Information processing device, information processing method, and computer program

Abstract

To predict a communication volume in a target environment with a high accuracy.SOLUTION: An information processing device includes a communication volume prediction unit that obtains relation data in which in a first environment including first apparatuses of a plurality of function types, the amount of variation in a communication volume in the first environment when the number of first apparatuses for each function type varies is associated with a varying number of the first apparatuses; and predicts a communication volume in a second environment including second apparatuses of the plurality of types of functions, based on the relation data and the number of second apparatuses for each function type in the second environment.SELECTED DRAWING: Figure 3

Description

[Technical field]

[0001] An embodiment of the present invention relates to an information processing device, an information processing method, and a computer program. [Background technology]

[0002] There is a method to learn a model for a specific environment (e.g., a model for anomaly detection) using communication data between multiple devices in that environment. However, when there is data with low communication frequency, it takes time to collect the data, which increases the learning time.

[0003] There is also a method for predicting communication volume from devices in a target network and application information installed on the devices, based on the number of devices in a network with known communication volume such as the number of packets and information on applications installed on the devices. This method is based on the premise that when the number of devices in the target network increases, the communication volume between devices other than the increased devices does not increase. However, in a general network, when the number of devices increases, the communication volume between devices other than the increased devices may increase, and in such a case, the method cannot predict the communication volume of the target network with high accuracy. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 6401537 Summary of the Invention [Problem to be solved by the invention]

[0005] The embodiments of the present invention provide an information processing device, an information processing method, and a computer program that enable highly accurate prediction of communication volume in a target environment. [Means for solving the problem]

[0006] The information processing device of this embodiment includes a communication volume prediction unit that acquires relationship data that associates a fluctuation in communication volume in a first environment including first devices of a plurality of functional types with a fluctuation in the number of first devices when the number of the first devices fluctuates for each of the function types in the first environment, and predicts the communication volume in the second environment based on the relationship data and the number of the second devices for each of the function types in a second environment including second devices of the plurality of functional types. [Brief description of the drawings]

[0007] [Figure 1] FIG. 2 is a schematic diagram showing an example of a first environment and a second environment. [Diagram 2] FIG. 4 is a schematic diagram showing another example of the first environment and the second environment. [Diagram 3] FIG. 1 is a block diagram of an information processing apparatus according to a first embodiment. [Figure 4] FIG. 4 is a diagram showing an example of first configuration information. [Diagram 5] FIG. 4 is a diagram for explaining the correspondence between a first environment and first environmental data. [Figure 6] FIG. 4 is a diagram showing an example of first environmental data. [Figure 7] FIG. 13 is a diagram showing an example of a classification rule. [Figure 8] FIG. 4 is a diagram showing an example of classified first communication data. [Figure 9] FIG. 13 is a diagram showing an example of the number of packets in a first environment for each classification over a certain period of time. [Figure 10] FIG. 11 is a diagram showing an example of second configuration information. [Figure 11] FIG. 11 is a diagram for explaining an example of second function type number information. [Figure 12] FIG. 4 is a diagram for explaining the process of a packet number prediction unit; [Figure 13] FIG. 13 is a diagram showing an example of the predicted number of packets in a certain period of time for each classification. [Figure 14] FIG. 4 is a diagram showing an example of identification correspondence information. [Figure 15] FIG. 11 is a diagram showing an example of communication prediction data. [Figure 16]5 is a flowchart illustrating an example of the operation of the information processing device according to the first embodiment. [Figure 17] FIG. 13 is a diagram showing an example of post-adjustment communication. [Figure 18] 5 is a flowchart illustrating an example of the operation of the information processing device according to the first embodiment. [Figure 19] 11A and 11B are diagrams for explaining how the number of packets increases when the number of function types increases. [Figure 20] FIG. 11 is a block diagram of an example of an information processing apparatus according to a second embodiment. [Figure 21] FIG. 4 is a block diagram showing an example of the configuration of an attack detection learning unit. [Figure 22] FIG. 2 is a diagram showing a hardware configuration of an information processing apparatus according to each embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0009] (First embodiment) FIG. 1 is a diagram showing an example of a first environment group and a second environment as environments to be handled in this embodiment. The first environment group 10 is a test environment configured based on a combination of various devices. The first environment group 10 includes a first environment 11, a first environment 12, a first environment 13, and a first environment 14. The second environment 20 is a production environment to be evaluated for communication volume, and is an environment different from the first environment group. The second environment 20 is any communication network, such as a network of a control system.

[0010] The first environment 11-14 and the second environment 20 each have various devices. In each of the first environment 11-14 and the second environment, a plurality of devices connected via a network are provided, and data is communicated between the devices. Each device can be classified by a function type that represents the classification or role of the device. The function type is, for example, a PLC (Programmable Logic Controller), an HMI (Human Machine Interface), an IDS (Intrusion Detection System), etc., but is not limited to these.

[0011] For example, even if multiple devices have the same classification or the same role, if these devices use different communication protocols, they may be treated as different function types. Also, PLCs that adjust different things, such as a PLC for temperature control and a PLC for water volume control, may be treated as the same function type or as different function types. In the following explanation, devices may be referred to by the function type that they possess. For example, a device whose function type is PLC may be simply referred to as "PLC" or the like.

[0012] The devices in the first environment 11-14 are referred to as first devices, and the devices in the second environment 20 are referred to as second devices. For example, the first environment 12 in FIG. 1 includes one first device HMI1 and two first devices PLC1 and PLC2. As an example, the first environment has a number of first devices that is 2 n (2 n) are prepared. In each first environment, there are one or two first devices having the same function type. That is, in each environment, there are at most two first devices having the same function type. In the example of FIG. 1, since the second environment 20 includes two function types, PLC and HMI, the first environment group 10 has four environments each having one or two devices whose function type is HMI and one device whose function type is PLC. Specifically, the first environment group 10 includes a first environment 11 having one HMI and one PLC, a first environment 12 having one HMI and two PLCs, a first environment 13 having two HMIs and one PLC, and a first environment 14 having two HMIs and two PLCs. The number of first environments is not limited to 2 n . For example, the number of first environments may be more than 2 n .

[0013] FIG. 2 is a diagram showing another example of the first environment group. When the number of types of function types in the second environment 20 increases, the number of first environments to be prepared increases exponentially. For this reason, it may be difficult to prepare the first environments separately. Therefore, for example, when the number of types of function types in the second environment 20 is two, one first environment 35 having two HMIs and two PLCs is prepared as shown in FIG. 2. The ON / OFF state of the power supply of each first device in the first environment 35 is changed. As a result, even if only the first environment 35 is actually prepared, the first environments 31 to 34 having the same properties as the first environments 11 to 14 can be easily realized.

[0014] However, the first environment to be actually prepared is not limited to one of the first environments 35, and may be two or three. In this case, too, by changing the ON / OFF state of the power supply of the first device in at least one of the environments, four environments having the same properties as the first environments 11 to 14 can be realized.

[0015] 1, it is sufficient that there are at most two first devices having the same function type in a certain first environment, but there may be three or more first devices having the same function type. In this case, it is possible to improve the prediction accuracy of the communication volume in the second environment in this embodiment.

[0016] FIG. 3 is a block diagram of the information processing device 100 according to the first embodiment. The information processing device 100 predicts the number of packets (communication volume) communicated in the second environment based on the communication data collected from the first environment group 10. The information processing device 100 also predicts communication data including packets communicated between second devices in the second environment 20. The information processing device 100 then adjusts the number of packets in the predicted communication data of the second environment based on the predicted number of packets. This makes it possible to predict the communication content and communication volume (number of packets) with high accuracy regardless of the number of second devices in the second environment 20. The predicted communication content and communication volume can be used, for example, to learn a model that detects anomalies (e.g., cyber attacks) in the second environment. Anomaly detection can be performed using the learned model. The information processing device 100 will be described in detail below.

[0017] The information processing device 100 includes a first environment storage unit 101, a classification rule storage unit 102, a classified packet number storage unit 103, a second environment storage unit 104, a predicted packet number storage unit 105, a predicted communication storage unit 106, a post-adjustment communication storage unit 107, a communication classification unit 108, a packet number prediction unit 109 (communication volume prediction unit), a packet number adjustment unit 110 (communication volume adjustment unit), and a second environment communication prediction unit 111 (communication prediction unit). Each of the storage units is configured by a storage medium such as a RAM (Random Access Memory), a flash memory, or an optical disk. The blocks 108, 109, 110, and 111 can be configured by a processor or circuit such as a CPU, an MPU, or an ASIC.

[0018] The first environment storage unit 101 stores configuration information (first configuration information) of the first devices of each first environment in the first environment group 10, and environmental data (first environmental data) of each first environment.

[0019] The first configuration information is information indicating a correspondence relationship between identification information (first identification information) of the first device in the first environment and a function type. The first identification information is given to each of the multiple first devices in advance.

[0020] The first identification information is information that can uniquely identify a certain first device. For example, the first identification information can be information that can identify a destination or source used as an address during communication between first devices in the first environment. The address during communication used as the first identification information can be, for example, an IP (Internet Protocol) address, a MAC (Media Access Control) address, or the like, but is not limited to these.

[0021] Alternatively, the first identification information may be information that can change depending on the environment that a certain first device belongs to. For example, the first identification information may be a port number or a Virtual Local Area Network Identity Document (VLAN ID).

[0022] Fig. 4 is a diagram showing an example of first configuration information in the first environments 11 to 14. The first configuration information 1010 indicates the correspondence between the first identification information (IP addresses) and function types of the first devices in the first environments 11 to 14. In the example of Fig. 4, the device addresses in the first environments 12 and 13 are partially overlapping, but the device addresses may all be different among the multiple first environments.

[0023] Each of the first environment data includes first function type number information of the first environment and communication data (first communication data) acquired from the first environment. The communication data is information data including one or more packets. The communication data in the first environment data may be data measured in an actual network, or may be data created based on specifications at the time of design.

[0024] The first function type number information includes the number of first devices configured for each function type of the first environment. Furthermore, the first function type number information may include the above-mentioned first configuration information (first identification information corresponding to the function type of each first device). When each first environment is realized by the method illustrated in the above-mentioned FIG. 2, the first function type number information may include the number of first devices in the ON state for each function type of the first environment.

[0025] 5 is a diagram showing an example of first environment data corresponding to each first environment. For example, the first environment 12 corresponds to first environment data 3220 including first function type number information 3020 and first communication data 3120. The first function type number information 3020 of the first environment 12 is HMI:1 (192.168.1.100) PLC:2 (192.168.1.150,192.168.1.200) This means that the first devices included in the first environment 12 are one HMI and two PLCs, the first identification information of the one HMI is 192.168.1.100, and the first identification information of the two PLCs is 192.168.1.150 and 192.168.1.200, respectively. In this example, the first function type number information 3020 also includes the contents of the first configuration information of the first environment 12 (see FIG. 4).

[0026] FIG. 6 shows a specific example of the first environment data of each first environment stored in the first environment storage unit 101. As described above, the communication data is information data including one or more packets. In this embodiment, the packet includes a source address, a destination address, a source port, a destination port, a type of communication protocol, and a TCP payload. The packet may include other information. For example, the transmission time may be included. A packet is a general name for a data transmission unit, and may include various transmission units such as a frame or a segment. As an example, a packet 3111, which is one of the packets included in the first communication data 3110, includes a source address: 192.168.0.100, a destination address: 192.168.0.200, a source port: 8888, a destination port: 443, a communication protocol: TCP, and a payload: 7384725745932874.

[0027] In this embodiment, the source address is the IP address of the first device that is the source of the data. The destination address is the IP address of the first device that is the destination of the data. The source port is a port number used in the transport layer protocol of the first device that is the source of the data. The destination port is a port number used in the transport layer protocol of the first device that is the destination of the data. In other words, the source address and source port, and the destination address and destination port are examples of first identification information. Examples of transport layer protocols include TCP and UDP.

[0028] The classification rule storage unit 102 stores classification rules for packets. A classification rule is a criterion for determining which classification class a packet belongs to based on packet information.

[0029] FIG. 7 is a diagram showing an example of a classification rule. The classification rule is a rule for classifying a packet into one of a plurality of classification classes. As an example, the classification rule uses at least one of the function type, the communication protocol, and the payload information. The classification rule may be created arbitrarily by a user who is an operator of the information processing device 100, or may be created by machine learning or the like based on the first communication data obtained from the first environment group. FIG. 7 shows an example of a plurality of classification rules created using the destination function type, the communication protocol, and the payload information. Each of the plurality of classification rules is a rule for classifying a packet into one of the classification classes A, B, C, D, etc. Note that the classification rule does not distinguish between the identification information of the device.

[0030] The communication classification unit 108 classifies a plurality of packets included in the first communication data for each first environment based on a plurality of classification rules stored in the classification rule storage unit 102. The communication classification unit 108 calculates the number of packets communicated per certain time for each classification class. The certain time can be set arbitrarily, such as 10 seconds, 1 minute, or 1 hour. If the acquisition period of communication packets acquired in each first environment is longer than the certain time, the number of packets communicated per certain time may be the average number of packets per certain time.

[0031] FIG. 8 shows an example of a result of classifying some packets (different from the packets shown in FIG. 6) in the first communication data 3110 in an arbitrary first environment. The classification rule used at this time is the classification rule shown in FIG. 7. For example, a packet 3115 is classified into classification class A because the destination function type is PLC, the communication protocol is TCP, and the value of the ninth bit from the beginning of the TCP payload is 1. A packet 3117 is classified into classification class B because the destination function type is PLC, the communication protocol is TCP, and the value of the ninth bit from the beginning of the TCP payload is 0. A packet 3116 is classified into classification class D because the destination function type is HMI and the communication protocol is TCP. In this way, the communication classification unit 108 classifies a plurality of packets included in the communication data for each first environment and counts the number of packets in each classification class. Note that the payload is expressed in decimal in FIG. 6, but is expressed in binary in FIG. 8.

[0032] The classified packet number storage unit 103 stores a pair of the first function type number information of each first environment and the number of packets for each classification class in a certain period of time in each first environment. The number of packets for each classification in a certain period of time is called the classified packet number, and information indicating the number of classified packets is called classified packet number information.

[0033] 9 is a diagram showing an example of classified packet number information for the first environment 11. Information on the number of packets communicated per minute is shown for each of classification classes A, B, C, D, .... Such classified packet number information is also stored in the classified packet number storage unit 103 for the first environments 12 to 14.

[0034] The second environment storage unit 104 stores, for the second environment 20, second function type number information and second configuration information.

[0035] The second function type number information includes the number of second devices in the second environment by function type.

[0036] The second configuration information is information indicating a correspondence relationship between identification information (second identification information) of the second device and a function type. The second identification information is given to each of the second devices in advance.

[0037] The second identification information is information that can uniquely identify a certain second device. For example, the second identification information can be information that can identify a destination or source used as an address during communication between second devices in the second environment. The address during communication used as the second identification information can be, for example, an IP address, a MAC address, or the like, but is not limited to these.

[0038] Alternatively, the second identification information may be information that can change depending on the environment that a certain second device is in. For example, a port number, a VLAN ID, or the like may be used as the first identification information.

[0039] 10 is a diagram showing an example of second configuration information 2010. The second configuration information 2010 indicates the correspondence between second identification information (IP address) of a second device in the second environment and a function type.

[0040] Fig. 11 shows an example of second function type number information 4000 corresponding to the second environment 20. The second function type number information 4000 includes the configuration number of the second devices for each function type of the second environment. In the example of Fig. 10, the second function type number information includes the contents of the second configuration information (second identification information corresponding to the function type of each second device), but the contents of the second configuration information do not have to be included in the second function type number information.

[0041] The packet number prediction unit 109 acquires the first function type number information of each first environment and the classified packet number information of each first environment from the classified packet number storage unit 103, and acquires the second configuration information 2010 and the second function type number information from the second environment storage unit 104. The packet number prediction unit 109 predicts the number of packets of each classification class communicated in the second environment using the acquired information and calculations such as machine learning. Information indicating the predicted number of packets of each classification class (predicted packet number information) is stored in the predicted packet number storage unit 105. The packet number prediction unit 109 corresponds to a communication volume prediction unit that predicts the communication volume in the second environment.

[0042] TIFF0007669312000001.tif57170

[0043] TIFF0007669312000002.tif24170

[0044]

number

[0045] Formula 1 represents, in any first environment, F i This represents the increase in the number of packets when the number of devices of function type i (the number of devices of function type i) increases by 1.

[0046] TIFF0007669312000004.tif73170

[0047] TIFF0007669312000005.tif30162

[0048] The above-mentioned formula 1 corresponds to the relational data that associates the fluctuation amount of the communication amount in the first environment, which includes the first devices of a plurality of function types, with the fluctuation number of the first devices when the number of the first devices fluctuates for each function type in the first environment. The relational data may be prepared for each classification class.

[0049] TIFF0007669312000006.tif51170

[0050]

number

[0051] TIFF0007669312000008.tif24170

[0052]

number

[0053] TIFF0007669312000010.tif18170

[0054]

number

[0055] All classification classes are selected as classification classes to be evaluated, and the number of packets per certain time period and the like are calculated for each classification class by carrying out the processing of equations 1 to 4. In this way, the packet number prediction unit predicts the number of packets (communication volume) in the second environment based on Equation 1 (relationship data) and the number of second devices for each function type in the second environment including second devices of multiple function types.

[0056] TIFF0007669312000012.tif41170

[0057] TIFF0007669312000013.tif17170

[0058] TIFF0007669312000014.tif7169

[0059] TIFF0007669312000015.tif7169

[0060] TIFF0007669312000016.tif12170

[0061] TIFF0007669312000017.tif7169

[0062] TIFF0007669312000018.tif7170

[0063] TIFF0007669312000019.tif28170

[0064] The predicted packet number storage unit 105 stores predicted packet number information for each classification class in the second environment 20. The predicted packet number information indicates the predicted number of packets of a classification class in a certain period of time.

[0065] 13 is a diagram showing an example of predicted packet number information. For example, in classification class A, the number of packets per minute is 375.

[0066] The second environment communication prediction unit 111 predicts data of communication performed in the second environment. More specifically, the second environment communication prediction unit 111 predicts data (packet contents) communicated between second devices in the second environment. The process performed by the second environment communication prediction unit 111 will be described in detail below.

[0067] The second environment communication prediction unit 111 creates correspondence information (identification correspondence information) of identification information between the first device and the second device based on at least one of the configuration information (first configuration information) of each first environment in the first environment memory unit 101 and the configuration information (second configuration information) of the second environment 20 in the second environment memory unit 104.

[0068] FIG. 14(A) is a diagram showing an example of the identification correspondence information. The identification correspondence information 4010 associates the identification information of the first device in the first configuration information 1010 (FIG. 4) of the first environment 11 to the first environment 14 with the identification information of the second device in the second configuration information 2010 (FIG. 11) with the same function type. For example, the first configuration information 1010 stores the first identification information 192.168.0.100 corresponding to the function type PLC, and the second configuration information 2010 stores the second identification information 192.168.3.100 corresponding to the function type PLC. In this case, as shown in FIG. 14, the identification correspondence information 4010 stores the first identification information 192.168.0.100 and the second identification information 192.168.3.100 in association with each other. It may be permitted that a plurality of different first identification information are associated with the same second identification information.

[0069] In the example of Figure 14 (A), all of the first configuration information of the first environment 11 to the first environment 14 is used, but the first configuration information of one, two or three first environments selected from the first environment 11 to the first environment 14 may be used.

[0070] 14B shows an example of identification correspondence information 4011 created based on the first configuration information of one first environment (first environment 11) and the second configuration information 2010. In the first environment 11, there is only one first device of each of two function types, and in the second environment, there are three second devices of each of two function types. Therefore, a first device with the same identification information (IP address) is associated with three second devices having the same function type but different identification information (IP address).

[0071] Even when using the first configuration information of two or three first environments among the first environments 11 to 14, the identification correspondence information can be created in a manner similar to the example of Figure 14(A) or Figure 14(B).

[0072] Next, the second environment communication prediction unit 111 creates communication prediction data by replacing the first identification information included in the first communication data of the first environment used to create the identification correspondence information with the second identification information based on the created identification correspondence information.

[0073] Fig. 15 is a diagram showing an example of communication prediction data. As can be seen by comparing with Fig. 6, the first identification information (IP address of the first device) is replaced with the second identification information (IP address of the second device) based on the identification correspondence information.

[0074] In addition, there may be a case where the first communication data includes the first identification information that is not replaced with the second identification information. In that case, the communication prediction data generated from the first communication data is deleted.

[0075] FIG. 16 is a flowchart showing an example of the second environment prediction process executed by the second environment communication prediction unit 111.

[0076] First, the second environment communication prediction unit 111 acquires first communication data and first configuration information of at least one first environment from the first environment memory unit 101, and acquires second configuration information from the second environment memory unit 104 (step S701).

[0077] Next, the second environment communication prediction unit 111 generates identification correspondence information that associates the first identification information and the second identification information corresponding to the same function type based on the acquired first configuration information and second configuration information (step S702).

[0078] Next, the second environment communication prediction unit 111 generates communication prediction data in which the first identification information of each packet included in the acquired first communication data is replaced with the second identification information based on the identification correspondence information (step S703).

[0079] Finally, the second environment communication prediction unit 111 stores the created communication prediction data in the predicted communication storage unit 106 (step S704).

[0080] In addition, the second environment communication prediction unit 111 may predict data (packets) communicated between the second devices in the second environment by other techniques. For example, the second environment communication prediction unit 111 may predict data (packets) communicated between the second devices in the second environment by using past communication history.

[0081] The packet number adjustment unit 110 acquires communication prediction data from the predicted communication storage unit 106, and classifies each packet included in the communication prediction data into one of a plurality of classification classes according to the classification rule. Then, the packet number adjustment unit 110 acquires predicted packet number information from the predicted packet number storage unit 105, and adjusts the number of packets of each classification class included in the communication prediction data by using at least one of discarding and duplicating so that the number of packets for each classification class becomes the number of packets in the predicted packet number information. At this time, the packets to be duplicated or discarded may be selected randomly, or the packets to be selected may be determined so that there is no significant bias in the communication source (sender), communication destination (destination), and communication content.

[0082] Fig. 17 is a diagram showing an example in which the packet number adjustment unit 110 adjusts the number of packets for a certain classification class. In the case of Fig. 17, packet 4007 is duplicated from packet 4003, and packet 4008 is duplicated from packet 4004. For other classification classes, the number of packets is similarly adjusted by duplication or discarding to match the number of packets in the predicted packet number information. When the predicted packet number information indicates the average proportion of packets for each classification class, the number of packets for each classification class can be adjusted to match that proportion.

[0083] The adjusted communication data storage unit 107 stores the communication data whose number of packets has been adjusted by the packet number adjustment unit 110 (adjusted communication data).

[0084] An example of the operation of the information processing device 100 in FIG. 3 will be described with reference to FIG. FIG. 18 is a flowchart of an example of processing executed by the information processing device 100.

[0085] In step S801, the communication classification unit 108 classifies all packets included in the first communication data into one of a plurality of classification classes for each first environment according to the classification rule. The communication classification unit 108 calculates the number of packets for each classification class in a certain period of time for each first environment.

[0086] In step S802, the packet number prediction unit 109 predicts the number of packets (or the average proportion of the number of packets for each classification class) in a certain period of time for each classification class in the second environment based on the first function type number information and first configuration information for each first environment, the classified packet number information for each first environment, and the second function type number information and second configuration information for the second environment (step S802).

[0087] In step S803, the second environment communication prediction unit 111 creates information (identification correspondence information) that associates the first configuration information of each first environment with the second configuration information of the second environment for the same function type. Based on the created identification correspondence information, the second environment communication prediction unit 111 creates communication prediction data in which the first identification information of a packet included in at least one first communication data of the first environment is replaced with the second identification information.

[0088] In step S804, the packet number adjustment unit 110 classifies each packet included in the communication prediction data into one of a plurality of classification classes in accordance with the classification rule.

[0089] In step S805, the packet number adjustment unit 110 adjusts the number of packets of the communication prediction data classified into each classification class by duplicating or discarding packets so that the number of packets of each classification class (or the average ratio of the number of packets) coincides with the number of packets for each classification class predicted in step S802. This ends the process.

[0090] As described above, according to the first embodiment, the number of packets for each classification class in the production environment is predicted, and communication data (packets) communicated in the production environment is predicted for each classification class, and the predicted number of packets for each classification class in the production environment is adjusted according to the predicted number of packets. This makes it possible to estimate with high accuracy the number of packets (or the average ratio of the number of packets) communicated in the production environment for each classification class.

[0091] In this embodiment, the number of packets in the production environment is predicted for each classification class, but the number of packets in the production environment may be predicted without classifying the packets. In this case, it is not necessary to classify the packets in the first environment either.

[0092] (Modification) The function types of the second device in the second environment 20 are F1, . . . , F n The number of functional types is C1,…,C n Then, it is assumed that the number of packets (communication volume) P communicated in the second environment can be approximated by the following equation 5.

[0093]

number

[0094] For example, when n=2, 3, 4, the number of packets P is as follows:

number

number

number

[0095] Equation 5 is the number of devices with function type Fi, C i It shows that when increases, the number of packets increases linearly (linearly) with a certain coefficient a. Equation 5 corresponds to relational data that associates the fluctuation in communication volume in a first environment including first devices of multiple function types when the number of first devices fluctuates for each function type in the first environment with the fluctuating number of first devices. The relational data may be prepared for each classification class.

[0096] For the sake of explanation, an example will be given below in which there are two function types, HMI and PLC (F1=HMI, F2=PLC, n=2). When formula 5 is expanded, it becomes formula 9 as follows.

[0097]

number

[0098] Furthermore, if the number of PLC devices is 2 (C2=2), the following equation 10 is obtained.

[0099]

number

[0100] It can be seen that Equation 10 is a linear function of C1. As shown in Figure 19, when only the number of HMI devices increases, the number of packets from all HMI devices increases linearly (2a 1,2 +a1).

[0101] Equation 5 corresponds to a function that sums up, across combinations, values ​​obtained by multiplying a coefficient for each combination of a plurality of function types by the number of first devices for each function type included in the combination.

[0102] Here, the packet number prediction unit 109 calculates the coefficient a in the function of Equation 5. This determines the number of packets P in the second environment. For example, when n=2, a 1,2 , a1, and a2 are known, the number of packets P(C1, C2) in the second environment can be found regardless of the values ​​of C1 and C2. 1,2 To find a1, a2, substitute values ​​such as (C1, C2) = (1, 1), (2, 1), (1, 2), (2, 2) into equation 5 and solve the simultaneous equations shown in equation 11 below. In this example, since there are three unknown variables, the variable values ​​may be determined using three of the four equations below, or the variable values ​​that result in the smallest error may be determined using all four equations.

[0103]

number

[0104] The packet calculation unit 109 can predict the number of packets in the second environment 20 based on Equation 9 using the calculated coefficients a and the values ​​of C1 and C2 in the second environment 20 (each 3).

[0105] Second embodiment 20 is a block diagram of an example of an information processing device 100A according to the second embodiment. An abnormality detection processing unit 112 is added to the information processing device 100 according to the first embodiment. 21 is a block diagram showing an example of the configuration of the anomaly detection processing unit 112. The anomaly detection processing unit 112 has a function of creating a model for performing anomaly detection based on the communication data after the packet count adjustment obtained in the first embodiment, and a function of performing anomaly detection based on the model. The anomaly detection processing unit 112 includes a communication unit 1121, an output unit 1122, a control unit 1123, and a storage unit 1124.

[0106] The communication unit 1121 is a communication interface that transmits and receives information or data to and from other devices connected via a network or the like. For example, the communication unit 1121 acquires communication data after adjusting the number of packets in the second environment 20 from the information processing device 100 according to the first embodiment. The communication unit 1121 also acquires communication data (second communication data) measured in the second environment 20. The communication unit 1121 may acquire the second communication data by directly receiving (intercepting) data transmitted and received by a second device in the second environment 20, or may acquire the second communication data from a device such as a server that manages the communication data measured in the second environment.

[0107] The storage unit 1124 stores the acquired second communication data (second communication data 1128 in FIG. 21). The storage unit 1124 is, for example, a storage medium such as a RAM, a flash memory, or an optical disk.

[0108] The control unit 1123 includes a learning unit 1125 and an abnormality detection unit 1127 .

[0109] The learning unit 1125 generates a model (model 1129 in FIG. 21) for detecting anomalies in the second environment 20 based on the communication data after the packet number adjustment in the second environment 20. As an example, the learning unit 1125 generates a threshold for determining the number of packets as the model 1129. For example, a value obtained by adding a certain value to the number of packets included in the communication data after the packet number adjustment is set as the threshold. Alternatively, the learning unit 1125 may generate a regression model such as a neural network by machine learning as a model for anomaly detection. Alternatively, the threshold may be a threshold for determining the average ratio of the number of packets between classification classes as the model 1129. For example, a certain range is determined as a normal range (upper limit threshold and lower limit threshold) for the ratio of the number of packets of each classification class in the communication data after the packet number adjustment. The learning unit 1125 may generate the model 1129 for each classification class. When the adjustment of the number of packets in the second environment 20 is performed without distinguishing the classification classes, the model 1129 is generated without distinguishing the classification classes. In the following explanation, a case where a threshold value is generated as the model 1129 will be described.

[0110] The anomaly detection unit 1127 compares the number of packets in the second environment acquired by the communication unit 1121 with a threshold. The anomaly detection unit 1127 performs a comparison with the threshold for each classification class. When the number of packets in at least any classification class is equal to or greater than the threshold, the anomaly detection unit 1127 detects that an anomaly has occurred in the second environment. Alternatively, the anomaly detection unit 1127 may calculate the ratio of the number of packets for each classification class, and detect the occurrence of an anomaly when the ratio in at least any classification class deviates from the normal range (the range between the upper threshold and the lower threshold).

[0111] The output unit 1122 is, for example, a liquid crystal display or a printer, and outputs various information. The output unit 1122 may output information indicating that an abnormality such as a cyber attack has been detected. The output unit 1122 may output information indicating the class classification in which the abnormality has been detected.

[0112] 20, the anomaly detection processing unit 112 of the second embodiment is incorporated into the information processing device 100 of the first embodiment, but the anomaly detection processing unit 112 may be a device independent of the information processing device 100. Also, the learning function and the anomaly detection function in the anomaly detection processing unit 112 may be separate devices.

[0113] As described above, according to the second embodiment, the predicted adjusted number of packets in the second environment is used for learning anomaly detection, thereby making it possible to reduce the learning time for anomaly detection and to improve the accuracy of anomaly detection.

[0114] (Hardware configuration) 22 shows a hardware configuration of an information processing device according to each embodiment. The information processing device is configured by a computer device 600. The computer device 600 includes a CPU 601, an input interface 602, a display device 603, a communication device 604, a main storage device 605, and an external storage device 606, which are interconnected by a bus 607.

[0115] The CPU (Central Processing Unit) 601 executes an information processing program, which is a computer program, on the main memory device 605. The information processing program is a program that realizes each of the above-mentioned functional configurations of the information processing device. The information processing program may be realized not as a single program, but as a combination of multiple programs and scripts. Each functional configuration is realized by the CPU 601 executing the information processing program.

[0116] The input interface 602 is a circuit for inputting operation signals from input devices such as a keyboard, a mouse, a touch panel, etc., to the information processing device. The input interface 602 corresponds to the input unit of the information processing device according to each embodiment.

[0117] The display device 603 displays data output from the information processing device. The display device 603 is, for example, but not limited to, an LCD (liquid crystal display), an organic electroluminescence display, a CRT (cathode ray tube), or a PDP (plasma display). Data output from the computer device 600 can be displayed on the display device 603. The display device 603 corresponds to the output unit of the information processing device according to each embodiment.

[0118] The communication device 604 is a circuit for the information processing device to communicate with an external device wirelessly or via wire. Data can be input from the external device via the communication device 604. The data input from the external device can be stored in the main memory device 605 or the external memory device 606.

[0119] The main memory device 605 stores an information processing program, data required for executing the information processing program, data generated by executing the information processing program, etc. The information processing program is expanded and executed on the main memory device 605. The main memory device 605 is, for example, a RAM, a DRAM, or an SRAM, but is not limited to these. Each storage unit or database of the information processing device according to each embodiment may be constructed on the main memory device 605.

[0120] The external storage device 606 stores an information processing program, data required for executing the information processing program, data generated by executing the information processing program, etc. These information processing programs and data are read into the main storage device 605 when the information processing program is executed. The external storage device 606 is, for example, a hard disk, an optical disk, a flash memory, and a magnetic tape, but is not limited to these. Each storage unit or database of the information processing device may be constructed on the external storage device 606.

[0121] The information processing program may be pre-installed in the computer device 600, or may be stored in a storage medium such as a CD-ROM. The information processing program may also be uploaded onto the Internet.

[0122] Furthermore, the information processing device may be configured as a single computer device 600, or may be configured as a system made up of a plurality of computer devices 600 connected to each other.

[0123] The present invention is not limited to the above-described embodiments as they are, and the components can be modified and embodied in the implementation stage without departing from the gist of the invention. Various inventions can be formed by appropriately combining multiple components disclosed in the above-described embodiments. For example, a configuration in which some components are deleted from all the components shown in each embodiment can also be considered. Furthermore, the components described in different embodiments can be appropriately combined. [Explanation of symbols]

[0124] 100 Information processing device 101 1st environment memory section 102 Classification rule memory unit 103 Classification packet number memory unit 104 2nd environment memory section 105 Predicted packet count memory unit 106 Predictive communication memory unit 107 Adjusted Communication Memory Unit 108 Communications Classification Division 109 Packet number prediction unit (communication volume prediction unit) 110 Packet number adjustment unit (communication volume adjustment unit) 111 Second Environmental Communication Prediction Department (Communication Prediction Department) 112 Anomaly detection processing unit (learning unit, anomaly detection unit) 1121 Communications Department 1122 Output section 1123 Control Unit 1124 Storage section 1125 Learning Department 1127 Anomaly detection unit 1128 Second communication data 1129 model 600 Computer equipment 601 CPU 602 Input Interface 603 Display device 604 Communication equipment 605 Main storage 606 External storage device 607 Bus

Claims

1. acquiring relationship data that associates a fluctuation in communication volume in a first environment including first devices of a plurality of function types with a fluctuation in the number of the first devices when the number of the first devices fluctuates for each of the function types; a communication traffic prediction unit that predicts a communication traffic in the second environment based on the relationship data and a number of the second devices for each of the function types in a second environment including the second devices of the plurality of function types; the relationship data indicates, for each of the function types, a change in the communication volume when the number of the first devices of the function type is increased and the number of the first devices of the other function types does not change; The communication traffic prediction unit, calculating a difference between the number of the first devices for the functional type and the number of the second devices for the same functional type as the functional type, for each of the functional types; multiplying the fluctuation in the communication volume when the number of first devices of the functional type is increased by one by the difference in the number of devices; predicting the communication volume in the second environment by adding a value obtained by multiplying the fluctuation amount and the difference to the communication volume in the first environment in a case where there is one first device for each of the plurality of function types; Information processing device.

2. The communication volume prediction unit acquires the relationship data based on first communication data between the first devices in a plurality of the first environments including the first devices of the plurality of function types and having a different number of the first devices. The information processing device according to claim 1 .

3. The number of the first devices in the plurality of first environments is one or two for each of the function types.

3. The information processing device according to claim 1 or 2.

4. The communication volume prediction unit further calculates a value obtained by multiplying a coefficient for each combination of the plurality of function types by the number of the first devices for each of the plurality of function types included in the combination, based on first communication data between the first devices in the first environment, in a function that sums up the combinations, and predicts the communication volume in the second environment based on the calculated coefficient and the number of the second devices for each of the plurality of function types in the second environment. The information processing device according to any one of claims 1 to 3.

5. a communication classification unit that classifies first communication data between the first devices in the first environment into a plurality of classification classes; The communication volume prediction unit predicts the communication volume in the second environment for each of the classification classes. The information processing device according to any one of claims 1 to 4.

6. The communication classification unit classifies the first communication data based on a function type of each of the first devices having a source address and a destination address of the first communication data. The information processing device according to claim 5 .

7. The communication classification unit classifies the first communication data based on at least one of a value of a payload portion included in the first communication data and a communication protocol of the first communication data. The information processing device according to claim 6.

8. The communication traffic prediction unit selectively turns on or off a power supply of a plurality of the first devices in the first environment including the plurality of the first devices for each of the function types, thereby generating a plurality of the first environments. The information processing device according to claim 2 .

9. a communication volume adjustment unit that adjusts the communication volume between the second devices in the second environment by copying or discarding at least a part of second communication data between the second devices based on the predicted communication volume; The information processing device according to any one of claims 1 to 8, further comprising:

10. a learning unit that generates a model for detecting an anomaly in the second environment based on the second communication data of the adjusted communication volume; The information processing device according to claim 9 .

11. a communication unit that receives second communication data communicated between the second devices in the second environment; an anomaly detection unit that detects an anomaly in the second environment based on the second communication data and the model; The information processing device according to claim 10 , further comprising:

12. a communication prediction unit that generates second communication data between the second devices in the second environment by replacing a source address and a destination address of first communication data between the first devices in the first environment with an address of an arbitrary second device having the same function type as the first device having the source address and an address of an arbitrary second device having the same function type as the first device having the destination address. The information processing device according to any one of claims 9 to 11, further comprising:

13. The communication volume is the number of packets. The information processing device according to any one of claims 1 to 12.

14. The communication volume is a value based on a ratio of the number of communication packets of the classification class to the total number of communication packets of the plurality of classification classes. The information processing device according to any one of claims 5 to 7.

15. acquiring relationship data that associates a fluctuation in communication volume in a first environment including first devices of a plurality of function types with a fluctuation in the number of the first devices when the number of the first devices fluctuates for each of the function types; acquiring information indicating the number of the second devices for each of the plurality of function types in a second environment including the second devices for the plurality of function types; predicting a communication volume in the second environment based on the relationship data and the information indicating the number of devices; the relationship data indicates, for each of the function types, a change in the communication volume when the number of the first devices of the function type is increased and the number of the first devices of the other function types does not change; calculating a difference between the number of the first devices for the functional type and the number of the second devices for the same functional type as the functional type, for each of the functional types; multiplying the fluctuation in the communication volume when the number of first devices of the functional type is increased by one by the difference in the number of devices; predicting the communication volume in the second environment by adding a value obtained by multiplying the fluctuation amount and the difference to the communication volume in the first environment in a case where there is one first device for each of the plurality of function types; Information processing methods.

16. acquiring relationship data in which a fluctuation in communication volume in a first environment including first devices of a plurality of function types is associated with a fluctuation in the number of the first devices for each of the function types; acquiring information indicating the number of the second devices for each of the plurality of function types in a second environment including the second devices for the plurality of function types; predicting a communication volume in the second environment based on the relationship data and the information indicating the number of devices; Run the following on your computer: the relationship data indicates, for each of the function types, a change in the communication volume when the number of the first devices of the function type is increased and the number of the first devices of the other function types does not change; calculating a difference between the number of the first devices of the functional type and the number of the second devices of the same functional type as the functional type for each of the functional types; multiplying, for each of the function types, the amount of change in the communication volume when the number of the first devices of the function type is increased by one by the difference in the number of the first devices; predicting the communication volume in the second environment by adding a value obtained by multiplying the variation amount and the difference to the communication volume in the first environment in a case where each of the first devices of the plurality of function types is one; A computer program for causing the computer to execute the above steps.

Images