Network analysis device and network analysis method

Abstract

By passively monitoring the data flow in the system under evaluation, policy compliance can be assessed in real time without affecting the system's operation. [Solution] The network analysis device compares operational data representing the operation of a control system in operation with each standard requirement indicated by standard requirement information representing the standard requirements that the control system must satisfy, and identifies pending requirements for which the judgment of compliance with the standard requirements should be postponed. The device obtains additional information from predefined information sources regarding the pending requirements, which is information that satisfies requirements defined as potentially necessary to resolve the pending requirements, and makes a judgment on compliance with the standard requirements regarding the pending requirements based on the additional information.

Description

Technical Field

[0001] The present invention generally relates to network analysis.

Background Art

[0002] Control systems constituting critical infrastructure are operated in fields with high impact on the real world, such as electric power, gas and water services that support social infrastructure, or manufacturing plants and transportation. Such control systems are required to operate continuously. Therefore, in the unlikely event of an outage or performance degradation, it may cause enormous risks in terms of safety and social impact. Accordingly, in cyber security measures for such control systems, there is a demand to minimize the impact of the measure itself on the control system, and to perform security evaluation and policy compliance audits while maintaining the operation of the control system.

[0003] In contrast, in so-called information systems (typically office IT systems and the like), techniques such as active scanning and penetration testing are widely used to evaluate the risk of communication between clients (e.g., user personal computers) and servers. In such information systems, even if the target under evaluation is temporarily suspended, the possibility of directly leading to a serious accident or large-scale social infrastructure outage is low. In addition, it is relatively easy to isolate the system when a failure occurs or switch to a redundant system, and in the worst case, rapid recovery can often be achieved through backup and recovery means. Therefore, it can be said that security evaluations and policy compliance audits for information systems are relatively easy to accept the risks associated with using active methods.

[0004] On the other hand, performing an active scan on a control system involves intentionally generating traffic to impose an unexpected communication load, or sending aggressive packets to control devices and network equipment. This could lead to serious consequences such as temporary shutdowns or performance degradation of the control system, or malfunctions and data loss due to undelivered control commands. In particular, in critical infrastructure in actual operation, even a momentary downtime can have extremely large human and economic impacts, making it difficult to easily tolerate the risks of active scanning. Therefore, there is a strong need for methods that allow security assessments and policy compliance audits to be conducted on control systems while minimizing changes to system operation and maintaining continuous operation.

[0005] As a prior art for passive monitoring that can replace the active scanning described above, for example, the one shown in Patent Document 1 has been proposed. Patent Document 1 mainly discloses a process for checking policy compliance of output data in application development, and proposes a method for sequentially adding or modifying policies in cooperation with data managers (see, for example, abstract). [Prior art documents] [Patent Documents]

[0006] [Patent Document 1] Japanese Patent Publication No. 2021-117873 [Overview of the project] [Problems that the invention aims to solve]

[0007] Patent Document 1 describes a mechanism that monitors whether application output data conforms to a defined policy and prompts developers or data managers to take action if there are omissions or deficiencies. However, this prior art is intended for application development in information systems and does not anticipate the operation of large-scale control systems that require continuous operation. In fact, the decision-making process shown in the document is a serial flow in which processing results are passed sequentially from the first decision unit to the second decision unit, and from the second decision unit to the third decision unit. This flow assumes pre-prepared data and policy information, and there is no description of performing a step-by-step re-evaluation based on additional data acquired from a system in operation. Therefore, it can be said that the document does not adequately disclose a method for acquiring supplementary information while suspending some requirements and determining final compliance over multiple stages in a control system that prioritizes continuous operation.

[0008] Therefore, the present invention has been made in view of the above problems, and aims to provide a technology that enables real-time evaluation of policy compliance by passively monitoring the data flow in a system under evaluation without affecting the operation of the system. [Means for solving the problem]

[0009] A network analysis device according to one aspect of the present invention compares operational data representing the operation of a control system in operation with each standard requirement indicated by standard requirement information representing the standard requirements that the control system must satisfy, and identifies pending requirements for which the determination of compliance with the standard requirements should be postponed. The device obtains additional information from a predetermined information source regarding the pending requirements, which is information that satisfies requirements defined as potentially necessary to resolve the pending requirements, and makes a determination of compliance with the standard requirements regarding the pending requirements based on the additional information. [Effects of the Invention]

[0010] According to the present invention, data flow in the system under evaluation can be monitored by passive monitoring, and policy compliance can be evaluated in real time without affecting the operation of the system. Other issues, configurations, and effects will be clarified by the following description of embodiments. Furthermore, the embodiments described herein are merely illustrative, and the present invention can be modified or altered in various ways without departing from its spirit. [Brief explanation of the drawing]

[0011] [Figure 1] This is a block diagram showing an example of the hardware configuration of the network analysis device in Example 1. [Figure 2] This is a block diagram showing an example of the functional configuration of the network analysis device in Example 1. [Figure 3] This figure shows an example of the data structure of the passive information database in Example 1. [Figure 4] This figure shows an example of the data structure of the regulatory compliance conditions database in Example 1. [Figure 5] This figure shows an example configuration of the handling flow tables in Example 1. [Figure 6] This diagram shows a flowchart of the first decision unit in Example 1. [Figure 7] This diagram shows a flowchart of the second decision unit in Example 1. [Figure 8] This is an explanatory diagram showing an example of the screen configuration displayed on the display device in Example 1. [Figure 9] This is a block diagram showing an example of the functional configuration of the network analysis device in Example 2. [Figure 10] This diagram shows a flowchart of the second decision unit in Example 2. [Figure 11] This is an explanatory diagram showing an example of the screen configuration displayed on the display device in Example 2. [Modes for carrying out the invention]

[0012] In the following description, "processor" refers to an arithmetic unit and may be one or more processor devices. At least one processor device is typically a microprocessor device such as a CPU (Central Processing Unit), but may also be other types of processor devices such as a GPU (Graphics Processing Unit). At least one processor device may be single-core or multi-core. At least one processor device may be a processor core. At least one processor device may be a broad processor device such as a hardware circuit that performs some or all of the processing (e.g., an FPGA (Field-Programmable Gate Array), a CPLD (Complex Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit)).

[0013] Furthermore, in the following explanation, "storage device" may refer to one or more persistent or non-persistent storage devices, which are examples of one or more memory devices. Persistent storage devices are typically non-volatile storage devices, specifically, for example, HDDs (Hard Disk Drives), SSDs (Solid State Drives), ROMs (Read Only Memory), or NVMe (Non-Volatile Memory Express) drives. Non-persistent storage devices are typically volatile memory devices, specifically, for example, RAM (Random Access Memory).

[0014] Further, in the following description, expressions such as "vvv table" and "vvv database" may be used to describe information that allows an output to be obtained for an input, but such information may be data of any structure (for example, it may be structured data or unstructured data), and may also be a learning model represented by a neural network, a genetic algorithm, a random forest, or the like that generates an output for an input. Accordingly, the "vvv table" and "vvv database" can be referred to as "vvv information". Further, in the following description, the configuration of each database and table is an example, and one database or table may be divided into two or more databases or tables, or all or part of two or more databases or tables may be a single database or table.

[0015] Further, in the following description, processes may be described with a "program" as the subject, but since the program is executed by a processor such as a CPU to perform predetermined processes appropriately using a storage device and / or an interface device or the like, the subject of the processes may be the CPU (or a device such as a controller having the processor). The program may be installed from a program source into an apparatus such as a computer. The program source may be, for example, a program distribution server or a computer-readable (e.g., non-transitory) recording medium. Further, in the following description, two or more programs may be implemented as a single program, or a single program may be implemented as two or more programs.

[0016] Further, in the following description, when describing elements of the same type without distinction, the common part of the reference signs may be used, and when describing elements of the same type with distinction, the reference signs or element identifiers may be used.

Example

[0017] The network analysis apparatus (information processing apparatus) according to Example 1 will be described with reference to FIG. 1 to FIG. 8.

[0018] Figure 1 is a block diagram showing an example of the hardware configuration of the network analysis device 1 in Embodiment 1.

[0019] The network analysis device 1 is an example of a computer, and is composed of a computer equipped with, for example, an arithmetic unit 11, non-volatile memory 12, volatile memory 13, input / output interface 14, and other peripheral circuits. These hardware components work together to run software and realize multiple functions.

[0020] The computing unit 11 includes a processor and is composed of, for example, a CPU (Central Processing Unit), an MPU (Micro Processing Unit), and / or a DSP (Digital Signal Processor).

[0021] Furthermore, the non-volatile memory 12 includes, for example, ROM (Read Only Memory) used as main memory, flash memory and hard disk drive used as auxiliary memory. The volatile memory 13 includes, for example, RAM (Random Access Memory) used as main memory.

[0022] The network analysis device 1 is a computer system that is physically located on a single computer or on multiple computers configured logically or physically. It may operate in separate threads on the same computer, or it may operate on a virtual computer built on multiple physical computer resources.

[0023] Furthermore, an ASIC (Application Specific Integrated Circuit) and an FPGA (Field Programmable Gate Array) can also be used as the arithmetic unit 11.

[0024] For example, non-volatile memory 12, such as flash memory and hard disk drives, stores programs that the arithmetic unit 11 can execute and data used when programs are executed. In other words, non-volatile memory 12 is a storage medium (device) that can read programs that realize the functions of this embodiment. Also, for example, non-volatile memory 12, such as ROM, stores immutable programs (for example, BIOS (Basic Input / Output System)).

[0025] For example, the volatile memory 13, such as RAM, is a storage medium (memory device) that temporarily stores programs executed by the arithmetic unit 11, data used during program execution, and signals input from the input / output interface 14.

[0026] The arithmetic unit 11 loads the program stored in the non-volatile memory 12 into the volatile memory 13 and performs calculations. The arithmetic unit 11 performs predetermined calculation processing on the data taken in from the input / output interface 14, the non-volatile memory 12, and the volatile memory 13 according to the program.

[0027] An input device 4 and a display device 5 are connected to the input / output interface 14. The input / output interface 14 is an interface device that receives input from the operator and outputs the program execution results in a format that the operator can see. A keyboard and mouse are examples of input devices 4. A device with a display screen, such as an LCD monitor, and a printer are examples of display devices 5.

[0028] Furthermore, the input / output interface 14 may also function as a network interface device that controls communication with an external device (for example, a control system to be evaluated, which is the target of acquiring operational data, etc.) in accordance with a predetermined protocol. In such a case, the network that serves as the path for such communication may be, for example, a wired LAN (Local Area Network), a wireless LAN, a WAN (Wide Area Network), or a mobile phone network, but is not limited to these.

[0029] Here, as an example of a mobile phone network, we may use a general public network, whether wired or wireless, such as the fifth-generation mobile communication system, or so-called 5G (5th Generation), which enables "massive simultaneous connections" and "ultra-low latency." Of course, in the future, even newer mobile phone systems beyond 5G may be used.

[0030] Furthermore, data exchange between the network analysis device 1 and other systems (such as control systems) via the input / output interface 14 may be carried out, for example, according to an API (Application Programming Interface) protocol.

[0031] Furthermore, the network analysis device 1 is connected to the passive information database 2 and the regulatory compliance conditions database 3 via the input / output interface 14. The passive information database 2 and the regulatory compliance conditions database 3 are databases that store predetermined data. The regulatory compliance conditions database 3 may also include a response flow table 50.

[0032] The data stored in the passive information database 2 and the regulatory compliance database 3 will be described in detail later. Note that the passive information database 2 and the regulatory compliance database 3 may also be stored in the non-volatile memory 12 and / or volatile memory 13.

[0033] In this embodiment, the information used by the network analysis device 1 is independent of the data structure and can be represented in any data structure. For example, a data structure appropriately selected from tables, lists, databases, or queues can store the information.

[0034] The input section of the input / output interface 14 converts data input signals from the input device 4 and signals input from the passive information database 2 and the regulatory compliance condition database 3 into data that can be processed by the arithmetic unit 11. The output section of the input / output interface 14 generates an output signal according to the calculation result of the arithmetic unit 11 and outputs that signal to the display device 5.

[0035] Figure 2 is a block diagram showing the functional configuration of the network analysis device 1 in Example 1.

[0036] The network analysis device 1 includes a functional module that includes a passive information database 2, a legal compliance condition database 3, a first decision unit 6, a second decision unit 7, a data addition unit 8, and a compliance status display unit 9.

[0037] These modules are implemented as software programs on the hardware configuration of the computing unit 11 shown in Figure 1. As an example, this network analysis device 1 may run on the Linux OS, and each functional module may be operated independently using container technology (such as Docker) (Linux is a registered trademark).

[0038] Of the modules mentioned above, the passive information database 2 records operational data such as network traffic, log information, and CPU usage that naturally occur during the operation of the control system. See Figure 3 for specific examples.

[0039] Furthermore, the Legal Compliance Conditions Database 3 contains internal regulations of operators of control systems, international standards, and various industry guidelines, as well as rules and standards that must be followed when operating control systems. Details of these legal or standard requirements are shown in Figure 4. In addition, Figure 5 shows an example of a response flow table 50 referenced in this database.

[0040] The first decision unit 6 is the initial module that refers to the information in the passive information database 2 and the legal compliance condition database 3 and makes a pass / fail judgment (judgment of compliance; pass / fail judgment) regarding the requirements that the control system must meet. In making this judgment, as shown in the flowchart in Figure 6, items that are difficult to judge due to insufficient data, etc., are treated as "pending".

[0041] On the other hand, the second judgment unit 7 is a module that, with respect to the items that were put on hold by the first judgment unit 6 (i.e., the pending requirements), utilizes the additional information obtained from the data addition unit 8 to make a final pass / fail determination and risk assessment regarding compliance with the standard requirements. As shown in the flowchart of Figure 7, the second judgment unit 7 re-evaluates the compliance with the pending requirements and, if sufficient information is available, determines either "pass" or "fail".

[0042] Furthermore, the data addition unit 8 is responsible for acquiring additional information, which is defined as information that may be necessary to resolve pending requirements. For example, the data addition unit 8 may collect broader or more detailed logs related to the operation data of the control system, or acquire operation data (passive data acquired through passive monitoring) to understand events that occur only during specific time periods, as additional information. In this embodiment, the data addition unit 8 receives requests from the first decision unit 6 and the second decision unit 7 and performs processing such as extending the collection operation of the passive information database 2.

[0043] Furthermore, the compliance status display unit 9 integrates the final judgment results of each requirement (standard requirements related to pending requirements) obtained by the first judgment unit 6 and the second judgment unit 7, and outputs them to the display device 5 (see Figure 1). Figure 8 shows an example of the screen configuration displayed on the display device 5 at this time. If pending requirements exist, they are displayed as "pending," and the re-evaluation results after acquiring additional information are also reflected in real time.

[0044] Figure 3 shows an example of the data structure of the passive information database 2.

[0045] The passive information database 2 stores records containing various values, such as an item name indicating the type of operational data, the value of the operational data, and a description, as time-series operational data. This operational data is structured so that information such as network traffic logs, error logs, and resource usage status (CPU, memory, etc.) is stored chronologically for each date and time of acquisition or observation (value of item name "Time"). In this embodiment, operational data of the control system is acquired and recorded as it occurs, and made searchable during the determination processing of the first determination unit 6 and the second determination unit 7. For example, threshold determinations such as "whether the CPU usage rate exceeds a certain value" and "whether the network bandwidth is within an acceptable range" are performed by referring to the operational data recorded here. Here, it is assumed that the following information obtained from the control system is accumulated as operational data chronologically (for example, every second).

[0046] First, to give an example of CPU usage log recording, data such as "2024-12-22 10:15:00,CPU=80%" and "2024-12-22 10:15:01,CPU=92%" would be considered operational data. In that case, if the threshold value defined in the standard requirements for the "CPU usage" item is, for example, "90%", then if the CPU usage value shown in the operational data exceeds the threshold of "90%", it is judged as a "cautionary state", and if that state continues for 10 seconds or more, it is judged as a "warning state" (determinants described later).

[0047] Network traffic logs also record information such as the number of bytes sent and received, and the number of packets per port number. Such network traffic logs may look like this: "2024-01-10 10:00:00,TotalTraffic=8MBPs,Port443=2MBPs,Port80=6MBPs".

[0048] Error logs, for example, are collections of event logs (communication errors, sensor malfunctions, etc.) notified by the control system. Such error logs may take the form of values ​​like "2024-01-10 10:00:05,DeviceID=XYZ,ErrorCode=E203".

[0049] This operational data will be stored on auxiliary storage for approximately 30 days, and older data will be deleted or archived sequentially. The process for determining compliance with standard requirements will be performed by referring to the data for the target period from the most recent 30 days, as needed.

[0050] Figure 4 shows an example of the data structure of the legal compliance conditions database 3.

[0051] The legal compliance requirements database 3 includes values ​​such as the type of specific requirements 40 (e.g., "availability requirements," "security requirements," and "data tampering prevention requirements") that the control system must meet in the laws, guidelines, or internal regulations; a requirement ID 41 indicating the requirement; a condition 42 that specifically defines the requirement; a response flow ID (which may be a source for obtaining additional information) indicating how to handle cases where the condition is not met, i.e., compliance is questionable; and the importance of the condition. The value in the "Condition" column above may include a threshold value or check items for making a judgment regarding the condition.

[0052] Furthermore, regarding the "availability requirements" among the above requirements, conditions such as "CPU usage does not exceed 90% for more than 10 consecutive seconds" and "network bandwidth usage does not exceed 80 MBPs" may be specified. Also, regarding the error log occurrence count requirement, conditions such as "no more than 10 error logs occur within one hour" may be specified. In addition, regarding the monitoring interval requirement, conditions such as "logs from specific critical control devices are collected at least once every 30 seconds" may be specified. Each of these requirements is associated with one of the records in the response flow table 50 shown in Figure 5, using the response flow ID as the key. For example, the response flow ID "FLOW-AV-001" for requirement ID "AV-0001" "CPU usage > 90% → Warning" is associated with the record in the response flow table 50 where the "Procedure" column is "Procedure for handling high load". This "Procedure for Handling High Load" includes instructions such as, "If CPU usage exceeds 90% for more than 10 consecutive seconds, prompt the system to collect detailed logs."

[0053] The following describes an example of the process performed in this embodiment.

[0054] Figure 6 shows the determination flow of availability requirements and error log status by the first decision unit 6.

[0055] The first decision unit 6 obtains operational data from the passive information database 2, for example, the CPU usage log and network traffic log for the most recent minute (step S60). Of the operational data obtained here, the CPU usage log is, for example, the CPU log from "10:00:00" to "10:00:59" on "2024-01-10". The first decision unit 6 also aggregates the operational data obtained here and identifies, for example, the duration of CPU usage at "90%" or higher as "15 seconds".

[0056] Next, the first determination unit 6 compares the value obtained in step S60 (e.g., duration of a predetermined CPU usage rate) with the availability requirements defined in the legal compliance conditions database 3 and determines whether there is an excess of the specified value (e.g., CPU usage rate exceeding 90% for 10 consecutive seconds) (step S61). For example, if the CPU usage rate exceeds 90% for 15 consecutive seconds, the first determination unit 6 determines that the above requirement has not been met (equivalent to a warning).

[0057] The first judgment unit 6 determines whether the corresponding operational data complies with each requirement in the legal compliance condition database 3 as described above (step S62). As a result, it flags any requirements that are not met as "pending requirements" and sends a "pending" message to the second judgment unit 7 (step S62: No → step S64). Depending on the nature of the unmet condition, it also sends a "warning" or "abnormal" message.

[0058] Regarding the above "reservation requirements," further analysis of traffic logs and memory usage may be necessary to identify the detailed cause of the "reservation." Therefore, the first decision unit 6 sends a notification regarding the above "reservation requirements" to the second decision unit 7, which identifies additional information necessary for determining compliance (pass or fail), such as "how much network bandwidth was used during periods of high CPU load" and "whether sensor errors occurred frequently during the same time period."

[0059] On the other hand, in step S62 above, if the corresponding operational data is compliant with each requirement item in the legal compliance condition database 3, the first judgment unit 6 flags the item for which the requirement has been met as a "compliant item" and sends a "pass" message to the second judgment unit 7 (step S62: Yes → step S63).

[0060] Figure 7 shows the re-evaluation flow of the pending requirements by the second judgment unit 7.

[0061] Upon receiving pending requirements from the first decision unit 6, the second decision unit 7 performs a re-evaluation in the following steps. First, the second decision unit 7 requests necessary information from the data addition unit 8, such as "memory usage log at the same time as high CPU load" or "detailed network traffic statistics for the period (by port and protocol)" (step S70).

[0062] Next, the second judgment unit 7 takes the additional information obtained from the data addition unit 8 into the passive information database 2, analyzes it again in conjunction with the most recent logs (step S71), and updates the passive information database 2 with the results (step S72). For example, it confirms new facts such as "memory usage is at a maximum of 70%, so there is plenty of headroom" and "network traffic is around 10 MBPs and is not particularly saturated."

[0063] The second decision unit 7, taking the analysis results from step S71 as an example, can identify that the failure to meet the availability requirement "CPU usage exceeding 90% for 10 consecutive seconds," as determined by the first decision unit 6, was caused by a "temporary peak in computational processing." In such cases, the second decision unit 7, through analysis using the additional information, determines that the standard requirements defined in the compliance requirements database 3 for the pending requirement are met, i.e., the requirement is compliant (step S73: Yes). In such situations, a response flow such as "If similar peaks do not occur consecutively within 24 hours, the requirement is considered met" can be applied. In this case, the second decision unit 7 can choose whether to continue log monitoring for another hour, following the "high load response procedure" which can be referenced from the response flow table 50. In other words, it can decide to acquire additional information.

[0064] Furthermore, if the re-evaluation (step S73) shows that the requirements are not met, the second judgment unit 7 either confirms it as a "warning" or "abnormal" (non-compliant requirement), or, if additional information is needed, sets a pending flag again (compliant requirement) and continues collecting additional data (steps S74, S75).

[0065] Figure 8 shows an example of the screen configuration displayed on the display device 5 by the compliance status display unit 9.

[0066] In this embodiment, the status of requirements and their achievement is displayed in the following format. For example, for the requirement "Availability," the screen display includes statuses such as "CPU usage: 95% (over 90% → pending)," "Judgment result: CPU usage is temporarily high, so detailed analysis is required," "Network traffic: 10 MBPs (no abnormalities)," "Judgment result: There are no abnormalities in the current network status," "Error log: None," and "Judgment result: No errors occurred."

[0067] As described above, this screen displays a list of requirements, including their names and statuses (e.g., passed, warning, pending, abnormal). Users can click on pending requirements to check the status of additional data acquisition and the progress of re-evaluation. In this example, a message is also displayed indicating that the peak in CPU usage may be temporary and prompting the user to collect data for re-evaluation (such as detailed memory usage logs).

[0068] As described above, in this embodiment, by setting specific numerical values ​​(for example, a threshold of 90% CPU usage or a network bandwidth of 80 MBPs) and incorporating step-by-step judgments, it becomes possible to perform accurate compliance evaluations without burdening the control system. Even in cases where the load is temporarily high, additional information can be obtained through the data addition unit 8, and the true problems can be identified through re-evaluation (compliance judgment). As a result, it is possible to check the necessary security and availability requirements step by step without stopping the control system in operation, and ultimately make a clear pass / fail judgment.

[0069] Furthermore, the compliance status display unit 9 displays details of pending requirements and warning items in real time, allowing system administrators to quickly grasp the current status and take additional measures if necessary (such as distributing process load, increasing equipment capacity, or reviewing the operation schedule). These effects are extremely useful in ensuring compliance with international standards and internal policies while maintaining the stable operation of large-scale control systems. [Examples]

[0070] Example 2 will now be described. In doing so, the differences from Example 1 will be explained primarily, and the similarities with Example 1 will be omitted or simplified.

[0071] Figure 9 is a block diagram showing an example of the functional configuration of the network analysis device 1 in this embodiment.

[0072] In Example 2, a third decision unit 10 is newly provided after the second decision unit 7. The network analysis device 1 is configured to handle complex evaluation flows.

[0073] The third decision unit 10 is a module for finally scrutinizing requirements that cannot be determined by the second decision unit 7. In Example 2, metadata other than normal operational data, such as external audit logs and administrator interview information, can be referenced. This makes it possible to make decisions that take into account events that cannot be processed by simple numerical comparisons and special exceptions in the system configuration.

[0074] Similar to Example 1, the compliance status display unit 9 integrates the pass / fail judgment results from the first to third judgment units and visualizes the final compliance status. In Example 2, a screen is provided that clearly shows the progress of the three-stage evaluation flow (for example, "On hold in the first judgment unit," "Undergoing re-evaluation in the second judgment unit," "Undergoing final verification in the third judgment unit," etc.) to the user.

[0075] Figure 10 is a flowchart showing an example of the processing performed by the data addition unit 8 in Example 2.

[0076] Compared to Example 1, this implementation allows for more flexible control of the range of additional information acquisition and implements a two-stage data acquisition process that responds to the requests of the second decision unit 7 and the third decision unit 10.

[0077] Here, the data addition unit 8 receives a notification from the second decision unit 7 or the third decision unit 10 and determines "what additional information is needed to evaluate which requirements" (step S100).

[0078] Furthermore, the data addition unit 8 analyzes the logs and metadata that need to be acquired and checks for duplication or omissions (step S101). Here, for example, it checks whether "logs from the same time period have been acquired multiple times, but the content is consistent" and makes corrections to maintain consistency as needed.

[0079] Furthermore, the data addition unit 8 reflects the analysis results from step S101 in the passive information database 2 (abbreviated as PIDB) and updates the data so that the second decision unit 7 and the third decision unit 10 can re-evaluate it (step S102). For example, it is conceivable that the log, which previously recorded only the past hour, could be expanded to record the past 24 hours, and waveform trends could be added and registered.

[0080] Next, the data addition unit 8 performs a provisional check based on the information obtained up to step S102 to determine whether the rules of the legal compliance condition database 3 are met. If they are met, it sends the result to the display device 5 as a "compliance requirement" (step S103: Yes, step S104). On the other hand, if the rules of the legal compliance condition database 3 are not met, the data addition unit 8 sends the result as a "non-compliance requirement" (step S103: No, step S105), prompting the third judgment unit 10 for further verification if necessary. Thus, in this embodiment 2, by incorporating a bypass to the third judgment unit 10 in addition to the result of the second judgment unit 7, the configuration allows for a more precise final judgment.

[0081] Figure 11 is an explanatory diagram showing an example of the screen configuration displayed on the display device 5 in Embodiment 2.

[0082] Screen 80 has the characteristic of reflecting the following additional information. After the availability check item determines "CPU usage: 95% (over 90% → pending)", the data addition unit 8 analyzes the CPU usage trend and network data over the past hour, and if it determines that "the cause of the high load is batch processing", it is finalized as a "compliance requirement". On the other hand, if further suspicious logs are found, the matter is handed over to the third judgment unit 10, and a conclusion is reached after additional processes such as "further checking of external audit logs" and "conducting interviews with administrators".

[0083] At the top of the screen are a "List of Regulations" button 81 and a "Change" button 82, allowing users to view and modify the rules in the compliance conditions database 3 as needed. In Example 2, it is assumed that some thresholds and required log collection periods will be adjusted according to the operational status, and users with administrator privileges can dynamically modify them from this screen.

[0084] Furthermore, the system displays three status levels in parallel, such as "Status: Compliant," "Status: Pending," and "Status: Requires Additional Verification," to clearly indicate which stage the judgment is at. This allows operators to easily understand whether an event occurring within the system is pending at the first judgment unit level 6, under re-evaluation at the second judgment unit level 7, or under scrutiny at the third judgment unit level 10.

[0085] According to this embodiment, in addition to the two-stage evaluation (first and second decision units) of Embodiment 1, the inclusion of a third decision unit 10 allows for more precise verification of complex requirements and uncertain factors. Specifically, the following advantages are available.

[0086] First, the third decision unit 10 refers not only to additional logs but also to metadata such as external audit logs, interview results, and system change history, which allows it to appropriately consider "operational exceptions that cannot be captured by normal numerical comparisons."

[0087] Furthermore, the flow from the first judgment unit 6 to the second judgment unit 7 to the third judgment unit 10 allows for the gradual resolution of information deficiencies and unknown events, ultimately clarifying "why the pass / fail decision was made." By not forcing the processing of pending requirements all at once, but instead acquiring and analyzing additional information step by step, a more reliable pass / fail determination becomes possible.

[0088] As a result, even in environments requiring continuous operation, such as control systems, a step-by-step and precise compliance evaluation can be performed, and if necessary, a final conclusion can be reached through special processing using the third decision unit 10. Consequently, while minimizing system downtime, the system comprehensively checks increasingly complex security policies and availability requirements, ultimately ensuring the safe and stable operation of the system.

[0089] It should be noted that the present invention is not limited to the embodiments described above (Examples 1 and 2).

[0090] Furthermore, the above explanation can be summarized as follows. The following summary may include supplementary explanations and explanations of variations of the above explanation.

[0091] The network analysis device (e.g., network analysis device 1) includes a storage device (e.g., non-volatile memory 12 and volatile memory 13) and a processor (e.g., arithmetic unit 11). The storage device stores operational data representing the operation of the control system in operation (e.g., data including values ​​for each item in the passive information database 2) and standard requirement information representing the standard requirements that the control system must satisfy (e.g., regulatory compliance condition database 3). The processor compares the operational data with each standard requirement indicated by the standard requirement information to identify pending requirements for which the judgment of compliance with the standard requirement should be postponed. The processor obtains additional information from predefined information sources regarding the pending requirements, which is information that satisfies requirements defined as potentially necessary to resolve the pending requirements, and based on the additional information, it determines compliance with the standard requirements with respect to the pending requirements. This makes it possible to monitor the data flow in the system under evaluation by passive monitoring and evaluate policy compliance in real time without affecting the operation of the system.

[0092] The computing unit may passively collect operational data from the control system and store this operational data in a memory device. This enables the collection and storage of operational data through passive monitoring.

[0093] Furthermore, the computing unit may obtain additional information as countermeasure information when dealing with situations where the pending requirements do not conform to the standard requirements, from the storage location of the countermeasure information, which is the information source. This makes it possible to obtain additional information, such as procedures for conforming the pending requirements to the standard requirements, accurately and efficiently.

[0094] Furthermore, when acquiring additional information, the computing unit may expand the acquisition period or increase the granularity of the data to be acquired for the operational data related to the retention requirements, and acquire operational data from the information source, which is the storage device or control system. This makes it possible to acquire operational data for a longer period, or operational data with more detailed observation events, as additional information, thereby eliminating adverse effects from so-called outliers and making compliance judgments.

[0095] Furthermore, when acquiring operational data as additional information, the computing unit may determine the type of additional information required for each hold requirement based on the content of the standard requirements, and depending on the type of additional information, expand the acquisition period or increase the granularity of the data to be acquired, and acquire operational data from the information source, which is the storage device or control system. This makes it possible to acquire different additional information for each hold requirement accurately and efficiently.

[0096] Furthermore, the computing unit may repeatedly perform the processes of acquiring additional information regarding the pending requirements and determining compliance with the standard requirements, depending on the number of pending requirements. This allows for accurate handling when multiple pending requirements are identified and enables efficient compliance determination of the entire control system under evaluation.

[0097] Furthermore, the computing unit may repeatedly perform the processes of acquiring additional information and determining compliance with the standard requirements for each pending requirement until the predetermined value indicated by the operational data corresponding to each pending requirement reaches the threshold specified in the standard requirements. The results of the compliance determination for all requirements in the standard requirements may then be integrated to determine the compliance status of the control system. This makes it possible to determine compliance with the standard requirements more strictly and accurately.

[0098] Furthermore, the storage device may store at least several types of operational data as operational data in the control system, including network traffic, system logs, memory usage, CPU utilization, and event logs. The arithmetic unit may perform tasks such as identifying pending requirements, acquiring additional information, and determining compliance with each of the multiple types of operational data, or in combination according to the standard requirements. This makes it possible to acquire and utilize a wide range of operational data and to make more accurate judgments about compliance with standard requirements.

[0099] Furthermore, the standard requirements information may include information that conforms to items related to international standards or security policies (for example, values ​​corresponding to such items) as information representing the standard requirements. When identifying pending requirements, the computing unit may compare operational data with information that conforms to items related to international standards or security policies indicated by the standard requirements information. When acquiring additional information, the computing unit may acquire additional information from predefined information sources regarding the information that conforms to the items related to international standards or security policies that are pending requirements. When determining compliance, the computing unit may determine compliance with the standard requirements with respect to the information that conforms to the items related to international standards or security policies that are pending requirements, based on the additional information. This makes it possible to identify and acquire objective and reliable compliance judgment results for the control system under evaluation for external parties. [Explanation of symbols]

[0100] 1: Network analysis device, 2: Passive information database, 3: Legal compliance condition database

Claims

1. A storage device that stores operational data representing the operation of a control system in operation, and standard requirements information representing the standard requirements that the control system must satisfy, The operating data is compared with each standard requirement indicated by the standard requirement information to identify pending requirements for which the judgment of compliance with the standard requirement should be postponed, and additional information is obtained from a predetermined information source with respect to the pending requirement, which is information that satisfies the requirements defined as potentially necessary to resolve the pending requirement, and a computing device makes a judgment regarding compliance with the standard requirement with respect to the pending requirement based on the additional information. A network analysis device equipped with the following features.

2. The computing device passively collects the operational data in the control system and stores the operational data in the storage device. The network analysis device according to claim 1.

3. The computing device obtains the additional information, which serves as countermeasure information for dealing with situations where the pending requirements do not conform to the standard requirements, from the storage location of the countermeasure information, which is the information source. The network analysis device according to claim 1.

4. The computing device, in acquiring the additional information, expands the acquisition period or increases the data granularity of the operational data related to the retention requirements, and acquires the operational data from the information source, the storage device or the control system. The network analysis device according to claim 1.

5. The computing device, when acquiring the operational data as additional information, determines the type of additional information required for each of the holding requirements based on the content of the standard requirements, and expands the acquisition period or increases the granularity of the data to be acquired according to the type of additional information, and acquires the operational data from the information source, the storage device or the control system. The network analysis apparatus according to claim 4.

6. The calculation unit repeatedly performs the following processes with respect to the pending requirements: obtaining the additional information and determining compliance with the standard requirements, in accordance with the number of pending requirements. The network analysis device according to claim 1.

7. The calculation unit repeatedly performs the processes of acquiring additional information and determining compliance with the standard requirements for each pending requirement until the predetermined value indicated by the operational data corresponding to each pending requirement reaches the threshold specified in the standard requirements, and then integrates the results of the compliance determination for all requirements in the standard requirements to determine the compliance status of the control system. The network analysis device according to claim 6.

8. The storage device stores at least one or more types of operational data, including network traffic, system logs, memory usage, CPU utilization, and event logs, as operational data in the control system. The computing device performs the identification of the pending requirements, the acquisition of the additional information, and the determination of compliance with respect to each of the multiple types of operational data, or in combination according to the standard requirements. The network analysis device according to claim 1.

9. The aforementioned standard requirements information includes information that conforms to international standards or security policy items, as information representing the standard requirements. The aforementioned computing device is In identifying the aforementioned retention requirements, the operational data is compared with information that conforms to the international standards or security policy items indicated by the information of the standard requirements, In obtaining the aforementioned additional information, the additional information is obtained from pre-defined information sources with respect to the information that complies with the aforementioned international standards or security policy items, which are the pending requirements. In determining compliance, the following determination is made based on the additional information, with respect to the information that complies with the international standard or security policy items which are the pending requirements, to determine compliance with the standard requirements. The network analysis device according to claim 1.

10. The operational data representing the operation of the control system in operation is compared with the standard requirements indicated by the standard requirements information, which is information representing the standard requirements that the control system must satisfy, to identify the requirements for which the determination of compliance with the standard requirements should be postponed. From the information sources defined in advance with respect to the aforementioned retention requirements, additional information is obtained that satisfies the requirements defined as potentially necessary to resolve the aforementioned retention requirements. Based on the aforementioned additional information, the compliance with the aforementioned standard requirements is determined with respect to the aforementioned retention requirements. A network analysis method that performs the following using a computer.

11. The operational data representing the operation of the control system in operation is compared with the standard requirements indicated by the standard requirements information, which is information representing the standard requirements that the control system must satisfy, to identify the requirements for which the determination of compliance with the standard requirements should be postponed. From the information sources defined in advance with respect to the aforementioned retention requirements, additional information is obtained that satisfies the requirements defined as potentially necessary to resolve the aforementioned retention requirements. Based on the aforementioned additional information, the compliance with the aforementioned standard requirements is determined with respect to the aforementioned retention requirements. A computer program that causes a computer to perform a task.

Images