Cyber ​​resilience analysis device, method, and program

Abstract

To quantize the effectiveness of planned measures against cyber attacks.SOLUTION: A cyber resilience analyzing device has: a creation unit that creates models for a control process, a component, and an agent by using a modeling method that can represent a time-series change, and regulates a dependence between the models; an update unit that temporally develops the model for the control process, the model for the component, and the model for the agent on the basis of the dependence from when a cyber attack carried out by the agent is started until when the measures against the cyber attack based on a predetermined plan conducted by another agent is completed, and records time-series data obtained from the models during the temporal development; and a calculation unit that calculates, based on the time-series data, a predetermined evaluation index for evaluating the measures according to the plan.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present disclosure relates to cybersecurity technology. [Background technology]

[0002] With the digital transformation (DX) of the industrial sector, the number of cases where IoT (Internet of Things) technology is being introduced to industrial computer systems (industrial control systems) is increasing. As a result, cybersecurity threats have become apparent in industrial control systems, just as they have in traditional IT systems. Cyberattacks on industrial control systems, including critical infrastructure, have a large social impact and may cause accidents related to the environment, health, and safety, so there is an urgent need to respond to them.

[0003] In recent years, the threat of APT (Advanced Persistent Threat) attacks, which are advanced attacks that are carried out continuously for a long period of time with the intention of damaging a specific industrial control system, has also increased. APT attacks often involve zero-day attacks, which exploit unknown vulnerabilities that are not publicly disclosed. While implementing sufficient security measures is essential to minimize risk, it is difficult to completely prevent APT attacks that involve zero-day attacks. Therefore, in order to reduce security risks, it is also important to take measures to minimize the impact on business even if an attack occurs, while establishing an organizational structure that can quickly restore the system. In the field of cybersecurity, the ability and resistance of a system to prevent cyber attacks is often called cyber resilience. Here, resistance refers to the ability to quickly deal with threats and restore the system after being attacked by a cyber attack. When the term cyber resilience is used in this specification, the definition of the term follows the definition above.

[0004] The first element in enhancing cyber resilience is to take sufficient preventive measures against cyber attacks, that is, measures to prevent attackers from attacking systems. To do this, it is effective to predict the series of paths and actions (hereinafter referred to as "attack scenarios") that an attacker will take from the attacker's perspective, from the time they infiltrate the target system to the time they achieve their goal, evaluate the risks, and then introduce the necessary measures.

[0005] The second element for enhancing cyber resilience is to prepare a plan in advance for the case where a cyberattack cannot be prevented, from detecting the threat to responding and recovering. The response and recovery plan must include the procedures from when an operator working on the industrial control system notices an abnormality to when he or she reports it to the incident responder, as well as the first response procedures that the incident responder should take immediately after receiving the report. It is desirable to have an organizational structure in place that allows the procedures to be immediately determined depending on the attack scenario that occurs.

[0006] However, unlike IT systems, availability is often the most important factor in industrial control systems, and if the response and recovery procedures after an attack are not followed correctly, the entire industrial facility may stop operating, which may lead to more damage. Therefore, in order to plan and implement a response plan after an attack occurs in an industrial control system, not only advanced security knowledge but also the operation of special systems where availability is important must be taken into consideration. As a specific example, if an attacked terminal does not affect the operation of the system, measures different from those taken in IT systems may be taken, such as continuing to operate until the next maintenance.

[0007] Patent Document 1 proposes a technology that generates a graph showing the connections between resources (assets) to be subject to security assessment, a graph showing the connections between areas in which the resources are located, and an attack graph (a graph showing the sequence of attacking actions by an attacker) against the resources by linking them together. By using this technology, it is possible to reproduce attack scenarios assumed in an industrial control system to be analyzed (hereinafter referred to as the "analysis target system").

[0008] Patent Document 2 proposes a technology that calculates the expected value of damage caused by cyber attacks in a specified period of time in a system to be analyzed based on predefined countermeasure information, vulnerability information, attack information, and risk event information. By using this technology, it is possible to specify the cost-effectiveness of security measures, which was previously unclear, and to determine their sufficiency. [Prior art documents] [Patent documents]

[0009] [Patent Document 1] International Publication No. WO2019 / 186722 [Patent Document 2] International Publication No. WO2016 / 200991 [Non-patent literature]

[0010] [Non-Patent Document 1] S. Berger, C. van Dun, and B. Haeckel, “IT Availability Risks in Smart Factory Networks - Analyzing the Effects of IT Threats on Production Processes Using Petri Nets” Information Systems Frontiers, 2022. [Non-Patent Document 2] D. Myers, K. Radke, S. Suriadi, and E. Foo, “Process Discovery for Industrial Control System Cyber ​​Attack Detection” 32th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), 2017, pp. 61-75 Summary of the Invention [Problem to be solved by the invention]

[0011] By utilizing the technology described in Patent Document 1 or Patent Document 2, it is possible to take preventive measures against cyber attacks and satisfy the first element for enhancing cyber resilience. In addition, by utilizing the technology described in Non-Patent Document 1, it is possible to quantify the risk regarding the availability of the entire system to be analyzed by modeling information devices and production processes in a factory environment.

[0012] However, the scope of modeling in the technology of Non-Patent Document 1 does not include human behavior such as operators and incident responders who act in response to a cyber attack. Therefore, the technology of Non-Patent Document 1 cannot determine the second element for enhancing cyber resilience, that is, how effective the response to be taken when a target system is attacked by a cyber attack.

[0013] One objective of this disclosure is to provide techniques for quantifying the effectiveness of planned responses to cyber attacks. [Means for solving the problem]

[0014] A cyber resilience analysis device according to one aspect of the present disclosure has a generation unit that generates models for a control process, a component, and an agent using a modeling method capable of expressing time-series changes and specifies dependencies between the models, an update unit that evolves the model of the control process, the model of the component, and the model of the agent over time based on the dependencies from the time when a cyber-attack by an agent is initiated until a response to the cyber-attack by another agent based on a specified plan is completed, and records time series data obtained from the models during the time evolution, and a calculation unit that calculates a specified evaluation index for evaluating a response according to the plan based on the time series data. Effect of the Invention

[0015] One aspect of the present disclosure makes it possible to quantify the effectiveness of planned responses to cyber attacks. [Brief description of the drawings]

[0016] [Figure 1] FIG. 1 is a block diagram showing an example of the configuration of a cyber resilience assessment system according to a first embodiment. [Diagram 2] FIG. 1 is a conceptual diagram illustrating an example of a system to be analyzed. [Diagram 3] FIG. 13 is a diagram showing an example of a control process log acquired from a production line. [Figure 4] 1 is a flowchart of processing executed by a cyber resilience analysis device in the first embodiment. [Diagram 5] FIG. 2 is a conceptual diagram showing the relationship between a control process, components, and agents. [Figure 6] FIG. 2 illustrates an example of a model of a control process. [Figure 7] FIG. 13 is a diagram showing an example of information input by a user to generate a model of a component. [Figure 8] FIG. 1 is a diagram illustrating an example of a model of a component reproduced by a Petri net. [Figure 9]FIG. 13 is a diagram illustrating an example of an operation definition of an attack agent. [Figure 10] FIG. 1 illustrates an example of a model of an attack agent. [Figure 11] FIG. 13 is a diagram showing an example of a model of a countermeasure agent created using a Petri net. [Figure 12] FIG. 13 is a diagram showing an example of a model of an operator agent using a Petri net. [Figure 13] FIG. 11 is a diagram showing an example of model information of an operator agent. [Figure 14] FIG. 13 is a diagram illustrating an example of time-series data of a model of a control process. [Figure 15] FIG. 13 is a diagram illustrating an example of time-series data of a component model. [Figure 16] FIG. 13 is a diagram illustrating an example of time-series data of an agent model. [Figure 17] FIG. 13 is a diagram showing an example of a screen displayed based on a calculation result 120E in the first embodiment. [Figure 18] FIG. 13 is a diagram illustrating an example of a screen displaying a list of key performance indicators for each scenario. [Figure 19] FIG. 13 is a diagram illustrating an example of a screen displaying information about a model. [Figure 20] FIG. 11 is a conceptual diagram showing an image of the operation of a model in the second embodiment. [Figure 21] 13 is a flowchart of a process executed by a cyber resilience analysis device in the second embodiment. [Figure 22] FIG. 13 is a diagram showing an example of a screen displayed based on a calculation result 120E in the second embodiment. [Diagram 23] 13 is a flowchart of a process executed by a cyber resilience analysis device in the third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017] (First embodiment) A cyber resilience assessment system according to a first embodiment will be described with reference to the drawings.

[0018] The cyber resilience assessment system is a system that evaluates the cyber resilience of, for example, industrial control systems that operate industrial machinery under the control of control devices and process materials or manufacture products.

[0019] FIG. 1 is a block diagram showing an example of the configuration of a cyber resilience assessment system according to the first embodiment.

[0020] The cyber resilience assessment system 1 includes a cyber resilience analysis device 11, a control device 12, and an input / output device 13, and is configured such that the control device 12 and the input / output device 13 are connected to the cyber resilience analysis device 11. The cyber resilience analysis device 11 is a computer equipped with a processor and a storage device as hardware, and has a processing unit 110 and a storage unit 120 as functional components.

[0021] The storage unit 120 is a storage device that stores data, and may store a control process log 120A, a model template 120B, a generative model 120C, time-series data 120D, and a calculation result 120E. As in this example, the storage unit 120 may be constructed inside the cyber resilience analysis device 11, or the storage unit 120 may be constructed in an external storage medium such as a hard disk drive (HDD) or a solid state drive (SSD) that is independent of the cyber resilience analysis device 11.

[0022] The input / output device 13 is a device that allows a user to interactively input and output data to the cyber resilience analysis device 11, and is mainly composed of a keyboard, mouse, display, etc.

[0023] The processing unit 110 is a functional unit realized by the processor executing a software program. The processing unit 110 includes a collection unit 110A, a generation unit 110B, an update unit 110C, a calculation unit 110D, an output unit 110E, and a learning unit 110F.

[0024] The collection unit 110A collects operation information, which is information relating to the results of the operation of the analysis target system, from the control device 12, converts it into log information in an accumulation format including time information, and stores it in the memory unit 120 as a control process log 120A.

[0025] The control device 12 is a device that controls industrial machines of the system to be analyzed, and examples thereof include a programmable logic controller (PLC), a remote terminal unit (RTU), an IoT sensor, and a server.

[0026] FIG. 2 is a conceptual diagram showing an example of a system to be analyzed. The system to be analyzed in the first embodiment is a production line 2. The industrial machines used in the production line 2 include a plurality of conveyors 21 and a plurality of robots 22. The control device 12 controls the conveyors 21 and the robots 22 according to a control process. The conveyor 21 carries, distributes, and collects the material 23 according to the control from the control device 12. The robot 22 processes the material 23 according to the control from the control device 12. The production line 2 illustrated in FIG. 2 is configured such that the material 23 flowing from the outside by the conveyor 21a is distributed to the conveyors 21a and 21b of two lines, the robot 22a (robot A) or the robot 22b (robot B) arranged on each line processes the material 23, and the processed material 23 is collected and output to the conveyor 21o.

[0027] The operation results of the production line 2 controlled by the control device 12 in accordance with the control process are acquired by the control device 12, collected by the collection unit 110A, and stored in the storage unit 120 as a control process log 120A.

[0028] Fig. 3 is a diagram showing an example of a control process log acquired from a production line. The control process includes multiple processes, and in the control process log 120A, the process names of processes that occurred at the times listed in the time column 31 are recorded in chronological order in the process column 33. Each process is assigned a unique ID 32. In the case of Fig. 3, the ID of the process "material allocation" is 1, the ID of the process "robot A processing" is 2, and the ID of the process "robot B processing" is 3.

[0029] Returning to FIG. 1, the generation unit 110B uses the control process log 120A and the model template 120B stored in the storage unit 120 to generate a model that reproduces the operating subjects related to the analysis target system. The model template 120B includes a template of a model having a basic configuration of each operating subject. The user may set various parameters used by the generation unit 110B, the update unit 110C, and the calculation unit 110D through the input / output device 13 at the timing of starting the generation unit 110B. The model generated by the generation unit 110B is stored in the storage unit 120 as a generation model 120C. As soon as the generation unit 110B completes the generation of the model, the update unit 110C operates.

[0030] The update unit 110C reads out the model stored in the storage unit 120 as the generative model 120C, and evolves the state of the read out model over time. The time-evolved period is specified by, for example, a user so as to include a period from the start of a cyber-attack until the cyber-attack response based on a predetermined response plan is completed and the analysis target system is restored. The update unit 110C stores information obtained from the time-evolved model at each time in the storage unit 120 as time-series data 120D. When the update unit 110C completes the time-evolved model for the period specified by the user, the calculation unit is started. Note that the control process log 120A stored in the storage unit 120 is used in a second embodiment described later, but is not used in the first embodiment.

[0031] The calculation unit 110D reads out the time series data 120D stored in the storage unit 120, and calculates the key performance indicators set by the user based on the data. The key performance indicators are evaluation indicators for evaluating important performance of the analysis target system. When factors that negatively affect the performance of the analysis target system exist, the key performance indicators decrease. For example, if the results such as the production volume of products obtained from the analysis target system decrease until the operation of the analysis target system that has fallen into an unintended state due to a cyber attack on the control device 12 is restored, the key performance indicators decrease. Therefore, the effectiveness of measures against cyber attacks can be evaluated by the key performance indicators. The calculation unit 110D stores the calculated key performance indicators in the storage unit 120 as calculation results 120E. Note that the learning unit 110F functions only in the third embodiment described later.

[0032] The output unit 110E is activated in response to an instruction from a user, and displays any time series data 120D and / or calculation results 120E stored in the storage unit 120 through the input / output device 13. At that time, the display format is not particularly limited as long as the time series data 120D and / or calculation results 120E are visible. For example, the numerical values ​​themselves may be displayed in a table format, or the numerical values ​​may be displayed in a graph format.

[0033] The operations of generating section 110B, updating section 110C, and calculating section 110D will be described in detail below.

[0034] FIG. 4 is a flowchart of processing executed by the cyber resilience analysis device in the first embodiment.

[0035] In step S101, the generation unit 110B generates a model of a control process in which a control device (e.g., a PLC) controls industrial machinery (e.g., a conveyor, a robot) in the system to be analyzed (e.g., a production line), a component which is an information system (e.g., an industrial computer system) that controls the execution of the control process, and an agent which is a person (e.g., a malicious person, an operator, a system administrator) that causes a security event that affects the function of the component.

[0036] An example of the above three types of models will be described below.

[0037] FIG. 5 is a conceptual diagram showing the relationship between the control process, components, and agents.

[0038] First, the control process model will be described.

[0039] A control process refers to a control process in an industrial control system, and in a production line, it means a process of generating or processing a product. In an industrial control system, dynamic changes in the system configuration are few, and predetermined processes are often repeated in the same order and at the same time intervals. Therefore, graph theory with the concept of time is suitable for modeling the control process of an industrial control system. For example, it is possible to reproduce the control process of an industrial control system by using graph theory with the concept of time added to Petri nets and finite automata. Petri nets and finite automata with the concept of time are called timed Petri nets and timed automatons.

[0040] FIG. 6 is a diagram illustrating an example of a model of a control process.

[0041] The control process model 50 is a model that expresses the control process of the production line illustrated in FIG. 2 and FIG. 5 by using a Petri net. A Petri net is a bipartite directed graph that is composed of two types of nodes: places represented by circles and transitions represented by bars or boxes. A delay time can be specified for the firing of a transition, and as soon as the transition is fired, a token represented by a black circle moves between places. In the example of this embodiment, a token is associated with a material or a product. A state that a material can take in a control process is represented by a place. For example, if there is a token in a place p52 labeled "waiting for processing", it means that the product is in a state of waiting for processing. Similarly, if there is a token in a place p53 labeled "waiting for collection", it means that the product is in a state of "waiting for collection". Each process included in the control process illustrated in FIG. 3 is represented by a transition. In order for a token to move between places, transitions t51 to t54 need to fire. By defining the firing delay time for each transition t51 to t54, it is possible to reproduce the processing of materials according to the time required for the process in an actual control system. Note that the time Petri net is an example of a modeling method capable of expressing time series changes, but the present invention is not limited to this method, and other modeling methods capable of expressing time series changes, such as timed automata, may be used.

[0042] In the model 50, the issued token is first placed in the place p51 labeled "process start". When the transition t51 labeled "material allocation" is fired, the token moves to the place p52 labeled "waiting for processing". If the transition t52 labeled "robot A processing" or the transition t53 labeled "robot B processing" is fired, the token moves to the place p53 labeled "waiting for collection". If the transition t54 labeled "material collection" is fired, the token moves to the place p54 labeled "process end". In this way, if the token issued to the place p51 labeled "process start" can be moved to the place p54 labeled "process end", it is considered that the production of one product has been successful. The token is issued to a place specified by the user at a certain time interval. This time interval may be calculated based on the data of the control process log 120A stored in the storage unit 120 and used as an average time interval in an actual control system. Moreover, the delay times of the transitions t51 to t54 may be calculated based on the data of the control process log 120A stored in the storage unit 120, and an average time interval in the actual control system may be calculated and used.

[0043] The control process model may be created by a user through manual input from the input / output device 13, or may be automatically generated by the generation unit 110B based on the operation of the actual control system, based on the control process log 120A stored in the storage unit 120. The generation unit 110B may utilize a technique such as process mining when automatically generating the model. Non-Patent Document 2 describes an example of process mining.

[0044] Next, the component model will be described.

[0045] A component is an information device that executes a control process in the system to be analyzed. If a component does not operate normally, the control process cannot be executed normally in the system to be analyzed. Dependencies may be defined between components. Dependencies between components are used to describe the relationship when one component requires another component to operate normally.

[0046] The component model generated by the generating unit 110B can reproduce various possible states depending on the occurrence of a security event as described below. Examples of states that the component model can reproduce include a normal operation state, an abnormal operation state, an infringement state, an abnormal operation concealment state, and a maintenance state. The normal operation state refers to a state in which the component is executing an intended operation. The abnormal operation state refers to a state in which the component is not executing an intended operation. The infringement state refers to a dangerous state in which the component is executing the same operation as the normal operation state but allows an attacker attempting a cyber attack to invade the terminal. The abnormal operation concealment state refers to a state in which information has been tampered with to conceal the fact that the component has fallen into an abnormal operation state. The maintenance state refers to a state in which the function of the component is temporarily stopped by applying a patch or the like.

[0047] A component may fall into an abnormal operation state, for example, when it is subjected to a Denial of Service (DoS) attack, and a component may fall into an abnormal operation concealment state, for example, when it is subjected to an information concealment attack that tampers with the settings of the alarm that is issued when an abnormality is detected.

[0048] The component model is generated based on information input by the user via the input / output device 13 to the generation unit 110B.

[0049] FIG. 7 is a diagram showing an example of information input by a user to generate a component model.

[0050] Each component is given an ID 61 that can uniquely identify the component, and a component name 62 that represents the component. Then, for the dependency relationship 63, an ID 631 of a component on which the component depends, and a maximum allowable downtime 632 that indicates the maximum time that the component can tolerate as a downtime for the component on which the component depends are defined.

[0051] 7, taking the example of a component with an ID of 1 and a component name of PLC A, the component with the name PLC A will enter an abnormal operation state if the dependent component with an ID of 3, that is, the control server, enters an abnormal state or maintenance state for 10 seconds or more. On the other hand, even if the dependent component, the control server, is in an abnormal operation concealment state, the abnormality of the control server will not be recognized, so the component with the name PLC A will not enter an abnormal state due to the dependency relationship.

[0052] In addition, the control process 64 records the process that the component causes the control system to execute. For example, if PLC A falls into an abnormal operating state, the "Robot A Processing" process in Figure 2 will not be executed, and part of the control process will malfunction. To explain this using the control process model in Figure 6, transition t52 labeled "Robot A Processing" cannot be fired, and tokens will accumulate in the place labeled "Waiting for Processing."

[0053] The model of the component generated by the generating unit 110B based on the information in Fig. 7 is not limited to a specific method as long as the time transition of the state of the component can be expressed. For example, the state of the component may be reproduced using a Petri net as in the case of the control process model. Alternatively, the generating unit 110B may model the component using a modeling method different from that of the control process.

[0054] 8 is a diagram showing an example of a component model reproduced by a Petri net. In a component model 70, the state of the component is expressed by the place in which the token is located. If a token is in a place p71 labeled "normal operating state", it means that the component is in a normal operating state. If a token is in a place p72 labeled "abnormal operating state", it means that the component is in an abnormal operating state.

[0055] For example, a template of a model of a component having the configuration shown in Fig. 8 is stored in advance in model template 120B of storage unit 120. Generation unit 110B automatically generates a model of the component based on the information stored in model template 120B and information input by a user as shown in Fig. 7.

[0056] In the first embodiment, the components are modeled on a physical terminal basis as an example of information equipment. However, each piece of software may be modeled as a component on a software basis. Alternatively, a unit that can be identified by a common platform enumeration (CPE) may be modeled as a component.

[0057] Finally, we explain the agent model.

[0058] An agent is a subject having a function of generating a security event that affects the function of a component, and may be expressed as an actor. Examples of types of agents include an attack agent, a response agent, and an operator agent.

[0059] An attack agent is a general term for a person or thing that causes damage to a system under analysis, such as an attacker or group that attempts a cyberattack, malware that attempts a cyberattack autonomously, a device, and AI. Examples of the functions of an attack agent include an action that transitions a component from a normal operation state to a compromised state, an action that transitions from a compromised state to an abnormal operation state, and an action that transitions from a compromised state to an abnormal operation concealment state. The state of the attack agent is specified before and after each action. The state of the attack agent is expressed, for example, as preparing for an attack, collecting information, etc. For example, when an attack agent in the preparing for an attack state performs any of the three types of actions mentioned above, it transitions to a state of collecting information and prepares for the next action.

[0060] The behavior of the attacking agent, that is, the actions and state transitions, are defined by the user through input operations from the input / output device 13.

[0061] FIG. 9 is a diagram illustrating an example of an operation definition of an attack agent.

[0062] In FIG. 9, information 80 about an attack agent named attacker A is defined. The attack agent attacks target components in the order shown in the attack phase column 81. In each attack phase, the attack agent launches an attack on the component shown in the to column 83, starting from the component shown in the from column 82, with the content shown in the action column 85. Since the attack phase of attack 1 corresponds to the initial intrusion stage, the from column 82 is left blank. If the same component is specified in the from column 82 and the to column 83, it means that the attack agent will launch an additional attack on that component after completing the "intrusion" action. Furthermore, each action requires the time listed in the required time 84.

[0063] Attack agents, like control processes and components, can also be modeled using Petri nets.

[0064] FIG. 10 is a diagram illustrating an example of a model of an attack agent.

[0065] In the attack agent model 90, the state of the attack agent is expressed by which place the token is located.

[0066] Possible states of an attacking agent include preparing for attack and collecting information, and places p91 and p92 correspond to them. For example, if there is a token in place p91 labeled "preparing for attack," it means that the attacking agent is in the preparing for attack state. Actions that change the state of an attacking agent can be reproduced using transitions. The actions of an attacking agent include intrusion, abnormal behavior, and concealment of abnormal behavior, and transitions t91, t92, and t93 correspond to them. The time described in the required time 84 of information 80 corresponds to the delay time of the transition ignition. Taking attack phase 1 as an example, it takes 300 seconds to execute the action "intrusion," so the delay time of the transition t91 labeled "intrusion" is 300 seconds. The token will stay in place p91 labeled "preparing for attack" for 300 seconds.

[0067] The attack agent model and the component model work together to transition the state. Taking attack phase 4 as an example, the attack agent executes an action of "abnormal operation" on PLC A starting from the control server. Therefore, the state of the component PLC A also transitions to abnormal operation. In the model of PLC A, a transition is fired so that the token moves from place p71 labeled "normal operation state" to place p72 labeled "abnormal operation state" in FIG. 8. Note that in this embodiment, the user statically defines the operation of the attack agent in advance as described above, but the present invention is not limited to this, and other operations may be used. For example, malware with unknown behavior may be reproduced by adding randomness to the operation of the attack agent.

[0068] The actions and states of the response agent and the operator agent are represented by a model, similar to the attack agent described above. A common Petri net may be used for the response agent, the operator agent, and the attack agent, with the actions represented by transitions and the states represented by places.

[0069] A response agent is a collective term for people and things that respond to cyberattacks after they are detected, taking action to restore components, such as a person or group that responds to cyberattack incidents, devices that operate autonomously to respond to cyberattacks and recover components from the damage, and AI.

[0070] FIG. 11 is a diagram showing an example of a model of a coping agent created using a Petri net.

[0071] The function of the response agent includes, for example, an action to detect infringement traces (transition t102), and a function to execute an action to transition a component from an abnormal operation state, an infringement state, or an abnormal operation concealment state to a normal operation state (transition t104). The state of the response agent before and after each of these actions is expressed as waiting (place p101), investigating (place p102), and considering a response plan (place p103), etc. In addition, the probability of executing the action "detecting infringement traces" may be defined. This means that infringement traces cannot be detected with the defined probability. If infringement traces cannot be detected, in the response agent model, transition t103 labeled "infringement traces not detected" is fired.

[0072] The operator agent is a general term for employees who operate components in the actual system to be analyzed or employees who are involved in part of the control process.

[0073] FIG. 12 is a diagram showing an example of a model of an operator agent using a Petri net.

[0074] In the example of model 1000, examples of the functions of the operator agent include a function to perform an action to detect abnormal operation of a component being investigated (transition t111), an action to start a countermeasure agent (transition t113), an action to evacuate from a system under analysis that has fallen into danger due to a cyber attack (transition t114), an action to change the schedule shift for work (transition t112), etc. The state of the operator agent before and after each action can be expressed as working (place p111), investigating abnormal operation (place p112), taking a break (place p113), etc.

[0075] FIG. 13 is a diagram showing an example of model information of an operator agent.

[0076] In the model of an operator agent, the components operated by the operator are specified as attributes. In the example of Fig. 13, an ID 1201 that uniquely identifies the operator agent and a name 1202 of the operator are defined. In addition, a component 1203 that each operator agent operates is specified.

[0077] The operator agent model changes the action to be taken depending on the state of the component to be operated.

[0078] A specific example will be described below using the model of operator A, which is assigned the ID 1. Referring to Fig. 13, the component that is the operation target of operator A, whose ID is 1, is the production instruction server. If the state of the production instruction server is "abnormal operation state", transition t111 of the model of operator A is fired, and the state of operator A transitions to "abnormal operation under investigation".

[0079] Here, if the component that is the target of Operator A's operation is in the "abnormal operation concealed state", Operator A cannot detect that the component is operating abnormally. Therefore, Operator A does not transition to the "abnormal operation under investigation" state, but remains in the "working" state. After a certain period of time has elapsed in this state, transition t113 labeled "start response agent" is fired. This action causes transition t101 labeled "start" to be fired in the response agent model, and the state of Operator A's model transitions from "waiting" to "investigating".

[0080] The above series of steps can be used to reproduce the occurrence of a cyber attack, its detection by an operator, and the recovery of components through action by incident responders.

[0081] As with attack agents, the amount of time required for response and operator agents to perform each action is user-definable, and may be based on the capabilities of the user's incident response team or as documented in the organization's incident response procedures.

[0082] Similar to component templates, agent model templates are stored in model template 120B of storage unit 120. Generation unit 110B automatically generates an agent model as described above based on the information stored in model template 120B and information input by the user.

[0083] In the first embodiment, three types of agents are given: an attack agent, a response agent, and an operator agent. However, the types of agents are not limited to these. Other types of agents having a function of affecting components may be added. For example, an automatic incident detection agent that automatically detects abnormal operations of a component or a control process, a maintenance agent that can transition the state to under maintenance by performing maintenance on a component, etc. may be given.

[0084] The method for modeling the control process is not limited to the above-mentioned graph theory example. For example, a dedicated simulator that can reproduce the control process graphically with higher accuracy may be used.

[0085] Returning to FIG. 4, in step S102, the generation unit 110B specifies the number of repetitions and end time of the simulation performed by the update unit 110C, and the key performance indicators calculated by the calculation unit 110D. A highly reliable result can be obtained by giving random behavior to the model generated by the generation unit 110B, performing multiple analyses, and averaging the analysis results. In this embodiment, the unit of simulation is called an episode. In other words, if the number of repetitions is specified as 10, the update unit 110C will perform 10 episodes of simulation with the same initial conditions.

[0086] The end time means the time to end the simulation that started from the condition of time 0. For example, if the end time is specified as 3600 seconds, the simulation will continue until the time reaches 3600 seconds.

[0087] A key performance indicator is an indicator that quantifies the damage caused by a cyber attack. In the first embodiment, the cumulative production volume of materials is used as the key performance indicator. However, the key performance indicator is not limited to this. Various other indicators may be used as the key performance indicator. In addition, multiple key performance indicators may be calculated from various viewpoints. As other key performance indicators, for example, production efficiency indicating the number of productions per unit time, component availability indicating the ratio of components in a normal operating state to all components, operator work rate indicating the ratio of operator agents in a working state to all operator agents, operator safety rate indicating the ratio of operator agents who have been able to avoid dangerous states to all operator agents, etc. may be used.

[0088] As shown here, the generation unit 110B may perform and complete all of the processing of step S102 in advance, or the update unit 110C may set the number of repetitions and the end time before starting the processing described below, and the calculation unit 110D may set the key performance indicators before starting the processing described below.

[0089] The processes from step S103 to step S108 described below are performed by update unit 110C.

[0090] In step S103, the update unit 110C initializes the model generated in step S101 and sets the time in the simulation to 0.

[0091] In step S104, the update unit 110C evolves the state of the models of the control process, the component, and the agent over time by one time step based on the model dependency. Here, the time step means the minimum time step width in the simulation. In the first embodiment, the minimum time step width is one second. Also, the model dependency is a dependency between models. Although only the dependency between components is shown in FIG. 7, there may be a dependency between agents, and there may be a dependency between control processes. Furthermore, there may be a dependency between an agent and a component, and there may be a dependency between a component and a control process. As described above, the model of the control process changes its behavior depending on the state of the model of the component. The model of the component changes its behavior depending on the state of the model of the agent and the control process. The model of the agent also changes its behavior depending on the state of the model of the component.

[0092] In step S105, the update unit 110C associates the states of all models with time, and stores them as time-series data 120D in the storage unit 120. Furthermore, in step S106, the update unit 110C updates the time managed in the simulation by advancing it by one time step.

[0093] Fig. 14 is a diagram showing an example of time series data of a control process model, Fig. 15 is a diagram showing an example of time series data of a component model, and Fig. 16 is a diagram showing an example of time series data of an agent model.

[0094] In Fig. 14, the number of materials 1303 remaining in each state is recorded for each episode 1301 and time 1302 in the time series data of the control process. For example, in the control process, at time 0 seconds, there are no materials. At time 6000 seconds, the number 6 is displayed in the "Process Completed" column. This shows that six materials have been completed.

[0095] 15, for the time-series data of components, the state of each component is recorded in the component column 1403 for each episode 1401 and time 1402. At the time 5999 seconds, the state of the production instruction server is "normal operation state", but at the time 6000 seconds, the state of the production instruction server changes to "abnormal operation state". This means that at the time 6000 seconds, the production instruction server was attacked by an attacking agent and fell into an abnormal operation state, or a dependent component continued to be in an abnormal operation state for a period exceeding the maximum allowable downtime, causing the production instruction server to fall into an abnormal operation state.

[0096] In FIG. 16, for the agent's time-series data, the state of each agent is recorded in an agent column 1503 for each episode 1501 and time 1502 .

[0097] According to FIG. 13, the component that is the target of the operation of Operator A is the production instruction server. As shown in FIG. 15, the production instruction server falls into an abnormal operation state at the time of 6000 seconds, and as shown in FIG. 16, the state of Operator A transitions from Working to Investigating Abnormal Operation at the time of 6001 seconds. On the other hand, according to FIG. 13, the component that is the target of the operation of Operator B is the monitoring device. As shown in FIG. 15, since the monitoring device is in an abnormal operation concealment state at the time of 6000 seconds, Operator B cannot detect the abnormality of the monitoring device, and as shown in FIG. 16, it remains in the working state. If there is a component that has fallen into an abnormal operation concealment state like this, a phenomenon occurs in which the damage expands due to delayed response and recovery.

[0098] In step S107, the update unit 110C checks whether the time in the simulation has reached the set end time. If it has not reached the end time, the update unit 110C returns to step S104 and updates the model again. If it has reached the end time, the update unit 110C proceeds to step S108.

[0099] In step S108, the update unit 110C checks whether the analysis process has been performed the set number of times. If the number of times the analysis process has been performed reaches the number of times the analysis process has been performed, the process proceeds to step S109. If the number of times the analysis process has been performed does not reach the number of times the analysis process has been performed, the update unit 110C returns to step S103, initializes the model and the time, and starts a new episode.

[0100] Finally, step S109 is performed by calculation unit 110D.

[0101] In step S109, the calculation unit 110D calculates the key performance indicator designated by the user based on the time-series data 120D, and stores the calculation result 120E in the storage unit 120. In the first embodiment, since the accumulated production volume is set as the key performance indicator, the calculation unit 110D calculates the accumulated production volume at each time in the simulation based on the time-series data of the control process in Fig. 14. This accumulated production volume is the average value of the accumulated production volume at each time for each episode.

[0102] Here, a series of processes from step S101 to step S109 is called a scenario. A scenario name is given to the generative model 120C, the time-series data 120D, and the calculation result 120E generated in step S101 to step S109 and stored in the storage unit 120 in order to identify what input information the results were generated from. This makes it possible to compare results between scenarios, as described below.

[0103] The user can visualize the time-series data 120D and the calculation results 120E by sending an instruction to the output unit 110E through the input / output device 13. For example, the output unit 110E identifies the state of each model at a time specified by the user based on the time-series data, generates an image that makes the state of each model visible, and displays it on the screen. In addition, the output unit 110E displays the cumulative production volume at each time in the simulation for each scenario on the screen based on the calculation results 120E.

[0104] FIG. 17 is a diagram showing an example of a screen displayed based on the calculation result 120E in the first embodiment.

[0105] Screen 1600 includes area 1601 for displaying key performance indicators in a graph, area 1602 for the user to set key performance indicators, area 1603 for the user to add and delete scenarios, and area 1604 for the user to specify a model that the user wants to display. Area 1601 displays a graph with time on the horizontal axis and key performance indicators on the vertical axis. The user can specify key performance indicators in area 1602. The user can also add or delete scenarios that display graphs in area 1601 by pressing add button 1603A or delete button 1603B in area 1603. The user can also specify a model that the user wants to display on a separate screen in area 1604.

[0106] Here, it is assumed that an example of the process from step S101 to step S109 is repeated for four scenarios in which the behavior of the agent is different. In area 1601, the time transition of the cumulative production volume in those four scenarios is displayed in a graph. In area 1601, the user can compare the graphs of each scenario.

[0107] A label with the scenario name of the scenario is displayed near the graph of each scenario. Scenario 1605A labeled "Normal operation" corresponds to a case where an attack agent is not generated and the analysis target system is operated normally. Scenario 1605B labeled "Response plan A" and scenario 1605C labeled "Response plan B" correspond to a case where a similar attack agent is generated, and then a response agent and an operator agent with different actions are generated. Scenario 1605D labeled "No response plan" corresponds to a case where an attack agent is generated that is the same as the attack agent generated in the above two scenarios 1605B and 1605C, and no response agent is generated. Therefore, in the "No response plan" scenario 1605D, it can be seen from the display in area 1601 that the function of the control process stops completely during the simulation and the cumulative production number does not increase above a certain number.

[0108] Also, in the area 1601, a dashed line representing the target value of the key performance indicator set by the user is displayed as a target value 1606. For example, the user can set the target of the strength of cyber resilience that the user wants to achieve in the analysis target system as the target value of this key performance indicator. Also, in the area 1601, a dashed line representing the end time set by the user as the time to end the analysis of the scenario is displayed as an end time 1607. Looking at the graph of the scenario 1650A of "Response Plan A", the cumulative production amount exceeds the target value at the end time. Therefore, in terms of the cumulative production amount, the user can confirm that the organization can achieve the cyber resilience strength targeted by the analysis target system by the operation of the response agent and the operator agent defined in "Response Plan A".

[0109] When multiple key performance indicators are set in calculation unit 110D, the user can select which key performance indicator to display in area 1601. The key performance indicator selected by the user using selection button 1602B is reflected in display field 1602A, and its graph is displayed in area 1601. When all scenario comparison display button 1602C is pressed, a list of key performance indicators at the end times of all scenarios is displayed on a separate screen.

[0110] FIG. 18 is a diagram showing an example of a screen displaying a list of key performance indicators for each scenario.

[0111] The screen of Fig. 18 displays target value ratios 2202 of key performance indicators for all scenarios 2201 in the form of a list. In the example of Fig. 18, the target value ratios of each of a plurality of key performance indicators are displayed. The target value ratio of a key performance indicator is the ratio between the value of the key performance indicator at the end time and the target value, and is displayed as a percentage, for example. If the target value ratio of a key performance indicator exceeds 100%, it means that the value at the end time exceeds the target value.

[0112] The user can check the quantitative evaluation results of the security posture of the organization's analyzed systems on the screens in Figures 17 and 18. If the security posture needs to be improved, the user can use the information displayed on the screens in Figures 17 and 18 to make such improvements.

[0113] The cyber resilience analysis apparatus 11 can also display the state of the model at a specified time in a specified episode in a scenario. When the user inputs a scenario name in the scenario field 1604A, an episode number in the episode field 1604B, a time in the time field 1604C, and presses the display button 1604D on the screen 1600 of Fig. 17, model information at that time in the episode with that episode number in the scenario with that scenario name is displayed on a separate screen.

[0114] FIG. 19 is a diagram showing an example of a screen displaying information about a model.

[0115] Component and agent models are displayed in a window 1701 of a screen 1700. A component model is represented by an object that resembles a computer device. An agent model is represented by an object that resembles a person. Dependencies between components are represented by arrows. Dependencies between components and agents are represented by dashed lines.

[0116] The user can adjust the display area of ​​the screen by operating scroll bar 1702. In addition, when the user operates mouse pointer 1704 to approach a model icon and place the mouse over it, a balloon 1703 with detailed information about the model is displayed. The state of the model is displayed as detailed information. When the user presses "Back" button 1705, window 1701 closes and the screen returns to that of FIG. 17. Note that while the example of FIG. 19 shows a screen displaying models of components and agents, other displays are also possible. For example, a function for displaying a model of a control process may be added.

[0117] In the first embodiment, a production line is assumed as the system to be analyzed, as shown in Fig. 2. However, the present invention is not limited to this. For example, various systems such as a chemical plant, a power system, and a railway system can be the system to be analyzed.

[0118] When a chemical plant is the target system, for example, the production amount of chemical substances produced in the chemical plant may be used as the key performance indicator.

[0119] In addition, for example, the amount of carbon dioxide emissions from the chemical plant may be used as a key performance indicator to quantitatively evaluate the environmental impact of a cyber attack.

[0120] In addition, environmental risks other than the carbon dioxide emissions described above can also be used as key performance indicators. For example, the amount of toxic substances generated in a chemical plant during the time it takes to respond to a cyber attack can be used as a key performance indicator.

[0121] When the analyzed system is an electric power system, for example, the amount of electric power supplied by the electric power system may be used as the key performance indicator.

[0122] Furthermore, when a railway system is the system to be analyzed, the punctuality of train operations or the degree of disruption to the train schedule may be used as a key performance indicator.

[0123] In addition, the remaining risk when a countermeasure is taken after a cyber-attack may be used as a key performance indicator. For example, when the analysis target system is restored by taking countermeasures to improve vulnerabilities only in some of the information devices that have been damaged by a cyber-attack and leaving the vulnerabilities of the other devices unattended, the ratio of the unattended devices to all the information devices may be used as a remaining risk and as a key performance indicator.

[0124] Second Embodiment A second embodiment of the present invention will now be described.

[0125] FIG. 20 is a conceptual diagram showing an image of the operation of the model in the second embodiment.

[0126] In the first embodiment, a cyber resilience assessment system is illustrated in which a model simulating an actual system to be analyzed is virtually evolved over time, and key performance indicators are calculated based on information obtained from the model during the time evolution. Meanwhile, in the second embodiment, a cyber resilience assessment system is illustrated in which a model simulating an actual system to be analyzed is evolved over time so as to be synchronized with the state of the actual system to be analyzed, and key performance indicators are calculated based on information obtained from the model during the time evolution.

[0127] The cyber resilience evaluation system according to the second embodiment has the same basic configuration and operation as the server resilience evaluation system according to the first embodiment. The functional configuration of the cyber resilience evaluation system according to the second embodiment is similar to that of the first embodiment shown in FIG. 1. In addition, the analysis target system of the cyber resilience evaluation system according to the second embodiment is similar to that of the first embodiment shown in FIG. 2.

[0128] The cyber resilience evaluation system according to the second embodiment differs in part from the server resilience evaluation system according to the first embodiment. In the first embodiment, the generating unit 110B, the updating unit 110C, and the calculating unit 110D shown in FIG. 1 operate independently of the state of the actual system to be analyzed. On the other hand, in the second embodiment, the generating unit 110B, the updating unit 110C, and the calculating unit 110D shown in FIG. 1 operate partially in synchronization with the actual system to be analyzed. It can also be said that the cyber resilience analysis device according to the second embodiment functions as a digital twin.

[0129] Here, a digital twin is defined as a model that reproduces the behavior of the system being analyzed in real time in a digital space based on data obtained from the system operating in the real world.

[0130] 21 is a flowchart of a process executed by a cyber resilience analysis device in the second embodiment. The process in the second embodiment is partially different from the process in the first embodiment shown in FIG.

[0131] The processes in steps S201 and S202 are performed by generation unit 110B.

[0132] In step S201, the generating unit 110B generates Petri net models for the agents, components, and control processes of the system to be analyzed, similarly to step S101 in Fig. 4. Note that, when it is desired to evaluate a plurality of scenarios of response plans and compare the evaluation results as in the first embodiment, it is preferable to define a set of models for each scenario in the stage of step S201.

[0133] In step S202, the generation unit 110B specifies the end time of the simulation performed by the update unit 110C and the key performance indicators calculated by the calculation unit 110D. Note that, since the second embodiment uses a digital twin that is partially synchronized with the system to be analyzed, the simulation is not repeated in order to give randomness to the model. Therefore, the number of repetitions is not specified.

[0134] The processes from step S203 to step S207 are performed by update unit 110C.

[0135] In step S203, the update section 110C initializes the model and the time, similarly to step S103 in FIG.

[0136] In step S204, the update unit 110C monitors the control process log 120A collected by the collection unit 110A and stored in the storage unit 120, and detects an update to the information indicating the state of the analysis target system. Upon detecting the update, the update unit 110C proceeds to step 205 and updates the state of each model based on the dependency relationship between the models.

[0137] In the example of the production line in Fig. 2, as soon as the update unit 110C detects a control process log indicating that materials have been put onto the conveyor, it issues a token to place p51 labeled "process start" in the model of the control process illustrated in Fig. 6. In other words, the real-world system to be analyzed and the model generated by the cyber resilience analysis device synchronize their partial operations.

[0138] In step S206, the update unit 110C stores the information on the updated model in the storage unit 120 as time-series data 120D.

[0139] In step S207, update unit 110C adds the time that has elapsed from the time when the state of the model was last updated to the current time to the time in the simulation so that the time in the simulation coincides with the real time.

[0140] Finally, in step S208, the calculation unit 110D calculates the key performance indicators designated by the user based on the latest time-series data 120D, and stores the results in the storage unit 120 as calculation results 120E.

[0141] In step S209, the update unit 110C checks whether the time in the simulation has reached the set end time. If it has not reached the end time, the update unit 110C returns to step S204 and updates the model again. If it has reached the end time, the update unit 110C ends the process.

[0142] By sending an instruction to the output unit 110E through the input / output device 13, the user can visualize the time-series data 120D and the calculation results 120E that are accumulated in real time from moment to moment.

[0143] 22 is a diagram showing an example of a screen displayed based on the calculation result 120E in the second embodiment. This screen in the second embodiment is partially different from that in the first embodiment shown in FIG.

[0144] Screen 2100 includes an area 2101 for displaying key performance indicators in a graph, an area 2102 where the user sets key performance indicators, an area 2103 where the user adds and deletes scenarios, and an area 2104 where the user specifies the model they want to display.

[0145] Area 2101 displays a graph with time on the horizontal axis and key performance indicators on the vertical axis. This graph is updated in real time and displays the key performance indicators up to the current time. The user can simultaneously check the real-time transitions of the key performance indicators for the four scenarios.

[0146] As in the display example in the first embodiment shown in Fig. 17, the target value 2606 and the end time 2607 may be displayed by dashed lines on the display screen 2010. Also, in the second embodiment, the current time 2608 indicating the current time may be displayed by dashed lines. The current time 2608 is gradually updated. When the current time 2608 matches the end time 2607, the analysis ends. In other words, if the end time of the simulation is set to 100 seconds, one analysis takes 100 seconds in actual time.

[0147] Also, similar to the first embodiment, the user can specify key performance indicators in area 2102. Furthermore, the user can add or delete scenarios for which graphs are to be displayed in area 2101, in area 2103. Furthermore, the user can specify a model to be displayed on a separate screen in area 2104.

[0148] In the second embodiment, as in the case of the first embodiment shown in Fig. 17, when multiple key performance indicators are set in the calculation unit 110D, the user can select which key performance indicator to display in the area 2101. The key performance indicator selected by the user using the selection button 2102B is reflected in the display field 2102A, and its graph is displayed in the area 2101. When the all scenario comparison display button 2102C is pressed, a list of the key performance indicators at the end times of all the scenarios is displayed on another screen.

[0149] Also in the second embodiment, the user can add or delete a scenario, the graph of which is displayed in the display area 2101, by pressing the add button 2103A or the delete button 2103B in the area 2103. Furthermore, the user can specify in the area 2104 a model that he or she wishes to display on a separate screen.

[0150] In the second embodiment, the cyber resilience analysis apparatus 11 can also display the state of the model at the current time for each scenario. When the user inputs a scenario name in the scenario column 2104A on the screen 2100 of Fig. 22 and presses the display button 2104B, model information for the scenario with that scenario name at the current time is displayed on a separate screen.

[0151] (Third embodiment) A third embodiment of the present invention will now be described.

[0152] In the third embodiment, the cyber resilience analysis device has a function of optimizing the model through learning.

[0153] The cyber resilience evaluation system according to the third embodiment has a basic configuration and operation with the server resilience evaluation system according to the first embodiment. The functional configuration of the cyber resilience evaluation system according to the third embodiment is similar to that of the first embodiment shown in Fig. 1. However, the learning unit 110F does not function in the first embodiment, but functions in the third embodiment.

[0154] In the first embodiment, the behavior rules of the agent model are defined by the user based on the response plan and are not changed while the episodes are repeated. In contrast, in the third embodiment, the learning unit 110F updates the behavior rules of the agent model based on the calculation result 120E calculated by the calculation unit 110D for each episode, and optimizes the response plan.

[0155] In addition, the system to be analyzed by the cyber resilience assessment system of the third embodiment is the same as that of the first embodiment shown in Figure 2.

[0156] 23 is a flowchart of a process executed by a cyber resilience analysis device in the third embodiment. The process in the third embodiment is partially different from the process in the first embodiment shown in FIG.

[0157] The processes from steps S301 to S307 are common to the processes from steps S101 to S107 in FIG.

[0158] In step S308, unlike the first embodiment, the calculation unit 110D calculates key performance indicators from the time-series data of the model every time the processing of steps S303 to S307 for one episode is completed. Then, in step S309, the update unit 110C checks whether the analysis processing has been performed the set number of times. If the number of times the analysis processing has been performed reaches the number of times of repetition, the processing ends. If the number of times the analysis processing has been performed does not reach the number of times of repetition, the processing proceeds to step S310.

[0159] In step S310, the learning unit 110F optimizes the model based on the key performance indicators calculated by the calculation unit 110D in step S308, and the process returns to step S303.

[0160] For example, if the key performance indicator is one in which the larger the value, such as the cumulative production volume, the higher the evaluation, the learning unit 110F may use the key performance indicator as an objective function and obtain, as a solution, the behavior of the response agent and the operator agent that maximizes the objective function. Also, if the key performance indicator is one in which the smaller the value, such as the carbon dioxide emission volume, the learning unit 110F may use the key performance indicator as an objective function and obtain, as a solution, the behavior of the response agent and the operator agent that minimizes the objective function. AI technology, such as reinforcement learning, may be used to search for an optimal solution. During optimization, a solution may be searched for within the range of actions that the response agent and the operator agent can perform as constraints.

[0161] Once the analysis is complete, the user activates the output unit 110E and checks the behavior of the optimized agent through the input / output device 13. Based on this information, the user can improve the security posture of the organization and enhance cyber resilience.

[0162] Although the embodiments of the present invention have been described above, the present invention is not limited to these embodiments, and these embodiments may be used in combination or some of the configurations may be changed within the scope of the technical concept of the present invention.

[0163] The above-described embodiment includes the following features, but is not limited to the features included in the above-described embodiment.

[0164] (Item 1) a generation unit that generates models by a modeling method capable of expressing time-series changes for a control process, which is a process by which a system to be analyzed operates, a component that causes the system to execute the control process, and an agent that performs an action that affects the behavior of the component, and that specifies, between the models, a dependency relationship in which the control process changes its behavior depending on the state of another control process or the component, a dependency relationship in which the component changes its behavior depending on the state of another component, the agent, or the control process, and a dependency relationship in which the agent changes its behavior depending on the state of another agent or the component; an update unit that evolves the control process model, the component model, and the agent model based on the dependency relationship over time from when a cyber-attack is started by an agent until a countermeasure against the cyber-attack by another agent based on a predetermined plan is completed, and records time series data obtained from the control process model, the component model, and the agent model during the time evolution; A calculation unit that calculates a predetermined evaluation index for evaluating a response according to the plan based on the time-series data; A cyber resilience analysis device having: This allows cyber attacks and countermeasures against them to be reproduced in a time series, including not only control processes and components but also agents, and evaluation indices are calculated based on the obtained time series data, making it possible to appropriately and quantitatively evaluate the effectiveness of planned countermeasures against cyber attacks. For example, it is possible to reproduce the sophisticated attacking behavior of the attacker with the attacker's intention, even in the case of sophisticated attacks with intent such as APT attacks. It is also possible to reproduce and evaluate the sophisticated countermeasure procedures of operators and countermeasure agents.

[0165] (Item 2) In the cyber resilience analysis device according to item 1, The agent model includes: an operator agent model representing an operator who operates the component; An attack agent model representing an entity that launches a cyber attack against the component; and a response agent model that represents an entity that implements responses to the cyber attacks on the components. According to this, by representing the actions of each of the actors involved - the operator, the attacker, and the responder - with individual models, it is possible to precisely reproduce the chronological series of behavior, including the actions of the actors involved, from the start of a cyber attack to the completion of the response.

[0166] (Item 3) In the cyber resilience analysis device according to item 2, The attack agent model can forcibly transition the model of the component from an intended state to an unintended state, and when the model of the component transitions from the intended state to the unintended state, it also transitions its own state.

[0167] (Item 4) In the cyber resilience analysis device according to item 3, The response agent model can transition the model of the component from an unintended state to an intended state, and when the model of the component transitions from the unintended state to the intended state, it also transitions its own state.

[0168] (Item 5) 5. The cyber resilience analysis device according to claim 4, The operator agent model can transition the state of the component model or the model of another agent depending on the state of the component model, and transitions its own state when transitioning the state of the component model or the model of the other agent.

[0169] (Item 6) In the cyber resilience analysis device according to item 1, The system further includes an output unit that identifies the state of the model at a specified time based on the time-series data, displays the state of the model so that it can be visually recognized, and displays the calculated evaluation index so that it can be visually recognized. This makes it possible to visually check the status of components and agents at a specified time, allowing users to check the status of components and agents by specifying the desired time from the start of a cyber-attack to the completion of the response and recovery.

[0170] (Item 7) In the cyber resilience analysis device according to item 1, A collection unit that collects information obtained from the analysis target system through actual operation and records it as log information, The update unit evolves the control process model, the component model, and the agent model over time while reflecting the log information in a state of the control process model. According to this, based on information obtained from the actual system being analyzed, the control process model is synchronized with the actual control process and time is allowed to evolve from the start of a cyber-attack to the completion of the response, making it possible to evaluate the response based on a more realistic assumption.

[0171] (Item 8) In the cyber resilience analysis device according to item 2, The system further includes a learning unit that optimizes behavior of the operator agent model and / or the response agent model with respect to the component, using the calculated value of the evaluation index as an objective function. According to this, it is possible to improve the response plan by optimizing the behavior of the operator agent and / or the response agent model so as to improve the value of the evaluation index.

[0172] (Item 9) In the cyber resilience analysis device according to item 1, The control process model is a model that can express the operation of the analysis target system in a distinct manner between an intended state and an unintended state.

[0173] (Item 10) 10. The cyber resilience analysis device according to claim 9, The model of the component determines whether the model of the control process is in the intended state or the unintended state depending on whether the component itself is in the intended state or the unintended state.

[0174] (Item 11) In the cyber resilience analysis device according to item 1, the control process causes a predetermined result to be produced by the operation of the analysis target system; obtaining information from a model of the control process that allows the outcome to be measured; the update unit evolves the control process model, the component model, and the agent model over time, and records information on results obtained from the control process model as the time-series data; The calculation unit calculates the evaluation index based on the information on the outcome. This allows evaluation indicators to be calculated based on measurable outcomes, such as the production volume of a product in a production process, making it possible to quantify the extent to which there is an impact on outcomes between the time a cyber-attack occurs and the time the response is completed.

[0175] (Item 12) In the cyber resilience analysis device according to item 1, The modeling method capable of expressing the time series change is a Petri net that has two types of nodes, places and transitions, the nodes are connected with directions, and a state change is expressed by a bipartite directed graph in which a token moves between the places by firing the transition, and a delay time can be set for firing the transition; The generation unit generates the control process, the components, and the agents using the Petri net. According to this method, all models of control processes, components, and agents are generated using Petri nets as a common method, so that it is easy to reproduce the mutual relationships between not only the system under analysis and the information system, but also the actors involved. [Explanation of symbols]

[0176] 1...cyber resilience evaluation system, 2...production line, 11...cyber resilience analysis device, 12...control device, 13...input / output device, 21...conveyor, 22...robot, 23...materials, 110...processing unit, 120...memory unit

Claims

1. a generation unit that generates models by a modeling method capable of expressing time-series changes for a control process, which is a process by which a system to be analyzed operates, a component that causes the system to execute the control process, and an agent that performs an action that affects the behavior of the component, and that specifies, between the models, a dependency relationship in which the control process changes its behavior depending on the state of another control process or the component, a dependency relationship in which the component changes its behavior depending on the state of another component, the agent, or the control process, and a dependency relationship in which the agent changes its behavior depending on the state of another agent or the component; an update unit that evolves the control process model, the component model, and the agent model based on the dependency relationship over time from when a cyber-attack is started by an agent until a countermeasure against the cyber-attack by another agent based on a predetermined plan is completed, and records time series data obtained from the control process model, the component model, and the agent model during the time evolution; A calculation unit that calculates a predetermined evaluation index for evaluating a response according to the plan based on the time-series data; A cyber resilience analysis device having:

2. The agent model includes: an operator agent model representing an operator who operates the component; An attack agent model representing an entity that launches a cyber attack against the component; A countermeasure agent model expressing an entity that implements countermeasures against the cyber attack for the component. The cyber resilience analysis device of claim 1 .

3. The attack agent model is capable of forcibly transitioning the model of the component from an intended state to an unintended state, and when the model of the component is transitioned from the intended state to the unintended state, the attack agent model also transitions its own state. The cyber resilience analysis device of claim 2.

4. the response agent model is capable of transitioning the model of the component from an unintended state to an intended state, and transitions its own state when the model of the component is transitioned from the unintended state to the intended state; The cyber resilience analysis device of claim 3 .

5. the operator agent model can transition a state of the model of the component or a model of another agent according to a state of the model of the component, and when the state of the model of the component or the model of the other agent is transitioned, the operator agent model also transitions its own state; The cyber resilience analysis device of claim 4.

6. An output unit that identifies a state of the model at a specified time based on the time-series data, displays the state of the model so that it can be visually recognized, and displays the calculated evaluation index so that it can be visually recognized. The cyber resilience analysis device of claim 1 .

7. A collection unit that collects information obtained from the analysis target system through actual operation and records it as log information, the update unit evolves the control process model, the component model, and the agent model over time while reflecting the log information in a state of the control process model. The cyber resilience analysis device of claim 1 .

8. A learning unit that optimizes an action of the operator agent model and / or the response agent model with respect to the component by using the calculated value of the evaluation index as an objective function. The cyber resilience analysis device of claim 2.

9. The control process model is a model capable of expressing the operation of the analysis target system in an intended state and the operation of the analysis target system in an unintended state in a distinguished manner. The cyber resilience analysis device of claim 1 .

10. determining whether the model of the control process is in the intended state or the unintended state depending on whether the model of the component is in the intended state or the unintended state; The cyber resilience analysis apparatus of claim 9.

11. the control process causes a predetermined result to be produced by the operation of the analysis target system; obtaining information from a model of the control process that allows the outcome to be measured; the update unit evolves the control process model, the component model, and the agent model over time, and records information on results obtained from the control process model as the time-series data; The calculation unit calculates the evaluation index based on the information of the result. The cyber resilience analysis device of claim 1 .

12. The modeling method capable of expressing the time series change is a Petri net that has two types of nodes, places and transitions, the nodes are connected with directions, and a state change is expressed by a bipartite directed graph in which a token moves between the places by firing the transition, and a delay time can be set for firing the transition; the generation unit generates the control process, the component, and the agent using the Petri net; The cyber resilience analysis device of claim 1 .

13. A model is generated by a modeling method capable of expressing time-series changes for a control process, which is a process by which a system to be analyzed operates, a component that causes the system to execute the control process, and an agent that performs an action that affects the behavior of the component, and a dependency relationship in which the control process changes its behavior depending on the state of another control process or the component, a dependency relationship in which the component changes its behavior depending on the state of another component, the agent, or the control process, and a dependency relationship in which the agent changes its behavior depending on the state of another agent or the component, are defined between the models; evolving the control process model, the component model, and the agent model based on the dependency relationship over time from when a cyber-attack is started by an agent until another agent completes responding to the cyber-attack based on a predetermined plan, and recording time series data obtained from the control process model, the component model, and the agent model during the time evolution; Calculating a predetermined evaluation index for evaluating the action taken according to the plan based on the time-series data. A computer-implemented cyber resilience analysis method.

14. A model is generated by a modeling method capable of expressing time-series changes for a control process, which is a process by which a system to be analyzed operates, a component that causes the system to execute the control process, and an agent that performs an action that affects the behavior of the component, and a dependency relationship in which the control process changes its behavior depending on the state of another control process or the component, a dependency relationship in which the component changes its behavior depending on the state of another component, the agent, or the control process, and a dependency relationship in which the agent changes its behavior depending on the state of another agent or the component, are defined between the models; evolving the control process model, the component model, and the agent model based on the dependency relationship over time from when a cyber-attack is started by an agent until another agent completes responding to the cyber-attack based on a predetermined plan, and recording time series data obtained from the control process model, the component model, and the agent model during the time evolution; Calculating a predetermined evaluation index for evaluating the action taken according to the plan based on the time-series data. A cyber resilience analysis program that allows computers to do this.

Images