 81, which is information about the security status of the installation location of the diagnosis target device, and network data 82, which is information about the security status of the path for accessing the diagnosis target device from the outside via a network. By calculating the instantaneous attack probability using at least one of the physical access data 81 and the network data 82, the accuracy of the calculated instantaneous attack probability is improved, and the presence or absence of a cyber-attack can be diagnosed more accurately.

[0075] The following modified examples are also within the scope of the present invention, and it is possible to combine the configurations shown in the modified examples with the configurations described in the above-mentioned embodiments, to combine the configurations described in the different embodiments above, or to combine the configurations described in the different modified examples below.

[0076] <Variation 1> The cumulative failure distribution function F(t) may be different from that explained in equation (4). For example, the cumulative failure distribution function F(t) may be calculated using the reliability function R(t) instead of the failure density function f(t). In this case, the cumulative failure distribution function F(t) may be defined as 1-R(t), and the instantaneous failure probability may be calculated in the form of 1-R(t1) using the diagnosis time t1. In addition, for example, a function having various parameters in the parameter database 2 and time as variables may be calculated in advance from the characteristics of the device to be diagnosed, and the diagnosis time t1 may be substituted into the function to calculate the probability.

[0077] <Variation 2> The security evaluation value Risk may be different from that explained in formula (8). For example, the security evaluation value Risk may be calculated by taking into account the current severity of the vulnerability in addition to the basic characteristics of the vulnerability itself, or by using the final vulnerability including the user's usage environment.

[0078] <Modification 3> In the above explanation, the Weibull distribution is used as an example of the failure density function f(t) and the Gaussian distribution is used as an example of the attack density function a(t), but the types of probability distributions are not limited to these. Other probability distributions may be used as the failure density function f(t) and the attack density function a(t).

[0079] <Modification 4> The calculation method of the adjusted instantaneous failure probability F'(t) and the adjusted instantaneous attack probability A'(t) may be different from that exemplified in the formula (12) and the formula (13). For example, after calculating the distance scale, the adjusted instantaneous failure probability F'(t) and the adjusted instantaneous attack probability A'(t) may be calculated by multiplying the calculated distance scale by the failure density function f(t) and the attack density function a(t) and integrating the result from time 0 to the diagnosis time t1. In addition, in each of the above-mentioned embodiments, the instantaneous failure probability and the instantaneous attack probability are made to have the same dimension using the probability distance scale shown in the formula (11), but the instantaneous failure probability and the instantaneous attack probability may be made comparable by other methods.

[0080] <Variation 5> The data stored in the various databases described above (parameter database 2, vulnerability database 3, maintenance and inspection database 5, physical information database 7, and access information database 8) may be different from the data described above. In addition, the method of using the data may also be different from that of each of the above-mentioned embodiments.

[0081] Although the embodiments of the present invention have been described above, the above-mentioned embodiments merely show some of the application examples of the present invention, and it is not intended that the technical scope of the present invention be limited to the specific configurations of the above-mentioned embodiments. [Explanation of symbols]

[0082] 1, 100, 200...diagnostic device, 2...parameter database, 3...vulnerability database, 4...display device, 5...maintenance and inspection database, 7...physical information database, 8...access information database, 11...arithmetic unit, 12...non-volatile memory, 13...volatile memory, 14...input / output interface, 21...shape parameter, 22...scale parameter, 23...position parameter, 31...publication date data, 32...equipment data, 41...time input unit, 42...instantaneous failure probability calculation unit, 43...instantaneous attack probability calculation unit, 44...probability adjustment unit, 45...discrimination unit, 46...output unit, 47...maintenance risk evaluation value calculation unit, 51...maintenance and inspection data, 52...maintenance staff data, 53...operation log data, 71...temperature data, 72...humidity data, 73...vibration data, 81...physical access data, 82...network data

Claims

1. A diagnostic device including a computing device, The computing device includes: Calculate the instantaneous attack probability, which is the probability that a cyber attack was carried out on the diagnostic target device at a specified time, Calculating an instantaneous failure probability, which is the probability that a failure occurs in the diagnosis target device at the predetermined time; determining whether or not there is a cyber-attack on the diagnosis target device and whether or not there is a malfunction in the diagnosis target device at the predetermined time based on the instantaneous attack probability and the instantaneous failure probability; Diagnostic equipment.

2. 2. The diagnostic device according to claim 1, The computing device includes: A diagnostic device that determines whether or not there is a cyber attack on the equipment to be diagnosed and whether or not there is a malfunction in the equipment to be diagnosed by comparing the instantaneous attack probability and the instantaneous failure probability with respective predetermined thresholds.

3. 2. The diagnostic device according to claim 1, The computing device includes: A diagnostic device that calculates the instantaneous attack probability using a time-varying first probability distribution, and calculates the instantaneous failure probability using a time-varying second probability distribution different from the first probability distribution.

4. 2. The diagnostic device according to claim 1, The computing device includes: A diagnostic device that calculates the instantaneous failure probability using at least one of parameters that represent characteristics of the shape, scale, and position of the probability distribution of the probability that the device to be diagnosed will fail.

5. 2. The diagnostic device according to claim 1, The computing device includes: A diagnostic device that calculates the instantaneous attack probability using vulnerability information related to the hardware or software that constitutes the device to be diagnosed.

6. 2. The diagnostic device according to claim 1, The computing device includes: A diagnostic device that adjusts the instantaneous attack probability and the instantaneous failure probability to have the same dimension.

7. 2. The diagnostic device according to claim 1, The computing device includes: A diagnostic device that displays on a display device the presence or absence of a cyber attack on the diagnosis target equipment determined by the arithmetic device, and the presence or absence of a malfunction in the diagnosis target equipment determined by the arithmetic device.

8. 2. The diagnostic device according to claim 1, The computing device includes: A diagnostic device that calculates the probability of an instantaneous attack using at least one of information regarding the maintenance and inspection of the equipment to be diagnosed, information regarding the maintenance personnel performing the maintenance and inspection of the equipment to be diagnosed, and information regarding the operation log of operations performed during the maintenance and inspection of the equipment to be diagnosed.

9. 2. The diagnostic device according to claim 1, The computing device includes: A diagnostic device that calculates the instantaneous failure probability using information regarding at least one of temperature, humidity, vibration, wind, radioactivity, and dust in the physical environment in which the device to be diagnosed operates.

10. 2. The diagnostic device according to claim 1, The computing device includes: A diagnostic device that calculates the instantaneous attack probability using at least one of information regarding the security status of the location where the diagnostic target device is installed and information regarding the security status of a path for accessing the diagnostic target device from the outside via a network.

11. Calculate the instantaneous attack probability, which is the probability that a cyber attack was carried out on the diagnostic target device at a specified time, Calculating an instantaneous failure probability, which is the probability that a failure occurs in the diagnosis target device at the predetermined time; determining whether or not there is a cyber-attack on the diagnosis target device and whether or not there is a malfunction in the diagnosis target device at the predetermined time based on the instantaneous attack probability and the instantaneous failure probability; Diagnostic methods.

Images