Anomaly detection device, anomaly detection method, and anomaly detection program

Abstract

The challenge is to efficiently detect anomalies on a circuit board equipped with digital circuits at locations other than the designated observation points, and to estimate the location where the anomaly occurred. [Solution] The observation results from node N1 are input to the predictor M1, which then predicts the observation results from node N2. The predictor M1 is a trained model that has been trained using a dataset where the observation results from node N1 are input data and the observation results from node N2 are output data. The anomaly score is calculated using the prediction results from predictor M1 and the observation results from node N2, and if this anomaly score is above a predetermined threshold, it is determined to be an anomaly.

Description

[Technical Field]

[0001] The present invention relates to an anomaly detection device, an anomaly detection method, and an anomaly detection program that can efficiently detect anomalies at locations other than observation points on a circuit board equipped with a digital circuit. [Background technology]

[0002] Traditionally, there have been known malicious techniques that involve applying an unauthorized voltage to the power supply of a board equipped with an IC (Integrated Circuit) chip, causing the circuit to malfunction, reading internal signals such as power supply noise, and extracting encryption keys.

[0003] For example, Patent Document 1 discloses a technique for detecting anomalies by using a neural network (autoencoder) whose parameters have been trained so that the inputs and outputs match, and by utilizing the property that it does not reproduce input data that has not been used for training.

[0004] Furthermore, Patent Document 2 discloses a technique for calculating the cross-correlation value between a first noise waveform and a received second noise waveform, and determining that an abnormal state exists if the calculated cross-correlation value exceeds a predetermined threshold when compared to past cross-correlation values. [Prior art documents] [Patent Documents]

[0005] [Patent Document 1] Japanese Patent Publication No. 2023-47970 [Patent Document 2] Japanese Patent Publication No. 2022-188548 [Overview of the Initiative] [Problems that the invention aims to solve]

[0006] However, according to the above Patent Document 1, although abnormalities near a single observation point can be detected, abnormalities at points where there is no observation point cannot be detected. Further, the device of the above Patent Document 2 cannot detect abnormalities at points other than the observation points of the second noise waveform.

[0007] The present invention has been made to solve the above problems (issues) of the prior art, and an object thereof is to provide an abnormality detection device, an abnormality detection method, and an abnormality detection program that can efficiently detect abnormalities at points other than the observation points of a substrate on which a digital circuit is mounted and can estimate the location where the abnormality has occurred.

Means for Solving the Problem

[0008] To solve the above problems, the present invention provides an abnormality detection device that provides observation points on a substrate on which a digital circuit is mounted and detects an abnormality occurring in the substrate based on the observation results at the observation points, the device comprising: an abnormality degree calculation means for calculating an abnormality degree based on the correlation relationship of the observation results at a plurality of observation points provided on the substrate; and an abnormality determination means for determining whether an abnormality has occurred based on the abnormality degree calculated by the abnormality degree calculation means.

[0009] Further, in the above invention, the abnormality degree calculation means includes: a first observation result acquisition means for acquiring a first observation result obtained from an event observable at a first observation point; a second observation acquisition means for acquiring a second observation result obtained from an event observable at a second observation point different from the first observation point; a correlation relationship learning means for learning the correlation relationship between the first observation result and the second observation result during normal operation; and an abnormality degree calculation means for calculating an abnormality degree from the first observation result, the second observation result, and the correlation relationship learned by the correlation relationship learning means.

[0010] Further, in the above invention, the correlation relationship learning means is characterized by including a first autoencoder that outputs a second observation prediction result when the first observation result during normal operation is input.

[0011] Further, in the present invention, in the above invention, the abnormality degree calculation means calculates a first abnormality degree based on an error between the second observation prediction result output from the first autoencoder and the second observation result observed at the second observation point.

[0012] Further, in the present invention, in the above invention, the correlation relationship learning means further includes a second autoencoder that outputs a first observation prediction result when the second observation result in a normal state is input.

[0013] Further, in the present invention, in the above invention, the abnormality degree calculation means calculates a first abnormality degree based on an error between the second observation prediction result output from the first autoencoder and the second observation result observed at the second observation point, and calculates a second abnormality degree based on an error between the first observation prediction result output from the second autoencoder and the first observation result observed at the first observation point.

[0014] Further, in the present invention, in the above invention, when it is determined by the abnormality determination means that an abnormality has occurred, it further includes notification means for notifying the fact.

[0015] Further, in the present invention, in the above invention, when it is determined by the abnormality determination means that an abnormality has occurred at a plurality of observation points, it further includes position specifying means for specifying the position where the abnormality has occurred based on the position information of the plurality of observation points where the abnormality has been detected.

[0016] Furthermore, the present invention relates to an anomaly detection method for an anomaly detection device that provides observation points on a substrate on which a digital circuit is mounted and detects an anomaly occurring on the substrate based on the observation results at the observation points, characterized in that it includes an anomaly degree calculation step of calculating the degree of anomaly based on the correlation of observation results at a plurality of observation points provided on the substrate, and an anomaly determination step of determining whether or not an anomaly has occurred based on the degree of anomaly calculated in the anomaly degree calculation step.

[0017] Furthermore, the present invention relates to an anomaly detection program executed in an anomaly detection device that provides observation points on a circuit board on which a digital circuit is mounted and detects an anomaly occurring on the circuit board based on the observation results at the observation points, characterized in that the program causes a computer to execute an anomaly degree calculation procedure that calculates the degree of anomaly based on the correlation of observation results at a plurality of observation points provided on the circuit board, and an anomaly determination procedure that determines whether or not an anomaly has occurred based on the degree of anomaly calculated by the anomaly degree calculation procedure. [Effects of the Invention]

[0018] According to the present invention, anomalies outside of observation points can be efficiently detected. Furthermore, the location where the anomaly occurred can be efficiently estimated. [Brief explanation of the drawing]

[0019] [Figure 1] Figure 1 is an explanatory diagram (part 1) of the anomaly detection device according to the embodiment. [Figure 2] Figure 2 is an explanatory diagram (part 2) of the anomaly detection device according to the embodiment. [Figure 3] Figure 3 is a functional block diagram showing the configuration of an IC chip having an anomaly detection device according to an embodiment. [Figure 4] Figure 4 is a functional block diagram showing the configuration of the anomaly detection circuit shown in Figure 3. [Figure 5] Figure 5 is a functional block diagram showing the configuration of the noise analysis circuit shown in Figure 4. [Figure 6]Figure 6 is a timing chart for measuring the noise waveform in the noise measurement circuit shown in Figure 4. [Figure 7] Figure 7 shows the structure of an autoencoder. [Figure 8] Figure 8 shows the noise waveform in the corresponding IC chip according to the embodiment. [Figure 9] Figure 9 shows an example of determining the degree of abnormality according to this embodiment. [Figure 10] Figure 10 shows an example of estimating an abnormal location according to the embodiment. [Figure 11] Figure 11 shows an example of estimating the abnormal location related to Modification Example 1. [Figure 12] Figure 12 shows an overview of the predictor according to Modification 1. [Figure 13] Figure 13 shows an example of estimating the abnormal location related to Modification Example 2. [Figure 14] Figure 14 shows an overview of the predictor according to Modification 2. [Modes for carrying out the invention]

[0020] [Embodiment] The embodiments of the anomaly detection device, anomaly detection method, and anomaly detection program according to this embodiment will be described in detail below with reference to the drawings.

[0021] <Overview of the abnormality detection device according to the embodiment> First, an overview of the anomaly detection device according to this embodiment will be described. Figures 1 and 2 are explanatory diagrams illustrating the overview of the anomaly detection device according to this embodiment.

[0022] As shown in Figure 1, the anomaly detection device according to this embodiment has multiple observation means associated with it. Here, nodes N1 and N2 shown in Figure 1 are assumed to be observation means.

[0023] By inputting the observation results from node N1 into predictor M1, the observation results from node N2 are predicted. This predictor M1 is a pre-trained model that has been trained using a dataset where the observation results from observation point (hereinafter referred to as "node") N1 are input data and the observation results from node N2 are output data.

[0024] The degree of anomaly is calculated using the prediction results from predictor M1 and the observation results from node N2. If this degree of anomaly exceeds a predetermined threshold, it is determined to be an anomaly.

[0025] Here, we have shown a case where the observation results from node N1 are input to predictor M1 to predict the observation results from node N2, and the degree of anomaly is calculated using the prediction results from predictor M1 and the observation results from node N2. However, it is also possible to configure the system to perform mutual monitoring through bidirectional prediction by inputting the observation results from node N2 to another predictor M2 to predict the observation results from node N1, and then calculating the degree of anomaly using the prediction results from predictor M2 and the observation results from node N1.

[0026] Furthermore, the anomaly detection device estimates the location where the anomaly is occurring by using multiple corresponding observation means. For example, as shown in Figure 2, the degree of anomaly in the path between node N0 and node N1, which are observation means, is d 01 The anomaly of the path between node N0 and node N2 is d 02 In that case, d 01 and d 02 If both are determined to be abnormal, it is presumed that an abnormality has occurred in the region enclosed by nodes N0, N1, and N2.

[0027] Thus, the anomaly detection device according to this embodiment can detect anomalies between multiple observation means by using the observation results of multiple observation means and a trained model, which is a predictor, that predicts the observation result of one observation from the observation result of another. Specifically, the correlation relationship under normal conditions between multiple observation means is learned, and an abnormal state can be detected based on the disturbance in the learned correlation relationship. Furthermore, by using the anomaly detection results of multiple observation means, the location where the anomaly is occurring can be estimated.

[0028] <Configuration of an IC chip having an abnormality detection device according to an embodiment> Next, the configuration of the IC chip having the anomaly detection device according to this embodiment will be described. Figure 3 is a functional block diagram showing the configuration of the IC chip having the anomaly detection device according to this embodiment.

[0029] As shown in Figure 3, IC chips 1A and 1B are mounted on an interposer 40. The interposer 40 is a board used to widen the spacing between the input / output terminals of the IC chips, which are arranged at fine intervals, so that they can be mounted on a printed circuit board. IC chips 1A and 1B are connected to a common power line L1 and a noise waveform data sharing bus B1 implemented on the interposer 40. The malicious circuit 80 is connected to node N3 of the common power line L1 of the interposer 40.

[0030] IC chip 1A includes a digital circuit 10A, an anomaly detection circuit 20A, and a power supply circuit 30A. The digital circuit 10A is a circuit that can be used in tablet devices, wearable devices, drone devices, or IoT terminals. The digital circuit 10A may also include encryption and decryption circuits to enhance signal confidentiality. IC chip 1B includes a digital circuit 10B, an anomaly detection circuit 20B, and a power supply circuit 30B.

[0031] The anomaly detection circuit 20A of IC chip 1A measures and stores a first noise waveform of the power supply voltage of the digital circuit 10A and the power supply circuit 30A when the digital circuit 10A performs a predetermined operation. It then predicts and stores the noise waveform at the node corresponding to node N1. Hereinafter, this predicted noise waveform will be referred to as the "predicted noise waveform".

[0032] The anomaly detection circuit 20A receives a second noise waveform measured when the digital circuit 10A performs a predetermined operation in the anomaly detection circuit 20B of the IC chip 1B, via the noise waveform data sharing bus B1, and calculates the degree of anomaly using the predicted noise waveform and the received second noise waveform. If the degree of anomaly is above a predetermined threshold, it is determined to be an anomaly.

[0033] Specifically, we will describe the detection of abnormalities in the common power line L1 that supplies power to the power circuits 30A and 30B of IC chip 1A and IC chip 1B. IC chip 1A and IC chip 1B are powered by the common power line L1 on the interposer 40, which supplies power to their respective power circuits 30A and 30B. The abnormality detection circuit 20A measures and stores a first noise waveform at node N1 on the common power line L1 of power circuit 30A when the digital circuit 10A is performing a predetermined operation. Then, by inputting this first noise waveform to the predictor M1, the circuit predicts and stores the noise waveform at node N2, which is the node corresponding to node N1.

[0034] The abnormality detection circuit 20B of the IC chip 1B measures and stores a second noise waveform at node N2 on the common power line L1 of the power supply circuit 30B when the digital circuit 10A is performing a predetermined operation.

[0035] Subsequently, the anomaly detection circuit 20A receives the second noise waveform of node N2, which is stored in the anomaly detection circuit 20B, via the noise waveform data sharing bus B1, and calculates the degree of anomaly using the predicted noise waveform stored in the anomaly detection circuit 20A and the received second noise waveform of node N2. If the degree of anomaly is above a predetermined threshold, it is determined to be an anomaly.

[0036] For example, the impedances of node N1 and node N2 on the common power line L1 differ at node N3 depending on whether the malicious circuit 80 is connected or not, due to the influence of the malicious circuit 80. Therefore, the first noise waveform measured at node N1 and the second noise waveform measured at node N2 will differ from the case where the malicious circuit 80 is not connected.

[0037] The predicted noise waveform is a prediction of the second noise waveform from the first noise waveform, assuming that the malicious circuit 80 is not connected. Therefore, there will be an error between this prediction and the second noise waveform when the malicious circuit 80 is connected. If this error exceeds a predetermined threshold, it is possible to detect an abnormality in the common power line L1.

[0038] Furthermore, since the operation of the anomaly detection circuit 20A of IC chip 1A and the operation of the anomaly detection circuit 20B of IC chip 1B are interchangeable, the accuracy of anomaly detection can be improved by mutually detecting anomalies based on the results of anomaly detection performed by the anomaly detection circuit 20A of IC chip 1A and the results of anomaly detection performed by the anomaly detection circuit 20B of IC chip 1B.

[0039] Furthermore, the anomaly detection circuit 20A can also be configured as an integrated circuit (IC) with software-like properties, such as an FPGA (Field Programmable Gate Array), allowing the circuit configuration to be programmed. Alternatively, the anomaly detection circuit 20A can be equipped with a CPU (Central Processing Unit) and memory, and configured to execute a program loaded from memory.

[0040] <Configuration of the abnormality detection circuit 20A> Next, the configuration of the anomaly detection circuit 20A shown in Figure 3 will be described. Figure 4 is a functional block diagram showing the configuration of the anomaly detection circuit 20A shown in Figure 3.

[0041] As shown in Figure 4, the anomaly detection circuit 20A includes a noise measurement circuit 21A, a noise memory circuit 24A, and a noise analysis circuit 25A. The noise measurement circuit 21A has multiple measurement circuits 22A, which measure, for example, the core power supply voltage and core ground voltage of the digital circuit 10A, the substrate potential of the IC chip 1A, and the voltage of the common power line L1 of the power supply circuit 30A.

[0042] The noise memory circuit 24A stores the noise waveform measured by the noise measurement circuit 21A. The noise memory circuit 24A also stores the degree of abnormality calculated by the noise analysis circuit 25A.

[0043] The noise analysis circuit 25A predicts a predicted noise waveform from the first noise waveform measured by the noise measurement circuit 21A. Then, it receives the second noise waveform stored in the noise memory circuit 24B of another associated IC chip (for example, IC chip 1B) via the noise waveform data sharing bus B1, calculates the degree of abnormality using the received second noise waveform and the predicted noise waveform, and determines that there is an abnormality if this degree of abnormality is above a predetermined threshold.

[0044] <Configuration of Noise Analysis Circuit 25A> Next, the configuration of the noise analysis circuit 25A shown in Figure 4 will be explained. Figure 5 is a functional block diagram showing the configuration of the noise analysis circuit 25A shown in Figure 4.

[0045] As shown in Figure 5, the noise analysis circuit 25A includes a prediction circuit 26A and an anomaly detection circuit 26B. The prediction circuit 26A predicts the second noise waveform of the associated IC chip (for example, IC chip 1B) using a predictor M1 stored in the prediction circuit 26A. Specifically, the first noise waveform stored in the noise memory circuit 24A is input to the predictor M1. The predictor M1 then predicts the second noise waveform of IC chip 1B.

[0046] If the prediction circuit 26A predicts a second noise waveform, the anomaly detection circuit 26B calculates the degree of anomaly using the second noise waveform stored in the noise memory circuit 24A and the predicted noise waveform. If this degree of anomaly is above a predetermined threshold, it determines that an anomaly exists. The squared error is used to calculate the degree of anomaly.

[0047] <Operation when measuring noise waveforms in the noise measurement circuit 21A> Next, we will explain the operation of the noise measurement circuit 21A when measuring the noise waveform. Figure 6 is a timing chart for measuring the noise waveform in the noise measurement circuit 21A shown in Figure 4.

[0048] As shown in Figure 6, the noise waveform of the external power supply voltage is reset by a reset signal input to the digital circuit 10A at time t2, when the external power supply voltage is applied at time t1 and has stabilized sufficiently. Measurement of the noise waveform begins at time t3, when the reset signal rises. Note that Figure 6 shows the noise waveform when the malicious circuit 80 is not connected.

[0049] The noise waveform differs from that shown in Figure 6 when the malicious circuit 80 is connected, because the impedance of the measurement node changes depending on whether the malicious circuit 80 is connected or not.

[0050] <Autoencoder Structure> Next, we will explain the structure of an autoencoder. Figure 7 shows the structure of an autoencoder. Autoencoders are widely used as models for compressing and reconstructing input data, and for extracting essential features of data to effectively process and analyze them.

[0051] As shown in Figure 7, an autoencoder is broadly composed of two parts: an encoder and a decoder. It learns through a process of compressing and then reconstructing input data.

[0052] An encoder compresses input data into a low-dimensional latent space (also called a latent representation or latent vector). This compressed data contains aggregated features of the original data and retains the important parts of the data.

[0053] The most compressed state obtained by the encoder is called the code, which is a condensed version of the original data's features and plays a role in data compression and feature extraction.

[0054] The decoder uses the code compressed by the encoder to reconstruct the data in a form as close to the original as possible. Through this reconstruction, the autoencoder learns to match the input and output as closely as possible.

[0055] <Noise waveform in an associated IC chip according to the embodiment> Next, the noise waveform in the associated IC chip according to this embodiment will be described. Figure 8 is a diagram showing the noise waveform in the associated IC chip according to this embodiment.

[0056] As shown in Figure 8(a), once the noise waveform of IC chip 1A is measured, the predictor M1 is used to predict the noise waveform of IC chip 1B associated with IC chip 1A. For example, the noise waveform shown by the predicted value in Figure 8(b) is the predicted noise waveform.

[0057] If the noise waveform of IC chip 1B, which is associated with IC chip 1A, is measured (actual measured value in Figure 8(b)), the degree of abnormality is determined using this noise waveform and the predicted noise waveform.

[0058] <An example of determining the degree of abnormality according to the embodiment> Next, an example of determining the degree of abnormality according to this embodiment will be described. Figure 9 is a diagram showing an example of determining the degree of abnormality according to this embodiment.

[0059] The abnormality degree calculated using the predicted noise waveform for the IC chip 1B associated with the IC chip 1A and the noise waveform measured by the IC chip 1B is distributed below a predetermined threshold when the malicious circuit 80 is not connected. For example, as shown in FIG. 9, when the threshold value is "0.0020", it has a distribution similar to a normal distribution within the range where the abnormality degree is less than "0.0020".

[0060] On the other hand, when the malicious circuit 80 is connected, the abnormality degree is irregularly distributed at "0.0020" or more. Thus, by setting the threshold value to "0.0020", it is possible to determine abnormality and normality.

[0061] <An example of estimating the abnormal position according to the embodiment> Next, an example of estimating the abnormal position according to this embodiment will be described. FIG. 10 is a diagram showing an example of estimating the abnormal position according to this embodiment.

[0062] In the abnormality detection device according to this embodiment, by using a plurality of associated observation means, the position where an abnormality has occurred is estimated. For example, as shown in FIG. 10, when the abnormality degree of the path between the nodes N0 and N1, which are the observation means, is d 01 and the abnormality degree of the path between the nodes N0 and N2 is d 02 , if both d 01 and d 02 are determined to be abnormal, it is estimated that an abnormality has occurred in the region F surrounded by the nodes N0, N1, and N2.

[0063] Also, when the abnormality degree of the path between the nodes N0 and N3 is d 03 and the abnormality degree of the path between the nodes N0 and N4 is d 04 , if both d 03 and d 04 are determined to be abnormal, it is estimated that an abnormality has occurred in the region G surrounded by the nodes N0, N3, and N4.

[0064] As described above, the anomaly detection device according to this embodiment is configured to detect anomalies between associated observation means by using the observation results of multiple associated observation means and a trained model, which is a predictor, that predicts the observation result of one from the observation result of the other. It is also configured to estimate the location where the anomaly is occurring by using multiple anomaly detection results of the associated observation means. By learning the correlation relationship of multiple observations under normal conditions and detecting a disturbance in the learned correlation relationship, it is possible to detect an abnormal state and estimate the location of the anomaly. Furthermore, by providing multiple such detection means, it is possible to estimate the location where the anomaly occurred.

[0065] [Example 1] By the way, in the above embodiment, a configuration was described in which the location of an anomaly is estimated by using multiple associated observation means, but the present invention is not limited thereto. It is also possible to configure the system to estimate the location of the anomaly by creating a dataset of the location where the malicious circuit is connected and the anomaly scores measured by the multiple observation means in this case, and using a predictor trained on this dataset as training data.

[0066] In this modified example 1, we describe an anomaly detection device that uses a predictor trained on a dataset containing the location where a malicious circuit is connected and the anomaly scores measured by multiple observation methods in this case, to estimate the location of the anomaly.

[0067] <An example of estimating the abnormal location related to Modification Example 1> An example of estimating the abnormal location in this modified example 1 will be explained. Figure 11 shows an example of estimating the abnormal location in this modified example 1.

[0068] In the anomaly detection device according to this modified example 1, multiple associated observation means are used to estimate the location to which the malicious circuit is connected based on the anomaly score calculated for each. Specifically, as shown in Figure 11, the anomaly score in the path between node N0 and node N1, which are observation means, is calculated as d 01 The degree of anomaly in the path between node N0 and node N2 is d02 The degree of anomaly in the path between node N1 and node N2 is d 12 In that case, d 01 d 02 and d 12 By inputting this into the predictor M2, the location H to which the malicious circuit is connected is estimated.

[0069] <Overview of Predictor M2 related to Modified Example 1> Next, an overview of the predictor M2 according to this modified example 1 will be described. Figure 12 is a diagram showing an overview of the predictor M2 according to this modified example 1.

[0070] The predictor M2 in this modified example 1 is a trained model that uses a dataset of multiple (e.g., three) data points of anomaly degrees between observation means and location data of malicious circuits, and is trained using this dataset as training data.

[0071] As shown in Figure 12, multiple data on the degree of anomaly between observation means (for example, d 01 d 02 and d 12 By inputting this into the predictor M2, the location H(x, y) to which the malicious circuit is connected is estimated.

[0072] As described above, the anomaly detection device according to this modified example 1 can use multiple associated observation means to estimate the location to which the malicious circuit is connected based on the degree of anomaly calculated for each.

[0073] [Differentiation 2] By the way, in the above embodiment, a configuration was described in which the location of an anomaly is estimated by using multiple associated observation means, but the present invention is not limited thereto. It is also possible to configure the system to estimate the location of the anomaly by creating a dataset of the location where the malicious circuit is connected and the anomaly scores measured by the numerous observation means in this case, and then using a predictor trained on this dataset as training data.

[0074] In this modified example 2, we describe an anomaly detection device that uses a predictor trained on a dataset containing the location where the malicious circuit is connected and the anomaly scores measured by numerous observation methods, to estimate the location of the anomaly.

[0075] <An example of estimating the abnormal location related to modified example 2> An example of estimating the abnormal location in this modified example 2 will be explained. Figure 13 shows an example of estimating the abnormal location in this modified example 2.

[0076] In the anomaly detection device according to this modified example 2, a number of associated observation means are used to estimate the location to which the malicious circuit is connected from the anomaly degree calculated for each. Specifically, as shown in Figure 13, the anomaly degree in the path between node N0 and node N1, which are observation means, is calculated as d 01 The degree of anomaly in the path between node N0 and node N2 is d 02 The degree of anomaly in the path between node N0 and node N3 is d 03 The degree of anomaly in the path between node N0 and node N4 is d 04 The degree of anomaly in the path between node N1 and node N2 is d 12 The degree of anomaly in the path between node N1 and node N3 is d 13 The degree of anomaly in the path between node N2 and node N4 is d 24 The degree of anomaly in the path between node N3 and node N4 is d 34 In that case, d 01 d 02 d 03 d 04 d 12 d 13 d 24 and d 34 By inputting this into the predictor M3, the location H to which the malicious circuit is connected is estimated.

[0077] <Overview of Predictor M3 related to Modified Example 2> Next, an overview of the predictor M3 according to this modified example 2 will be described. Figure 14 is a diagram showing an overview of the predictor M3 according to this modified example 2.

[0078] The predictor M3 in this modified example 2 is a trained model that uses a dataset of numerous (e.g., 8) anomaly scores between observation methods and location data of malicious circuits, and is trained using this dataset as training data.

[0079] As shown in Figure 14, a large amount of data on the degree of anomaly between observation methods (for example, d 01 d 02 d 03 d 04 d 12 d 13 d 24 and d 34 By inputting this into the predictor M3, the location H(x, y) to which the malicious circuit is connected is estimated.

[0080] As described above, the anomaly detection device according to this modified example 2 can use a number of associated observation means to estimate the location to which the malicious circuit is connected based on the degree of anomaly calculated for each.

[0081] It should be noted that the configurations illustrated in each of the above embodiments are functional schematics and do not necessarily have to be physically represented as shown. In other words, the distributed and integrated forms of each device are not limited to those shown, and all or part of them can be functionally or physically distributed and integrated in any unit according to various loads and usage conditions. [Industrial applicability]

[0082] The anomaly detection device, anomaly detection method, and anomaly detection program according to the present invention can efficiently detect anomalies at locations other than observation points on a circuit board equipped with digital circuits, and are suitable for estimating the location where an anomaly occurred. [Explanation of Symbols]

[0083] Nodes N0, N1, N2, N3, N4 M1, M2, M3 predictor B1 Noise waveform data sharing bus L1 common power line 1A, 1B IC chips 10A, 10B Digital Circuits 20A, 20B Anomaly Detection Circuit 21A, 21B Noise Measurement Circuit 22A Measurement Circuit 24A, 24B Noise Memory Circuit 25A, 25B Noise Analysis Circuit 26A Prediction Circuit 26B Abnormality judgment circuit 30A, 30B power supply circuit 40 Interposer 80 Malice Circuit

Claims

1. An anomaly detection device that provides observation points on a circuit board equipped with a digital circuit and detects an anomaly occurring in the circuit board based on the observation results at said observation points, An anomaly degree calculation means for calculating the degree of anomaly based on the correlation of observation results at multiple observation points provided on the substrate, An abnormality determination means that determines whether or not an abnormality has occurred based on the degree of abnormality calculated by the abnormality calculation means. An anomaly detection device characterized by being equipped with the following features.

2. The aforementioned abnormality degree calculation means is A first observation result acquisition means for acquiring a first observation result obtained from an observable event at a first observation point, A second observation acquisition means for acquiring a second observation result obtained from an event observable at a second observation point different from the first observation point, Under normal conditions, a correlation learning means learns the correlation between the first observation result and the second observation result, An anomaly degree calculation means calculates the degree of anomaly from the first observation result and the second observation result, and the correlation learned by the correlation learning means. An anomaly detection device according to claim 1, characterized by comprising the above.

3. The correlation learning means described above is: The anomaly detection device according to claim 2, further comprising a first autoencoder that outputs a second observation prediction result when the first observation result under normal conditions is input.

4. The aforementioned abnormality degree calculation means is An anomaly detection device according to claim 3, characterized in that a first degree of anomaly is calculated based on the error between the second observation prediction result output from the first autoencoder and the second observation result observed at the second observation point.

5. The correlation learning means described above is: The anomaly detection device according to claim 3, further comprising a second autoencoder that outputs a first observation prediction result when the second observation result under normal conditions is input.

6. The aforementioned abnormality degree calculation means is An anomaly detection device according to claim 5, characterized in that a first degree of anomaly is calculated based on the error between the second observation prediction result output from the first autoencoder and the second observation result observed at the second observation point, and a second degree of anomaly is calculated based on the error between the first observation prediction result output from the second autoencoder and the first observation result observed at the first observation point.

7. The abnormality detection device according to claim 1, further comprising a notification means for notifying that an abnormality has occurred when the abnormality determination means determines that an abnormality has occurred.

8. The anomaly detection device according to claim 1, further comprising a location identification means that identifies the location where an anomaly occurred based on the location information of the multiple observation points where an anomaly was detected, when the anomaly determination means determines that an anomaly has occurred at multiple observation points.

9. An anomaly detection method in an anomaly detection device that provides observation points on a circuit board equipped with a digital circuit and detects an anomaly occurring in the circuit board based on the observation results at said observation points, An anomaly degree calculation step, which calculates the degree of anomaly based on the correlation of observation results at multiple observation points provided on the substrate, An abnormality determination step determines whether or not an abnormality has occurred based on the abnormality level calculated in the abnormality level calculation step. An anomaly detection method characterized by including

10. An anomaly detection program executed in an anomaly detection device that provides observation points on a circuit board equipped with digital circuits and detects anomalies occurring on the circuit board based on the observation results at those observation points, An anomaly calculation procedure for calculating the degree of anomaly based on the correlation of observation results at multiple observation points provided on the substrate, An abnormality determination procedure that determines whether or not an abnormality has occurred based on the abnormality level calculated by the abnormality level calculation procedure described above, An anomaly detection program characterized by causing a computer to execute a command.

Images