Incident detection device, model learning device, security log integrated monitoring system, incident detection method, model learning method, and program

Abstract

To provide an incident detection device for detecting abnormality based on a pattern whose appearance frequency is low.SOLUTION: An incident detection device includes a log acquisition unit that acquires a log of a monitoring control system of a power generation plant, a log classification unit that classifies the log based on an operation state of the monitoring control system, a feature amount calculation unit that calculates a value of a feature amount according to the operation state from the log classified by the log classification unit, and an incident detection unit that detects an abnormality of the monitoring control system based on the value of the feature amount according to the operation state.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an incident detection device, a model learning device, a security log integrated monitoring system, an incident detection method, a model learning method, and a program. [Background technology]

[0002] Some power plants, such as nuclear, thermal, and hydroelectric power plants, have an operating period during which the plant is in operation and an inspection period during which the plant is inspected. For example, a nuclear power plant has an operating period of 13 months and a one-month periodic inspection period. Maintenance such as equipment updates for the monitoring and control system that monitors and controls such power plants and the security log integrated monitoring system that monitors logs to ensure the security of the monitoring and control system must be carried out during the limited time of the periodic inspection period.

[0003] Patent Document 1 discloses a technology for monitoring unauthorized access to a network, which terminates learning when the required amount of learning data to be used for anomaly detection has been collected. The data processing device in this technology divides input data aggregated per unit time into predetermined regions, performs principal component analysis for each region to calculate features, classifies the features of each region into patterns, and terminates learning when the number of occurrences of the patterns converges. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2009-135649 Summary of the Invention [Problem to be solved by the invention]

[0005] However, the technique of Patent Document 1 has a problem in that it is not possible to learn patterns that appear infrequently, and therefore it may not be possible to perform anomaly detection based on such patterns.

[0006] The present disclosure has been made in consideration of these circumstances, and provides an incident detection device, a model learning device, an integrated security log monitoring system, an incident detection method, a model learning method, and a program that can detect anomalies based on patterns that appear infrequently. [Means for solving the problem]

[0007] This disclosure has been made to solve the above-mentioned problems, and one aspect of the present disclosure is an incident detection device that includes a log acquisition unit that acquires logs from a monitoring and control system of a power plant, a log classification unit that classifies the logs acquired by the log acquisition unit based on the operating state of the monitoring and control system, a feature calculation unit that calculates feature values ​​corresponding to the operating state from the logs classified by the log classification unit, and an incident detection unit that detects an abnormality in the monitoring and control system based on the feature values ​​corresponding to the operating state.

[0008] Another aspect of the present disclosure is the incident detection device described above, wherein the incident detection unit uses a model according to the operating state when detecting an abnormality in the monitoring and control system.

[0009] Another aspect of the present disclosure is the incident detection device described above, wherein the model according to the driving state is a model generated by machine learning using values ​​of feature quantities according to the driving state calculated from logs classified based on the driving state.

[0010] Another aspect of the present disclosure is the incident detection device described above, wherein the value of the feature is a value related to any one of successful logon, failed logon, successful logoff, policy change, authentication, execution history, and access history.

[0011] Another aspect of the present disclosure is a model learning device that includes a log classification unit that classifies logs of a monitoring and control system of a power plant based on the operating state of the monitoring and control system, a feature calculation unit that calculates feature values ​​corresponding to the operating state from the logs classified by the log classification unit, and a model learning unit that generates a model for detecting abnormalities in the monitoring and control system by machine learning using the feature values ​​corresponding to the operating state.

[0012] Another aspect of the present disclosure is the above-described model learning device, wherein the model learning unit generates a model according to the driving state.

[0013] Another aspect of the present disclosure is the above-described model learning device, including a model evaluation unit that evaluates the model using a log selected from the logs of the monitoring and control system.

[0014] Another aspect of the present disclosure is the model learning device described above, wherein the logs of the monitoring and control system include logs of equipment that is changed or added by updating the monitoring and control system.

[0015] Another aspect of the present disclosure is a security log integrated monitoring system comprising: a log acquisition unit that acquires logs of a monitoring and control system of a power plant; a first log classification unit that classifies the logs acquired by the log acquisition unit based on the operating state of the monitoring and control system; a first feature calculation unit that calculates feature values ​​corresponding to the operating state from the logs classified by the first log classification unit; an incident detection unit that detects an abnormality in the monitoring and control system based on the feature value corresponding to the operating state; a second log classification unit that classifies the logs based on the operating state of the monitoring and control system; a second feature calculation unit that calculates feature values ​​corresponding to the operating state from the logs classified by the second log classification unit; and a model learning unit that generates a model for detecting abnormalities in the monitoring and control system by machine learning using the feature values ​​corresponding to the operating state, wherein the incident detection unit uses the model generated by the model learning unit when detecting abnormalities in the monitoring and control system.

[0016] Another aspect of the present disclosure is an incident detection method including a first step of acquiring logs from a monitoring and control system of a power plant, a second step of classifying the logs acquired in the first step based on the operating state of the monitoring and control system, a third step of calculating values ​​of feature quantities corresponding to the operating state from the logs classified in the second step, and a fourth step of detecting an abnormality in the monitoring and control system based on the values ​​of feature quantities corresponding to the operating state.

[0017] Another aspect of the present disclosure is a model learning method including a first step of classifying logs of a monitoring and control system of a power plant based on the operating state of the monitoring and control system, a second step of calculating feature values ​​corresponding to the operating state from the logs classified in the first step, and a third step of generating a model for detecting abnormalities in the monitoring and control system by machine learning using the feature values ​​corresponding to the operating state.

[0018] Another aspect of the present disclosure is a program for causing a computer to function as a log acquisition unit that acquires logs from a monitoring and control system of a power plant, a log classification unit that classifies the logs acquired by the log acquisition unit based on the operating state of the monitoring and control system, a feature calculation unit that calculates feature values ​​corresponding to the operating state from the logs classified by the log classification unit, and an incident detection unit that detects abnormalities in the monitoring and control system based on the feature values ​​corresponding to the operating state.

[0019] Another aspect of the present disclosure is a program for causing a computer to function as a log classification unit that classifies logs of a monitoring and control system of a power plant based on the operating state of the monitoring and control system, a feature calculation unit that calculates feature values ​​corresponding to the operating state from the logs classified by the log classification unit, and a model learning unit that generates a model for detecting abnormalities in the monitoring and control system by machine learning using the feature values ​​corresponding to the operating state. [Effects of the Invention]

[0020] According to this disclosure, the incident detection device, model learning device, security log integrated monitoring system, incident detection method, model learning method, and program can detect anomalies based on patterns that appear infrequently. [Brief explanation of the drawings]

[0021] [Figure 1] 1 is a schematic block diagram showing an overview of a security log integrated monitoring system 10 according to an embodiment of the present disclosure. [Figure 2] 1 is a schematic block diagram showing the configuration of a security log integrated monitoring system 10 according to the embodiment. [Figure 3] 10 is a flowchart illustrating the operation of a model learning device 10b in the same embodiment. [Figure 4] 10 is a flowchart illustrating the operation of the incident detection device 10a in the embodiment. [Figure 5] 4 is a time chart illustrating the operation of the security log integrated monitoring system 10 in the embodiment. [Figure 6] FIG. 2 is an explanatory diagram illustrating the hardware configuration of each device according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0022] Hereinafter, an embodiment of the present disclosure will be described with reference to the drawings. FIG. 1 is a schematic block diagram showing an overview of a security log integrated monitoring system 10 according to an embodiment of the present disclosure. The security log integrated monitoring system 10 acquires log data from monitoring and control systems 20 of power plants such as nuclear, thermal, and hydroelectric power plants, and performs anomaly detection (detection of security-related incidents) related to these systems. The security log integrated monitoring system 10 includes a log maintenance function, a rule-based log monitoring function, an incident detection function using a machine learning model, event ticket management, a reporting function, an audit support function, a response plan function, and the like.

[0023] The monitoring and control system 20 is a system that monitors and controls a power plant. The monitoring and control system 20 includes a computer 21, an OPS (operator station) 22, a PC (personal computer) 23, and NW (network) security equipment 24. The computer 21 forms a dual system and performs automatic control of the power plant and inputs data to and from instruments and other devices in the power plant. The OPS 22 is a human-machine interface device for monitoring and controlling the power plant. The PC 23 is a personal computer. The NW security equipment 24 is a security device such as a firewall that is placed on a network that communicatively connects the computer 21, the OPS 22, and the PC 23. Although FIG. 1 shows one computer 21, one OPS 22, one PC 23, and one NW security equipment 24, multiple units may be used. In addition, the monitoring and control system 20 may include network / security equipment such as a firewall, an IDS (Intrusion Detection System), an IPS (Intrusion Prevention System), a router, and a switch, and may also include server / application / device equipment such as a web server, a proxy server, a DHCP (Dynamic Host Configuration Protocol) server, a database, an application server, and a security camera.

[0024] FIG. 2 is a schematic block diagram showing the configuration of integrated security log monitoring system 10 according to this embodiment. The configuration shown in FIG. 2 is a configuration related to the incident detection function of integrated security log monitoring system 10. Integrated security log monitoring system 10 includes incident detection device 10a and model learning device 10b. Incident detection device 10a and model learning device 10b may each be realized by one or more computers reading and executing a program. Furthermore, part or all of incident detection device 10a and part or all of model learning device 10b may be realized by a single computer reading and executing a program.

[0025] The incident detection device 10a includes a log acquisition unit 11, a first log classification unit 12 (log classification unit), a first feature calculation unit 13 (feature calculation unit), and an incident detection unit 14. The log acquisition unit 11 acquires logs of the monitoring and control system 20. These logs may include logs generated by the OS, middleware, and applications of each device that constitutes the monitoring and control system 20. The first log classification unit 12 classifies the logs acquired by the log acquisition unit 11 based on the operating status of the monitoring and control system 20.

[0026] The operating state of the monitoring and control system 20 may be, for example, during system switching of a device constituting a dual system, such as the computer 21, or during a certain period after system switching, while an operator or maintenance personnel is accessing the monitoring and control system 20, or during a certain period after access begins, while the line load of the network of the monitoring and control system 20 is within a predetermined range. Furthermore, when the monitoring and control system 20 corresponds to multiple operating states, the operating state may be classified into the operating state with the highest predetermined priority, or each of the multiple operating states may be classified. The first log classification unit 12 may determine these states based on the logs acquired by the log acquisition unit 11. The operating state to be determined (classified) is the same as that determined by the second log classification unit 16 described later, and may be the operating state set by the operator when generating a model used by the incident detection unit 14.

[0027] The first feature amount calculation unit 13 calculates a value of a feature amount corresponding to the operating state of the monitoring and control system 20 from the log classified by the first log classification unit 12. The first feature amount calculation unit 13 may calculate values ​​of multiple feature amounts. The log used to calculate the value of the feature amount may be a log for a period of time corresponding to the operating state of the monitoring and control system 20. The value of the feature amount is, for example, a value (e.g., number of times, frequency) related to logon success or failure, logoff success, policy change, authentication, execution history of processes, etc., access history, etc. The correspondence between the operating state and the calculated feature amount value is the same as that of the second feature amount calculation unit 17 described later, and may be a correspondence relationship set by an operator when generating a model used by the incident detection unit 14.

[0028] The incident detection unit 14 detects an abnormality (security-related incident) in the monitoring and control system 20 based on the value of the feature quantity corresponding to the operating state calculated by the first feature quantity calculation unit 13. When detecting an abnormality, the incident detection unit 14 notifies the operator of the detection of the abnormality by displaying on a screen or the like. Note that the incident detection unit 14 may use a model corresponding to the operating state when detecting an abnormality in the monitoring and control system 20. Furthermore, the model may be a model generated by machine learning in the model learning device 10b using the value of the feature quantity corresponding to the operating state calculated from logs classified based on the operating state.

[0029] The model learning device 10b includes a log storage unit 15, a second log classification unit 16 (log classification unit), a second feature calculation unit 17 (feature calculation unit), a model learning unit 18, and a model evaluation unit 19. The log storage unit 15 stores the logs acquired by the log acquisition unit 11. The log storage unit 15 is configured by a non-volatile memory such as a hard disk drive, a magneto-optical disk drive, or a flash memory, a volatile memory such as a RAM (Random Access Memory), or a combination of these. The second log classification unit 16 classifies the logs stored in the log storage unit 15 based on the operating state of the monitoring and control system 20. The method of determining the operating state and the operating state to be determined are the same as those of the first log classification unit 12, but the determination method and the operating state may be set by an operator.

[0030] The second feature quantity calculation unit 17 calculates the value of a feature quantity corresponding to the operating state of the monitoring and control system 20 from the log classified by the second log classification unit 16. The second feature quantity calculation unit 17 may calculate the values ​​of a plurality of feature quantities. The log used to calculate the value of the feature quantity may be a log for a period of time whose length corresponds to the operating state of the monitoring and control system 20. The value of the feature quantity is the same as that of the first feature quantity calculation unit 13. The correspondence between the operating state and the value of the calculated feature quantity may be a correspondence relationship set by an operator.

[0031] The model learning unit 18 generates a model for detecting an abnormality in the monitoring and control system 20 by machine learning using the values ​​of the feature quantities corresponding to the operating state calculated by the second feature quantity calculation unit 17. The model learning unit 18 may generate a model corresponding to the operating state, that is, may generate a model for each operating state. The generation of a model corresponding to each operating state may be performed by machine learning using the values ​​of the feature quantities corresponding to the operating state. This machine learning may be, for example, a one-class support vector machine (SVM). That is, the second log classification unit 16 may extract and classify only normal logs (logs in which no abnormality is detected) from the log storage unit 15. The logs extracted by the second log classification unit 16 may be logs from a period specified by an operator or a period excluding the period specified by the operator (the period in which an abnormality is detected).

[0032] The model evaluation unit 19 evaluates the model generated by the model learning unit 18 using a log selected from the logs stored in the log storage unit 15. The selected log is correct answer data (a log in which an abnormality should be detected) and may be a log from a period specified by an operator, or may be a log prepared in advance as correct answer data rather than a log generated by the monitoring and control system 20. In other words, the model evaluation unit 19 inputs a log in which an abnormality should be detected into the model generated by the model learning unit 18 and evaluates the model based on whether or not the model detects an abnormality. Depending on the result of the evaluation by the model evaluation unit 19, at least some of the log classification, feature calculation, and model generation by the second log classification unit 16, the second feature calculation unit 17, and the model learning unit 18 may be repeated by changing any of the settings. The repetition may be performed only for models of operating states in which no abnormality was detected even when correct answer data was input.

[0033] FIG. 3 is a flowchart illustrating the operation of the model learning device 10b according to this embodiment. First, the second log classification unit 16 of the model learning device 10b selects a normal log from the logs stored in the log storage unit 15 (step Sa1). Next, the second log classification unit 16 classifies the logs selected in step Sa1 according to the operating state of the monitoring and control system 20 (step Sa2). Next, the second feature calculation unit 17 of the model learning device 10b calculates feature values ​​according to the classification (operating state) of the log classified in step Sa2 (step Sa3). Next, the model learning unit 18 of the model learning device 10b uses the feature values ​​calculated in step Sa3 to generate a model according to the classification in step Sa2 (step Sa4). Next, the model evaluation unit 19 of the model learning device 10b evaluates the model generated in step Sa4 using the log of correct data from the logs stored in the log storage unit 15 (step Sa5). Depending on the evaluation result, steps starting from Sa1 may be repeated.

[0034] FIG. 4 is a flowchart illustrating the operation of the incident detection device 10a according to this embodiment. First, the log acquisition unit 11 of the incident detection device 10a acquires logs from the monitoring and control system 20 (step Sb1). Next, the first log classification unit 12 of the incident detection device 10a classifies the logs acquired in step Sb1 according to the operating state of the monitoring and control system 20 (step Sb2). This classification of the logs according to the operating state may be performed every predetermined period, or the operating state may be changed each time a predetermined log is detected. Next, the first feature calculation unit 13 of the incident detection device 10a calculates feature values ​​according to the classification (operating state) of the logs classified in step Sb2 (step Sb3). Next, the incident detection unit 14 of the incident detection device 10a uses the feature values ​​calculated in step Sb3 to determine the occurrence of an abnormality using a model according to the classification in step Sb2 (step Sb4). If an abnormality has occurred, the incident detection unit 14 notifies an operator.

[0035] FIG. 5 is a time chart illustrating the operation of the security log integrated monitoring system 10 according to this embodiment. Periods P1, P2, and P3 are operating periods of the power plant, and periodic inspections T2 and T3 are periods during which the power plant undergoes regular inspections. During period P2, the incident detection device 10a performs anomaly detection using a model based on logs from period P1, which is the operating period immediately preceding period P2. During period P2, the model learning device 10b selects logs from period P2 and generates a model by learning the logs from period P2. Note that, when generating this model, the model learning device 10b may use logs from the equipment (devices) of the monitoring and control system 20 to be updated during period P3. That is, the second log classification unit 16 may classify the logs, the second feature calculation unit 17 may calculate feature values ​​according to the classification, and the model learning unit 18 may generate a model using the feature values. The equipment of the monitoring and control system 20 to be updated in the period P3 is equipment of the monitoring and control system 20 that has been changed or added due to maintenance work during the periodic inspection T2, and that will be used in the period P3. The logs of the equipment of the monitoring and control system 20 may be generated by prior testing of the equipment, or may be logs assumed based on the specifications of the equipment.

[0036] Furthermore, during period P3, model learning device 10b acquires supervised data for evaluating the model from log storage unit 15. Model learning device 10b performs a first evaluation (primary evaluation) of the learned model using this supervised data. During period P3, these log selection, log learning, and first evaluation of the model may be repeated. Furthermore, in the periodic inspection T2, the model learning device 10b may perform a second evaluation (overall evaluation) of the model generated in the period P2 using the correct answer data.

[0037] During period P3, the incident detection device 10a performs anomaly detection using a model based on the logs from period P2. Also during period P3, the model learning device 10b selects logs from period P3, generates a model by learning the logs from period P3, and performs a first evaluation. Then, during regular inspection T3, the model learning device 10b may perform a second evaluation of the model generated during period P3 using the correct answer data.

[0038] In this way, model learning device 10b classifies logs according to the operating state of monitoring and control system 20 and uses them for model learning, so that logs to be used for model learning can be selected so that they include patterns with low occurrence frequency in parallel with the operation of the power plant during the operating period, rather than during the short period of regular inspection. Therefore, incident detection device 10a can detect anomalies based on patterns with low occurrence frequency.

[0039] FIG. 6 is an explanatory diagram illustrating the hardware configuration of each device according to this embodiment. The devices are an incident detection device 10a and a model learning device 10b. Each device includes an input / output module I, a memory module M, and a control module P. The input / output module I is implemented by including some or all of the communication module H11, connection module H12, pointing device H21, keyboard H22, display H23, button H3, microphone H41, speaker H42, camera H51, or sensor H52. The memory module M is implemented by including a drive H7. The memory module M may further be configured by including some or all of memory H8. The control module P is implemented by including memory H8 and a processor H9. These hardware components are connected to each other so as to be able to communicate with each other via a bus, and are supplied with power from a power supply H6.

[0040] The connection module H12 is a digital input / output port such as a USB (Universal Serial Bus). The pointing device H21, keyboard H22, and display H23 may be touch panels. The sensor H52 may be an acceleration sensor, a gyro sensor, a GPS receiver module, a proximity sensor, or the like. The power supply H6 is a power supply unit that supplies the electricity necessary to operate each device. The power supply H6 may be a battery. The drive H7 is an auxiliary storage medium such as a hard disk drive or a solid-state drive. The drive H7 may be a non-volatile memory such as an EEPROM or a flash memory, or a magneto-optical disk drive or a flexible disk drive. The drive H7 is not limited to being built into each device, but may also be an external storage device connected to the connector of the connection module H12. The memory H8 is a main storage medium such as a random access memory. The memory H8 may be a cache memory. The memory H8 stores instructions when executed by one or more processors H9. The processor H9 is a CPU (Central Processing Unit). The processor H9 may be an MPU (microprocessing unit) or a GPU (graphics processing unit). The processor H9 reads programs and various data from the drive H7 via the memory H8 and performs calculations to execute instructions stored in one or more memories H8.

[0041] The input / output module I is used in the incident detection device 10a, the model learning device 10b, etc. The control module P is used to implement each part of the incident detection device 10a and the model learning device 10b. Note that in this specification and the like, the terms "incident detection device 10a" and "model learning device 10b" may be replaced with the term "control module P."

[0042] The present disclosure may be embodied as follows. (1) One embodiment of the present disclosure is an incident detection device that includes a log acquisition unit that acquires logs from a monitoring and control system of a power plant; a log classification unit that classifies the logs acquired by the log acquisition unit based on the operating state of the monitoring and control system; a feature calculation unit that calculates a value of a feature corresponding to the operating state from the logs classified by the log classification unit; and an incident detection unit that detects an abnormality in the monitoring and control system based on the value of the feature corresponding to the operating state.

[0043] This allows the incident detection device to detect anomalies based on log patterns that appear infrequently.

[0044] (2) Another embodiment of the present disclosure is the incident detection device described in (1), wherein the incident detection unit uses a model corresponding to the operating state when detecting an abnormality in the monitoring and control system.

[0045] This allows the incident detection device to change the model used for abnormality detection depending on the driving state.

[0046] (3) Another embodiment of the present disclosure is the incident detection device described in (2), wherein the model according to the driving state is a model generated by machine learning using values ​​of feature quantities according to the driving state calculated from logs classified based on the driving state.

[0047] This allows the incident detection device to use machine-learned models for anomaly detection for each driving state.

[0048] (4) Another embodiment of the present disclosure is an incident detection device described in any one of (1) to (3), wherein the value of the feature is a value related to one of successful logon, failed logon, successful logoff, policy change, authentication, execution history, and access history.

[0049] This allows the incident detection device to detect anomalies based on any of successful logon, failed logon, successful logoff, policy change, authentication, execution history, and access history.

[0050] (5) Another embodiment of the present disclosure is a model learning device including: a log classification unit that classifies logs of a monitoring and control system of a power plant based on an operating state of the monitoring and control system; a feature calculation unit that calculates feature values ​​corresponding to the operating state from the logs classified by the log classification unit; and a model learning unit that generates a model for detecting an abnormality in the monitoring and control system by machine learning using the feature values ​​corresponding to the operating state.

[0051] As a result, the model generated by the model learning device can detect anomalies based on log patterns that appear infrequently.

[0052] (6) Another embodiment of the present disclosure is the model learning device according to (5), wherein the model learning unit generates a model according to the driving state.

[0053] This allows the model learning device to generate a model according to the driving state.

[0054] (7) Another embodiment of the present disclosure is a model learning device according to (5) or (6), which includes a model evaluation unit that evaluates the model using a log selected from the logs of the monitoring and control system.

[0055] This allows the model learning device to evaluate the model generated based on normal logs.

[0056] (8) Another embodiment of the present disclosure is a model learning device described in any one of (5) to (7), wherein the logs of the monitoring and control system include logs of equipment that is changed or added by updating the monitoring and control system.

[0057] This allows the model learning device to generate a model before changing or adding equipment to the monitoring and control system.

[0058] (9) Another embodiment of the present disclosure is a security log integrated monitoring system including: a log acquisition unit that acquires logs of a monitoring and control system of a power plant; a first log classification unit that classifies the logs acquired by the log acquisition unit based on an operating state of the monitoring and control system; a first feature calculation unit that calculates a value of a feature according to the operating state from the logs classified by the first log classification unit; an incident detection unit that detects an abnormality in the monitoring and control system based on the value of the feature according to the operating state; a second log classification unit that classifies the logs based on the operating state of the monitoring and control system; a second feature calculation unit that calculates a value of a feature according to the operating state from the logs classified by the second log classification unit; and a model learning unit that generates a model for detecting an abnormality in the monitoring and control system by machine learning using the value of the feature according to the operating state, wherein the incident detection unit uses the model generated by the model learning unit when detecting an abnormality in the monitoring and control system.

[0059] (10) Another embodiment of the present disclosure is an incident detection method including a first step of acquiring logs from a monitoring and control system of a power plant; a second step of classifying the logs acquired in the first step based on an operating state of the monitoring and control system; a third step of calculating values ​​of feature quantities corresponding to the operating state from the logs classified in the second step; and a fourth step of detecting an abnormality in the monitoring and control system based on the values ​​of feature quantities corresponding to the operating state.

[0060] (11) Another embodiment of the present disclosure is a model learning method including a first step of classifying logs of a monitoring and control system of a power plant based on an operating state of the monitoring and control system, a second step of calculating values ​​of feature quantities corresponding to the operating state from the logs classified in the first step, and a third step of generating a model for detecting an abnormality in the monitoring and control system by machine learning using the values ​​of feature quantities corresponding to the operating state.

[0061] (12) Another embodiment of the present disclosure is a program for causing a computer to function as a log acquisition unit that acquires logs from a monitoring and control system of a power plant, a log classification unit that classifies the logs acquired by the log acquisition unit based on the operating state of the monitoring and control system, a feature calculation unit that calculates feature values ​​corresponding to the operating state from the logs classified by the log classification unit, and an incident detection unit that detects an abnormality in the monitoring and control system based on the feature values ​​corresponding to the operating state.

[0062] (13) Another embodiment of the present disclosure is a program for causing a computer to function as a log classification unit that classifies logs of a monitoring and control system of a power plant based on the operating state of the monitoring and control system, a feature calculation unit that calculates feature values ​​corresponding to the operating state from the logs classified by the log classification unit, and a model learning unit that generates a model for detecting abnormalities in the monitoring and control system through machine learning using the feature values ​​corresponding to the operating state.

[0063] 1 and 2, the integrated security log monitoring system 10, the incident detection device 10a, and the model learning device 10b may be realized by recording a program for realizing the functions of the integrated security log monitoring system 10, the incident detection device 10a, and the model learning device 10b on a computer-readable recording medium, and reading and executing the program recorded on the recording medium into a computer system. Note that the term "computer system" here includes hardware such as an OS and peripheral devices.

[0064] Furthermore, if a WWW system is used, the "computer system" also includes the homepage provision environment (or display environment). "Computer-readable recording media" refers to portable media such as flexible disks, optical magnetic disks, ROMs, and CD-ROMs, as well as storage devices such as hard disks built into computer systems. Furthermore, "computer-readable recording media" also includes devices that dynamically store programs for a short period of time, such as communication lines used when transmitting programs over networks like the Internet or over communication lines like telephone lines, and devices that store programs for a fixed period of time, such as volatile memory within computer systems that serve as servers or clients. The programs may also be programs that implement some of the aforementioned functions, or may be programs that can realize the aforementioned functions in combination with programs already stored in the computer system.

[0065] The embodiments of this disclosure have been described in detail above with reference to the drawings, but the specific configuration is not limited to this embodiment, and design changes and the like are also included within the scope that does not deviate from the gist of this disclosure. [Explanation of symbols]

[0066] 10. Integrated Security Log Monitoring System 10a Incident detection device 10b Model learning device 11 Log acquisition section 12 First log classification section 13 First feature calculation unit 14 Incident detection unit 15 Log storage unit 16 Second Log Classification Unit 17 Second feature calculation unit 18 Model Learning Department 19 Model Evaluation Department 20 Monitoring and Control Systems 21 Calculator 22 OPS 23 PC 24 Network security equipment

Claims

1. a log acquisition unit that acquires logs of a monitoring and control system of a power plant; a log classification unit that classifies the logs acquired by the log acquisition unit based on an operating state of the monitoring and control system; a feature value calculation unit that calculates a feature value corresponding to the driving state from the log classified by the log classification unit; an incident detection unit that detects an abnormality in the monitoring and control system based on a value of a feature quantity corresponding to the operating state; An incident detection device comprising:

2. The incident detection device according to claim 1 , wherein the incident detection unit uses a model according to the operating state when detecting an abnormality in the monitoring and control system.

3. The incident detection device according to claim 2, wherein the model according to the driving state is a model generated by machine learning using values ​​of features according to the driving state calculated from logs classified based on the driving state.

4. The incident detection device according to claim 1 , wherein the value of the feature is a value related to any one of successful logon, unsuccessful logon, successful logoff, policy change, authentication, execution history, and access history.

5. a log classification unit that classifies logs of a monitoring and control system of a power plant based on an operating state of the monitoring and control system; a feature value calculation unit that calculates a feature value corresponding to the driving state from the log classified by the log classification unit; a model learning unit that generates a model for detecting an abnormality in the monitoring and control system by machine learning using values ​​of feature quantities according to the operating state; A model learning device comprising:

6. The model learning device according to claim 5 , wherein the model learning unit generates a model according to the driving state.

7. The model learning device according to claim 5 , further comprising a model evaluation unit that evaluates the model using a log selected from the logs of the monitoring and control system.

8. The model learning device according to claim 5 , wherein the logs of the monitoring and control system include logs of equipment that are changed or added by updating the monitoring and control system.

9. a log acquisition unit that acquires logs of a monitoring and control system of a power plant; a first log classification unit that classifies the logs acquired by the log acquisition unit based on an operating state of the monitoring and control system; a first feature amount calculation unit that calculates a value of a feature amount corresponding to the driving state from the log classified by the first log classification unit; an incident detection unit that detects an abnormality in the monitoring and control system based on a value of a feature quantity corresponding to the operating state; a second log classification unit that classifies the logs based on an operating state of the monitoring and control system; a second feature amount calculation unit that calculates a value of a feature amount corresponding to the driving state from the log classified by the second log classification unit; a model learning unit that generates a model for detecting an abnormality in the monitoring and control system by machine learning using values ​​of feature quantities according to the operating state; Equipped with The incident detection unit uses the model generated by the model learning unit when detecting an abnormality in the monitoring and control system. Integrated security log monitoring system.

10. A first step of acquiring a log of a monitoring and control system of a power plant; a second step of classifying the logs acquired in the first step based on an operating state of the monitoring and control system; a third step of calculating a value of a feature quantity according to the driving state from the log classified in the second step; a fourth step of detecting an abnormality in the monitoring and control system based on the value of the feature quantity corresponding to the operating state; An incident detection method comprising:

11. A first step of classifying logs of a monitoring and control system of a power plant based on an operating state of the monitoring and control system; a second step of calculating a value of a feature quantity according to the driving state from the log classified in the first step; a third step of generating a model for detecting an abnormality in the monitoring and control system by machine learning using the values ​​of the feature quantities according to the operating state; A model learning method having

12. Computer, a log acquisition unit that acquires logs from a monitoring and control system of a power plant; a log classification unit that classifies the logs acquired by the log acquisition unit based on an operating state of the monitoring and control system; a feature value calculation unit that calculates a feature value corresponding to the driving state from the log classified by the log classification unit; an incident detection unit that detects an abnormality in the monitoring and control system based on a value of a feature quantity corresponding to the operating state; A program to function as a

13. Computer, a log classification unit that classifies logs of a monitoring and control system of a power plant based on an operating state of the monitoring and control system; a feature value calculation unit that calculates a feature value corresponding to the driving state from the log classified by the log classification unit; a model learning unit that generates a model for detecting an abnormality in the monitoring and control system by machine learning using values ​​of feature quantities according to the operating state; A program to function as a

Images