Supervisory Control System

Abstract

To provide a monitoring control system capable of defending a cyber attack even in a case where an L2 switch becomes an entrance of the cyber attack.SOLUTION: A network monitoring switch 20 of a monitoring control system 100 comprises an analysis unit 21 which analyzes packet data of a passing packet, a packet block unit 22 and a data storage unit 23. The analysis unit 21 includes: a port access analysis section 21A for determining whether or not a port which receives packet communication is an authorized port; a white list analysis section 21B; a traffic analysis section 21C; and a threat determination section 21D for determining a threat of the packet passing the network monitoring switch 20 from analysis results of the port access analysis section 21A, the white list analysis section 21B and the traffic analysis section 21C.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present application relates to a supervisory control system. [Background technology]

[0002] Conventionally, cybersecurity measures for control systems have been considered primarily to protect end-point devices such as PLCs (Programmable Logic Controllers), and control is performed by monitoring and analyzing address information and packet information to defend against external attacks. For example, a technology has been disclosed that monitors network packets, diagnoses the security threat level, and issues instructions to the source or destination device to deal with the situation (see Patent Document 1). A technology has been proposed that monitors and analyzes network packets, and blocks ports that are determined to have a problem (see Patent Document 2, for example). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP2018-157343A [Patent Document 2] JP 2019-92149 A Summary of the Invention [Problem to be solved by the invention]

[0004] In these conventional monitoring and control systems that use network monitoring switches, countermeasures have been considered that primarily aim to protect the control devices from intrusions and attacks by new malicious devices, but there was a problem in that the control system could not be defended when a known IP (Internet Protocol) device (such as a router) became the subject of an attack.

[0005] For example, in Patent Document 2, a communication port lockdown routine is used to prevent new malicious devices from communicating with control devices on the system. However, this is a technology for protecting control devices from external attacks, and there is an issue that it does not provide a countermeasure in the event that the L2 switch becomes a cyber attack device.

[0006] The present application aims to provide a monitoring and control system that can defend against an L2 switch becoming an entry point for a cyber attack. [Means for solving the problem]

[0007] The monitoring and control system disclosed in the present application comprises: A monitoring and control system in which a monitoring and control device that monitors and controls the operation of an external controlled device and a network monitoring switch as an L2 switch arranged between the monitoring and control device and the controlled device are connected via a network, the network monitoring switch comprises an analysis unit that analyzes packet data of a passing packet, a packet blocking unit that blocks the transport of the packet when a threat is found in the data, a management database that records information on packets that have passed in the past and a communication history, a whitelist database that records a source and a destination that have been confirmed to be safe, a configuration setting database that records setting information for the network monitoring switch, and a data storage unit that stores the analyzed traffic information of the packet in the management database; The analysis unit is a port access analysis unit that uses the Config setting database to determine whether a port that receives packet communication is an authorized port; a whitelist analysis unit that determines whether the MAC address, IP address, and communication protocol of the source and destination are recorded in the whitelist database; a traffic analysis unit that uses the management database to determine whether the frequency of use of the source and the destination and the packet interval are appropriate; a threat determination unit that determines a threat of the packet passing through the network monitoring switch based on analysis results of the port access analysis unit, the whitelist analysis unit, and the traffic analysis unit, The traffic analysis unit determines whether the packet interval is equal to or greater than a standard minimum packet interval for the bandwidth being used. death, the monitoring and control system includes a plurality of the network monitoring switches and an integrated management database that collectively holds setting information of the plurality of network monitoring switches; Each of the network monitoring switches includes a setting synchronization unit that transmits changed setting contents to the integrated management database when the contents of the whitelist database and the Config setting database are updated, and updates the whitelist database and the Config setting database using data received from the integrated management database; The integrated management database includes a setting synchronization table that records a combination of the network monitoring switches that synchronizes settings between the whitelist database and the Config setting database. It is something. In addition, the monitoring and control system disclosed in the present application is A monitoring and control system in which a monitoring and control device that monitors and controls the operation of an external controlled device and a network monitoring switch as an L2 switch arranged between the monitoring and control device and the controlled device are connected via a network, the network monitoring switch comprises an analysis unit that analyzes packet data of a passing packet, a packet blocking unit that blocks the transport of the packet when a threat is found in the data, a management database that records information on packets that have passed in the past and a communication history, a whitelist database that records a source and a destination that have been confirmed to be safe, a configuration setting database that records setting information for the network monitoring switch, and a data storage unit that stores the analyzed traffic information of the packet in the management database; The analysis unit is a port access analysis unit that uses the Config setting database to determine whether a port that receives packet communication is an authorized port; a whitelist analysis unit that determines whether the MAC address, IP address, and communication protocol of the source and destination are recorded in the whitelist database; a traffic analysis unit that uses the management database to determine whether the frequency of use of the source and the destination and the packet interval are appropriate; a threat determination unit that determines a threat of the packet passing through the network monitoring switch based on analysis results of the port access analysis unit, the whitelist analysis unit, and the traffic analysis unit, the traffic analysis unit determines whether the packet interval is equal to or greater than a standard minimum packet interval for a bandwidth being used; the network monitoring switch includes an interlocking cutoff table in which one communication path and an associated communication path related to the communication path are registered in advance; The packet blocking unit blocks communication of the one communication path and the associated communication path in cooperation with each other. In addition, the monitoring and control system disclosed in the present application is A monitoring and control system in which a monitoring and control device that monitors and controls the operation of an external controlled device and a network monitoring switch as an L2 switch arranged between the monitoring and control device and the controlled device are connected via a network, the network monitoring switch comprises an analysis unit that analyzes packet data of a passing packet, a packet blocking unit that blocks the transport of the packet when a threat is found in the data, a management database that records information on packets that have passed in the past and a communication history, a whitelist database that records a source and a destination that have been confirmed to be safe, a configuration setting database that records setting information for the network monitoring switch, and a data storage unit that stores the analyzed traffic information of the packet in the management database; The analysis unit is a port access analysis unit that uses the Config setting database to determine whether a port that receives packet communication is an authorized port; a whitelist analysis unit that determines whether the MAC address, IP address, and communication protocol of the source and destination are recorded in the whitelist database; a traffic analysis unit that uses the management database to determine whether the frequency of use of the source and the destination and the packet interval are appropriate; a threat determination unit that determines a threat of the packet passing through the network monitoring switch based on analysis results of the port access analysis unit, the whitelist analysis unit, and the traffic analysis unit, the traffic analysis unit determines whether the packet interval is equal to or greater than a standard minimum packet interval for a bandwidth being used; When the analysis unit detects the threat, it transmits information about the threat to a higher-level bus via a relay device. Effect of the Invention

[0008] According to the monitoring and control system disclosed in the present application, This makes it possible to provide a monitoring and control system that can be defended even if the L2 switch becomes the entry point for a cyber attack. [Brief description of the drawings]

[0009] [Figure 1] 1 is a block diagram showing a configuration of a monitoring and control system according to a first embodiment. [Diagram 2] 1 is a block diagram showing a configuration of a monitoring and control device according to a first embodiment. [Diagram 3] 4 is a flowchart of traffic diagnosis by an analysis unit according to the first embodiment. [Figure 4] 4 is a flowchart relating to network status monitoring according to the first embodiment. [Diagram 5] FIG. 11 is a block diagram showing a configuration of a monitoring and control system according to a second embodiment. [Figure 6] 13A and 13B are a block diagram showing a configuration of an integrated management database and a configuration of a setting synchronization table according to a second embodiment. [Figure 7] 11 is a flowchart according to a second embodiment. [Figure 8] FIG. 11 is a block diagram showing a configuration of a monitoring and control system according to a third embodiment. [Figure 9] 13 is a flowchart according to a third embodiment. [Figure 10] FIG. 11 is a block diagram showing a configuration of a monitoring and control system according to a fourth embodiment. [Figure 11] 13 is a flowchart according to a fourth embodiment. [Figure 12] FIG. 13 is a block diagram showing the configuration of a monitoring and control system according to a fifth embodiment. [Figure 13] FIG. 13 is a diagram showing a configuration of an interlocking cutoff table according to the fifth embodiment. [Figure 14] 13 is a flowchart according to the fifth embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Embodiment 1 The monitoring and control system according to the first embodiment will be described below with reference to the drawings. FIG. 1 is a block diagram showing the configuration of a monitoring and control system 100. As shown in FIG. FIG. 2 is a block diagram showing the configuration of the monitor and control device 90. As shown in FIG. The monitoring control system 100 includes a monitoring control device 90, a network monitoring terminal 10, a display processing unit 12, and a network monitoring switch 20 (hereinafter simply referred to as the monitoring switch 20) as an L2 switch. The monitoring switch 20 is connected to external controlled devices 40A, 40B, . . . 40X via a network 50.

[0011] The monitoring and controlling device 90 is configured with a processor 91 and a storage device 92, as shown in FIG. 2, which is an example of hardware. The storage device includes a volatile storage device such as a random access memory, not shown, and a non-volatile auxiliary storage device such as a flash memory. Also, instead of the flash memory, an auxiliary storage device such as a hard disk may be included. The processor 91 executes a program input from the storage device 92. In this case, the program is input from the auxiliary storage device to the processor 91 via the volatile storage device. Also, the processor 91 may output data such as a calculation result to the volatile storage device of the storage device 92, or may store the data in the auxiliary storage device via the volatile storage device. The monitoring and controlling device 90 monitors and controls the operations of the external controlled devices 40A to 40X.

[0012] The monitoring switch 20 comprises an analysis unit 21 that analyzes packet data of packets passing through the monitoring switch 20, a packet blocking unit 22 that blocks the transportation of the packet if a threat (such as a virus) is found in the data, and a data storage unit 23 that stores the analyzed traffic information of the passing packets.

[0013] The analysis unit 21 includes a port access analysis unit 21A that analyzes access to the input port of the monitoring switch 20, a whitelist analysis unit 21B that analyzes the safety of the source and destination, a traffic analysis unit 21C that analyzes the safety of traffic passing through the monitoring switch 20, and a threat determination unit 21D that comprehensively determines the threat of packets passing through the monitoring switch 20 based on the analysis results of the port access analysis unit 21A, the whitelist analysis unit 21B, and the traffic analysis unit 21C.

[0014] The monitoring switch 20 also has three databases: a management database DB1 that records packet information and communication history that have passed through in the past, a whitelist database DB2 that records sources and destinations that have been confirmed to be safe, and a configuration setting database DB3 that records permitted input port information and other various setting information. The port access analysis unit 21A uses the configuration setting database DB3. The whitelist analysis unit 21B uses the whitelist database DB2. The traffic analysis unit 21C uses the management database DB1.

[0015] The data recorded in each of the databases DB1 to DB3 is processed by the display processing unit 12, and the state of the network 50 can be monitored by the network monitoring terminal 10. The network monitoring terminal 10 can set the packet interval and the usage frequency threshold of each monitoring switch 20, thereby setting the security level of the network 50.

[0016] Next, the operation of the monitoring switch 20 will be described. FIG. 3 is a flowchart of traffic diagnosis by the analysis unit 21. The communication via the monitoring switch 20 is first analyzed in three steps by the analysis unit 21. When the monitoring switch 20 receives a packet communication (step S001), the port access analysis unit 21A first determines whether the communication is to a port registered in the Config setting database DB3 that is permitted to be connected (step S002). Next, the whitelist analysis unit 21B determines whether the MAC addresses (Media Access Control addresses), IP addresses, and communication protocols of the source and destination are within the ranges recorded in the whitelist database DB2 (step S003). Next, the traffic analysis unit 21C determines the frequency of use of the source and destination, whether the packet interval is appropriate, and whether it is equal to or greater than the standard minimum packet interval of the bandwidth used (step S004). The frequency of use may be set by diagnosing the normal operation of the system in operation in advance and setting a threshold value, and setting it so that it is detected when the threshold value is exceeded (when the packet interval becomes smaller).

[0017] If it is determined that the conditions are not met in any of steps S002 to S004, the packet blocking unit 22 blocks the communication (step S005) and issues an alert (step S006). If it is determined that the conditions are met in all of steps S002 to S004, the communication is permitted (step S007), and the data storage unit 23 stores the communication data in the management database DB1 (step S008). In addition, the communication status is displayed on the network monitoring terminal 10 via the display processing unit 12 (step S009), thereby visualizing the information.

[0018] FIG. 4 is a flowchart relating to the state monitoring of the network 50 according to the first embodiment. The monitoring control system 100 detects threats on the network 50, blocks and reports malicious traffic, and also visualizes the state of the network 50, making it possible to constantly monitor the state. The display processing unit 12 acquires data such as a list of IP addresses of connected devices stored by the monitoring switch 20, their usage status, communication history, and current traffic status, and performs visualization processing (step S101). Furthermore, the administrator can view selected information on the network monitoring terminal 10 (step S102). Furthermore, if the monitoring switch 20 detects a threat, an alert is displayed (step S103) to notify the administrator that a threat has been detected.

[0019] According to the monitoring and control system of the first embodiment, L2 switch This makes it possible to provide a monitoring and control system that can defend against cyber attacks even if the system becomes an entry point for them. In addition, access port analysis and whitelist analysis can be used to prevent communication from unknown IP devices, and traffic analysis can be used to prevent the spread of attacks from already connected IP devices. do.

[0020] Embodiment 2 The monitoring and control system according to the second embodiment will be described below with reference to the drawings, focusing on the differences from the first embodiment. FIG. 5 is a block diagram showing the configuration of the monitoring and control system 200. As shown in FIG. FIG. 6 is a block diagram showing the configuration of the integrated management database DB4 and a diagram showing the configuration of the setting synchronization table STB. FIG. 7 is a flowchart according to the second embodiment. In the second embodiment, the monitoring control system 200 includes a plurality of monitoring switches 220 (220A, 220B, . . . 220X) and an integrated management database DB4 that collectively holds various setting information of the plurality of monitoring switches 220A, 220B, . . . 220X.

[0021] The integrated management database DB4 includes setting data DTA of the monitoring switch 220A, setting data DTB of the monitoring switch 220B, and setting data DTX of the monitoring switch 220X. The setting data DTA to DTX store at least the same information as that recorded in the whitelist database DB2 and the Config setting database DB3 of each of the monitoring switches 220A to 220X.

[0022] The integrated management database DB4 also includes a setting synchronization table STB that records in advance combinations of the monitoring switches 220 whose settings should be synchronized among the multiple monitoring switches 220A to 220X (step S201).

[0023] In the case where multiple monitoring switches 220 (220A, 220B) are implemented in the monitoring control system 200, when the contents of the whitelist database DB2 and the Config setting database DB3 of one of the monitoring switches 220 are updated (step S202), the setting synchronization unit 24 of the monitoring switch 220A transmits the changed setting contents to the integrated management database DB4. When the update information receiving unit DB4IN of the integrated management database DB4 receives the changed setting data from the monitoring switch 220A, it refers to the setting synchronization table STB and searches for the monitoring switches 220B to 20X whose settings are to be synchronized using the setting synchronization table.

[0024] If there are any switches 20B-20X to be synchronized, the setting data DTA and the corresponding setting data DTB-DTX are updated, and the updated setting data is transmitted to the target monitoring switches 220B-220X by the update information transmission unit DB4OUT. The setting synchronization unit 24 of the monitoring switches 220B-220X that have received the setting data rewrites and updates the contents of the whitelist database DB2 and Config setting database DB3 in the switch using the received setting data (step S203).

[0025] According to the monitoring and control system of embodiment 2, when the settings of one specific monitoring switch 220A and the whitelist database DB2 are updated, the same update information is deployed to the related monitoring switches 220B to 220X via the integrated management database DB4, and the same settings can be automatically made to the related monitoring switches 220B to 220X.

[0026] Embodiment 3 The monitoring and control system according to the third embodiment will be described below with reference to the drawings, focusing on the differences from the first and second embodiments. FIG. 8 is a block diagram showing the configuration of the monitoring and control system 300. As shown in FIG. The monitoring and control system 300 includes a monitoring switch 220 and a relay device 70 connected to a higher-level bus 305 of the wide-area monitoring and control system.

[0027] When the analysis unit 21 in the monitoring switch 220 detects a threat by communication analysis as in the first embodiment, the analysis unit 21 transmits the information to the upper bus 305 via the relay device 70. The data transmitted to the upper bus 305 is stored in a file server 350 connected to the upper bus 305. An administrator can monitor and manage the communication paths to be monitored using the wide area monitoring control terminal 60.

[0028] FIG. 9 is a flowchart according to the third embodiment. When the analysis unit 21 in the monitoring switch 220 detects a threat in traffic analysis (step S301), the fact that the threat has been detected and information about it (source, destination, and details of the threat) are transmitted to the wide-area monitoring control system via the relay device 70 and the upper bus 305 (step S302). Then, the wide-area monitoring control terminal 60 notifies the user by sounding an alarm or the like that the monitoring switch 220 has detected an abnormality. The transmitted information is stored in the file server 350 (step S303).

[0029] According to the monitoring and control system of the third embodiment, the communication of the path specified by the administrator can be judged as normal or abnormal as one item. That is, by linking the wide-area monitoring and control system with the network monitoring switch and monitoring the network status with the wide-area monitoring and control system, it is possible to realize unified wide-area monitoring including security events.

[0030] Embodiment 4 The monitoring and control system according to the fourth embodiment will be described below with reference to the drawings, focusing on the differences from the first to third embodiments. FIG. 10 is a block diagram showing the configuration of the monitoring and control system 400. As shown in FIG. FIG. 11 is a flowchart according to the fourth embodiment. In this embodiment, when the threat determination unit 21D of the monitoring switch 420A detects a threat (step S401), the alert generation unit 21E generates the contents of the threat as an alert (step S402) and notifies the administrator and an address specified by the administrator by email (step S403).

[0031] At the same time, the security history and traffic history up until the threat was detected are sent to the network monitoring terminal 10. The network monitoring terminal 10 displays the received information on a daily or hourly basis in a graph. This history data is obtained from the management database DB1 held by the monitoring switch 420A.

[0032] According to the monitoring control system of the fourth embodiment, a threat occurring in a network can be promptly notified to relevant parties. Also, the location where the threat occurred can be quickly identified using the network monitoring terminal 10.

[0033] Embodiment 5. The monitoring and control system according to the fourth embodiment will be described below with reference to the drawings, focusing on the differences from the first to fourth embodiments. FIG. 12 is a block diagram showing the configuration of the monitoring and control system 500. FIG. 13 is a diagram showing the configuration of the interlocking cutoff table 25. As shown in FIG. FIG. 14 is a flowchart according to the fifth embodiment. In this embodiment, it is assumed that the monitoring control system 500 includes a plurality of monitoring switches 520 (520A, 520B). A certain communication path, an associated communication path related to the communication path, and a threshold (upper limit) of the number of packets per predetermined time of the associated communication path are registered in advance in the interlocking cutoff table 25. When the threat determination unit 21D of a specific monitoring switch 520A detects a threat and cuts off communication (step S501), the packet cutoff unit 522 refers to the interlocking cutoff table 25 of the network monitoring switch 520A (step S502).

[0034] If there is an associated communication path for the communication path where a threat has been detected, the current communication state of the associated communication path is checked (step S503). If the check result shows that the packet interval is smaller than the set threshold, the packet blocking unit 522 also blocks communication on this associated path (step S504). Furthermore, if the associated communication path is monitored by another monitoring switch 520B (step S505), the packet blocking unit 522 of that monitoring switch 520B is instructed to check the communication state.

[0035] According to the monitoring control system of the fifth embodiment, it is possible to prevent damage from spreading because it is possible to cut off not only the path where a threat has occurred but also the communication of related communication paths in a coordinated manner. Also, even if the related path is under the monitoring of another monitoring switch, the cutoff process can be coordinated between the monitoring switches.

[0036] Although the present application describes various exemplary embodiments and examples, the various features, aspects, and functions described in one or more embodiments are not limited to application to a particular embodiment, but may be applied to the embodiments alone or in various combinations. Therefore, countless modifications not exemplified are assumed within the scope of the technology disclosed in this application, including, for example, modifying, adding, or omitting at least one component, and further, extracting at least one component and combining it with a component of another embodiment. [Explanation of symbols]

[0037] 100,200,300,400,500 Monitoring and control systems, 10 network monitoring terminal, 12 display processing unit, 20,20B,220,220A,220B,220X,420A,520,520A,520B network monitoring switches, 21 Analysis unit, 21A Port access analysis unit, 21B Whitelist analysis unit, 21C traffic analysis unit, 21D threat determination unit, 21E alert generation unit, 22,522 packet blocking unit, 23 data storage unit, 24 setting synchronization unit, 25 Interlocking cutoff table, 40A~40X Controlled device, 350 File server, 60 wide area monitoring and control terminal, 70 relay device, 90 monitoring and control device, 91 processor, 92 storage device, 305 upper bus, DB1 management database, DB2 Whitelist Database, DB3 Config Setting Database, DB4 Integrated Management Database, DB4IN Update Information Receiver, DB4OUT Update information transmission section, DTA, DTB, DTX Setting data, STB setting synchronization table.

Claims

1. A monitoring and control system in which a monitoring and control device that monitors and controls the operation of an external controlled device and a network monitoring switch as an L2 switch arranged between the monitoring and control device and the controlled device are connected via a network, the network monitoring switch comprises an analysis unit that analyzes packet data of a passing packet, a packet blocking unit that blocks the transport of the packet when a threat is found in the data, a management database that records information on packets that have passed in the past and a communication history, a whitelist database that records a source and a destination that have been confirmed to be safe, a Config setting database that records setting information for the network monitoring switch, and a data storage unit that stores analyzed traffic information of the packet in the management database; The analysis unit is a port access analysis unit that uses the Config setting database to determine whether a port that receives packet communication is an authorized port; a whitelist analysis unit that determines whether the MAC address, IP address, and communication protocol of the source and destination are recorded in the whitelist database; a traffic analysis unit that uses the management database to determine whether the frequency of use of the source and the destination and the packet interval are appropriate; a threat determination unit that determines a threat of the packet passing through the network monitoring switch based on analysis results of the port access analysis unit, the whitelist analysis unit, and the traffic analysis unit, the traffic analysis unit determines whether the packet interval is equal to or greater than a standard minimum packet interval for a bandwidth being used; the monitoring and control system includes a plurality of the network monitoring switches and an integrated management database that collectively holds setting information of the plurality of network monitoring switches; Each of the network monitoring switches includes a setting synchronization unit that transmits changed setting contents to the integrated management database when contents of the whitelist database and the Config setting database are updated, and updates the whitelist database and the Config setting database using data received from the integrated management database; The integrated management database is a monitoring and control system including a setting synchronization table that records combinations of the network monitoring switches that synchronize settings between the whitelist database and the Config setting database.

2. A monitoring and control system in which a monitoring and control device that monitors and controls the operation of an external controlled device and a network monitoring switch serving as an L2 switch disposed between the monitoring and control device and the controlled device are connected via a network, the network monitoring switch comprises an analysis unit that analyzes packet data of a passing packet, a packet blocking unit that blocks the transport of the packet when a threat is found in the data, a management database that records information on packets that have passed in the past and a communication history, a whitelist database that records a source and a destination that have been confirmed to be safe, a Config setting database that records setting information for the network monitoring switch, and a data storage unit that stores analyzed traffic information of the packet in the management database; The analysis unit is a port access analysis unit that uses the Config setting database to determine whether a port that receives packet communication is an authorized port; a whitelist analysis unit that determines whether the MAC address, IP address, and communication protocol of the source and destination are recorded in the whitelist database; a traffic analysis unit that uses the management database to determine whether the frequency of use of the source and the destination and the packet interval are appropriate; a threat determination unit that determines a threat of the packet passing through the network monitoring switch based on analysis results of the port access analysis unit, the whitelist analysis unit, and the traffic analysis unit, the traffic analysis unit determines whether the packet interval is equal to or greater than a standard minimum packet interval for a bandwidth being used; the network monitoring switch includes an interlocking cutoff table in which one communication path and an associated communication path related to the communication path are registered in advance; The packet blocking unit is a monitoring and control system that blocks communication of the one communication path and the related communication path in conjunction with each other.

3. A monitoring and control system in which a monitoring and control device that monitors and controls the operation of an external controlled device and a network monitoring switch that is an L2 switch disposed between the monitoring and control device and the controlled device are connected via a network, the network monitoring switch comprises an analysis unit that analyzes packet data of a passing packet, a packet blocking unit that blocks the transport of the packet when a threat is found in the data, a management database that records information on packets that have passed in the past and a communication history, a whitelist database that records a source and a destination that have been confirmed to be safe, a Config setting database that records setting information for the network monitoring switch, and a data storage unit that stores analyzed traffic information of the packet in the management database; The analysis unit is a port access analysis unit that uses the Config setting database to determine whether a port that receives packet communication is an authorized port; a whitelist analysis unit that determines whether the MAC address, IP address, and communication protocol of the source and destination are recorded in the whitelist database; a traffic analysis unit that uses the management database to determine whether the frequency of use of the source and the destination and the packet interval are appropriate; a threat determination unit that determines a threat of the packet passing through the network monitoring switch based on analysis results of the port access analysis unit, the whitelist analysis unit, and the traffic analysis unit, the traffic analysis unit determines whether the packet interval is equal to or greater than a standard minimum packet interval for a bandwidth being used; The analysis unit transmits information about the threat to a higher-level bus via a relay device when the threat is detected.

4. the monitoring and control system includes a plurality of the network monitoring switches and an integrated management database that collectively holds setting information of the plurality of network monitoring switches; Each of the network monitoring switches includes a setting synchronization unit that transmits changed setting contents to the integrated management database when contents of the whitelist database and the Config setting database are updated, and updates the whitelist database and the Config setting database using data received from the integrated management database; 4. The monitoring and control system according to claim 2, wherein the integrated management database includes a setting synchronization table that records combinations of the network monitoring switches that synchronize settings between the whitelist database and the Config setting database.

5. 5. The monitoring and control system according to claim 1, wherein the network monitoring switch includes an alert generating unit that generates an alert and notifies the content of the threat determined by the threat determining unit.

6. the network monitoring switch includes an interlocking cutoff table in which one communication path and an associated communication path related to the communication path are registered in advance; 6. The monitoring and control system according to claim 1, wherein the packet blocking unit blocks communication of the one communication path and the associated communication path in cooperation with each other.

7. The monitoring and control system according to claim 1, 2, or 4 to 6, wherein when the analysis unit detects the threat, it transmits information about the threat to a higher-level bus via a relay device.

Images