Incident response system and method

Abstract

To improve stability in power supply.SOLUTION: An incident response system 1 comprises a memory 4 and a CPU 3. The CPU functions as an intrusion detection unit 51, a suspected component extraction unit 52, a fallback planning unit 53, an outage evaluation unit 54, and a restoration instruction unit 56 by executing a program. The intrusion detection unit detects a damaged component in which a security incident has occurred. The suspected component extraction unit extracts a suspected component having a log from the damaged component. The fallback planning unit formulates a fallback plan for causing a suspected subordinate component that is subordinate to the suspected component to enter fallback mode. The outage evaluation unit calculates outage load and an outage time of the suspected component during the fallback on the basis of the fallback plan, and evaluates the influence of the outage on a power grid. The restoration instruction unit instructs restoration of the suspected subordinate component in the fallback mode on the basis of the fallback plan.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] The present invention relates to an incident response system and method. [Background technology]

[0002] Control systems, which have traditionally been operated in closed environments, are increasingly being used in open network environments due to the advancement of open systems, DX (Digital Transformation), and system integration.

[0003] Even power systems may be able to link with IT (Information Technology) business systems through the use of wide-area communications such as the fifth-generation mobile communications system (5G) and the cloud. This increases the risk of security incidents, such as virus infections and unauthorized operations from outside. For example, there have been cases where security incidents caused by open communications environments and IT systems have led to infrastructure failures, including power outages.

[0004] Patent Document 1 describes a method of storing access permission information for each of a plurality of network interfaces, and judging whether or not access to the network interface is permitted based on the access permission information. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2013-041370 A Summary of the Invention [Problem to be solved by the invention]

[0006] In Patent Document 1, unauthorized operations can be quickly blocked based on predefined access permission information. However, there is a risk that the power outage range will expand, and the method is based on the premise that unauthorized applications use communication paths different from normal ones, and there is no mention of how to handle cases where legitimate applications and communication paths are hijacked, or how to deal with cases where a simulated intrusion occurs.

[0007] The present invention has been made in consideration of the above problems, and has an object to provide a technique for improving the stability of power supply. [Means for solving the problem]

[0008] In order to achieve the above object, the present invention provides an incident response system comprising a memory in which a program is stored and a CPU, wherein the memory comprises a communication operation database that stores logs of a plurality of components that control a power system, and the CPU, by executing the program, functions as an intrusion detection unit that detects a victim component among the plurality of components in which a security incident has occurred, an extraction unit that extracts a suspicious component having a log from the victim component detected by the intrusion detection unit based on the log stored in the communication operation database, a degeneration plan formulation unit that formulates a degeneration plan for degenerating a suspected lower-level component that is lower than the suspicious component extracted by the extraction unit, an evaluation unit that calculates a power outage load and power outage duration of the suspected component when the suspected lower-level component is operated in degenerated operation based on the degeneration plan formulated by the degeneration plan formulation unit, and evaluates the impact of a power outage on the power system based on the calculated power outage load and power outage duration, and a restoration instruction unit that instructs restoration of the suspected lower-level component operated in degenerated operation based on the degeneration plan. Effect of the Invention

[0009] According to the present invention, the stability of power supply can be improved. [Brief description of the drawings]

[0010] [Figure 1] A diagram of the power system and computer components. [Diagram 2] A diagram of the computer components. [Diagram 3] Software configuration diagram of computer components. [Figure 4] FIG. 4 is a diagram showing an example of a data structure of system configuration information. [Diagram 5] FIG. 4 is a diagram showing an example of a data structure of control task information. [Figure 6] FIG. 4 is a diagram showing an example of a data structure of system configuration information. [Figure 7] FIG. 4 is a diagram showing an example of a data structure of load information. [Figure 8] FIG. 4 is a diagram showing an example of a data structure of control configuration plan information. [Figure 9] FIG. 4 is a diagram showing an example of a data structure of impact assessment information. [Figure 10] 4 is a flowchart showing the overall processing by the incident response system. [Figure 11] 11 is a flowchart showing detailed processing of S5 in FIG. 10; [Figure 12] A diagram showing the HMI display screen. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, specific examples of an incident response system and method according to an embodiment of the present invention will be described with reference to the drawings. Note that the present invention is not limited to the examples, but is defined by the claims.

[0012] FIG. 1 is a block diagram of the power system and computer components.

[0013] The power system 10 includes a plurality of substation equipment 11 and a plurality of switches 12 electrically connected between the substation equipment 11. The substation equipment 11 includes a transformer 13 and a plurality of switches 14. The downstream of the switch 12 is electrically connected to a load L. The information on the load L may include the number W of consumers.

[0014] A computer component 20 that controls various facilities included in the power system 10 is communicatively connected to the power system 10. The computer component 20 has an IT operation layer 21, a supervisory control layer 22, and a field control layer 23. The IT operation layer 21, the supervisory control layer 22, and the field control layer 23 form a hierarchical structure in order from the upstream.

[0015] The IT operation layer 21 includes a data center (DC in the figure) 24 and an information distribution system 25. The data center 24 stores various data. The information distribution system 25 may be a workstation. The information distribution system 25 is also referred to simply as a component hereinafter. The data center 24 and the information distribution system 25 are communicatively connected to each other via a business network 26. The business network 26 may be, for example, a WAN (Wide Area Network). The business network 26 is communicatively connected to the external Internet via a firewall (FW in the figure) 27. The data center 24 and the information distribution system 25 function as an example of a "component." The data center 24 and the information distribution system 25 are also referred to simply as a component hereinafter.

[0016] The monitoring and control layer 22 includes, for example, a substation monitoring and control system 28, a plurality of distribution control systems 29, and a firewall network monitor (hereinafter, FW network monitor) 30. The substation monitoring and control system 28 and the distribution control system 29 may be control servers (Ctrl servers in the figure). The substation monitoring and control system 28 remotely monitors and controls a control controller 35 of the field control layer 23, which will be described later. The distribution control system 29 remotely monitors and controls a control controller 36 of the field control layer 23, which will be described later. The substation monitoring and control system 28, the plurality of distribution control systems 29, and the FW network monitor 30 are connected to each other for communication via a monitoring and control network 31. The FW network monitor 30 is provided between the information distribution system 25 and the monitoring and control network 31. The FW network monitor 30 has log collection software and collects communication logs and operation logs of the substation monitoring and control system 28 and the distribution control system 29. A firewall (FW in the figure) 32 is provided between multiple power distribution control systems 29 in the monitoring and control network 31. The substation monitoring and control system 28 and the power distribution control system 29 function as an example of a "component." The substation monitoring and control system 28 and the power distribution control system 29 will hereinafter also be referred to simply as a component.

[0017] The field control layer 23 includes a control controller 35 communicatively connected downstream of the substation monitoring control system 28, and a plurality of control controllers (devices) 36 communicatively connected downstream of a plurality of power distribution control systems 29. The plurality of control controllers 36 are communicatively connected to each other via a field network 37. The control controller 35 controls the substation equipment 11. The control controller 36 controls the switch 12. The control controller 35 and the control controller 36 function as examples of "components." Hereinafter, the control controller 35 and the control controller 36 will also be simply referred to as components.

[0018] FIG. 2 is a configuration diagram of the computer components.

[0019] A routing network monitor 38 is further communicatively connected to the field network 37. The routing network monitor 38 is provided between the field network 37 and the monitoring control network 31. The routing network monitor 38 has log collection software and collects communication logs and operation logs of the control controller 35 and the control controller 36.

[0020] An HMI (Human Machine Interface) 39 is further communicatively connected to the monitoring and control network 31. The HMI 39 may be a touch panel operated by a user.

[0021] An incident response system 1 is further communicatively connected to the business network 26. The incident response system 1 has log analysis software, and accumulates and analyzes logs of the components 28, 29, 35, and 36 collected by the FW network monitor 30 and the routing network monitor 38, and logs of the component 25. The incident response system 1 further has configuration optimization software, and formulates an optimal degeneration plan for the power system 10 and the computer component 20.

[0022] FIG. 3 is a software configuration diagram of the computer components.

[0023] The controller 35 has a control logic 35a for controlling the substation equipment 11. The controller 36 has a control logic 36a for controlling the switch 12.

[0024] The routing network monitor 38a communicatively connected to the substation monitoring and control system 28 has a status monitoring display unit 40, a control instruction unit 41, and a system information database (hereinafter, DB) 42. The status monitoring display unit 40 monitors the status of the control controller 35, and displays the status of the control controller 35 to the user. The control instruction unit 41 controls the control controller 35 according to instructions input by the user. The system information DB 42 stores various information of the substation equipment 11. Like the routing network monitor 38a, the substation monitoring and control system 28 has the status monitoring display unit 40, the control instruction unit 41, and the system information DB 42.

[0025] The routing network monitor 38b communicatively connected to the power distribution control system 29 has a status monitoring display unit 42, a control instruction unit 43, and a system information DB 44. The status monitoring display unit 42 monitors the status of the control controller 36 and displays the status of the control controller 36 to the user. The control instruction unit 43 controls the control controller 36 in response to instructions input by the user. The system information DB 44 stores various information on the switch 12. The power distribution control system 29 has the status monitoring display unit 42, the control instruction unit 43, and the system information DB 44, similar to the routing network monitor 38b.

[0026] The FW network monitor 30 has a log collection and transmission unit 45, a communication management unit (access control unit) 46, and a communication and operation log DB 47. The log collection and transmission unit 45 collects communication logs and operation logs of the substation monitoring and control system 28 and the power distribution control system 29, and transmits the collected communication logs and operation logs to the incident response system 1. The communication management unit 46 manages communication from the information distribution system 25 to the monitoring and control network 31. The communication and operation log 47 stores the communication logs and operation logs of the substation monitoring and control system 28 and the power distribution control system 29 collected by the log collection and transmission unit 45.

[0027] Various business systems 2, an information distribution system 25, and an incident response system 1 are communicatively connected to a business network 26.

[0028] The information distribution system 25 has a power system information DB 47, a power system information display application 48, and an analysis and optimization application 49. The power system information DB 47 stores various data on the power system 10. The information display application 48 displays the data stored in the power system information DB 47 to a user. The analysis and optimization application 49 analyzes the data stored in the power system information DB 47 and optimizes the analyzed data.

[0029] The incident response system 1 includes a CPU 3 and a memory 4. The CPU 4 executes programs stored in the memory 4, which will be described later, to function as a log collection unit 50, an intrusion detection unit 51, a suspicious component extraction unit 52 as an example of an "extraction unit", a degeneration plan formulation unit 53, a power outage evaluation unit 54 as an example of an "evaluation unit", a recovery plan formulation unit 55, and a recovery instruction unit 56.

[0030] The log collection unit 50 collects the communication logs and operation logs of the components 28, 29, 35, and 36 collected by the FW network monitor 30 and the routing network monitor 38, and the communication logs and operation logs of the components 24 and 25. The intrusion detection unit 51 detects a victim component in which a security incident has occurred among the components 25, 28, 29, 35, and 36 included in the computer component 20. A victim component is a component that is highly likely to have been the subject of unauthorized intrusion. The victim component may be detected, for example, by a virus scan. Specifically, the intrusion detection unit 51 extracts the victim component based on the operation logs and communication logs of the components 28, 29, 35, 36, 24, and 25, and system configuration information as an example of the "equipment state."

[0031] The suspect component extraction unit 52 extracts suspect components that have logs from the victim component detected by the intrusion detection unit 51 within a certain period of time. The suspect component extraction unit 52 extracts components that have accepted communication and operations from the victim component, i.e., components that are lower than the victim component (hereinafter referred to as suspect lower components). The degeneration plan creation unit 53 creates a degeneration plan for degenerating the suspect lower component. The degeneration plan is a change plan for degenerating the monitoring and control configuration of the power system 10.

[0032] The degenerate operation may include control transfer, autonomous operation, and stopping of a component. For example, the degenerate planning unit 53 judges whether it is possible to insert (insert) a task of the suspect component into the spare time in the control period from among other components that can communicate with the control target, and transfers control when the judgment result is true. At this time, the degenerate planning unit 53 evaluates the risk that the inserted task due to the non-stationary processing will not be executed as the transferable time. Furthermore, when the degenerate planning unit 53 operates the suspect subcomponent autonomously, it evaluates the autonomous operation possible time for the suspect subcomponent that has received an operation input from the suspect component from the data freshness required for the operation input (data generated within m minutes is required to operate correctly). Furthermore, when control transfer and autonomous operation are impossible, the degenerate planning unit 53 stops the suspect component and the suspect subcomponent.

[0033] The power outage evaluation unit 54 calculates the power outage load and power outage duration of the suspected sub-component when the suspected sub-component is put into degraded operation based on the degraded plan formulated by the degraded plan formulation unit 53. The power outage evaluation unit 54 evaluates the power outage impact on the power system 10 based on the calculated power outage load and power outage duration. The power outage evaluation unit 54 may determine the degraded plan with the least power outage impact. The power outage impact may be an integrated value of the power outage load and the power outage duration. The restoration plan formulation unit 55 formulates restoration plans for the damaged component, the suspect component, and the suspected sub-component put into degraded operation. The restoration instruction unit 56 instructs restoration work for the damaged component, the suspect component, and the suspected sub-component put into degraded operation based on the restoration plan formulated by the restoration plan formulation unit 50.

[0034] The memory 3 has a communication and operation history DB 57 as an example of a “communication operation database”, a system configuration information DB 58, a task specification information DB 59, a failure history DB 60, a system configuration DB 61, a demand information DB 62, and a recovery plan DB 63. The memory 3 stores a program executed by the CPU 3.

[0035] The communication and operation history DB 57 stores the communication logs and operation logs of the components 28, 29, 35, and 36 collected by the FW network monitor 30 and the routing network monitor 38, and the communication logs and operation logs of the components 24 and 25. The system configuration information DB 58 stores system configuration information of various components included in the computer component 20.

[0036] The task specification information DB 59 stores control tasks executed by various components included in the computer component 20. The fault history DB 60 stores the history of damaged components. The system configuration DB 61 stores system configuration information within the power system 10. The demand information DB 62 stores information on the load L in the power system 10. The restoration plan DB 63 stores restoration plans for damaged components, suspect components, and suspect lower-level components that have been put into degenerate operation.

[0037] FIG. 4 is a diagram illustrating an example of a data structure of the system configuration information.

[0038] The system configuration information DB 58 stores system configuration information. The system configuration information is a table that stores ID 401, source 402, destination and control target 403, target task 404, and last communication date 405 as item values ​​(column values). ID 401 is an identifier that identifies a component. Source 402 is the source of the task. Destination and control target 403 is the destination of the task (the target to be controlled). Target task 404 indicates the type of task. Last communication date 405 is the time of the last communication log.

[0039] FIG. 5 is a diagram illustrating an example of a data structure of the control task information.

[0040] Control task information is stored in the task specification DB 59. The control task information is a table that stores, as item values ​​(column values), an ID 501, a task name 502, an execution component 503, an input source 504, an output destination 505, an execution type 505, an input freshness 507, a control period 508, a CPU time 509, and a last execution time 510.

[0041] ID 501 is an identifier that identifies a task. Task name 502 is the name of the task. Execution component 503 is the component that executed the task. Input source 504 is the input source of the task. Output destination 505 is the output destination of the task. Execution type 505 is the execution type of the task, which is either periodic stationary or non-stationary. Input freshness 507 is the freshness of data required for correct operation. Control period 508 is the period for executing the task. CPU time 509 is the execution time by the CPU for each task. Final execution time 510 is the final execution time of the task.

[0042] FIG. 6 is a diagram illustrating an example of a data structure of the system configuration DB.

[0043] System configuration information is stored in the system configuration DB 61. The system configuration information is a table that stores an ID 601, a system line name 602, and a connected device 603 as item values ​​(column values). The ID 601 is an identifier that identifies a system line in the power system 10. The system line name 602 is the name of the system line. The connected device 603 is a device that is connected to the system battle.

[0044] FIG. 7 illustrates an example of a data structure of the load information.

[0045] The demand information DB stores load information. The load information is a table that stores an ID 701, a system line name 702, a maximum load 703, and a number of contracted consumers 704 as item values ​​(column values). The ID 701 is an identifier that identifies a system line in the power system 10. The system line name 702 is the name of the system line. The maximum load 703 is the maximum load amount on the system line. The number of contracted consumers 704 is the number of contracted consumers electrically connected to the system line.

[0046] FIG. 8 is a diagram illustrating an example of a data structure of the control configuration planning information.

[0047] The recovery plan DB stores control configuration plan information and impact assessment information. The control configuration plan information is a table that stores, as item values ​​(column values), an ID 801, a source 802, a source and control target 803, a target task 804, a change type 805, a possible continuation time 806, and a recovery time 807.

[0048] ID 801 is an identifier that identifies a component. Source 802 is the source of the task. Destination and controlled object 803 is the destination (controlled object) of the task. Target task 804 indicates the type of task. Change type 805 is either transfer of function, autonomous operation, or stop. Continuation time 806 is the time during which function transfer or autonomous operation can be continued. Recovery time 807 is the time required to recover the component.

[0049] FIG. 9 is a diagram illustrating an example of a data structure of the impact assessment information.

[0050] The impact evaluation information is a table that stores, as item values ​​(column values), an ID 901, an impact range 902, a type 903, a maximum load 904, a duration 905, a power outage duration 906, an impact amount 907, and an evaluation value.

[0051] ID 901 is an identifier for identifying the degeneration plan. Impact range 902 is the range affected by the degeneration plan. Type 903 is the type of degeneration plan, which is transfer, autonomous operation, or stop. Maximum load 904 is the maximum load amount for each impact range. Duration 905 is the duration of degenerate operation for each impact range (time during which function can be transferred or time during which autonomous operation is possible). Power outage duration 906 is the power outage time required until recovery. Impact amount (power outage impact) 907 is a value obtained by integrating the maximum load and the power outage time when the duration (time during which function can be transferred or time during which autonomous operation is possible) is shorter than the expected recovery time, and is the impact amount during the power outage for each impact range. Evaluation value 908 is an evaluation value for each degeneration plan.

[0052] FIG. 10 is a flowchart showing the overall processing by the incident response system.

[0053] First, the log collection unit 50 collects the communication logs and operation logs of the components 28, 29, 35, and 36 collected by the FW network monitor 30 and the routing network monitor 38, and the communication logs and operation logs of the components 24 and 25 (S1).

[0054] The intrusion detection unit 51 detects a victim component in which a security incident has occurred among the components 25, 28, 29, 35, and 36 included in the computer component 20, and determines whether or not an intrusion has been detected (S2).

[0055] If the determination result of S2 is true, the degeneration planning unit 53 extracts a suspicious component that has communicated with the victim component (S3). The degeneration planning unit 53 determines whether or not a suspicious component has been extracted from all components (S4).

[0056] If the result of the determination in S4 is true, the degeneration plan formulation unit 53 calculates a degeneration plan for stopping the suspect component and performing recovery work, and the power outage evaluation unit 54 calculates the amount of impact (S5). The power outage evaluation unit 54 selects the degeneration plan with the least amount of impact (S6). The recovery instruction unit 56 stops the damaged component and the suspect component determined to be stopped, and cuts off communication (S7).

[0057] The recovery instruction unit 56 performs recovery work for the stopped components (S8). The recovery instruction unit 56 restarts the stopped components and returns to the normal control configuration (S9).

[0058] FIG. 11 is a flowchart showing detailed processing of S5 in FIG.

[0059] The degeneracy planning unit 53 extracts components that can communicate with a suspected lower-level component (S501). The degeneracy planning unit 53 determines whether there is a margin capable of accepting control tasks in a steady state (S502).

[0060] If the determination result of S502 is true, the degeneration planning unit 53 extracts the processing time, startup frequency, and interval of the non-stationary task (S503). The degeneration planning unit 53 determines whether the control task can be accepted in the non-stationary state (S504). If the determination result of S504 is true, the degeneration planning unit 53 sets the transferable time to a sufficiently large value (S505).

[0061] If the determination result in S504 is false, the degeneration planning unit 53 estimates the next startup time of the non-routine task and sets it as the transferable time (S506).

[0062] The degeneration planning unit 53 determines whether the control task can be accepted in the steady state (S507). If the determination result in S504 is true, the degeneration planning unit 53 stops the suspected lower-level component (S508) and proceeds to S509.

[0063] If the determination result in S504 is false, the degeneration planning unit 53 proceeds to S509. In S509, the degeneration planning unit 53 calculates the load amount of the equipment controlled by the suspected lower-level component and downstream of the equipment from the system configuration. The degeneration planning unit 53 calculates the expected power outage time from the difference between the expected recovery time of the suspected component and the time during which handover or autonomous operation is possible (S510). The degeneration planning unit 53 determines the impact amount of the control configuration change to be the sum of the load amount calculated in S509 and the expected power outage time calculated in S510 (S511).

[0064] If the determination result in S502 is false, the degeneration plan formulation unit 53 determines whether the suspect lower-level component is capable of autonomous operation (S512).

[0065] If the determination result of S512 is false, the degeneration planning unit 53 proceeds to S507. If the determination result of S512 is true, the degeneration planning unit 53 acquires the data freshness requirement of the suspicious lower component (S513). The degeneration planning unit 53 sets the data freshness requirement as the autonomous operation possible time (S514).

[0066] FIG. 12 is a diagram showing a display screen of the HMI.

[0067] The upper left corner of the display screen 120 of the HMI 39 displays a field 121 showing the component where the intrusion was detected and the component that will be affected. The lower left corner of the display screen 120 displays a field 122 showing a proposed degeneration plan. The lower right corner of the display screen 120 displays a field 123 showing the degenerate simulation and its evaluation (impact of power outage).

[0068] According to this configuration, the incident response system 1 includes a memory 4 and a CPU 3. The memory 4 includes a communication and operation history database 57 that stores logs of a plurality of components that control the power system 10. The CPU 3 includes an intrusion detection unit 51, a suspected component extraction unit 52, a degeneration plan creation unit 53, a power outage evaluation unit 54, and a restoration instruction unit 56. The intrusion detection unit 51 detects a victim component in which a security incident has occurred among a plurality of components that control the power system 10. The suspected component extraction unit 52 extracts a suspected component that has a log from the victim component. The degeneration plan creation unit 53 creates a degeneration plan for degenerating a suspected lower component that is lower than the suspected component. The power outage evaluation unit 54 calculates a power outage load amount and a power outage time of the suspected component when the suspected lower component is degenerated based on the degeneration plan, and evaluates a power outage impact on the power system 10 based on the calculated power outage load amount and power outage time. The restoration instruction unit 56 instructs the restoration of the suspected lower component that has been degenerated based on the degeneration plan.

[0069] This makes it possible to improve the stability of the power supply by selecting a degeneration plan that minimizes the impact of a power outage.

[0070] Furthermore, the power outage evaluation unit 54 calculates the integrated value of the power outage load amount and the power outage time as the power outage impact. This makes it possible to calculate the power outage impact with high accuracy using a simple configuration.

[0071] Furthermore, the degeneration plan creation unit 53 extracts a function transfer component capable of transferring the function of the suspected lower component from among the multiple components, creates the degeneration plan when the function of the suspected lower component is transferred to the extracted function transfer component, and the power outage evaluation unit 54 calculates the power outage time as the difference between the expected recovery time of the suspected component and the function transfer possible time of the function transfer component. This makes it possible to minimize the impact of the power outage.

[0072] Furthermore, when the degeneration plan formulation unit 53 cannot extract a function transfer component, it extracts an autonomous operation component capable of autonomous operation from among the suspected lower components, and the power outage evaluation unit 54 calculates the difference between the expected recovery time of the suspected component and the autonomous operation possible time of the autonomous operation component as the power outage time. This makes it possible to operate the component capable of autonomous operation as much as possible.

[0073] Furthermore, if the degeneration plan formulation unit 53 cannot extract the function handover component and the autonomous operation component, the power outage assessment unit 54 assesses the suspected lower-level component as out of function, thereby enabling the suspected lower-level component to be promptly stopped.

[0074] Furthermore, when the function transfer possible time and the autonomous operation possible time are shorter than the expected recovery time, the power outage evaluation unit 54 calculates the load amount of the suspected lower-level component that will be stopped as the power outage load amount of the power grid 10. This makes it possible to appropriately calculate the power outage load amount.

[0075] Furthermore, the power outage evaluation unit 54 calculates the autonomous operation possible time of the autonomous operation component based on the data freshness required for the operation input from the suspect component to the lower component. This makes it possible to appropriately extract the autonomous operation possible time of the autonomous operation component.

[0076] Furthermore, the suspicious component extraction unit 52 extracts suspicious components based on the operation log, communication log, and equipment status for each of the multiple components, thereby improving the accuracy of extracting suspicious components.

[0077] The present invention is not limited to the above-mentioned embodiment, but includes various modified examples. For example, the above-mentioned embodiment has been described in detail to clearly explain the present invention, and is not necessarily limited to those including all of the configurations described. Also, it is possible to replace a part of the configuration of one embodiment with the configuration of another embodiment, and it is also possible to add the configuration of another embodiment to the configuration of one embodiment. Also, it is possible to add, delete, or replace a part of the configuration of each embodiment with another configuration. [Explanation of symbols]

[0078] 1...incident response system, 3...CPU, 4...memory, 10...power system, 25...information distribution system, 28...substation monitoring and control system, 29...power distribution control system, 35...controller, 36...controller, 51...intrusion detection unit, 52...suspicious component extraction unit, 53...degradation plan creation unit, 54...power outage evaluation unit, 56...restoration instruction unit, 57...communication and operation database

Claims

1. An incident response system including a memory in which a program is stored and a CPU, The memory includes a communication operation database that stores logs of a plurality of components that control a power system; The CPU executes the program, an intrusion detection unit that detects a victim component where a security incident has occurred among the plurality of components; an extraction unit that extracts a suspect component having a log from the victim component detected by the intrusion detection unit based on the log stored in the communication operation database; a degeneration plan making unit that makes a degeneration plan for degenerating a suspected lower-level component that is lower than the suspected component extracted by the extracting unit; an evaluation unit that calculates a power outage load and a power outage duration of the suspected component when the suspected lower-level component is operated in a degraded operation based on the degraded plan formulated by the degraded plan formulation unit, and evaluates an impact of a power outage on the power grid based on the calculated power outage load and the power outage duration; a recovery instruction unit that instructs the recovery of the suspect lower-level component that has been put into degraded operation based on the degradation plan.

2. The evaluation unit calculates an integrated value of the power outage load and the power outage time as the power outage effect. The incident response system of claim 1 .

3. the degeneration plan creation unit extracts, from among the plurality of components, a function transfer component capable of transferring a function of the suspected lower-level component, and creates the degeneration plan when the function of the suspected lower-level component is transferred to the extracted function transfer component; the evaluation unit calculates, as the power outage duration, a difference between an estimated recovery time of the suspect component and a function transfer available time of the function transfer component; The incident response system of claim 2 .

4. When the degeneration planning unit cannot extract the function transfer component, the degeneration planning unit extracts an autonomous driving component capable of autonomous driving from among the suspected lower-level components; The evaluation unit calculates a difference between an expected recovery time of the suspect component and an autonomous operation available time of the autonomous operation component as the power outage time. The incident response system of claim 3 .

5. The evaluation unit evaluates the suspected lower-level component as out of function when the degeneration plan creation unit cannot extract the function transfer component and the autonomous driving component. The incident response system of claim 4.

6. When the function transfer available time and the autonomous operation available time are shorter than the expected recovery time, the evaluation unit calculates a load amount of the suspected lower-level component that will be stopped as a power outage load amount of the power grid. The incident response system of claim 5.

7. The evaluation unit calculates the autonomous driving possible time of the autonomous driving component based on data freshness required for an operation input from the suspect component to the lower component. The incident response system of claim 6.

8. The extracting unit extracts the suspicious component based on an operation log, a communication log, and an equipment status for each of the plurality of components. The incident response system of claim 1 .

9. Detecting a victim component in which a security incident has occurred among a plurality of components that control a power system; extracting a suspect component having logs from the victim component; creating a degeneration plan for degenerating a suspected lower-level component below the suspected component; calculating a power outage load and a power outage duration of the suspected component when the suspected lower-level component is operated in a degraded state based on the degraded plan, and evaluating an integrated value of the calculated power outage load and the power outage duration as a power outage impact of the power grid; and instructing the restoration of the suspected lower-level component that has been put into degraded operation based on the degrading plan.

Images