System model generation device, system model generation method, and system model generation program

Abstract

It is desired to create a system model with relatively high accuracy based on communication data.SOLUTION: The system model generation apparatus 100 includes a certainty evaluation unit 130 and an overlap removal unit 140. When a device list composed of respective records corresponding to respective devices provided in a system is created on the basis of communication data in the system, a certainty evaluation part 130 selects a record corresponding to relatively high certainty from an overlapping record group when the overlapping record group composed of a plurality of records corresponding to an object device exists in the device list. For the overlapping record group, the overlap removing unit 140 integrates the communication information of each record other than the selected record with the communication information of the selected record, and removes each record other than the selected record from the device list.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to a system model generation device, a system model generation method, and a system model generation program. [Background technology]

[0002] Risk analysis of operational technology (OT) systems requires a significant amount of time, so efforts are underway to use tools to perform analysis more efficiently. However, creating a system model that corresponds to input data is a complex process. A system model is a model that represents each device in the system, the attributes of each device, and the system's network topology. As a solution to this problem, Patent Document 1 discloses a visualization tool that uses a technology to estimate a list of devices and their connection status by analyzing communication data, and automatically create a system model based on the estimation results. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2021-144639 Summary of the Invention [Problem to be solved by the invention]

[0004] The system model related to the technology disclosed in Patent Document 1 has a problem of low accuracy because it simply analyzes device information from communication data. The background to this problem is explained below. However, this technology may not be able to completely identify a device by analyzing communication data alone. Specifically, this technology has low accuracy in identifying the device type because it determines the type from the protocol used, etc. In this technology, multiple pieces of information corresponding to the same device are not treated as information corresponding to the same device, so that the same device may exist multiple times in the system model. That is, the device list may contain multiple duplicate records for one device. Note that in actual products, one device may be recorded multiple times for each protocol.

[0005] The present disclosure aims to create a system model with relatively high accuracy in a technology for creating a system model based on communication data. [Means for solving the problem]

[0006] The system model generation device according to the present disclosure comprises: A system model generation device that generates a system model indicating each device included in a system and a network within the system, When a device list is created based on communication data within the system, the list includes records indicating each device included in the system, the type of each device included in the system, communication information for identifying each device included in the system during communication, and certainty corresponding to the accuracy of the type of each device included in the system, a certainty evaluation unit that, when a duplicate record group consisting of a plurality of records corresponding to a target device exists in the device list, selects a record corresponding to a relatively high certainty from the duplicate record group; a duplicate removal unit that integrates communication information of each record other than the selected record with communication information of the duplicate record group and removes each record other than the selected record from the device list; Equipped with. [Effects of the Invention]

[0007] According to the present disclosure, the reliability evaluation unit and the duplicate removal unit perform processing to remove duplicate records from the device list based on reliability. Here, the device list is created based on communication data. Also, a system model may be created based on the device list. Therefore, according to the present disclosure, in a technique for creating a system model based on communication data, a system model with relatively high accuracy can be created. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram showing an example of the configuration of a system model generation system 90 according to a first embodiment. [Figure 2] FIG. 1 is a diagram showing an example of a hardware configuration of a system model generating device 100 according to a first embodiment. [Figure 3] 3 is a flowchart showing the operation of the system model generating device 100 according to the first embodiment. [Figure 4] 3 is a flowchart showing the operation of the system model generating device 100 according to the first embodiment. [Figure 5] FIG. 1 is a diagram showing a specific example of a system. [Figure 6] 1A and 1B are diagrams showing specific examples of system configuration information, where FIG. 1A is a table showing asset information, and FIG. 1B is a table showing connection information. [Figure 7] FIG. 3 is a diagram showing exclusion rules according to the first embodiment. [Figure 8] FIG. 3 is a diagram showing conversion rules according to the first embodiment. [Figure 9] 5 is a diagram for explaining the processing of a type correction unit 120 according to the first embodiment. FIG. [Figure 10] FIG. 3 is a diagram for explaining the processing of the overlap removal unit 140 according to the first embodiment. [Figure 11] 5A and 5B are diagrams for explaining the processing of the attribute interpolation unit 150 according to the first embodiment, where FIG. 5A is a table showing interpolation rules, and FIG. 5B is a table showing a list of devices. [Figure 12] FIG. 3 is a diagram showing attribute items according to the first embodiment. [Figure 13] FIG. 3 is a diagram showing attribute items according to the first embodiment. [Figure 14] 1A and 1B are diagrams for explaining the processing of the association creating unit 170 according to the first embodiment, where FIG. 1A is a table showing connection information, and FIG. 1B is a table showing an association list. [Figure 15] 1A and 1B are diagrams for explaining the processing of the model creating unit 190 according to the first embodiment, where FIG. 1A shows a model corresponding to device information, and FIG. 1B shows a model corresponding to related information. [Figure 16] 10A and 10B are diagrams for explaining the effects of the first embodiment, in which (a) is a table showing an initial device list, and (b) is a table showing a device list after type correction. [Figure 17] 10A and 10B are diagrams illustrating the effects of the first embodiment, in which (a) is a table showing an initial device list, (b) is a table showing a device list after type correction, and (c) is a table showing a device list after duplicates have been removed. [Figure 18] 1A and 1B are diagrams illustrating the effects of the first embodiment, in which (a) is a table showing a list of devices after duplication has been removed, and (b) is a table showing connection information. [Figure 19] FIG. 10 is a diagram showing an example of a hardware configuration of a system model generating device 100 according to a modification of the first embodiment. [Figure 20] 10 is a flowchart showing the operation of the system model generating device 100 according to the second embodiment. [Figure 21] 10A and 10B are diagrams for explaining the effects of the second embodiment, in which FIG. 10A shows a logical configuration, and FIG. 10B shows a physical configuration including a switch. DETAILED DESCRIPTION OF THE INVENTION

[0009] In the description of the embodiments and the drawings, the same elements and corresponding elements are given the same reference numerals. The description of elements given the same reference numerals will be omitted or simplified as appropriate. Arrows in the drawings mainly indicate the flow of data or the flow of processing. Furthermore, "unit" may be read as "circuit," "step," "procedure," "process," or "circuitry" as appropriate.

[0010] Embodiment 1 Hereinafter, this embodiment will be described in detail with reference to the drawings.

[0011] ***Configuration Description*** 1 shows an example of the configuration of a system model generation system 90 according to this embodiment. As shown in FIG. 1, the system model generation system 90 includes a visualization tool, a system model generation device 100, a modeling tool, and a security analysis tool. The visualization tool is a tool that visualizes the configuration of a system and outputs asset information and connection information related to the system. A specific example of the visualization tool is Guardian by Nozomi Networks. The system may be an OT (Operational Technology) system. A modeling tool has the function of displaying a system configuration diagram corresponding to a system model and the function of enabling editing of the system configuration diagram. The modeling tool outputs a system model that has been checked and modified by the user. A specific example of a modeling tool is Microsoft Office Visio. The security analysis tool analyzes the security of the system corresponding to the input system model and outputs an analysis report showing the analysis results. The asset information is information that shows a list of assets such as devices that the system has, and is made up of records corresponding to each asset. Specifically, the asset information is made up of records that show each asset that the system has, the type of each asset that the system has, and the communication information for each asset that the system has. The connection information is information that indicates the communication results within the system.

[0012] As shown in FIG. 1, the system model generation device 100 includes an exclusion unit 110, a type correction unit 120, a certainty evaluation unit 130, a duplicate removal unit 140, an attribute interpolation unit 150, an equipment list management unit 160, an association creation unit 170, an association list management unit 180, and a model creation unit 190. The system model generation device 100 generates a system model that indicates each device included in the system and the network within the system. Specifically, the system model generation device 100 integrates communication information and evaluates the reliability of correcting the types corresponding to each device included in the system based on an estimation model created based on communication data within the system. In this process, the system model generation device 100 appropriately removes unnecessary data, converts the types corresponding to each device, removes records corresponding to duplicate devices, and creates information indicating the connections between devices. The estimation model is a model estimated as a system model corresponding to a certain system. The estimation model may be created in any manner. The communication information is information for identifying each asset provided in the system at the time of communication. Certainty is a measure that corresponds to the accuracy of a type.

[0013] The exclusion unit 110 generates post-exclusion asset information by excluding one or more records in accordance with the exclusion rule. The post-exclusion asset information is information in which records corresponding to devices that do not actually exist in the system are excluded from the asset information. Specifically, the exclusion unit 110 determines whether each record indicated by the asset information is to be excluded in accordance with a preset exclusion rule. As a specific example, the exclusion unit 110 excludes records relating to assets that do not actually exist, such as broadcasts, from the asset information. The exclusion rules indicate rules for excluding, from the asset information, records corresponding to assets that do not actually exist in the system.

[0014] The type correcting unit 120 appropriately corrects the type corresponding to each device in the asset information in accordance with a preset conversion rule, etc. The type correcting unit 120 also calculates the certainty corresponding to each device whose type has been corrected. The conversion rules indicate the rules for modifying the type. Specifically, when asset information is generated based on communication data within the system and post-exclusion asset information is generated, the type modification unit 120 modifies the type of one or more records in the post-exclusion asset information in accordance with the conversion rule, and sets a certainty corresponding to the accuracy of the modified type for each modified record.The type modification unit 120 then sets each record for which a certainty has been set as a record in the device list. Furthermore, the type correction unit 120 may calculate a judgment value corresponding to each type of candidate device type based on each attribute indicated by a target record, which is one of the records indicated in the device list. In this case, the type correction unit 120 corrects the type of the target record based on the calculation results of each judgment value and sets a certainty for the target record. Here, in the device list, each record indicates one or more attributes corresponding to the device indicated by that record.

[0015] The reliability evaluation unit 130 evaluates the reliability of each record for duplicate records for the same device in the device list. Specifically, when the device list is created based on communication data within the system and a duplicate record group consisting of multiple records corresponding to the target device exists in the device list, the reliability evaluation unit 130 selects a record corresponding to a relatively high reliability from the duplicate record group. The device list is information showing a list of devices included in the system, and is made up of records corresponding to each device. Specifically, the device list is made up of records showing each device included in the system, the type of each device included in the system, communication information of each device included in the system, and certainty corresponding to the certainty of the type of each device included in the system.

[0016] The duplicate removal unit 140 appropriately removes duplicate records from the device list based on the evaluation result by the reliability evaluation unit 130. At this time, the duplicate removal unit 140 integrates the communication information indicated by the record to be removed with the communication information indicated by the record to be kept. Specifically, the duplicate removal unit 140 integrates the communication information of each record other than the selected record into the communication information of the selected record for the group of duplicate records, and removes each record other than the selected record from the device list.

[0017] The attribute interpolation unit 150 appropriately interpolates attributes corresponding to each device in the device list according to a preset interpolation rule. The attribute interpolation unit 150 interpolates attributes for one or more records in the device list according to the interpolation rule. The interpolation rules indicate the rules for interpolating attributes for the records.

[0018] The device list management unit 160 is a database that manages a device list.

[0019] The relation creating unit 170 creates information indicating the relation between the devices, i.e., the relation regarding the communication connection between the devices in the system, based on the connection information and the device list. The relation creating unit 170 also registers the created relation in the relation list. The relation list is information showing a list of relations relating to communication connections between devices, and is made up of records corresponding to each relation.

[0020] The relation list management unit 180 is a database that manages the relation list.

[0021] The model creation unit 190 creates a system model based on the device list and the association list, and outputs the created system model. At this time, the model creation unit 190 matches the format of the information for each device and the format of the connection information between devices to the specifications of the modeling tool.

[0022] 2 shows an example of the hardware configuration of the system model generation device 100 according to this embodiment. The system model generation device 100 is made up of a computer. The system model generation device 100 may be made up of multiple computers.

[0023] As shown in the figure, the system model generation device 100 is a computer that includes hardware such as a processor 11, a memory 12, an auxiliary storage device 13, an input / output IF (Interface) 14, and a communication device 15. These pieces of hardware are appropriately connected via signal lines 19.

[0024] The processor 11 is an integrated circuit (IC) that performs arithmetic processing and controls the hardware of the computer. Specific examples of the processor 11 include a central processing unit (CPU), a digital signal processor (DSP), or a graphics processing unit (GPU). The system model generating device 100 may include multiple processors that replace the processor 11. The multiple processors share the role of the processor 11.

[0025] The memory 12 is typically a volatile storage device, specifically a random access memory (RAM). The memory 12 is also called a primary storage device or a main memory. Data stored in the memory 12 is saved in the secondary storage device 13 as needed.

[0026] The auxiliary storage device 13 is typically a non-volatile storage device, and specific examples thereof include a ROM (Read Only Memory), an HDD (Hard Disk Drive), or a flash memory. Data stored in the auxiliary storage device 13 is loaded into the memory 12 as needed. The memory 12 and the auxiliary storage device 13 may be integrated into one unit.

[0027] The input / output IF 14 is a port to which an input device and an output device are connected. A specific example of the input / output IF 14 is a USB (Universal Serial Bus) terminal. Specific examples of the input device are a keyboard and a mouse. A specific example of the output device is a display.

[0028] The communication device 15 is a receiver and a transmitter, and is specifically a communication chip or a network interface card (NIC).

[0029] Each unit of the system model generating device 100 may use the input / output IF 14 and the communication device 15 as appropriate when communicating with other devices.

[0030] The auxiliary storage device 13 stores a system model generation program. The system model generation program is a program that causes a computer to realize the functions of each unit included in the system model generation device 100. The system model generation program is loaded into the memory 12 and executed by the processor 11. The functions of each unit included in the system model generation device 100 are realized by software.

[0031] Data used when executing the system model generation program and data obtained by executing the system model generation program are stored in a storage device as appropriate. Each part of the system model generation device 100 uses a storage device as appropriate. Specific examples of the storage device include at least one of the memory 12, the auxiliary storage device 13, a register in the processor 11, and a cache memory in the processor 11. Note that the terms "data" and "information" may have the same meaning. The storage device may be independent of the computer. The functions of the memory 12 and the auxiliary storage device 13 may be realized by other storage devices.

[0032] The system model generation program may be recorded on a computer-readable nonvolatile recording medium. Specific examples of the nonvolatile recording medium include an optical disk and a flash memory. The system model generation program may be provided as a program product.

[0033] ***Explanation of Operation*** The operating procedure of the system model generating device 100 corresponds to a system model generating method, and the program that realizes the operation of the system model generating device 100 corresponds to a system model generating program.

[0034] 3 and 4 are flowcharts showing an example of the operation of the system model generating device 100. The operation will be explained using the drawings.

[0035] (Step S101) System configuration information is created using an existing visualization tool. This configuration information is created using the technology disclosed in Patent Document 1, for example. Hereinafter, this configuration information will be assumed to consist of asset information and connection information. FIG. 5 shows an example of the system. Figure 6 shows the configuration information of the system shown in Figure 5. Figure 6(a) is a table showing asset information, and Figure 6(b) is a table showing connection information. Here, PC is an abbreviation for Personal Computer, PLC is an abbreviation for Programmable Logic Controller, and MAC is an abbreviation for Media Access Control.

[0036] (Step S102) The exclusion unit 110 reads one record that has not yet been read as a selected record from among the records indicated by the asset information as a selected record, and determines whether the selected record is to be excluded by referring to the exclusion rules. Figure 7 shows a specific example of an exclusion rule. In this example, the exclusion rule consists of multiple rules. Each rule specifies a condition that must be met for a record to be excluded. The exclusion unit 110 determines that a selected record is to be excluded if the selected record matches any one of the rules indicated by the exclusion rules. Here, when the asset information shown in Fig. 6(a) and the exclusion rules shown in Fig. 7 are used, the record with ID (Identification) 4 is determined to be to be excluded.

[0037] (Step S103) If the selected record is to be excluded, the exclusion unit 110 excludes the selected record from the asset information, and then the process proceeds to step S110. Otherwise, the exclusion unit 110 proceeds to step S104.

[0038] (Step S104) The type corrector 120 selects one rule that has not yet been selected as a selected rule from among the rules indicated by the conversion rules, and determines whether the selected record corresponds to the selected rule. The type correction process is a process of estimating the true type of the selected record from the attribute information of the selected record when the type of the selected record is incorrectly determined. This process may use a method adopted in existing visualization tools. Figure 8 shows a specific example of a conversion rule. In this example, the conversion rule consists of multiple rules. Each rule consists of a condition, a type assumed as the type of record that satisfies the condition, and a certainty corresponding to the type. Here, HMI is an abbreviation for Human Machine Interface. In addition, when a regression equation that calculates a judgment value for each type based on each attribute is generated in advance based on data previously output by the visualization tool, the type correction unit 120 may calculate a judgment value for each type using each regression equation. In this case, the type correction unit 120 may select a type with a relatively high degree of certainty based on the calculated judgment value, and calculate a certainty corresponding to the selected type. The judgment value may be used as the certainty. Here, the series of regression equations corresponding to each type corresponds to a conversion rule, and each regression equation corresponds to a rule constituting the conversion rule. Each regression equation is used to calculate a judgment value corresponding to each type, which is a candidate for the type of equipment, based on each attribute. [Regression formula group] shows specific examples of regression formulas corresponding to the judgment values ​​for each category. In each regression formula, each attribute is converted into a numerical expression. Note that attributes that cannot be quantified are excluded.

[0039] [Regression equations] (Type 1 judgment value) = a1 × (attribute 1) + b1 × (attribute 2) + ... + n1 (Type 2 judgment value) = a2 × (attribute 1) + b2 × (attribute 2) + ... + n2 …

[0040] (Step S105) If the selected record satisfies the selection rule, the type modification unit 120 proceeds to step S106, otherwise the type modification unit 120 proceeds to step S108.

[0041] (Step S106) The type modification unit 120 modifies the type of the selected record in accordance with the selection rules.

[0042] (Step S107) The type modification unit 120 sets a certainty corresponding to the modified type for the selected record. The certainty corresponds to the score of the selected rule. Fig. 9 is a diagram corresponding to the asset information from which the record with ID 4 has been excluded and the conversion rule shown in Fig. 8, and explains the processing of the type correction unit 120. Here, the curved lines in the diagram indicate that one table has been divided. If the selected record corresponds to a target rule, which is one of the rules indicated by the conversion rules, the type of the selected record is corrected to the type indicated by the target rule. In addition, the certainty corresponding to the corrected type is set. As a result, the asset information is corrected as shown in Figure 9.

[0043] (Step S108) The type modification unit 120 adds the selected record to the device list.

[0044] (Step S109) If all rules indicated by the conversion rules have been selected as selected rules by the type correction unit 120, the type correction unit 120 proceeds to step S110. Otherwise, the type correction unit 120 proceeds to step S104.

[0045] (Step S110) If the exclusion unit 110 has read all the records indicated by the asset information as selected records, the type modification unit 120 proceeds to step S111. Otherwise, the type modification unit 120 proceeds to step S102.

[0046] (Step S111) The duplicate removal unit 140 acquires, as an acquired record, one record that has not yet been acquired as an acquired record from among the records indicated by the device list.

[0047] (Step S112) The duplication removal unit 140 determines whether the acquired record overlaps with other records indicated in the device list. In this case, the duplication removal unit 140 determines whether there is duplication by referring to information for identifying each device, such as an IP (Internet Protocol) address or a MAC address, as a specific example. If there is a duplication of the acquired record in the device list, the duplication removal unit 140 proceeds to step S113. Otherwise, the duplication removal unit 140 proceeds to step S116.

[0048] (Step S113) The certainty evaluation unit 130 compares the certainty of all records included in the duplicate record group and selects the record corresponding to the highest certainty. Here, the duplicate record group consists of the acquired record and each record that overlaps with the acquired record.

[0049] (Step S114) The duplicate removal unit 140 integrates the communication information of each record that is included in the duplicate record group and that has not been selected by the reliability evaluation unit 130, into the communication information of the record that has been selected by the reliability evaluation unit 130. As a specific example, the duplicate removal unit 140 integrates (adds) communication information such as an IP address indicated by the record to be removed into the communication information of the record to be kept.

[0050] (Step S115) The duplicate removal unit 140 removes duplicates from the device list so that only records corresponding to types with relatively high corresponding certainty remain in the duplicate record group. As a specific example, the duplicate removal unit 140 deletes each record from the duplicate records that is considered to be relatively less useful in risk analysis based on the evaluation value of certainty. At this time, the device list is updated. Fig. 10 corresponds to Fig. 9 and explains the processing of the duplicate removal unit 140. In Fig. 9, a record with an ID of 2 and a record with an ID of 3 share a MAC address. Therefore, these records are duplicates. Here, the reliability of the record with an ID of 2 is higher than the reliability of the record with an ID of 3. Therefore, the communication information of the record with an ID of 3 is integrated with the communication information of the record with an ID of 2. Furthermore, the record with an ID of 3 is removed.

[0051] (Step S116) If all records indicated in the device list have been acquired as acquired records by the duplication removal unit 140, the duplication removal unit 140 proceeds to step S117. Otherwise, the duplication removal unit 140 proceeds to step S111.

[0052] (Step S117) The attribute interpolation unit 150 acquires, as an acquired record, one record that has not yet been acquired as an acquired record from among the records indicated by the device list.

[0053] (Step S118) The attribute interpolation unit 150 determines whether the acquired record corresponds to any of the rules indicated by the interpolation rules based on the type of the acquired record. If the acquired record corresponds to any of the rules, the attribute interpolation unit 150 proceeds to step S119. Otherwise, the attribute interpolation unit 150 proceeds to step S121. Fig. 11 is a diagram illustrating the processing of the attribute interpolation unit 150. Fig. 11(a) shows a specific example of an interpolation rule. Fig. 11(a) shows, for each type, each attribute to be interpolated and its initial value.

[0054] (Step S119) The attribute interpolation unit 150 interpolates attributes indicated by the rule corresponding to the acquired record for the acquired record. At this time, the attribute interpolation unit 150 adds an initial value of each attribute to be interpolated to the acquired record according to the rule. Note that some attributes do not have an initial value set, and for attributes for which an initial value is not set, the user may manually set the initial value using a modeling tool or the like after the system model is output. Fig. 12 shows a specific example of attributes when the device is an IT (Information Technology) device or an OT device. Fig. 13 shows a specific example of attributes when the device is a network device. Note that some items, such as the OS (Operating System) type, can sometimes be determined from the protocol used in the visualization tool. The attribute interpolation unit 150 may use the technique disclosed in [Reference 1] for attribute interpolation processing. The attribute interpolation processing is processing for interpolating missing attributes for analysis based on known attribute information.

[0055] [Reference 1] International Publication No. 2011 / 037004

[0056] (Step S120) The attribute interpolation unit 150 updates the device list so that each interpolated attribute is reflected. Fig. 11(b) shows a specific example of a device list updated by the attribute interpolation unit 150. When the interpolation rule shown in Fig. 11(a) is used, for a record whose type is PC, the attribute interpolation unit 150 sets α1 to attribute n+1 and β1 to attribute n+2. Note that the attribute interpolation unit 150 does not set a value for attribute n+3 because no initial value is set for this attribute.

[0057] (Step S121) If all records indicated in the device list have been acquired as acquired records by the attribute interpolation unit 150, the attribute interpolation unit 150 proceeds to step S122. Otherwise, the attribute interpolation unit 150 proceeds to step S117.

[0058] (Step S122) The association creating unit 170 reads, as a selected record, one record that has not yet been read as a selected record from among the records indicated by the connection information. Fig. 14 corresponds to Fig. 11 and is a diagram illustrating the processing of the association creation unit 170. Fig. 14(a) shows a specific example of a record indicated by the connection information. In this example, the source IP address and the destination IP address are shown.

[0059] (Step S123) The association creation unit 170 searches the device list for each device corresponding to the information indicated by the selected record. At this time, as a specific example, the association creation unit 170 searches for a device corresponding to each address indicated by the selected record. Note that if a device corresponding to the address indicated by the selected record does not exist in the device list, the selected record is excluded. However, the association creation unit 170 may create an association between the device and the switch. Furthermore, when connecting each device to a switch, the association creation unit 170 creates an association between the switch and the device corresponding to a valid address.

[0060] (Step S124) The association creating unit 170 adds each of the found devices to the association list as appropriate. Figure 14(b) shows a specific example of a relation list. In Figure 14(a), the sender corresponds to a device with ID 1, and the destination corresponds to a device with ID 2. Therefore, in the first row of this example, 1 is set as the start point and 2 is set as the end point.

[0061] (Step S125) If all records indicated by the connection information have been read as selected records by the association creating unit 170, the association creating unit 170 proceeds to step S126. Otherwise, the association creating unit 170 proceeds to step S122.

[0062] (Step S126) The model creating unit 190 acquires, as an acquired record, one record that has not yet been acquired as an acquired record from among the records indicated in the device list.

[0063] (Step S127) The model creation unit 190 creates a model corresponding to the device indicated by the acquired record in accordance with the specifications of the modeling tool, and outputs the created model. FIG. 15(a) shows a specific example of a model corresponding to a device.

[0064] (Step S128) If all records indicated in the device list have been acquired as acquired records by the model creation unit 190, the model creation unit 190 proceeds to step S129. Otherwise, the model creation unit 190 proceeds to step S126.

[0065] (Step S129) The model creating unit 190 acquires, as an acquired record, one record that has not yet been acquired as an acquired record from among the records indicated in the association list.

[0066] (Step S130) The model creation unit 190 creates a model corresponding to the relationship between the devices indicated by the acquired record in accordance with the specifications of the modeling tool, etc., and outputs the created model. Note that if the identifiers at both ends of the relationship are assigned by the modeling tool, the model creation unit 190 may acquire the identifiers of each device when outputting information about each device corresponding to both ends of the relationship, record the acquired identifiers, and use the recorded identifiers in the processing of this step. FIG. 15(b) shows a specific example of a model corresponding to the relationship between devices.

[0067] (Step S131) If all records indicated in the association list have been acquired as acquired records by the model creation unit 190, the model creation unit 190 ends the processing of this flowchart. Otherwise, the model creation unit 190 proceeds to step S129.

[0068] ***Explanation of the effect of the first embodiment*** Conventional manual system model generation processes have the problem of being cumbersome due to the large number of inputs and settings required. Another problem is that system specifications are not always correct, making it impossible to create a correct system model based on the specifications. Another problem is that modeling is subjective, meaning that analysis results can vary depending on the analyst. On the other hand, according to this embodiment, these problems are resolved because a system model is automatically created based on communication data.

[0069] Conventional visualization tool-based technologies analyze captured communication data and automatically generate OT system configuration information. They also create an asset list from communication addresses. They also analyze communication card information and communication protocols to determine the connection status between assets and the model of each asset. Therefore, in the conventional technology, multicast and broadcast are also output as assets, which causes a problem that assets that do not actually exist are mixed into the asset list. On the other hand, according to the present embodiment, it is possible to exclude assets that do not actually exist based on exclusion rules. Furthermore, while the prior art has the problem of inaccurate model identification, the present embodiment makes it possible to appropriately correct the model based on conversion rules and to identify the model with relatively high accuracy based on certainty. Furthermore, the conventional technology has a problem of duplicate registration of the same asset. For example, the same asset is registered twice based on the MAC address and the IP address. On the other hand, according to the present embodiment, it is possible to eliminate duplicate registration based on reliability, etc. Furthermore, the conventional technology has a problem in that communications at different layers (such as the MAC address level and the IP address level) are recorded together. As a specific example, when both the MAC address level and the IP address level are depicted as a system model, a model in which physical connections and logical connections are mixed is created. On the other hand, according to the present embodiment, this problem is solved by eliminating duplicate registrations. Furthermore, conventional techniques lack the attribute information necessary for analysis, which causes a problem that the attributes of the device are unknown at the time of analysis. As a specific example, information indicating whether or not the storage is encrypted is useful information for risk analysis, even though it is not included in the communication data. On the other hand, according to the present embodiment, the attribute is interpolated based on an interpolation rule, thereby solving the problem.

[0070] Fig. 16 is a diagram illustrating the effects of embodiment 1. Fig. 16(a) is a table showing an initial device list, and Fig. 16(b) is a table showing a device list after type correction. In FIG. 16(a), the MAC addresses are the same between the two records. Therefore, the two records correspond to the same device. However, as shown in FIG. 16(b), the types of the two records have become different as a result of the type correction process for the two records. Here, at least one of the types of the two records is incorrect. In addition, a certainty corresponding to the type is set for each record. At this time, by determining the records to be excluded based on the certainty corresponding to the rule applied when the type was modified, it is possible to leave records with a higher certainty. Thus, according to this embodiment, even if there are multiple records relating to the same device and the type correction process for one or more records could not be performed appropriately, it is possible to exclude records that are considered to have a relatively low degree of certainty based on the certainty of each record.

[0071] 17 and 18 are diagrams illustrating the effects of the first embodiment. In this embodiment, as shown in (a) to (c) of Fig. 17, after a type correction is performed, if there is duplication, the duplication is removed. Also, as shown in (a) of Fig. 18, when the duplication is removed, the communication information of the record to be removed is integrated with the communication information of the record to be kept. If the communication information is not integrated, the device corresponding to the destination in the connection information shown in Figure 18(b) will be lost from the device list. This will cause a problem in that the correct connection configuration cannot be created. On the other hand, if the communication information is integrated, the device corresponding to the destination will be present in the device list, so this problem will not occur. In this way, in this embodiment, by integrating communication information (linking addresses) when removing duplicate records, even after performing exclusion and de-duplication on the device list, each device corresponding to the source and destination of the connection information is not lost in the device list. Therefore, according to this embodiment, an appropriate system model can be created.

[0072] ***Other Configurations*** <Variation 1> FIG. 19 shows an example of the hardware configuration of a system model generating device 100 according to this modification. The system model generating device 100 includes a processing circuit 18 in place of the processor 11, the processor 11 and memory 12, the processor 11 and auxiliary storage device 13, or the processor 11, memory 12, and auxiliary storage device 13. The processing circuitry 18 is hardware that realizes at least a part of the components of the system model generating device 100 . The processing circuitry 18 may be dedicated hardware or may be a processor that executes a program stored in the memory 12 .

[0073] When processing circuitry 18 is dedicated hardware, processing circuitry 18 may be, for example, a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array), or a combination thereof. The system model generating device 100 may include a plurality of processing circuits that replace the processing circuit 18. The plurality of processing circuits share the role of the processing circuit 18.

[0074] In the system model generating device 100, some functions may be realized by dedicated hardware, and the remaining functions may be realized by software or firmware.

[0075] Processing circuitry 18 is illustratively implemented in hardware, software, firmware, or a combination thereof. The processor 11, memory 12, auxiliary storage device 13, and processing circuit 18 are collectively referred to as "processing circuitry." In other words, the functions of the functional components of the system model generating device 100 are realized by the processing circuitry. The system model generating device 100 according to other embodiments may also have the same configuration as this modified example.

[0076] Embodiment 2 The following mainly describes the differences from the above-described embodiment with reference to the drawings. As shown in Figure 18(b), the connection information does not include switches in either the source or destination. However, there is a need to depict the physical configuration of a system. Therefore, in this embodiment, related information is created assuming that communication is performed via a switch.

[0077] ***Configuration Description*** The configuration of the system model generating device 100 according to this embodiment is similar to the configuration of the system model generating device 100 according to the first embodiment. The exclusion unit 110 according to this embodiment does not exclude communication information from each record, taking into consideration the creation of associations between devices and switches. The association creating unit 170 according to this embodiment creates an association indicating the connection between each device and a switch. That is, the association creating unit 170 creates information indicating the presence of a switch between the devices as information indicating the association.

[0078] ***Explanation of Operation*** Fig. 20 is a flowchart showing an example of the operation of the system model generating device 100. The operation will be explained using Fig. 20. Note that Fig. 20 shows only the difference between the operation according to the first embodiment and the operation according to the second embodiment.

[0079] (Step S201) The relation creating unit 170 creates a relation indicating the connection between one of the found devices and the switch, and adds the created relation to the relation list.

[0080] (Step S202) The relation creating unit 170 creates a relation indicating the connection between the other of the searched devices and the switch, and adds the created relation to the relation list.

[0081] ***Explanation of the effect of the second embodiment*** In conventional technology, the communication data created by visualization tools does not include switch addresses, making it difficult to create a physical configuration that includes switches. The visualization tool analyzes the data captured by the switch, and in this embodiment, creates the physical configuration including the switch by creating related information assuming that each communication is performed via the switch.

[0082] Fig. 21 is a diagram corresponding to the connection information shown in (b) of Fig. 18, and is a diagram illustrating the effect of this embodiment. When a system model is created based on the source and destination of the connection information, only a system model showing a logical configuration such as that shown in (a) of Fig. 21 can be created. On the other hand, according to this embodiment, by regarding each communication as being executed via a switch, it is possible to create a physical configuration including a switch as shown in FIG. 21(b).

[0083] ***Other embodiments*** The above-described embodiments may be freely combined, or any of the components in each embodiment may be modified, or any of the components in each embodiment may be omitted. Furthermore, the embodiments are not limited to those shown in Embodiments 1 and 2, and various modifications are possible as needed. The procedures explained using flowcharts and the like may be modified as appropriate.

[0084] Various aspects of the present disclosure are summarized below as appendices.

[0085] (Appendix 1) A system model generation device that generates a system model indicating each device included in a system and a network within the system, When a device list is created based on communication data within the system, the list includes records indicating each device included in the system, the type of each device included in the system, communication information for identifying each device included in the system during communication, and certainty corresponding to the accuracy of the type of each device included in the system, a certainty evaluation unit that, when a duplicate record group consisting of a plurality of records corresponding to a target device exists in the device list, selects a record corresponding to a relatively high certainty from the duplicate record group; a duplicate removal unit that integrates communication information of each record other than the selected record with communication information of the duplicate record group and removes each record other than the selected record from the device list; A system model generating device comprising:

[0086] (Appendix 2) When asset information consisting of records indicating each asset provided by the system, the type of each asset provided by the system, and communication information for identifying each asset provided by the system at the time of communication is generated based on communication data within the system, and post-exclusion asset information is generated in which records corresponding to each device that does not actually exist in the system are excluded from the asset information, The system model generating device further comprises: a type correction unit that corrects the type of one or more records in the post-exclusion asset information according to conversion rules that indicate each rule for correcting the type, sets a certainty corresponding to the accuracy of the corrected type for each corrected record, and sets each record for which the certainty has been set as a record in the equipment list; 2. The system model generating device according to claim 1, comprising:

[0087] (Appendix 3) The system model generating device further comprises: an exclusion unit that generates the excluded asset information by excluding one or more records from the asset information in accordance with exclusion rules that indicate rules for excluding records corresponding to assets that do not actually exist in the system; 3. The system model generating device according to claim 2, comprising:

[0088] (Appendix 4) In the device list, each record indicates one or more attributes corresponding to the device indicated by each record; The type correction unit calculating a judgment value corresponding to each type of candidate device type based on each attribute indicated by a target record, which is one of the records indicated by the device list; 4. The system model generating device according to claim 2, wherein the type of the target record is modified based on the calculation results of each judgment value, and the certainty is set for the target record.

[0089] (Appendix 5) The system model generating device further comprises: an attribute interpolation unit that interpolates attributes for one or more records in the device list according to interpolation rules that indicate rules for interpolating attributes for records; 5. The system model generating device according to claim 1, comprising:

[0090] (Appendix 6) The system model generating device further comprises: an association creating unit that creates information indicating associations regarding communication connections between devices in the system based on connection information indicating communication results within the system and the device list; 6. The system model generating device according to any one of appendices 1 to 5, comprising:

[0091] (Appendix 7) 7. The system model generating device according to claim 6, wherein the association creating unit creates information indicating that a switch exists between the devices as the information indicating the association.

[0092] (Appendix 8) 8. The system model generating device according to any one of appendices 1 to 7, wherein the system is an OT (Operational Technology) system. [Explanation of symbols]

[0093] 11 processor, 12 memory, 13 auxiliary storage device, 14 input / output IF, 15 communication device, 18 processing circuit, 19 signal line, 90 system model generation system, 100 system model generation device, 110 exclusion unit, 120 type correction unit, 130 certainty evaluation unit, 140 duplicate removal unit, 150 attribute interpolation unit, 160 equipment list management unit, 170 association creation unit, 180 association list management unit, 190 model creation unit.

Claims

1. A system model generation device that generates a system model indicating each device included in a system and a network within the system, When a device list is created based on communication data within the system, the list includes records indicating each device included in the system, the type of each device included in the system, communication information for identifying each device included in the system during communication, and certainty corresponding to the accuracy of the type of each device included in the system, a certainty evaluation unit that, when a duplicate record group consisting of a plurality of records corresponding to a target device exists in the device list, selects a record corresponding to a relatively high certainty from the duplicate record group; a duplicate removal unit that integrates communication information of each record other than the selected record with communication information of the duplicate record group and removes each record other than the selected record from the device list; A system model generating device comprising:

2. When asset information consisting of records indicating each asset provided by the system, the type of each asset provided by the system, and communication information for identifying each asset provided by the system at the time of communication is generated based on communication data within the system, and post-exclusion asset information is generated in which records corresponding to each device that does not actually exist in the system are excluded from the asset information, The system model generating device further comprises: a type correction unit that corrects the type of one or more records in the post-exclusion asset information according to conversion rules that indicate each rule for correcting the type, sets a certainty corresponding to the accuracy of the corrected type for each corrected record, and sets each record for which the certainty has been set as a record in the equipment list; The system model generating device according to claim 1 , comprising:

3. The system model generating device further comprises: an exclusion unit that generates the excluded asset information by excluding one or more records from the asset information in accordance with exclusion rules that indicate rules for excluding records corresponding to assets that do not actually exist in the system; The system model generating device according to claim 2 , comprising:

4. In the device list, each record indicates one or more attributes corresponding to the device indicated by the record, The type correction unit calculating a judgment value corresponding to each type of candidate device type based on each attribute indicated by a target record, which is one of the records indicated by the device list; 4. The system model generating device according to claim 2, wherein the type of the target record is modified based on the calculation results of each judgment value, and the certainty is set for the target record.

5. The system model generating device further comprises: an attribute interpolation unit that interpolates attributes for one or more records in the device list according to interpolation rules that indicate rules for interpolating attributes for records; The system model generating device according to claim 1 , further comprising:

6. The system model generating device further comprises: an association creating unit that creates information indicating associations regarding communication connections between devices in the system based on connection information indicating communication results within the system and the device list; The system model generating device according to claim 1 , further comprising:

7. The system model generating device according to claim 6 , wherein the association creating unit creates information indicating the presence of a switch between the devices as the information indicating the association.

8. 4. The system model generating device according to claim 1, wherein the system is an Operational Technology (OT) system.

9. 1. A system model generation method executed by a system model generation device, which is a computer that generates a system model indicating each device included in a system and a network within the system, comprising: When a device list is created based on communication data within the system, the list includes records indicating each device included in the system, the type of each device included in the system, communication information for identifying each device included in the system during communication, and certainty corresponding to the accuracy of the type of each device included in the system, the system model generation device, when a group of duplicate records consisting of a plurality of records corresponding to target devices exists in the device list, selects a record corresponding to a relatively high degree of certainty from the group of duplicate records; the system model generation device integrates communication information of each record other than a selected record into the communication information of the selected record for the group of duplicate records, and removes each record other than the selected record from the device list.

10. A system model generation program executed by a system model generation device, which is a computer that generates a system model indicating each device included in a system and a network within the system, comprising: When a device list is created based on communication data within the system, the list includes records indicating each device included in the system, the type of each device included in the system, communication information for identifying each device included in the system during communication, and certainty corresponding to the accuracy of the type of each device included in the system, a certainty evaluation process for selecting a record corresponding to a relatively high certainty from the duplicate record group when a duplicate record group consisting of a plurality of records corresponding to a target device exists in the device list; a duplicate removal process for integrating communication information of each record other than the selected record into communication information of the selected record for the group of duplicate records, and removing each record other than the selected record from the device list; a system model generating program that causes the system model generating device to execute the above;

Images