Monitoring system, system, monitoring method, and program

Abstract

To provide a monitoring system capable of suppressing notification of an anomaly when an operation log different from a steady state is generated even if there is no anomaly.SOLUTION: A monitoring system comprises an anomaly detection unit that determines whether a monitored system is out of a steady state based on an operation log of the monitored system, an operation mode determination unit that determines the operation mode of the monitored system using a false detection learning model, and an anomaly notification unit that issues information indicating an anomaly in the monitored system when the anomaly detection unit determines that the operation log is out of the steady state, and the anomaly notification unit does not issue information indicating an anomaly when the operation mode determination unit determines that the operation mode is a specific operation mode.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a monitoring system, a monitoring method, and a program. [Background technology]

[0002] Conventionally, there is a detection device that uses a learning model generated from normal data and abnormal data such as an operation log of a monitored system to detect an abnormality in a monitored system that operates stably in a steady state, such as a power control system. For example, Patent Document 1 discloses a sample data generation device that generates normal data and abnormal data to generate a learning model for the detection device. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] International Publication No. 2019 / 073557 Summary of the Invention [Problem to be solved by the invention]

[0004] However, detection devices that use conventional learning models have the problem that they may report abnormalities when operation logs that differ from the steady state are generated, even if no abnormality is present, such as when the monitored system is started up, shut down, or undergoes maintenance work.

[0005] The present disclosure has been made in consideration of such circumstances, and provides a monitoring system, a monitoring method, and a program that can prevent abnormalities from being notified when an operation log that differs from a steady state is generated even if there is no abnormality. [Means for solving the problem]

[0006] This disclosure has been made to solve the above-mentioned problems, and one aspect of the present disclosure is a monitoring system comprising an anomaly detection unit that determines whether a monitored system is out of a steady state based on an operation log of the monitored system, an operation mode determination unit that determines the operation mode of the monitored system using a false positive learning model, and an anomaly notification unit that issues information indicating an anomaly in the monitored system when the anomaly detection unit determines that the operation log is out of the steady state, and the anomaly notification unit does not issue the information indicating the anomaly when the operation mode determination unit determines that the operation mode is a specific operation mode.

[0007] Another aspect of the present disclosure is the above-mentioned monitoring system, comprising a false positive model learning unit that performs machine learning on the correspondence between the operation log of the monitored system when the anomaly detection unit determines that the monitored system is out of a steady state and the specific operation mode, and generates the false positive learning model.

[0008] Another aspect of the present disclosure is the above-mentioned monitoring system, wherein the operation mode determination unit receives a notification that the anomaly detection unit has determined that the operation log is out of a steady state via a data diode capable of communication in only one direction.

[0009] Another aspect of the present disclosure is the monitoring system described above, wherein the abnormality notification unit issues information indicating an abnormality in the monitored system corresponding to an alert level based on the distance from the steady state indicated by the operation log and the distance from the specific operation mode indicated by the operation log.

[0010] Another aspect of the present disclosure is a system including an anomaly detection unit that determines whether a monitored system is out of a steady state based on an operation log of the monitored system; an operation mode determination unit that determines an operation mode of the monitored system using a false positive learning model; an anomaly notification unit that issues information indicating an anomaly in the monitored system when the anomaly detection unit determines that the operation log is out of the steady state; and a terminal that performs a display according to the information issued by the anomaly notification unit, wherein the anomaly notification unit does not issue the information indicating the anomaly when the operation mode determination unit determines that the operation mode is a specific operation mode.

[0011] Another aspect of the present disclosure is the above-mentioned system, further comprising the monitored system that generates the operation log.

[0012] Another aspect of the present disclosure is a monitoring method comprising a first step of determining whether a monitored system is out of a steady state based on an operation log of the monitored system, a second step of determining an operation mode of the monitored system using a false positive learning model, and a third step of issuing information indicating an abnormality in the monitored system if it is determined in the first step that the operation log is out of the steady state, and in the third step, if it is determined in the second step that the operation mode is a specific operation mode, the information indicating the abnormality is not issued.

[0013] Another aspect of the present disclosure is a program for causing a computer to function as an anomaly detection unit that determines whether a monitored system is out of a steady state based on an operation log of the monitored system, an operation mode determination unit that determines the operation mode of the monitored system using a false positive learning model, and an anomaly notification unit that issues information indicating an anomaly in the monitored system when the anomaly detection unit determines that the operation log is out of a steady state, wherein the anomaly notification unit does not issue the information indicating the anomaly when the operation mode determination unit determines that the operation mode is a specific operation mode. Effect of the Invention

[0014] According to this disclosure, the monitoring system, system, monitoring method, and program can prevent an abnormality from being notified when an operation log that differs from a steady state is generated even if there is no abnormality. [Brief description of the drawings]

[0015] [Figure 1] 1 is a schematic block diagram showing a configuration of a system 100 according to a first embodiment of the present disclosure. [Diagram 2] 2 is a schematic functional block diagram showing the configuration of a monitoring system 20 according to the embodiment. [Diagram 3] 4 is a flowchart illustrating the operation of the monitoring system 20 in the embodiment. [Figure 4] 11 is a flowchart illustrating a steady-state determination process in the embodiment. [Diagram 5] 10 is a schematic diagram showing a display image example (part 1) of the display / operation terminal 30 in the embodiment. FIG. [Figure 6] 13 is a schematic diagram showing a second example of a display image on the display / operation terminal 30 in the embodiment. FIG. [Figure 7] FIG. 11 is a schematic functional block diagram showing the configuration of monitoring systems 20a and 20b according to a second embodiment. [Figure 8]FIG. 11 is a schematic functional block diagram showing the configuration of a monitoring system 20c according to a third embodiment. [Figure 9] FIG. 2 is an explanatory diagram illustrating a hardware configuration of each device according to the above-described embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] <First embodiment> Hereinafter, a first embodiment of the present disclosure will be described with reference to the drawings. FIG. 1 is a schematic block diagram showing a configuration of a system 100 according to the first embodiment of the present disclosure. The system 100 includes a monitored system 10, a monitoring system 20, and a display / operation terminal 30. The monitored system 10 may be any system such as a power grid control system, a power generation facility control system, or a communication system, and generates an operation log related to the system itself. The operation log may be text data representing the control content or operation content, or may be measurement data such as voltage and temperature.

[0017] The monitoring system 20 collects the operation log generated by the monitored system 10, and when an abnormality is detected based on the operation log, it issues information indicating the abnormality of the monitored system 10. However, the monitoring system 20 uses a false positive learning model to determine the operation mode of the monitored system 10 and stores the determination result. Even when an abnormality is detected based on the operation log, the monitoring system 20 does not issue information indicating the abnormality if the stored operation mode is a specific operation mode α. The specific operation mode α is a mode in which an operation log different from that in the steady state is generated even if no abnormality occurs, such as during startup, shutdown, or maintenance work. The monitoring system 20 may be realized by one or more computers reading and executing a program. For example, the monitoring system 20 may be arranged on a so-called cloud.

[0018] When the monitoring system 20 issues information indicating an abnormality in the monitored system 10, the display / operation terminal 30 receives the information and displays the information on a display such as a liquid crystal display or an organic EL (Electro-Luminescence) display. Furthermore, when the display / operation terminal 30 displays the information indicating an abnormality on the screen, if the abnormality is due to a specific operation mode α, the display / operation terminal 30 accepts feedback from the operator of the display / operation terminal 30. For example, if there are multiple specific operation modes α, one of the multiple specific operation modes α is specified by this feedback. The monitoring system 20 generates a false detection learning model by machine learning using this feedback.

[0019] In addition, the display and operation terminal 30 may be realized by one or more computers reading and executing a program, and the program may be transmitted to the display and operation terminal 30 by the monitoring system 20.

[0020] 2 is a schematic functional block diagram showing the configuration of a monitoring system 20 according to this embodiment. The monitoring system 20 includes a steady state model learning unit 21, a steady state model storage unit 22, an abnormality detection unit 23, a false detection model learning unit 24, a false detection model storage unit 25, an operation mode determination unit 26, and an abnormality notification unit 27.

[0021] The steady state model learning unit 21 performs machine learning on the operation log when the monitored system 10 is in a steady state, and generates a steady state model for determining the distance of the monitored system 10 from the steady state. For this machine learning, known methods such as One Class SVM (Support Vector Machine) and neural networks can be used. Note that the steady state is a state in which no abnormality occurs and normal operation is performed. The steady state model storage unit 22 stores the steady state model generated by the steady state model learning unit 21.

[0022] The anomaly detection unit 23 collects the operation log of the monitored system 10 from the monitored system 10. The anomaly detection unit 23 judges whether or not the monitored system 10 is out of the steady state based on the collected operation log. When making this judgment, the anomaly detection unit 23 uses the steady state model stored in the steady state model storage unit 22. Furthermore, the anomaly detection unit 23 may use a predetermined threshold value to judge whether or not the monitored system 10 is out of the steady state. When the anomaly detection unit 23 judges that the monitored system 10 is out of the steady state, it notifies the operation mode judgment unit 26 of the judgment result.

[0023] The false detection model learning unit 24 performs machine learning of the correspondence between the operation log of the monitored system 10 when the abnormality detection unit 23 determines that the monitored system 10 is out of the steady state and the specific operation mode α, and generates a false detection learning model. The false detection model learning unit 24 receives feedback from the operator of the display / operation terminal 30 via the abnormality notification unit 27, and uses the feedback for machine learning to generate a false detection learning model. For this machine learning, a known method such as One Class SVM (Support Vector Machine) or a neural network can be used. When there are multiple specific operation modes, a false detection learning model may be generated for each of the multiple specific operation modes. The feedback includes information indicating the operation mode specified by the operator in response to the notification of the abnormality when the abnormality is notified. The feedback may further include an operation log when the abnormality is notified. The false detection model learning unit 24 may acquire an operation log corresponding to the operation mode specified by the operator in response to the notification of the abnormality from the operation mode determination unit 26 or the like. The false positive model storage unit 25 stores the false positive learning model generated by the false positive model learning unit 24.

[0024] The operation mode determination unit 26 determines and stores the operation mode of the monitored system 10 using the false positive learning model stored in the false positive model storage unit 25. For this determination, the operation log used when the anomaly detection unit 23 determined that the monitored system 10 is out of the steady state may be used. After determining that the operation mode of the monitored system 10 is a specific operation mode α, the operation mode determination unit 26 acquires the operation log of the monitored system 10 and determines whether the monitored system 10 has returned to the steady state using the steady state model stored in the steady state model storage unit 22. This determination is continued until the monitored system 10 returns to the steady state.

[0025] When the anomaly detection unit 23 determines that the operation log is out of the steady state, the anomaly notification unit 27 issues information indicating an anomaly in the monitored system 10. However, when the operation mode determination unit 26 determines that the operation mode is a specific operation mode α, the anomaly notification unit 27 does not issue information indicating an anomaly. Furthermore, when the anomaly notification unit 27 issues information indicating an anomaly, and there is feedback regarding the information, the anomaly notification unit 27 passes the feedback to the false detection model learning unit 24.

[0026] FIG. 3 is a flowchart for explaining the operation of the monitoring system 20 in this embodiment. First, the abnormality detection unit 23 acquires an operation log of the monitored system 10 (step Sa1). Next, the abnormality detection unit 23 judges whether the operation log acquired in step Sa1 is out of the steady state or not (step Sa2). For this judgment, the steady state model stored in the steady state model storage unit 22 is used. The abnormality detection unit 23 may compare the similarity between the operation log and the steady state model with a threshold value to judge whether it is out of the steady state or not. Note that the operation log used for the judgment may be a predetermined number of operation logs or may be an operation log of a predetermined length of time. For example, when the steady state model is based on One Class SVM, the similarity may be the distance between the output vector obtained by inputting the operation log into the steady state model and the origin. Note that the distance becomes smaller as the distance becomes farther from the steady state. Therefore, when the similarity is set to a larger value as the similarity increases, the reciprocal of the distance or the value obtained by subtracting the distance from a predetermined maximum distance may be set as the similarity. Furthermore, for example, if the steady state model is a neural network that outputs a larger value the closer the operation log is to the steady state, the similarity may be an output value obtained by inputting the operation log to the steady state model.

[0027] If it is determined in step Sa2 that the steady state is not exceeded (step Sa2-No), the process returns to step Sa1. If it is determined in step Sa2 that the steady state is exceeded (step Sa2-Yes), the operation mode determination unit 26 refers to the stored operation mode, and if the referred operation mode is the specific operation mode α (step Sa4-Yes), the process returns to step Sa1.

[0028] Also, if the referred operation mode is not the specific operation mode α (step Sa4-No), the operation mode determination unit 26 determines the similarity between the operation log and the false positive learning model stored in the false positive model storage unit 25 (step Sa5). If the operation mode determination unit 26 determines that the similarity is equal to or greater than a predetermined threshold and is similar (step Sa6-Yes), that is, if it determines that the operation mode is the specific operation mode α corresponding to the similar false positive learning model, it sets (stores) the specific operation mode α as the operation mode (step Sa7). Next, the operation mode determination unit 26 starts a steady state determination process (step Sa8) to be described later, and the process returns to step Sa1. Note that, for example, when the false positive learning model is based on One Class SVM, the similarity may be the reciprocal of the distance between the output vector obtained by inputting the operation log into the false positive learning model and the origin, or may be a value obtained by subtracting the distance from a predetermined maximum distance. In addition, the similarity may be, for example, an output value obtained by inputting the operation log into the false positive learning model when the false positive learning model is a neural network that outputs a larger value the closer the operation log is to the false positive learning model (a specific operation mode α).

[0029] Also, when the operation mode determination unit 26 determines that the similarity is less than the threshold and is not similar (step Sa6-No), the abnormality notification unit 27 issues information indicating an abnormality to notify the abnormality (step Sa9). The abnormality notification unit 27 may issue information indicating an abnormality by transmitting a signal of the information indicating an abnormality to the display and operation terminal 30 or another device using a dedicated signal line, or may issue information indicating an abnormality by transmitting a message including the information indicating an abnormality to the display and operation terminal 30 or another device using a general-purpose IP network or the like. The abnormality notification unit 27 may issue information indicating an abnormality without specifying a notification destination, such as by broadcasting the information indicating an abnormality without specifying an address or turning on a lamp. The abnormality notification unit 27 acquires feedback from the operator from the display and operation terminal 30 (step Sa10), and the process returns to step Sa1. This feedback is provided to machine learning by the erroneous detection model learning unit 24.

[0030] FIG. 4 is a flowchart for explaining the steady-state determination process in this embodiment. When the steady-state determination process is started by step Sa8 in FIG. 3, the operation mode determination unit 26 acquires the operation log of the monitored system 10 (step Sb1). The operation mode determination unit 26 determines the similarity between the steady-state model stored in the steady-state model storage unit 22 and the operation log (step Sb2). This similarity is the same as the similarity in step Sa2. When the operation mode determination unit 26 determines that the similarity is equal to or greater than a predetermined threshold and is similar (step Sb3-Yes), that is, when it determines that it is a steady state, it sets (stores) the steady state as the operation mode (step Sb4). On the other hand, when the operation mode determination unit 26 determines that the similarity is less than the predetermined threshold and is not similar (step Sb3-No), the process returns to step Sb1.

[0031] Fig. 5 is a schematic diagram showing a display image example (part 1) of the display / operation terminal 30 in this embodiment. Display image G1 in Fig. 5 is an example of an image displayed when the display / operation terminal 30 receives information indicating an abnormality from the monitoring system 20. Display image G1 displays images showing devices A, B, and C constituting the monitored system 10. Speech bubble D1 indicates that an abnormality has occurred in device B of the monitored system 10. Speech bubble D1 includes a list L1 displaying an operation log, an operation mode setting button B1 for setting the operation mode to be fed back, and a confirmation button B2 for closing speech bubble D1.

[0032] When the operator checks the operation log displayed in list L1, or determines from separately obtained information that the current operation mode of the monitored system 10 is a specific operation mode α, he or she presses the operation mode setting button B1.

[0033] Fig. 6 is a schematic diagram showing a display image example (part 2) of the display / operation terminal 30 in this embodiment. Image G2 in Fig. 6 is an example of an image displayed by the display / operation terminal 30 when the operation mode setting button B1 in Fig. 5 is pressed. Dialog D2 in image G2 includes a list L2 displaying an operation log, a list L3 of radio buttons for specifying an operation mode, a setting button G3 for feeding back the operation mode specified in list L3, and a cancel button G4 for clearing the dialog D2 and canceling the setting of the operation mode.

[0034] In this manner, the abnormality notification unit 27 in this embodiment does not issue information indicating an abnormality when the operation mode is determined to be a specific operation mode by the operation mode determination unit 26. This makes it possible to prevent an abnormality from being notified when an operation log different from the normal state is generated even if there is no abnormality, such as during start-up, shut-down, or maintenance work.

[0035] <Second embodiment> The system 100 in the second embodiment is similar to that in FIG. 1, but the monitoring system 20 is divided into a monitoring system 20a that is placed on the high security side and a monitoring system 20b that is placed on the low security side having a lower security level than the high security side.

[0036] FIG. 7 is a schematic functional block diagram showing the configuration of the monitoring systems 20a and 20b in the second embodiment. In FIG. 7, the parts corresponding to those in FIG. 2 are given the same reference numerals, and the description is omitted. The monitoring system 20a includes a steady state model learning unit 21, a steady state model storage unit 22, an abnormality detection unit 23, and a first operation mode determination unit 26a. The monitoring system 20b includes an erroneous detection model learning unit 24, an erroneous detection model storage unit 25, a second operation mode determination unit 26b, and an abnormality notification unit 27. The first operation mode determination unit 26a of the monitoring system 20a and the second operation mode determination unit 26b of the monitoring system 20b are connected via a data diode 40 (unidirectional communication device). The data diode 40 allows communication in only one direction from the first operation mode determination unit 26a to the second operation mode determination unit 26b, and does not allow communication in the opposite direction.

[0037] The first operation mode determination unit 26a periodically determines whether or not the monitored system 10 is in a steady state from the operation log of the monitored system 10, using the steady state model stored in the steady state model storage unit 22. When the first operation mode determination unit 26a determines that the monitored system 10 is in a steady state, it notifies the second operation mode determination unit 26b via the data diode 40 that the monitored system 10 is in the steady state.

[0038] Similar to the operation mode determination unit 26, the second operation mode determination unit 26b determines and stores the operation mode of the monitored system 10 using the erroneous detection learning model stored in the erroneous detection model storage unit 25. Furthermore, when the second operation mode determination unit 26b is notified by the first operation mode determination unit 26a that the monitored system 10 is in a steady state, it changes the stored operation mode to the steady state.

[0039] The second operation mode determination unit 26b may change the stored operation mode to the steady state when it does not receive a notification from the abnormality detection unit 23 that the monitored system 10 has been determined to be out of the steady state for a predetermined time or longer. In this case, the monitoring system 20a may not include the first operation mode determination unit 26a, and the second operation mode determination unit 26b may be connected to the abnormality detection unit 23 via the data diode 40.

[0040] In this way, in the second embodiment, the steady state model storage unit 22 that stores the steady state model is placed on the upstream side of the data diode 40, i.e., on the high security side, so that the steady state model can be protected from external attacks.

[0041] <Third embodiment> The system 100 in the third embodiment is similar to that in FIG. 1, but differs in that, instead of the monitoring system 20, a monitoring system 20c is provided that notifies the user of an alarm level when notifying the user of an abnormality.

[0042] Fig. 8 is a schematic functional block diagram showing the configuration of a monitoring system 20c in the third embodiment. In Fig. 8, parts corresponding to those in Fig. 2 are given the same reference numerals, and the description thereof will be omitted. The monitoring system 20c includes a steady state model learning unit 21, a steady state model storage unit 22, an abnormality detection unit 23c, a false detection model learning unit 24, a false detection model storage unit 25, an operation mode determination unit 26c, an abnormality notification unit 27, and an alarm level determination unit 28.

[0043] 2, but calculates the distance of the operation log from the steady state when it is determined that the operation is out of the steady state. This distance may be the difference between the similarity and the threshold value, for example, in the case where it is determined whether the operation is out of the steady state by comparing the similarity with a threshold value.

[0044] The operation mode determination unit 26c is similar to the operation mode determination unit 26 in FIG. 2, but calculates the distance from the specific operation mode α of the operation log. For example, when the similarity is compared with a threshold value to determine whether or not the operation mode is the specific operation mode α, this distance may be the difference between the similarity and the threshold value. Also, when there are multiple specific operation modes α, the distance may be calculated for each of the multiple specific operation modes α.

[0045] When the abnormality notification unit 27 issues information indicating an abnormality, the warning level determination unit 28 determines the warning level based on the distance calculated by the abnormality detection unit 23c and the operation mode determination unit 26c, and notifies the display / operation terminal 30 of the warning level together with the information indicating the abnormality, and causes it to be displayed on the screen. The warning level determination unit 28 may calculate the total value of the distances calculated by the abnormality detection unit 23c and the operation mode determination unit 26c, and determine that the warning level is higher as the total value is larger. Alternatively, the warning level determination unit 28 may select the smallest value of the distances calculated by the abnormality detection unit 23c and the operation mode determination unit 26c, and determine that the warning level is higher as the smallest value is larger.

[0046] This allows a higher warning level to be notified as the monitored system 10 moves away from the steady state and the specific operation mode α. The second embodiment and the third embodiment may be combined. For example, the abnormality detection unit 23 and the second operation mode determination unit 26b of the second embodiment may calculate the distances from the steady state and the specific operation mode α, and the warning level determination unit 28 included in the monitoring system 20b may determine the warning level based on these distances.

[0047] FIG. 9 is an explanatory diagram illustrating the hardware configuration of each device according to each of the above-mentioned embodiments. The devices are the monitoring systems 20, 20a, 20b, and 20c, and the display and operation terminal 30. Each device includes an input / output module I, a storage module M, and a control module P. The input / output module I is realized by including a part or all of the communication module H11, the connection module H12, the pointing device H21, the keyboard H22, the display H23, the button H3, the microphone H41, the speaker H42, the camera H51, and the sensor H52. The storage module M is realized by including a drive H7. The storage module M may further be configured by including a part or all of the memory H8. The control module P is realized by including a memory H8 and a processor H9. These hardware components are connected to each other so as to be able to communicate with each other via a bus, and are supplied with power from a power source H6.

[0048] The connection module H12 is a digital input / output port such as a USB (Universal Seriul Bus). In the case of a portable device, the pointing device H21, the keyboard H22, and the display H23 are touch panels. The sensor H52 is an acceleration sensor, a gyro sensor, a GPS receiving module, a proximity sensor, or the like. The power source H6 is a power supply unit that supplies electricity required to operate each device. In the case of a portable device, the power source H6 is a battery. The drive H7 is an auxiliary storage medium such as a hard disk drive or a solid state drive. The drive H7 may be a non-volatile memory such as an EEPROM or a flash memory, or a magneto-optical disk drive or a flexible disk drive. In addition, the drive H7 is not limited to being built into each device, but may be an external storage device connected to a connector of the connection module H12. The memory H8 is a main storage medium such as a random access memory. The memory H8 may be a cache memory. The memory H8 stores instructions when the instructions are executed by one or more processors H9. The processor H9 is a CPU (Central Processing Unit). The processor H9 may be a microprocessing unit (MPU) or a graphics processing unit (GPU). The processor H9 reads out programs and various data from the drive H7 via the memory H8 and performs calculations to execute instructions stored in one or more memories H8.

[0049] The input / output module I is used in the monitoring systems 20, 20a, 20b, and 20c, the display and operation terminal 30, and the like. The storage module M realizes the steady state model storage unit 22 and the erroneous detection model storage unit 25. The control module P is used to implement each part of the monitoring systems 20, 20a, 20b, and 20c, and the display and operation terminal 30. In this specification and the like, the descriptions of the monitoring systems 20, 20a, 20b, and 20c, and the display and operation terminal 30 may be replaced with the description of the control module P.

[0050] Furthermore, the present disclosure may have the following embodiments. (1) One embodiment of the present disclosure is a monitoring system comprising: an anomaly detection unit that determines whether a monitored system is out of a steady state based on an operation log of the monitored system; an operation mode determination unit that determines an operation mode of the monitored system using a false positive learning model; and an anomaly notification unit that issues information indicating an anomaly in the monitored system when the anomaly detection unit determines that the operation log is out of the steady state, wherein the anomaly notification unit does not issue the information indicating the anomaly when the operation mode determination unit determines that the operation mode is a specific operation mode.

[0051] (2) Another aspect of the present disclosure is the monitoring system described in (1), further comprising a false positive model learning unit that performs machine learning on the correspondence between the operation log of the monitored system when the anomaly detection unit determines that the monitored system is out of a steady state and the specific operation mode, and generates the false positive learning model.

[0052] (3) Another aspect of the present disclosure is the monitoring system described in (1) or (2), wherein the operation mode determination unit receives a notification that the anomaly detection unit has determined that the operation log is out of a steady state via a data diode capable of communication in only one direction.

[0053] (4) Another aspect of the present disclosure is a monitoring system described in any one of (1) to (3), wherein the abnormality notification unit issues information indicating an abnormality in the monitored system corresponding to an alarm level based on a distance from the steady state indicated by the operation log and a distance from the specific operation mode indicated by the operation log.

[0054] (5) Another aspect of the present disclosure is a system including an anomaly detection unit that determines whether a monitored system is out of a steady state based on an operation log of the monitored system; an operation mode determination unit that determines an operation mode of the monitored system using a false positive learning model; an anomaly notification unit that issues information indicating an anomaly in the monitored system when the anomaly detection unit determines that the operation log is out of the steady state; and a terminal that performs a display according to the information issued by the anomaly notification unit, wherein the anomaly notification unit does not issue the information indicating the anomaly when the operation mode determination unit determines that the operation mode is a specific operation mode.

[0055] (6) Furthermore, another aspect of the present disclosure is the system according to (5), further comprising the monitored system that generates the operation log.

[0056] (7) Another aspect of the present disclosure is a monitoring method including a first step of determining whether a monitored system is out of a steady state based on an operation log of the monitored system, a second step of determining an operation mode of the monitored system using a false positive learning model, and a third step of issuing information indicating an abnormality in the monitored system if it is determined in the first step that the operation log is out of the steady state, and in the third step, if it is determined in the second step that the operation mode is a specific operation mode, not issuing the information indicating the abnormality.

[0057] (8) Another aspect of the present disclosure is a program for causing a computer to function as an anomaly detection unit that determines whether a monitored system is out of a steady state based on an operation log of the monitored system, an operation mode determination unit that determines the operation mode of the monitored system using a false positive learning model, and an anomaly notification unit that issues information indicating an anomaly in the monitored system when the anomaly detection unit determines that the operation log is out of the steady state, wherein the anomaly notification unit does not issue the information indicating the anomaly when the operation mode determination unit determines that the operation mode is a specific operation mode.

[0058] 1, 7 and 8, a program for realizing the functions of the monitoring systems 20, 20a, 20b, 20c and the display / operation terminal 30 may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read into a computer system and executed to realize the monitoring systems 20, 20a, 20b, 20c and the display / operation terminal 30. Note that the term "computer system" here includes hardware such as the OS and peripheral devices.

[0059] In addition, if a WWW system is used, the "computer system" also includes the homepage providing environment (or display environment). In addition, "computer-readable recording medium" refers to portable media such as flexible disks, optical magnetic disks, ROMs, and CD-ROMs, and storage devices such as hard disks built into computer systems. Furthermore, "computer-readable recording medium" also includes those that dynamically hold a program for a short period of time, such as a communication line when transmitting a program via a network such as the Internet or a communication line such as a telephone line, and those that hold a program for a certain period of time, such as volatile memory inside a computer system that serves as a server or client in such cases. Furthermore, the above program may be one that realizes part of the above-mentioned functions, or may be one that can realize the above-mentioned functions in combination with a program already recorded in the computer system. [Explanation of symbols]

[0060] 10 Monitored Systems 20, 20a, 20b, 20c Surveillance system 21 Steady-state model learning section 22 Steady-state model storage section 23, 23c Abnormality detection section 24 False positive model learning part 25 False positive model memory 26, 26c Operation mode determination unit 26a First operation mode determination unit 26b Second operation mode determination unit 27 Abnormality notification section 28 Alarm level determination section 30 Display and operation terminal 40 Data Diode

Claims

1. an anomaly detection unit that determines whether a monitored system is out of a steady state based on an operation log of the monitored system; an operation mode determination unit that determines an operation mode of the monitored system using an erroneous detection learning model; an abnormality notification unit that issues information indicating an abnormality in the monitored system when the abnormality detection unit determines that the operation log is out of a steady state; Equipped with the abnormality notification unit does not issue information indicating the abnormality when the operation mode determination unit determines that the operation mode is a specific operation mode. Surveillance system.

2. The monitoring system of claim 1, further comprising an error detection model learning unit that performs machine learning on the correspondence between the operation log of the monitored system when the anomaly detection unit determines that the monitored system is out of a steady state and the specific operation mode, and generates the error detection learning model.

3. 2. The monitoring system according to claim 1, wherein the operation mode determination unit receives a notification that the abnormality detection unit has determined that the operation log is out of a steady state via a data diode capable of communication only in one direction.

4. The monitoring system of claim 1 , wherein the abnormality notification unit issues information indicating an abnormality in the monitored system corresponding to an alarm level based on a distance from the steady state indicated by the operation log and a distance from the specific operation mode indicated by the operation log.

5. an anomaly detection unit that determines whether a monitored system is out of a steady state based on an operation log of the monitored system; an operation mode determination unit that determines an operation mode of the monitored system using an erroneous detection learning model; an anomaly notification unit that issues information indicating an anomaly in the monitored system when the anomaly detection unit determines that the operation log is out of a steady state; a terminal that displays information corresponding to the information issued by the abnormality notification unit; Equipped with the abnormality notification unit does not issue information indicating the abnormality when the operation mode determination unit determines that the operation mode is a specific operation mode. system.

6. The system according to claim 5 , further comprising the monitored system that generates the operation log.

7. A first step of determining whether or not a monitored system is out of a steady state based on an operation log of the monitored system; a second step of determining an operating mode of the monitored system using a false positive learning model; a third step of issuing information indicating an abnormality in the monitored system when it is determined in the first step that the operation log is out of a steady state; having In the third step, when the operation mode is determined to be a specific operation mode in the second step, the information indicating the abnormality is not issued. Monitoring method.

8. Computer, an anomaly detection unit that determines whether or not a monitored system is out of a steady state based on an operation log of the monitored system; an operation mode determination unit that determines an operation mode of the monitored system using an erroneous detection learning model; an abnormality notification unit that issues information indicating an abnormality in the monitored system when the abnormality detection unit determines that the operation log is out of a steady state; A program for causing the device to function as a the abnormality notification unit does not issue information indicating the abnormality when the operation mode determination unit determines that the operation mode is a specific operation mode. program.

Images