Threshold calculation device, abnormality detection device, threshold calculation method, and abnormality detection method

Abstract

A threshold value calculation device according to the present invention calculates a threshold value used in an abnormality detection device for detecting abnormal communication in a first device in a facility in which a home network (11) is installed. A second device different from the first device is provided in the facility. The threshold value calculation device is provided with: a device state acquisition unit (110) for acquiring a device state of the first device in a first time period; a room occupancy situation determination unit (120) for determining a room occupancy situation of a person who is present in the facility in the first time period on the basis of information acquired from the second device; a communication log collection unit (130) for collecting a communication log generated by communication transmitted and received by the first device in the first time period; and a learning unit (140) for calculating a threshold value for communication in the first device in a second time period subsequent to the first time period on the basis of the device state, the room occupancy situation, and the communication log. The device state includes at least one state of the first device, the room occupancy situation includes at least one situation of the person, and the learning unit (140) calculates a threshold value for each combination of the at least one state and the at least one situation.

Description

[Technical Field]

[0001] The present disclosure relates to a threshold calculation device, an anomaly detection device, a threshold calculation method, and an anomaly detection method. [Background technology]

[0002] In recent years, various IoT (Internet of Things) devices in homes have begun to connect to the Internet via home routers. Connecting these home IoT devices to the Internet enables functions such as remote control, status monitoring, and device integration.

[0003] On the other hand, popular home network protocols such as ECHONET Lite (registered trademark, same below), UPnP (Universal Plug and Play), and DLNA (registered trademark, same below) (Digital Living Network Alliance) do not include secure concepts such as communication encryption.

[0004] Furthermore, in many cases, it is not possible to install security software such as antivirus software on home IoT devices, as is the case with conventional IT (Information Technology) devices such as PCs, and cyber attacks are occurring targeting devices connected to home networks (e.g., LAN: Local Area Network).

[0005] For example, if a home IoT device is manipulated by a cyberattack, it could infect a smart TV with a virus, expose surveillance camera footage online, or be used to attack other servers on the Internet. Furthermore, if the home IoT device is a medical device, it could be manipulated in a way that puts human life at risk.

[0006] Therefore, it is becoming increasingly important to monitor the traffic flowing through home networks and detect abnormalities in home IoT devices caused by unauthorized access, virus infections, etc.

[0007] Methods for detecting network anomalies include a signature detection method that detects anomalies by comparing known abnormal packet patterns (signatures) with the patterns of packets flowing on the network, and an anomaly detection method that detects anomalies by comparing the patterns of packets in a normal state with the patterns of packets flowing on the network (see, for example, Patent Document 1).

[0008] However, in the signature detection method, abnormal packet patterns must be determined in advance, and therefore, it is not possible to detect abnormalities such as unknown viruses.

[0009] On the other hand, the anomaly detection method, as in Patent Document 1, uses machine learning technology to learn normal packet patterns and detects all packet patterns that do not match the learned model as abnormal, making it possible to detect abnormalities such as unknown viruses. [Prior art documents] [Patent documents]

[0010] [Patent Document 1] Japanese Patent Application Laid-Open No. 2004-312064 Summary of the Invention [Problem to be solved by the invention]

[0011] However, the method disclosed in Patent Document 1 detects anomalies by learning packet patterns of normal devices, but may not be able to accurately detect anomalies when communication usage changes in response to changes in conditions within the facility.

[0012] Therefore, in order to solve the above-mentioned problems, the present disclosure provides a threshold calculation device, an anomaly detection device, a threshold calculation method, and an anomaly detection method that can perform anomaly detection more accurately. [Means for solving the problem]

[0013] A threshold calculation device according to one embodiment of the present disclosure is a threshold calculation device that calculates a threshold used in an anomaly detection device that is connected to an intra-facility network and detects abnormal communications in a first device within a facility in which the intra-facility network is installed, wherein a second device different from the first device is installed within the facility, and the threshold calculation device includes: a first device status acquisition unit that acquires the device status of the first device during a first period; a first occupancy status determination unit that determines the presence status of people within the facility during the first period based on information acquired from the second device; a first communication log collection unit that collects communication logs generated by communications sent and received by the first device during the first period; and a calculation unit that calculates a threshold for communications of the first device during a second period after the first period based on the device status, the occupancy status, and the communication log, wherein the device status includes one or more states of the first device, and the occupancy status includes one or more statuses of the people, and the calculation unit calculates the threshold for each combination of the one or more states and the one or more statuses.

[0014] An anomaly detection device according to one embodiment of the present disclosure is an anomaly detection device that is connected to an intra-facility network and detects abnormal communication in a first device within a facility in which the intra-facility network is installed, wherein a second device different from the first device is installed within the facility, and the anomaly detection device includes: a second device status acquisition unit that acquires the device status of the first device for a second period following a first period; a first occupancy status determination unit that determines the occupancy status of people within the facility during the second period based on information acquired from the second device; a second communication log collection unit that collects communication logs generated by communications sent and received by the first device during the second period; and an anomaly detection unit that selects a threshold value corresponding to the device status and the occupancy status for the second period from among threshold values ​​for each of the one or more states and combinations of the one or more situations of the first device calculated by the threshold calculation device, and detects the abnormal communication of the first device during the second period based on the selected threshold value and the communication log for the second period.

[0015] A threshold calculation method according to one embodiment of the present disclosure is a threshold calculation method for calculating a threshold used in an anomaly detection device that is connected to an intra-facility network and detects abnormal communications in a first device within a facility in which the intra-facility network is installed, wherein a second device different from the first device is installed within the facility, the method includes acquiring the device status of the first device for a first period, determining the presence status of people within the facility during the first period based on information acquired from the second device, collecting a communication log generated by communications sent and received by the first device during the first period, and calculating a threshold for communications of the first device for a second period after the first period based on the device status, the presence status, and the communication log, wherein the device status includes one or more states of the first device and the presence status includes one or more states of the people, and the threshold calculation includes calculating the threshold for each combination of the one or more states and the one or more states.

[0016] An anomaly detection method according to one embodiment of the present disclosure is an anomaly detection method for detecting abnormal communication in a first device connected to an intra-facility network and within a facility in which the intra-facility network is installed, wherein a second device different from the first device is installed within the facility, the anomaly detection method includes the steps of: acquiring the device status of the first device for a second period following a first period; determining the presence or absence of people in the facility during the second period based on the information acquired from the second device; collecting a communication log generated by communications sent and received by the first device during the second period; selecting a threshold value corresponding to the device status and the presence or absence during the second period from threshold values ​​calculated by the threshold calculation method for each of the one or more states and combinations of the one or more states of the first device; and detecting the abnormal communication of the first device during the second period based on the selected threshold value and the communication log for the second period. [Effects of the Invention]

[0017] According to the present disclosure, it is possible to realize a threshold calculation device or the like that can perform anomaly detection more accurately. [Brief explanation of the drawings]

[0018] [Figure 1] FIG. 1 is a diagram showing the overall configuration of an anomaly detection system according to an embodiment. [Figure 2] FIG. 2 is a configuration diagram of the anomaly detection processing device according to the embodiment. [Figure 3] FIG. 3 is a diagram illustrating an example of device status data according to the embodiment. [Figure 4] FIG. 4 is a diagram illustrating an example of occupancy status data according to the embodiment. [Figure 5] FIG. 5 is a diagram illustrating an example of a communication log according to the embodiment. [Figure 6] FIG. 6 is a diagram illustrating an example of learning data according to the embodiment. [Figure 7] FIG. 7 is a diagram illustrating an example of threshold data according to the embodiment. [Figure 8A] FIG. 8A is a flowchart showing the operation of the threshold calculation device according to the embodiment. [Figure 8B] FIG. 8B is a flowchart showing the operation of the anomaly detection device according to the embodiment. [Figure 9] FIG. 9 is a flowchart showing an example of the device status acquisition process according to the embodiment. [Figure 10] FIG. 10 is a flowchart showing an example of the device status acquisition process according to the embodiment. [Figure 11] FIG. 11 is a flowchart showing another example of the device status acquisition process according to the embodiment. [Figure 12] FIG. 12 is a flowchart showing yet another example of the device status acquisition process according to the embodiment. [Figure 13] FIG. 13 is a flowchart showing an example of the occupancy status determination process according to the embodiment. [Figure 14] FIG. 14 is a flowchart illustrating an example of a communication log collection process according to the embodiment. [Figure 15] FIG. 15 is a flowchart showing an example of the learning process according to the embodiment. [Figure 16]FIG. 16 is a flowchart illustrating an example of the learning data creation process according to the embodiment. [Figure 17] FIG. 17 is a flowchart showing an example of the threshold setting process according to the embodiment. [Figure 18] FIG. 18 is a flowchart showing an example of the abnormality detection process according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0019] (Background to this disclosure) As described in the above "Problem to be Solved by the Invention," the method disclosed in Patent Document 1 may not be able to accurately detect anomalies when communication usage changes in response to changes in the conditions within the facility. For example, in the case of IoT devices in the home, device usage varies depending on the number of residents present, their attributes, etc., so using only packet patterns of normal devices may result in false positives, missed detections, etc.

[0020] For example, if a smart TV is turned on and the lights come on, you want to detect an abnormality if the resident is not present, but because it is not possible to determine whether the resident is present or not, it is not possible to detect an abnormality, and there is a possibility that it will be missed.

[0021] In addition, if a new device is connected by someone other than the resident, such as a visitor, and the number of people present in the room increases, resulting in an increase in communication volume, this may be detected as an abnormality, resulting in a false positive.

[0022] As such, conventional technology does not detect abnormalities by taking into account the presence of residents in the room, so when communication usage changes in response to changes in the conditions within the facility, it is not possible to accurately detect abnormalities, and detection may be missed or false positives may occur.

[0023] Therefore, the inventors of the present application have conducted extensive research into a threshold calculation device, an anomaly detection device, a threshold calculation method, and an anomaly detection method that can perform anomaly detection more accurately, and have devised the threshold calculation device, anomaly detection device, a threshold calculation method, and anomaly detection method described below.

[0024] A threshold calculation device according to one embodiment of the present disclosure is a threshold calculation device that calculates a threshold used in an anomaly detection device that is connected to an intra-facility network and detects abnormal communications in a first device within a facility in which the intra-facility network is installed, wherein a second device different from the first device is installed within the facility, and the threshold calculation device includes: a first device status acquisition unit that acquires the device status of the first device during a first period; a first occupancy status determination unit that determines the presence status of people within the facility during the first period based on information acquired from the second device; a first communication log collection unit that collects communication logs generated by communications sent and received by the first device during the first period; and a calculation unit that calculates a threshold for communications of the first device during a second period after the first period based on the device status, the occupancy status, and the communication log, wherein the device status includes one or more states of the first device, and the occupancy status includes one or more statuses of the people, and the calculation unit calculates the threshold for each combination of the one or more states and the one or more statuses.

[0025] As a result, a threshold is calculated for each combination of equipment status and occupancy status, and the anomaly detection device detects an anomaly in communication during the second period using a threshold according to the equipment status and occupancy status during the second period, thereby enabling more accurate anomaly detection compared to detecting an anomaly in communication using a packet pattern of normal equipment regardless of the status within the facility as in Patent Document 1. Therefore, by using the threshold calculated by the threshold calculation device, anomaly detection can be performed more accurately.

[0026] Furthermore, for example, the first device state acquisition unit may acquire, as the device state, at least one of a power state and a setting value of the first device based on communication including a device control command for controlling the first device.

[0027] This allows the calculation unit to calculate a threshold value for at least one of the power state and the set value. When the anomaly detection device detects an anomaly using a threshold value according to at least one of the power state and the set value in the second period, the anomaly detection can be performed more accurately for at least one of the power state and the set value. Therefore, by using the threshold value calculated by the threshold calculation device, the anomaly detection can be performed more accurately for at least one of the power state and the set value.

[0028] Furthermore, for example, the first occupancy status determining unit may determine the occupancy status based on information acquired from the first device or a third device other than the first device and the second device.

[0029] This allows the occupancy status to be determined using information acquired from devices other than the second device, making it possible to more accurately confirm the occupancy status, which leads to more accurate anomaly detection.

[0030] Also, for example, the communication log may include type information indicating an online type determined based on a destination identifier of the communication log, the type information including one or more online types in the communication log, and the calculation unit may further calculate the threshold value for each combination of the one or more online types.

[0031] This allows a threshold to be calculated for each combination that includes one or more online types. In other words, a threshold can be calculated for each communication destination. When the anomaly detection device detects an anomaly using a threshold according to the online type of communication in the second period, anomaly detection for that online type can be performed more accurately. Therefore, by using the threshold calculated by the threshold calculation device, anomaly detection can be performed more accurately when there is one or more online types.

[0032] Furthermore, for example, the calculation unit may generate learning data in which the device state, the occupancy status, and the communication log are associated with each other, and calculate the threshold value based on the learning data.

[0033] This allows the threshold to be calculated easily by creating learning data in advance and simply extracting necessary data from the learning data.

[0034] Furthermore, for example, the occupancy status may include the presence or absence of the person in the facility, and the calculation unit may calculate the threshold value for each of the presence and absence of the person.

[0035] This allows the calculation unit to calculate a threshold value for each of the presence and absence of a person. When the anomaly detection device detects an anomaly using a threshold value according to whether a person is present or absent during the second period, anomaly detection can be performed more accurately in either case. Therefore, by using the threshold value calculated by the threshold calculation device, anomaly detection can be performed more accurately when a person is present or absent.

[0036] Furthermore, for example, the occupancy status may include at least one of the number of people and their locations within the facility, and the calculation unit may calculate the threshold value for each of the at least one of the number of people and their locations within the facility.

[0037] This allows the calculation unit to calculate a threshold value for at least one of the number of people and their locations. When the anomaly detection device detects an anomaly using a threshold value according to at least one of the number of people and their locations in the second period, the anomaly detection can be performed more accurately for at least one of the cases. Therefore, by using the threshold value calculated by the threshold calculation device, the anomaly detection can be performed more accurately for at least one of the number of people and their locations.

[0038] Furthermore, for example, the occupancy status may include one or more pieces of activity information of the person in the first period, and the calculation unit may further calculate the threshold value based on the one or more pieces of activity information.

[0039] This allows a threshold to be calculated for each combination that further includes human activity information. In other words, a threshold can be calculated for each piece of human activity information. When the anomaly detection device detects an anomaly using a threshold according to the human activity information of the second period, anomaly detection for that activity information can be performed more accurately. Therefore, by using the threshold calculated by the threshold calculation device, anomaly detection can be performed more accurately when there is one or more pieces of activity information.

[0040] Furthermore, for example, the threshold may be a threshold for the communication volume of the first device, and may include a maximum value and a minimum value of the communication volume.

[0041] This allows a threshold value to be calculated that can detect an anomaly both when the communication volume is high and when it is low. By using such a threshold value, anomaly detection can be performed more accurately than when the threshold value is only one of the upper and lower limits.

[0042] Furthermore, an anomaly detection device according to one aspect of the present disclosure is an anomaly detection device that is connected to an intra-facility network and detects abnormal communication in a first device within a facility in which the intra-facility network is installed, wherein a second device different from the first device is installed within the facility, and the anomaly detection device includes: a second device status acquisition unit that acquires the device status of the first device during a second period following a first period; a first occupancy status determination unit that determines the presence status of people within the facility during the second period based on information acquired from the second device; a second communication log collection unit that collects communication logs generated by communications sent and received by the first device during the second period; and an anomaly detection unit that selects a threshold value corresponding to the device status and the occupancy status for the second period from among threshold values ​​for each of the one or more states and combinations of the one or more situations of the first device calculated by the threshold calculation device, and detects the abnormal communication of the first device during the second period based on the selected threshold value and the communication log for the second period.

[0043] As a result, the anomaly detection device can detect communication anomalies during the second period using thresholds corresponding to the equipment status and occupancy status for the second period out of the thresholds calculated for each combination of equipment status and occupancy status. By detecting communication anomalies using such thresholds, the anomaly detection device can perform anomaly detection more accurately than when detecting communication anomalies using packet patterns of normal equipment regardless of the status within the facility, as in Patent Document 1.

[0044] Furthermore, for example, the anomaly detection unit may compare the communication log with the selected threshold, and if the communication log does not satisfy the threshold, determine that the communication log is abnormal and output the determination result.

[0045] This allows the anomaly detection device to notify the user that an anomaly has been detected, if an anomaly has been detected.

[0046] Furthermore, a threshold calculation method according to one embodiment of the present disclosure is a threshold calculation method for calculating a threshold used in an anomaly detection device that is connected to an intra-facility network and detects abnormal communications in a first device within a facility in which the intra-facility network is installed, wherein a second device different from the first device is installed within the facility, the method includes acquiring the device status of the first device for a first period, determining the presence status of people within the facility during the first period based on information acquired from the second device, collecting a communication log generated by communications sent and received by the first device during the first period, and calculating a threshold for communications of the first device for a second period after the first period based on the device status, the presence status, and the communication log, wherein the device status includes one or more states of the first device and the presence status includes one or more statuses of the people, and the threshold calculation includes calculating the threshold for each combination of the one or more states and the one or more statuses.

[0047] This provides the same effect as the above-described threshold calculation device.

[0048] Furthermore, an anomaly detection method according to one aspect of the present disclosure is an anomaly detection method for detecting abnormal communication in a first device connected to an intra-facility network and within a facility in which the intra-facility network is installed, wherein a second device different from the first device is installed within the facility, the method includes: acquiring the device status of the first device for a second period following a first period; determining the presence status of people within the facility during the second period based on the information acquired from the second device; collecting a communication log generated by communications sent and received by the first device during the second period; selecting a threshold value corresponding to the device status and the presence status during the second period from threshold values ​​calculated by the threshold calculation method for each of the one or more states and combinations of the one or more states of the first device; and detecting the abnormal communication of the first device during the second period based on the selected threshold value and the communication log for the second period.

[0049] This provides the same effect as the anomaly detection device described above.

[0050] Hereinafter, with reference to the drawings, a description will be given of the configuration of an anomaly detection system according to an embodiment of the present disclosure, the configurations of a threshold calculation device and an anomaly detection device, and the processing flow in the threshold calculation device and the anomaly detection device.

[0051] The embodiments described below each represent a preferred specific example of the present disclosure. In other words, the numerical values, shapes, materials, components, arrangement and connection of the components, steps, and order of steps shown in the following embodiments are examples of the present disclosure and are not intended to limit the present disclosure.

[0052] The present disclosure is defined by the claims. Therefore, among the components in the following embodiments, components that are not recited in the independent claims that represent the most general concept of the present disclosure are not necessarily required to achieve the object of the present disclosure, but are described as components that constitute more preferred embodiments.

[0053] Furthermore, the numerical values ​​and numerical ranges described in the embodiments are merely examples, and the present invention is not limited to these numerical values ​​and numerical ranges.

[0054] (Embodiment) In an embodiment of the present disclosure, a configuration is described in which the threshold value used for detecting anomalies is varied based on the operating status of each device in the home and the status of the residents estimated from information obtained from each sensor or device installed in the home, and an abnormality in the device is determined.

[0055] [1. Details of the embodiment] Here, as an embodiment of the present disclosure, an anomaly detection system according to the present disclosure will be described with reference to the drawings. Note that in this embodiment, a case will be described in which home IoT devices (air conditioners, televisions, etc.) and IT devices (smartphones (hereinafter, smartphones), personal computers (hereinafter, PCs)), etc. are connected to a home network (home network 11), but the devices connected to the network are not limited to these.

[0056] In addition, the following describes an example in which IoT devices and IT devices are placed inside a home, but the devices are not limited to being placed inside a home and may be placed in any facility that people can enter and exit.

[0057] [1.1 Overall configuration of anomaly detection system] 1 is a diagram showing the overall configuration of an anomaly detection system 1 according to this embodiment.

[0058] As shown in Figure 1, the anomaly detection system 1 includes the Internet 10, a home network 11, a home gateway 20, an air conditioner 30, a gas water heater 31, an electric lock 32, lighting (lighting device) 33, a television 40, a recorder 41, a controller 50, a smartphone 60, a personal computer 61, an anomaly detection processing device 70, and an anomaly monitoring device 80.

[0059] The Internet 10 is the general Internet, the smartphone 60 is a general smartphone, and the PC 61 is a general personal computer.

[0060] The home gateway 20, air conditioner 30, gas water heater 31, electric lock 32, lighting 33, television 40, recorder 41, controller 50, smartphone 60, personal computer 61 and anomaly detection processing device 70 are connected via a home network 11, and when the air conditioner 30, gas water heater 31, electric lock 32, lighting 33, television 40, recorder 41, controller 50, smartphone 60, personal computer 61 and anomaly detection processing device 70 communicate with the Internet 10, they communicate via the home gateway 20.

[0061] The home gateway 20 is connected to an air conditioner 30, a gas water heater 31, an electric lock 32, lighting 33, a television 40, a recorder 41, a controller 50, a smartphone 60, a personal computer 61, and an abnormality detection processing device 70, and mediates communication between the connected devices and between the connected devices and the Internet 10.

[0062] In addition, the home gateway 20 manages information such as IP addresses required for communication between the air conditioner 30, gas water heater 31, electric lock 32, lighting 33, television 40, recorder 41, controller 50, smartphone 60, personal computer 61, and anomaly detection processing device 70, and assigns IP addresses or notifies information required for communication in response to requests from each device.

[0063] The home gateway 20 also monitors communications between connected devices and communications between the connected devices and the Internet 10, and transfers the contents of the communications to the anomaly detection processing device .

[0064] The communication content to be transferred to the anomaly detection processing device 70 may be the communication packet itself received by the home gateway 20, or a log of the communication packet that has been shaped may be transferred.

[0065] When the home gateway 20 transfers the log, the home gateway 20 itself may be provided with a log collection function, or another log collection device may be used.

[0066] The air conditioner 30, gas water heater 31, electric lock 32, lighting 33, television 40, and recorder 41 are home IoT devices that receive device control commands, interpret the contents of the received device control commands, and operate accordingly. The device control commands may be transmitted from the home network 11, or may be transmitted from a terminal (not shown) or a server (not shown) on the Internet 10 via the home gateway 20.

[0067] Furthermore, each device connects to the Internet 10 via the home gateway 20 as necessary to update firmware, download content, etc. Furthermore, each device notifies other devices of its operation or information detected by a sensor installed in each device (sensor information).

[0068] For example, in the case of air conditioner 30, it notifies other devices of the operating status (power on / power off), power saving operation setting (power saving operation in progress / normal operation in progress, etc.), operation mode setting (automatic / cooling / heating / dehumidification / humidification / fan, etc.), temperature setting value, information from the installed sensors (room temperature / humidity / outdoor temperature), setting values ​​for wind direction and wind volume, etc.

[0069] In the case of a gas water heater 31, it notifies other devices of the operating status (power on / power off), the water heater combustion status, or settings such as the hot water temperature setting value, hot water insulation setting value, and automatic operation time setting value.

[0070] In the case of an electric lock 32, it notifies other devices of settings such as the operating status (power on / power off), locking setting (locked / unlocked), door open / closed status, alarm status (normal status / forced open / door open / manual unlock / tamper, etc.), and automatic locking mode setting (ON / OFF).

[0071] In the case of the lighting 33, the operating state (power on / power off), and if there is a dimming function, the setting value, etc. are notified to other devices.

[0072] In the case of a television 40, it notifies other devices of its operating status (power on / power off), the channel number being viewed or the volume setting value, etc., and in the case of a recorder 41, it notifies other devices of its operating status (power on / power off), content transfer status (stopped / playing / transferring / paused (playing) / paused (recording) / recording / no media, etc.).

[0073] The timing of these notifications is not particularly limited, and may be made periodically, when the state or value changes, or when an inquiry is made from another device.

[0074] The controller 50 is a device for controlling home IoT devices such as the air conditioner 30, gas water heater 31, electric lock 32, and lighting 33, and controls these devices by sending device control commands to the air conditioner 30, gas water heater 31, electric lock 32, and lighting 33. The controller 50 may send device control commands in response to input from a user, or may send device control commands automatically in response to pre-set conditions.

[0075] The smartphone 60 and the PC 61 are IT devices connected to the Internet 10 via the home gateway 20. Note that a server may be connected to the Internet 10, and the home gateway 20, the smartphone 60, and the PC 61 may communicate with the server via the Internet 10 to interact with home IoT devices on the home network 11.

[0076] When the anomaly detection processing device 70 detects an anomaly in communications between home IoT devices such as the air conditioner 30, gas water heater 31, electric lock 32, lighting 33, television 40, and recorder 41, and IT devices such as the smartphone 60 and personal computer 61, the anomaly detection processing device 70 sends an alert to the anomaly monitoring device 80 on the Internet 10 via the home gateway 20. The communication anomaly may be an anomaly in the amount of communications or the number of communications. The anomaly detection processing device 70 may also be a server device managed by a security operation center (SOC). The amount of communications and the number of communications are, for example, the amount of communications and the number of communications over a predetermined period of time, but the amount of communications may also be, for example, the amount of communications per communication.

[0077] Based on the alert notified by the abnormality detection processing device 70, the abnormality monitoring device 80 collects and centrally manages communication logs, packets, etc. required for analyzing the alert.

[0078] The anomaly monitoring device 80 performs correlation analysis using the collected logs, packets, etc., and determines abnormalities such as signs and traces of a security incident. If the anomaly monitoring device 80 determines that an abnormality has occurred, it notifies residents, etc., of the equipment abnormality.

[0079] The analysis performed by the abnormality monitoring device 80 is not limited to correlation analysis, and other methods of analysis may be used.

[0080] In addition, there is no particular limitation on the method of collecting the communication logs used for analysis by the anomaly monitoring device 80. The logs may be acquired from the anomaly detection processing device 70, the home gateway 20, or another method.

[0081] Furthermore, the method by which the abnormality monitoring device 80 notifies the resident of an abnormality is not particularly limited. The notification may be sent to the resident's smartphone, an alarm installed in the house may sound, or another method may be used.

[0082] In this embodiment, the home gateway 20 and the anomaly detection processing device 70 are illustrated separately, but the function of the anomaly detection processing device 70 may be incorporated into the home gateway 20.

[0083] In addition, the components of the anomaly detection system 1 include an air conditioner 30, a gas water heater 31, an electric lock 32, lighting 33, a television 40, and a recorder 41 as home IoT devices that receive device control commands, and a smartphone 60 and a personal computer 61 as IT devices that connect to the Internet 10 via the home gateway 20, but this device configuration is not necessarily required, and other devices may be present, or only one of the devices may be present.

[0084] Furthermore, home IoT devices may not only receive device control commands, but also transmit device control commands to other devices, and may also perform communications other than device control commands.Home IoT devices are an example of IoT devices deployed within a facility.

[0085] Furthermore, although the IT devices are connected to the Internet 10, this is not limiting and they may communicate with devices on the home network 11. These devices may also communicate with terminals or servers on the Internet 10 via the Internet 10.

[0086] Furthermore, the home gateway 20 may be further connected to a device capable of detecting a person, such as a camera (not shown) or a motion sensor (not shown). In other words, a device capable of detecting a person, such as a camera or a motion sensor, may be installed in the home. The camera may be a camera mounted on the electric lock 32, smartphone 60, or personal computer 61, and the motion sensor may be a motion sensor mounted on the air conditioner 30 or lighting 33. The device capable of detecting a person may also be a carbon dioxide sensor, a sensor for detecting water usage, or the like.

[0087] The home gateway 20, air conditioner 30, gas water heater 31, electric lock 32, lighting 33, television 40, recorder 41, controller 50, smartphone 60, and personal computer 61 are located within the home. The abnormality detection processing device 70 may be located within the home or outside the home.

[0088] Furthermore, one of the air conditioner 30, gas water heater 31, electric lock 32, lighting 33, television 40, recorder 41, controller 50, smartphone 60, and personal computer 61 is an example of a first device installed in a home (an example of a facility), and another device other than the one device is an example of a second device, and yet another device is an example of a third device. At least one of the second device and the third device may be a device capable of detecting a person, such as a camera or a motion sensor. The first device is a device for which the threshold calculation device calculates a threshold.

[0089] [1.2 Overall configuration of the abnormality detection processing device 70] 2 is a configuration diagram of the anomaly detection processing device 70 according to this embodiment. FIG. 2 is a block diagram showing the functional configuration of the anomaly detection processing device 70.

[0090] As shown in FIG. 2, the abnormality detection processing device 70 includes a communication unit 100, an equipment status acquisition unit 110, an occupancy status determination unit 120, a communication log collection unit 130, a learning unit 140, an abnormality detection unit 150, an equipment status storage unit 200, an occupancy status storage unit 210, a communication log storage unit 220, and a learning data storage unit 230.

[0091] In this embodiment, the threshold calculation unit includes a communication unit 100, an appliance status acquisition unit 110 (an example of a first appliance status acquisition unit), an occupancy status determination unit 120 (an example of a first occupancy status determination unit), a communication log collection unit 130 (a first communication log collection unit), a learning unit 140, an appliance status storage unit 200, an occupancy status storage unit 210, a communication log storage unit 220, and a learning data storage unit 230. Also, in this embodiment, the anomaly detection device includes a communication unit 100, an appliance status acquisition unit 110 (an example of a second appliance status acquisition unit), an occupancy status determination unit 120 (an example of a second occupancy status determination unit), a communication log collection unit 130 (a second communication log collection unit), and an anomaly detection unit 150. The anomaly detection processing device 70 has the configuration of both a threshold calculation unit and an anomaly detection device. In this embodiment, the first equipment status acquisition unit and the second equipment status acquisition unit, the first occupancy status determination unit and the second occupancy status determination unit, and the first communication log collection unit and the second communication log collection unit are each realized as a common component, but are not limited to this.

[0092] The threshold calculation device calculates a threshold used in an anomaly detection device that is connected to home network 11 and detects abnormal communication in a first device in a house where home network 11 is installed. The anomaly detection device is also connected to home network 11 and detects abnormal communication in a first device in a house where home network 11 is installed.

[0093] The communication unit 100 receives communication packets from the Internet 10 or the home network 11. The communication unit 100 receives not only communications addressed to the home gateway 20 but also all communication packets on the home network 11 flowing via the home gateway 20.

[0094] Furthermore, the communication unit 100 transmits a device status acquisition request transmitted from the device status acquisition unit 110 to the communication line to which the home gateway 20 is connected, and transmits a device status acquisition response received from the home gateway 20 via the communication line to the device status acquisition unit 110. Alternatively, the communication unit 100 transmits device information and device status (device status) actively transmitted from devices connected to the home network 11 to the device status acquisition unit 110 via the home gateway 20.

[0095] The device status acquisition unit 110 transmits a device status acquisition request via the communication unit 100 and receives a device status acquisition response, thereby acquiring information about devices connected to the home network 11 and their statuses, and registers the information in the device status holding unit 200. Alternatively, the device status acquisition unit 110 acquires device information and their statuses actively transmitted from devices connected to the home network 11 from the home gateway 20 via the communication unit 100, and registers the information in the device status holding unit 200. The information registered by the device status acquisition unit 110 is also referred to as device status data (see FIG. 3). Note that registration means storing or updating.

[0096] The device information is information for identifying the device, and includes, for example, at least one of a device identifier and a device type.

[0097] The device state may be inferred from the power used by the device, etc. Furthermore, the device state may not only be the operating state (power on / power off), but also a state specific to each device, or a combination of multiple device states may be registered. Furthermore, the device state may include at least one of the power state and setting value of a first device based on communication including a device control command for controlling multiple devices including the first device.

[0098] Below are examples of information that may be included in the device status other than the power status (power on / power off) for each device. The power status can also be considered the operating status of the device.

[0099] For example, in the case of the air conditioner 30, the set temperature, operation mode (cooling / heating, etc.), etc. may be registered. The set temperature is an example of a set value.

[0100] In the case of a gas water heater 31, the hot water setting temperature, the water heater usage status (amount of gas or hot water used, etc.), and other values ​​themselves may be registered. The hot water setting temperature is an example of a setting value.

[0101] For the electric lock 32, the unlocked / locked state may be registered. For the lighting 33, the dimming state may be registered.

[0102] In the case of the television 40, the values ​​themselves such as the channel number being viewed and the volume may be registered. In the case of the recorder 41, the status such as playing / recording may be registered.

[0103] In the case of a smartphone 60 or a personal computer 61, the User-Agent or the name of the application being used may be registered.

[0104] In the case of a human sensor, whether or not a person is detected may be registered. In the case of a temperature and humidity sensor (not shown), the temperature or humidity value itself may be registered.

[0105] In the case of a window (not shown) or door open / close sensor (not shown), information such as whether the door is open or closed, the numerical value indicating how far it is open, and the locking status (unlocked / locked) may be registered.

[0106] The device status storage unit 200 stores, as device status data, information relating to the status of devices connected to the home network 11. The device status storage unit 200 is a storage device such as a semiconductor memory.

[0107] 3 is a diagram showing an example of device status data in this embodiment. The device status data shown in FIG.

[0108] As shown in Figure 3, the device status data includes a device identifier and a device type as information for identifying the device, and a device status as information representing the current state of the device, and the device type and device status are registered as a pair.

[0109] When a device is connected to the home network 11 for the first time, the device identifier, device type, and device status are newly registered, and the device status is updated to the latest status as appropriate thereafter.

[0110] As the device identifier, a MAC (Media Access Control) address obtained from the device may be registered, or information other than the MAC address may be used as the identifier.

[0111] The device type may be a device name, model name, or OS (Operating System) name estimated from terminal information acquired from the device, or a combination of these.

[0112] The device status registers the device status, such as the operating status (power on / power off) determined by the device status acquisition unit 110. In Fig. 3, one device status is registered for each device type, but multiple device statuses may be registered, each device status may be registered in a separate column, or different registration items may be registered for each device type. The device status includes one or more states (for example, power on, power off, unlocked, etc.) of each of multiple devices including the first device.

[0113] Returning to FIG. 2, the occupancy status determination unit 120 determines the presence status of people in the home based on information acquired from devices connected to the home network 11. For example, the occupancy status determination unit 120 determines the presence status of people in the home using at least information acquired from a second device other than the first device for which the threshold for abnormality detection is calculated. For example, the occupancy status determination unit 120 may further determine the presence status of people in the home based on information acquired from at least one of the first device and the third device. Furthermore, the occupancy status determination unit 120 may acquire the current device status from the device status storage unit 200, determine the presence status based on a combination of the device statuses, and create occupancy status data (see FIG. 4). The occupancy status determination unit 120 registers the created occupancy status data in the occupancy status storage unit 210. The occupancy status data is a table in which the device status is associated with the presence status (e.g., whether the person is present or absent). The occupancy status data is created, for example, before the threshold calculation device actually calculates the threshold.

[0114] The occupancy status determination unit 120 may analyze the usage status of each device or information from various sensors to determine the occupancy status of people in the house, and register the occupancy status data created by the occupancy status storage unit 210.

[0115] When determining based on the usage status of each device, the occupancy status determination unit 120 infers the occupancy status from a combination of the usage status of each device. For example, the occupancy status determination unit 120 determines that a person is in the room when the device status of the air conditioner 30 is powered on, the device status of the electric lock 32 is unlocked, and the device status of the television 40 is powered on. The occupancy status determination unit 120 may infer the occupancy status from the usage status of the devices using a table in which combinations of the usage status of each device are associated with the occupancy status.

[0116] When determining the occupancy status from information from various sensors, the occupancy status determination unit 120 may determine the occupancy status from information from a motion sensor installed in the home, or from information obtained by analyzing images or videos from a camera installed in the home. Alternatively, the occupancy status determination unit 120 may have all residents carry a transmitter such as an RF tag, and use a receiver such as an RF receiver installed in the home to receive information from a sensor mounted on the transmitter to determine the location of the transmitter in the home, whether the transmitter is operating, and determine the occupancy status based on the information. Alternatively, the occupancy status determination unit 120 may determine the occupancy status by having all residents carry a receiver, installing the receiver in the home, and notifying a server or home controller 50, such as the home gateway 20, of the received signal. Alternatively, the occupancy status may be determined based on information obtained by tracking the resident's movements using an indoor positioning system. In addition, the occupancy status determination unit 120 may estimate the number of users from the amount of communication passing through the home gateway 20 and the past amount of communication, or may estimate the number of users from the number of connections to Wi-Fi (registered trademark) access points (Wi-Fi APs), or may determine the number of users from other information.

[0117] In addition, the occupancy status determination unit 120 may determine the occupancy status from sensor information obtained from each home appliance, etc. (for example, information from a refrigerator open / close sensor, information from a window or door open / close sensor, water usage in the kitchen or bathroom, room temperature, humidity, carbon dioxide concentration, chemical substance concentration or changes therein, etc.), from which it can be determined that a person is actually in the house or that a person is moving.

[0118] The occupancy status storage unit 210 stores, as occupancy status data, information about the occupancy status determined from a combination of the states of the second device or a plurality of devices including the second device. The occupancy status storage unit 210 is a storage device such as a semiconductor memory.

[0119] 4 is a diagram showing an example of occupancy status data in this embodiment. The occupancy status data shown in FIG.

[0120] As shown in Fig. 4, the occupancy status data stores combinations of device states for all devices registered in the device status data stored in the device status storage unit 200, and corresponding occupancy statuses. The occupancy status stores the presence / absence status (present / absent) of the residence. In other words, the occupancy status includes whether or not there is someone in the home. The occupancy status includes one or more statuses of the people in the home (present, absent, etc.).

[0121] The presence status is not limited to the presence / absence status (present / absent). For example, when a person is present, the presence status may include the number of people present, the location of the resident, or the attributes of the resident, or a combination of multiple presence statuses may be registered.

[0122] For example, the presence status data may include the number of people present, such as one person present or two people present, or information about where in the house people are present, such as only on the first floor or only on the second floor, or only in the bedroom, only in the living room, or in the kitchen. In other words, the presence status may include at least one of the number of people present and their locations in the home. Also, for example, the presence status data may include attributes of people present at home, such as only children present or only grandparents present, or attributes of people other than residents, such as whether there are visitors. The location may include which room a person is in, which floor they are on, etc.

[0123] The presence status may also include information about a person's activity. The activity information may include information indicating whether a person is awake or asleep, information about the amount of movement of the person, and the like. The activity information can be acquired by various sensors, etc. Furthermore, when a person is present in the room but the monitoring system of a home security company is in monitoring mode, the presence status determination unit 120 may determine that the person is asleep.

[0124] Also, in FIG. 4, the occupancy status is registered in one column, but it may be registered in separate columns for each of the above-mentioned contents.

[0125] The contents of Figure 4 are an example, but the actual presence / absence determination can be made by registering combinations of presence / absence in advance, by learning from past usage records and making an automatic determination, or by having residents register their presence status when using the anomaly detection system 1.

[0126] The occupancy status data shown in Fig. 4 is created for each room in the house, for example. For example, the occupancy status data differs for each room in the house.

[0127] In FIG. 4, when any state of the equipment state or the room occupancy state is acceptable, the condition may be expressed using a symbol such as "-".

[0128] 2, the communication log collection unit 130 registers communication packets received by the communication unit 100 as communication logs in the communication log holding unit 220. The communication log collection unit 130 collects, for example, communication logs generated by communications transmitted and received between a plurality of devices including the first device.

[0129] The communication log storage unit 220 stores, as communication data, information relating to communications between devices connected to the home network 11. The communication log storage unit 220 is a storage device such as a semiconductor memory.

[0130] 5 is a diagram showing an example of a communication log according to the present embodiment. The communication data shown in FIG.

[0131] 5, the communication log contains the communication date and time, sender identifier, destination identifier, communication protocol, communication volume, and online type included in the communication packet. The communication log is time-series data for a certain period of time.

[0132] The date and time of communication is registered as the date and time when the communication occurred. The granularity of the time is not limited to seconds, but may be registered in milliseconds or even microseconds.

[0133] The source identifier is registered as the MAC address of a device connected to the home network 11. Information other than the MAC address may be used as the source identifier.

[0134] In the destination identifier, a fully qualified domain name (FQDN) or a domain name is registered as an identifier of a destination with which a device connected to the home network 11 communicates. The destination identifier may also be a MAC address or an IP address, or a combination of these.

[0135] The communication protocol is registered as the communication protocol. The communication log collection unit 130 may determine the communication protocol used in the communication from the data portion of the communication packet, or may estimate it from the destination port number.

[0136] For example, in ECHONET Lite, the first two bytes of communication data are set to 0x1081 or 0x1082, so if the first two bytes of the data portion of the communication packet are 0x1081 or 0x182, the communication log collection unit 130 determines that the communication protocol is ECHONET Lite.

[0137] Also, for example, ECHONET Lite uses UDP (User Datagram Protocol) port number 3610 for communication, so if the destination port number of the received communication is 3610, the communication log collection unit 130 determines that the communication protocol is ECHONET Lite.

[0138] Furthermore, the communication log collection unit 130 may combine the above determinations, or may make a determination based on other information.

[0139] The packet size of the communication packet is registered in the communication volume.

[0140] The online type (local communication / global communication) is registered as the online type. The communication log collection unit 130 determines the communication as "local communication" when the destination identifier indicates a device within the home network 11, and determines the communication as "global communication" when the destination identifier indicates a server (not shown) or a site (not shown) on the Internet 10, and registers the determination result.

[0141] As described above, the communication log includes type information indicating the online type determined based on the destination identifier of the communication log, and the type information may include one or more online types in the communication log.

[0142] The communication log may be transferred to the communication log collection unit 130 by providing the home gateway 20 or other device (not shown) with a communication log generation function.

[0143] Returning to FIG. 2, the learning unit 140 calculates a threshold value (e.g., a communication volume threshold value) for communication of each of a plurality of devices including the first device based on the device state, occupancy status, and communication log. The learning unit 140 calculates a threshold value according to the device state and occupancy status for a second period including the time when the communication log to be detected by the anomaly detection device was acquired. The learning unit 140 may, for example, calculate a threshold value for each combination of the device state (e.g., one or more states) and the occupancy status (e.g., one or more situations). The learning unit 140 may also calculate a threshold value for each combination of one or more online types. In other words, the learning unit 140 may calculate a threshold value for each combination of the device state (e.g., one or more states), the occupancy status (e.g., one or more situations), and one or more online types.

[0144] The learning unit 140 creates learning data and threshold data based on the device status data acquired from the device status storage unit 200, the occupancy status data acquired from the occupancy status storage unit 210, and the communication log acquired from the communication log storage unit 220, and registers the data in the learning data storage unit 230. The learning unit 140 is an example of a calculation unit.

[0145] The learning data storage unit 230 stores communication contents including the device status and the room occupancy status as learning data. The learning data storage unit 230 also stores thresholds calculated from the learning data as threshold data. The learning data is actual measurement data for calculating thresholds.

[0146] 6 is a diagram showing an example of learning data in this embodiment. The learning data shown in FIG.

[0147] As shown in FIG. 6, the learning data includes the communication date and time, device identifier, device status, room presence status, communication volume, and online type.

[0148] In the device identifier and device status, the device identifier and device status of the device status data held by the device status holding unit 200 are registered.

[0149] In the occupancy status, the occupancy status of the occupancy status data held by the occupancy status holding unit 210 is registered.

[0150] The communication date and time, online type, and communication volume registered in the communication data held by the communication log holding unit 220 are registered as the communication date and time, online type, and communication volume.

[0151] As shown in Fig. 6, the learning unit 140 generates learning data in which the device status, the occupancy status, and the communication log (communication volume and online type in the example of Fig. 6) are associated with each other. The learning data is, for example, time-series data in which the device status, the occupancy status, and the communication log are arranged in chronological order. Then, the learning unit 140 calculates a threshold value based on the learning data, as will be described later.

[0152] The learning unit 140 may generate learning data as shown in FIG. 6 for each of a plurality of devices including the first device.

[0153] 7 is a diagram showing an example of threshold data in this embodiment. The threshold data shown in FIG.

[0154] As shown in FIG. 7, the threshold data includes registered device identifiers, device states, room occupancy statuses, online types, and thresholds.

[0155] In the device identifier and device status, the device identifier and device status of the device status data held by the device status holding unit 200 are registered.

[0156] In the occupancy status, the occupancy status of the occupancy status data held by the occupancy status holding unit 210 is registered.

[0157] The communication date and time, online type, and communication volume registered in the communication data held by the communication log holding unit 220 are registered as the communication date and time, online type, and communication volume.

[0158] The minimum and maximum packet size values ​​calculated by the learning unit 140 from the communication volume stored in the communication log storage unit 220 are registered as threshold values. The threshold values ​​are not limited to the minimum and maximum packet size values. The average packet size may be registered, the number of accesses per unit of time may be registered, other information may be registered as the threshold value, or a combination of these may be registered. The number of columns of threshold data may be increased depending on the threshold value registered. The calculation of the threshold value will be described later.

[0159] The threshold is a threshold for the amount of communication, and may include a maximum value and a minimum value of the amount of communication. The threshold is a threshold for the number of communications, and may include a maximum value and a minimum value of the number of communications. The threshold only needs to include at least one of the maximum value and the minimum value.

[0160] 7, the learning unit 140 generates threshold data in which the device state, occupancy status, online type, and the threshold value of the communication volume at that time are associated with each other. The threshold data is, for example, data in which a threshold is associated with each combination of the device state, occupancy status, and online type. Then, the abnormality detection unit 150 detects an abnormality in the device based on the threshold data generated by the learning unit 140, as will be described later.

[0161] The learning unit 140 may generate threshold data such as that shown in FIG. 7 for each of a plurality of devices including the first device.

[0162] 2, the anomaly detection unit 150 compares the threshold data in the learning data storage unit 230 with the communication log in the communication log storage unit 220 to determine whether or not an anomaly has occurred. The anomaly detection unit 150 notifies the anomaly monitoring device 80 via the communication unit 100 of any communication that has been determined to be an anomaly.

[0163] [1.3 Operation of the anomaly detection system] The operation of the above-described anomaly detection system 1 will be described below with reference to Figs. 8A to 18. First, the operation of the threshold calculation device (threshold calculation method) will be described with reference to Figs. 8A to 17. Fig. 8A is a flowchart showing the operation of the threshold calculation device (threshold calculation process) of the anomaly detection processing device 70. The threshold calculation process will also be referred to as a learning process.

[0164] (S801a) The anomaly detection processing device 70 performs device status acquisition processing. In step S801a, the threshold calculation device of the anomaly detection processing device 70 acquires the device status of each of multiple devices, including the first device, during a first period in order to determine a threshold. The first period is a period prior to the time when the communication log of the target for anomaly detection in the anomaly detection device was acquired.

[0165] (S802a) The abnormality detection processing device 70 performs an occupancy status determination process. In step S802a, the threshold calculation device of the abnormality detection processing device 70 performs a process of determining the occupancy status for the first period based on the information acquired from the second device.

[0166] (S803a) The abnormality detection processing device 70 performs a communication log collection process. In step S803a, the threshold calculation device of the abnormality detection processing device 70 performs a process of collecting communication logs for a first period.

[0167] (S804) The anomaly detection processing device 70 performs a learning process. In step S804, the threshold calculation device of the anomaly detection processing device 70 performs a process to calculate a threshold for communication with each of the multiple devices including the first device in a second period after the first period.

[0168] Next, the operation of the anomaly detection device will be described with reference to Fig. 8B, which is a flowchart showing the operation (anomaly detection process) of the anomaly detection device.

[0169] (S801b) In step S801b, the anomaly detection device of the anomaly detection processing device 70 performs processing to acquire the device status of each of multiple devices, including the first device, during a second period following the first period, in order to determine a communication anomaly. The second period is, for example, a period following the first period, but at least a portion of the second period may be included in the first period. The second period may be the time (for example, the current time) when the communication log of the detection target is acquired, or may be a period of one hour, one day, etc.

[0170] (S802b) The anomaly detection processing device 70 performs an occupancy status determination process. In step S802b, the anomaly detection device of the anomaly detection processing device 70 performs a process of determining the occupancy status for the second period based on the information acquired from the second device.

[0171] (S803b) The anomaly detection processing device 70 performs a communication log collection process. In step S803b, the anomaly detection device of the anomaly detection processing device 70 performs a process of collecting communication logs for the second period.

[0172] (S805) The anomaly detection processing device 70 performs an anomaly detection process. The anomaly detection device of the anomaly detection processing device 70 detects abnormal communications of each of the multiple devices including the first device during the second time period, based on the threshold calculated by the threshold calculation device and the device states, occupancy status, and communication logs during the second time period.

[0173] The communication log collection process may be performed before the device status acquisition process or the occupancy status determination process. The learning process and the abnormality detection process may be performed in parallel.

[0174] The learning process and the abnormality detection process will be described below with reference to FIGS.

[0175] [1.3.1 Operation during device status acquisition process] 9 is a flowchart showing an example of the device status acquisition process (S801 (S801a, S801b)) in this embodiment. FIG. 9 shows the process of the device status acquisition unit 110.

[0176] (S1101) The device status acquisition unit 110 checks the status of ECHONET Lite-compatible devices connected to the home network 11 and updates the device status data.

[0177] (S1102) The device status acquisition unit 110 checks the status of the UPnP / DLNA compatible devices connected to the home network 11 and updates the device status data.

[0178] (S1103) The device status acquisition unit 110 checks the status of other devices connected to the home network 11 and updates the device status data.

[0179] (S1104) The device status acquisition unit 110 waits for a certain period of time, returns to step S1101, and continues the processing from step S1101 onwards.

[0180] In FIG. 9, the device status acquisition unit 110 sequentially performs the processes from step S1101 to step S1103, but the processes do not have to be in the order of FIG. 9. Furthermore, the device status acquisition unit 110 may perform these processes in parallel. Furthermore, the device status acquisition unit 110 does not have to perform all of the processes from step S1101 to S1103 every time. The device status acquisition unit 110 only needs to perform at least one of steps S1101 to S1103 in the device status acquisition process. Furthermore, if the device actively transmits a status notification periodically, the device status acquisition unit 110 may perform the process when the notification is received.

[0181] Steps S1101 to S1103 will be described below with reference to FIGS.

[0182] [1.3.1.1 Status check process for ECHONET Lite compatible devices] Fig. 10 is a flowchart showing an example of device status acquisition processing in this embodiment. Specifically, Fig. 10 is a flowchart showing an example of status investigation processing (S1101) of an ECHONET Lite-compatible device.

[0183] (S11011) The device status acquisition unit 110 multicasts a local node instance list request (0xD6), which is a control command for ECHONET Lite-compliant devices, to the home network 11 as a device search request to the home network 11.

[0184] (S11012) The device status acquisition unit 110 determines whether or not there is a response to the local node instance list request (0xD6). If there is a response (Yes in S11012), the device status acquisition unit 110 performs the process of step S11013. If there is no response (No in S11012), the device status acquisition unit 110 performs the process of step S11017.

[0185] (S11013) The device status acquisition unit 110 determines whether the responding device is registered in the device status data, for example, whether it is an unregistered device. Specifically, the device status acquisition unit 110 determines whether the connection terminal device identifier, such as the source MAC address, included in the response is a device registered in the device status storage unit 200. If it is determined that the device is not registered (No in S11013), the device status acquisition unit 110 performs the process of step S11014. If it is determined that the device is registered (Yes in S11013), the device status acquisition unit 110 performs step S11015.

[0186] (S11014) The device status acquisition unit 110 newly registers the connected terminal device identifier (such as the source MAC address) and device type for the target device in the device status storage unit 200. The device type is determined by the ECHONET (registered trademark) object code (EOJ). For example, if the class group code is 0x01 (air conditioning-related device class group) or the class code is 0x30 (home air conditioner class), the device type can be identified as an air conditioner. Furthermore, the device status acquisition unit 110 may identify the device type by analyzing the communication packet, or may infer it from the OUI (Organizationally Unique Identifier) ​​of the MAC address.

[0187] (S11015) The device status acquisition unit 110 transmits an operation status acquisition request to the target device using an ECHONET Lite compliant device control command.

[0188] Control commands include a property value read request (ESV (ECHONET Lite service): 0x62) to acquire the operating status of the device's power supply (EPC (ECHONET property): 0x80) or a status request specific to the device type, and these requests may be combined. If the device is a home air conditioner, device status acquisition unit 110 sends a property value read request (ESV: 0x62) to acquire the operation mode setting (EPC: 0xB0) as the operating status acquisition request, and if the device is a water heater, it sends a property value read request (ESV: 0x62) to acquire the hot water supply temperature setting (EPC: 0xD1) as the operating status acquisition request.

[0189] (S11016) The device status acquisition unit 110 receives a response result to the control command sent in step S11015, identifies the device status based on the received response result, and registers the identified device status in the device status data.

[0190] The response result to a property value read request (ESV: 0x62) for acquiring the device's power operating status (EPC: 0x80) is power ON (EDT (ECHONET property value data): 0x30) or power OFF (EDT: 0x31), and the device status acquisition unit 110 registers "power ON" or "power OFF" in the device status data. The device status acquisition unit 110 may register the character string "power ON" or "power OFF" as the registered content, or may register the property value "EDT: 0x30" or "EDT: 0x31".

[0191] Also, for example, in the case of a water heater, suppose that a response to a request to read a property value to acquire the operating status of the power supply of the device (EPC: 0x80) is, for example, power ON (EDT: 0x30), and a response to a request to read a property value to acquire the hot water supply temperature setting (EPC: 0xD1) is, for example, a set temperature of 48°C (EDT: 0x30). In this case, the device status acquisition unit 110 registers both the EPC and EDT as the response results of the water heater, for example, "0x80 / 0x30" or "EPC: 0xD1 / 0x30."

[0192] (S11017) The device status acquisition unit 110 may update the device status of a device that has already been registered in the device status data but has not responded, that is, a device that was previously connected to the home network 11 but is not currently connected to the home network 11, by setting the device status to "power off." Note that the device status acquisition unit 110 may update the device status by setting the device status to "not connected" instead of "power off."

[0193] [1.3.1.2 UPnP / DLNA compatible device status check process] Fig. 11 is a flowchart showing another example of the device status acquisition process according to the present embodiment. Specifically, Fig. 11 is a flowchart showing an example of the status check process (S1102) of a UPnP / DLNA compatible device.

[0194] (S11021) The device status acquisition unit 110 multicasts an M-SEARCH request, which is a control command for UPnP / DLNA-compatible devices, to the home network 11 as a device search request.

[0195] (S11022) The device status acquisition unit 110 determines whether or not there is a response to the M-SEARCH request. If there is a response (Yes in S11022), the device status acquisition unit 110 performs the process of step S11023. If there is no response (No in S11022), the device status acquisition unit 110 performs the process of step S11027.

[0196] (S11023) The device status acquisition unit 110 determines whether the responding device is registered in the device status data, for example, whether it is an unregistered device. Specifically, the device status acquisition unit 110 determines whether a connection terminal device identifier such as a source MAC address included in the response is a device registered in the device status storage unit 200. If it is not registered (No in S11023), the device status acquisition unit 110 performs step S11024. If it is registered (Yes in S11023), the device status acquisition unit 110 performs step S11026.

[0197] (S11024) The device status acquisition unit 110 transmits a device type request (for example, an HTTP GET request) to the target device.

[0198] (S11025) The device status acquisition unit 110 acquires a response result (Device Description XML) to the device type request, and newly registers an unregistered device in the device status data based on the acquired response result. Specifically, the device status acquisition unit 110 estimates the device type from parameters such as "modelName," "modelNumber," and "modelDescription" included in the response result, and newly registers the connected terminal device identifier (source MAC address, etc.) included in the response result and the device type in the device status data (device status storage unit 200). Note that the above-mentioned parameters are merely examples, and the device status acquisition unit 110 may estimate the device type from other parameters. Furthermore, the device status acquisition unit 110 may identify the device type by analyzing a communication packet, or may infer it from the OUI of the MAC address.

[0199] (S11026) Since a response has been received from the target device, the device status acquisition unit 110 sets the device status to "power ON" and registers it in the device status data. The device status may be set based on the response result to the status request specific to the device type.

[0200] (S11027) The device status acquisition unit 110 may update the device status of a device that has already been registered in the device status data but has not responded, that is, a device that was previously connected to the home network 11 but is not currently connected to the home network 11, by setting the device status of the device to "power off." Note that the device status acquisition unit 110 may update the device status by setting the device status to "not connected" instead of "power off."

[0201] [1.3.1.3 Other equipment status investigation process] Fig. 12 is a flowchart showing yet another example of the device status acquisition process according to the present embodiment. Fig. 12 is a flowchart showing an example of the status check process (S1103) of devices other than ECHONET Lite compatible devices and UPnP / DLNA compatible devices (such as the smartphone 60 and the personal computer 61).

[0202] (S11031) The device status acquisition unit 110 broadcasts an ARP (Address Resolution Protocol) request to the home network 11 as a device search request.

[0203] (S11032) The device status acquisition unit 110 determines whether or not there is a response to the ARP request. If there is a response (Yes in S11032), the device status acquisition unit 110 performs the process of step S11033. If there is no response (No in S11032), the device status acquisition unit 110 performs the process of step S11036.

[0204] (S11033) The device status acquisition unit 110 determines whether the responding device is registered in the device status data, for example, whether it is an unregistered device. Specifically, the device status acquisition unit 110 determines whether a connection terminal device identifier such as a source MAC address included in the response is a device registered in the device status storage unit 200. If it is determined that the device is unregistered (No in S11033), the device status acquisition unit 110 performs step S11034. If it is determined that the device is registered (Yes in S11033), the device status acquisition unit 110 performs step S11035.

[0205] (S11034) The device status acquisition unit 110 newly registers the connected terminal device identifier (such as the source MAC address) and device type for the target device in the device status data (device status storage unit 200). The device status acquisition unit 110 may identify the device type by analyzing the communication packets communicated by the device, or may infer it from the OUI of the MAC address. For example, the OS name or OS version can be determined by analyzing the User-Agent included in the communication packets.

[0206] (S11035) The device status acquisition unit 110 registers the device status based on the response result of the target device. For example, the device status acquisition unit 110 sets the device status of the target device to "power ON" and registers it in the device status data. The device status acquisition unit 110 may set the device that has returned a response to "power ON," or may analyze the communication packets communicated by the device and set the application, etc., used by the device. For example, the device status acquisition unit 110 can determine the browser, etc., being used by analyzing the User-Agent included in the communication packets.

[0207] (S11036) The device status acquisition unit 110 may update the device status of a device that has already been registered in the device status data but has not responded, that is, a device that was previously connected to the home network 11 but is not currently connected to the home network 11, by setting the device status to "power off." Note that the device status acquisition unit 110 may update the device status by setting the device status to "not connected" instead of "power off."

[0208] [1.3.2 Operation during occupancy status determination process] 13 is a flowchart showing an example of the occupancy status determination process (S802 (S802a, S802b)) in this embodiment. FIG. 13 shows the process of the occupancy status determination unit 120.

[0209] (S1201) The occupancy status determining unit 120 acquires the current device status of all devices registered in the device status data stored in the device status storing unit 200.

[0210] (S1202) The occupancy status determination unit 120 compares the status indicated by the device status data stored in the device status storage unit 200 with the combination of device statuses registered in the occupancy status data stored in the occupancy status storage unit 210, and determines whether the resident is present or absent, that is, whether someone is present in the house. For example, if the device status data stored in the device status storage unit 200 is the status shown in FIG. 3 (air conditioner 30 is "powered on," electric lock 32 is "unlocked," television 40 is "powered off," and smartphone 60 is "powered on"), the occupancy status data stored in the occupancy status storage unit 210 is determined to be "present," which is the occupancy status that matches the combination of device statuses shown in FIG. 4. Furthermore, the occupancy status determination unit 120 may infer the occupancy status of the occupancy status data from the combination of device statuses and register it, or may set whether the resident is present or absent. The occupancy status determination unit 120 is not limited to determining presence or absence from the status of the equipment, but may also determine presence or absence using various sensor information such as a human presence sensor, or may determine presence or absence from the usage of water, electricity, gas, etc., or may determine presence or absence by taking into account online type information in addition to the status of the equipment.

[0211] [1.3.3 Operation during communication log collection process] 14 is a flowchart showing an example of the communication log collection process (S803 (S803a, S803b)) in this embodiment. FIG. 14 shows the process of the communication log collection unit 130.

[0212] (S1301) The communication log collection unit 130 receives, via the communication unit 100, the contents of a communication packet flowing through a communication line connected to the home gateway 20.

[0213] (S1302) The communication log collection unit 130 determines the destination of the received communication packet. If the destination identifier (FQDN, domain name, MAC address, IP address, etc.) of the received communication packet is addressed to a device within the home network 11, the communication log collection unit 130 performs step S1303, and if the destination identifier is addressed to a server or site on the Internet 10, the communication log collection unit 130 performs step S1304.

[0214] (S1303) If the destination identifier is addressed to a device within the home network 11, the communication log collection unit 130 sets the online type of the received communication packet to "local communication."

[0215] (S1304) If the destination identifier is a server or site on the Internet 10, the communication log recorder 130 sets the online type of the received communication packet to "global communication."

[0216] (S1305) The communication log collection unit 130 registers the date and time of communication, the source identifier (MAC address, IP address, etc.), the destination identifier, the communication protocol, the online type, and the communication volume from the received communication packet as a communication log in the communication log storage unit 220.

[0217] [1.3.4 Behavior during learning process] Fig. 15 is a flowchart showing an example of the learning process (S804) in this embodiment. Fig. 15 shows the process of the learning unit 140. The process shown in Fig. 15 is performed, for example, for each of a plurality of devices including the first device.

[0218] (S1401) The learning unit 140 generates learning data that is used to calculate a threshold value.

[0219] (S1402) The learning unit 140 sets a threshold value based on the created learning data.

[0220] In FIG. 15, the learning unit 140 sequentially performs the processes of steps S1401 and S1402, but these processes may also be performed in parallel.

[0221] The processes in steps S1401 and S1402 will be described below with reference to FIGS. 16 and 17, respectively.

[0222] [1.3.4.1 Details of the training data creation process] FIG. 16 is a flowchart showing an example of the learning data creation process (S1401) in this embodiment.

[0223] (S14011) The learning unit 140 acquires the communication log stored in the communication log storage unit 220. Specifically, the learning unit 140 acquires the sender identifier, communication volume, and online type of the currently communicating device from the communication log stored in the communication log storage unit 220. The learning unit 140 acquires the current communication log, but may also acquire a communication log at a specified time, a communication log of a specific device, or a list of communication logs. If the learning unit 140 acquires a list of communication logs, it repeatedly performs the processes of steps S14012 to S14014.

[0224] (S14012) The learning unit 140 acquires the device status data stored in the device status storage unit 200. Specifically, the learning unit 140 acquires all device types and device statuses of the device status data stored in the device status storage unit 200. The learning unit 140 may acquire the device status by specifying date and time by adding date and time information to the device status data.

[0225] (S14013) The learning unit 140 acquires the occupancy status data stored in the occupancy status storage unit 210. Specifically, the learning unit 140 acquires the occupancy status from the occupancy status data stored in the occupancy status storage unit 210 based on the equipment status data acquired in step S14012. For example, if the equipment status data acquired in step S14012 indicates that the air conditioner is "powered on," the electric lock is "unlocked," and the television is "powered off," the learning unit 140 can acquire "occupancy status" as the occupancy status. Furthermore, the learning unit 140 may acquire the occupancy status by specifying date and time by adding date and time information to the occupancy status data.

[0226] (S14014) The learning unit 140 associates the source identifier, communication volume, and online type acquired in step S14011 with the device type and device status acquired in step S14012 and the occupancy status acquired in step S14013, and registers them as learning data in the learning data storage unit 230. For example, when registering learning data from a communication log at "2020 / 11 / 4 16:45:00", the learning unit 140 acquires the source identifier "11:11:11:11:11:11", the communication volume "15,000 Bytes", and the online type "global communication" from the communication log stored in the communication log storage unit 220 shown in FIG. 5 in step S14011, acquires the device status "power on" of the device (air conditioner) with the device identifier "11:11:11:11:11:11" from the device status data stored in the device status storage unit 200 shown in FIG. 3 in step S14012, acquires "in the room" as the occupancy status in step S14013, and registers the communication date and time "2020 / 11 / 4 16:45:00" as learning data. The following are registered in association with each other: "16:45:00", device identifier "11:11:11:11:11:11", device status "power ON", presence status "in the room", communication volume "15,000 Bytes", and online type "global communication".

[0227] The timing of registration by the learning unit 140 in the learning data storage unit 230 may be the same as the timing of saving the communication log in the communication log storage unit 220, or may be any timing. When registering at any timing, the learning unit 140 needs to store the device status and occupancy status at the time of communication in the communication log.

[0228] Note that when registering the learning data, the learning unit 140 is not limited to generating the learning data using all of the data acquired in steps S14011, S14012, and S14013. For example, the learning unit 140 may perform a process to remove outliers from at least one of the communication log, the device status data, and the occupancy status data. The process to remove outliers may use any existing process, for example, a process using the interquartile range (IQR).

[0229] [1.3.4.2 Details of threshold setting process] FIG. 17 is a flowchart showing an example of the threshold setting process (S1402) in this embodiment.

[0230] (S14021) The learning unit 140 acquires the device status data stored in the device status storage unit 200. Specifically, the learning unit 140 acquires the device identifier (MAC address, etc.) and the device type from the device status data stored in the device status storage unit 200. The learning unit 140 may acquire the device identifier and device type of a specific device, or may acquire a list of devices registered in the device status data. If a list is acquired, the learning unit 140 repeats the processes of steps S14022 to S14027 for each device.

[0231] (S14022) The learning unit 140 determines whether or not there is learning data for the device in question from the learning data stored in the learning data storage unit 230. Specifically, the learning unit 140 uses the acquired device identifier (MAC address, etc.) to search for learning data for the device in question from the learning data stored in the learning data storage unit 230. If learning data for the device is found (Yes in S14022), the learning unit 140 performs step S14023, and if learning data is not found (No in S14022), the learning unit 140 performs step S14024.

[0232] (S14023) The learning unit 140 acquires the communication volume for each combination of device status / occupancy status / online type included in the learning data, and calculates a threshold for each of the combinations. The learning unit 140 calculates a threshold for each of the combinations.

[0233] For example, when the learning data stored in the learning data storage unit 230 is the content shown in FIG. 6, when the "Device Status / Presence Status / Online Type" for the device identifier "11:11:11:11:11:11" is "Power ON / Presence / Global Communication," the acquired communication volumes are "7,500 Bytes" and "15,000 Bytes." If "minimum / maximum" thresholds are set, "7,500 / 15,000 Bytes" are set as the thresholds. When three or more communication volumes are acquired for the "Device Status / Presence Status / Online Type" for the device identifier "11:11:11:11:11:11," the learning unit 140 sets the communication volume with the smallest communication volume among the three or more communication volumes as the minimum threshold and the communication volume with the largest communication volume as the maximum threshold. Note that the learning unit 140 is not limited to calculating both the minimum and maximum values ​​as the thresholds, and may calculate at least one of the minimum and maximum values ​​as the thresholds. Setting the lowest communication volume as the minimum threshold and the highest communication volume as the maximum threshold are examples of calculating thresholds. It can also be said that the learning unit 140 determines the thresholds by setting the lowest communication volume as the minimum threshold and the highest communication volume as the maximum threshold.

[0234] Furthermore, the number of combinations of device status / occupancy status / online type can be calculated by multiplying the number of device status patterns by the number of occupancy status patterns by the number of online type patterns. For example, if there are two device status patterns (power on / power off), two occupancy status patterns (not present / present), and two online type patterns (local communication / global communication), there are 2 (number of device status patterns) x 2 (number of occupancy status patterns) x 2 (number of online type patterns) = 8 combinations, and 8 patterns of threshold data are set as the thresholds for the device.

[0235] Furthermore, when the presence status includes one or more pieces of information about a person's activities, the learning unit 140 may calculate a threshold for each of the one or more pieces of information about the activities. Furthermore, as described above, when the presence status includes whether a person is present or absent, the learning unit 140 may calculate a threshold for each of whether a person is present or absent. Furthermore, when the presence status includes at least one of the number of people and their locations in the house, the learning unit 140 may calculate a threshold for each of the at least one of the number of people and their locations.

[0236] In step S14023, the learning unit 140 may acquire the communication volume for each combination of the device status / occupancy status / online type, and perform processing to remove outliers from the acquired communication volumes. The processing to remove outliers may use any existing processing, for example, processing using the interquartile range (IQR).

[0237] (S14024) The learning unit 140 uses the acquired device type to determine whether or not there is already registered threshold data of the same device type from the threshold data stored in the learning data storage unit 230. If it is determined that threshold data of the same device type exists (Yes in S14024), the learning unit 140 performs step S14025, and if it is determined that threshold data of the same device type does not exist (No in S14024), the learning unit 140 performs step S14026.

[0238] (S14025) The learning unit 140 sets the thresholds of the threshold data for the same device type as the threshold data for that device type. Specifically, for example, when a new air conditioner is purchased, the thresholds of the air conditioner that is already installed are used. Setting this threshold data does not necessarily have to be performed; whether or not to perform this may be selected depending on the device type, and the method for setting the thresholds may be changed.

[0239] (S14026) The learning unit 140 sets an initial threshold as the threshold for the acquired device type. The initial threshold may be set to the maximum and minimum values ​​of the total communication volume, or may be set to an initial threshold set by the device manufacturer. Furthermore, if the answer is No in step S14024, the learning unit 140 does not need to set a threshold. Furthermore, the anomaly detection device may set a learning period and exclude the corresponding device from anomaly detection targets during the learning period.

[0240] (S14027) The learning unit 140 registers the created threshold data in the learning data storage unit 230.

[0241] As described above, the learning unit 140 calculates a threshold value for detecting an abnormality in the communication log (i.e., communication) that is the target of detection by the abnormality determination device, based on actual data on past communication volume that is the same as the equipment state and occupancy state when the communication log that is the target of detection by the abnormality determination device was acquired (i.e., communication was performed).

[0242] [1.3.5 Anomaly detection process operation] 18 is a flowchart showing an example of the abnormality detection process (S805) in this embodiment. FIG. 18 shows the operation of the abnormality detection unit 150 (an abnormality detection method).

[0243] (S1501) The anomaly detection unit 150 acquires a communication log of a detection target from the communication log stored in the communication log storage unit 220. For example, the anomaly detection unit 150 acquires a source identifier (such as a MAC address), communication volume, and online type of a currently communicating device from the communication log stored in the communication log storage unit 220. The device is currently the target of anomaly detection, and is an example of a second period.

[0244] (S1502) The abnormality detection unit 150 acquires device status data including at least the device status of the second device. The abnormality detection unit 150 may also acquire the current device status of the target device from the device status data stored in the device status storage unit 200 using a transmission source identifier (such as a MAC address).

[0245] (S1503) The abnormality detection unit 150 acquires occupancy status data. For example, the abnormality detection unit 150 acquires the current occupancy status from the occupancy status data stored in the occupancy status storage unit 210.

[0246] (S1504) The abnormality detection unit 150 acquires threshold data. Based on the device status acquired in step S1502 and the occupancy status acquired in step S1503, the abnormality detection unit 150 acquires a threshold by selecting a threshold corresponding to the device status and the occupancy status from the threshold data. For example, the abnormality detection unit 150 acquires a corresponding threshold from the threshold data stored in the learning data storage unit 230 using the sender identifier, online type, device status, and occupancy status as keys. For example, using the threshold data in FIG. 7, if the device identifier of the currently communicating device is "11:11:11:11:11," the device status is "power on," the online type is "local communication," and the current occupancy status is "not in the room," the abnormality detection unit 150 acquires "0 / 1,234" as the threshold (minimum value / maximum value).

[0247] In this way, the abnormality detection unit 150 selects a threshold value according to the current (an example of the second period) equipment status and occupancy status from the threshold values ​​calculated by the learning unit 140 (threshold calculation device) for each combination of equipment status / occupancy status / online type, and detects current abnormal communication of the first equipment based on the selected threshold value and the current communication log (e.g., communication volume).

[0248] (S1505) The anomaly detection unit 150 determines whether the communication volume is within the threshold. Specifically, the anomaly detection unit 150 determines whether the acquired communication volume is between the minimum and maximum thresholds. If it is determined that the acquired communication volume is between the minimum and maximum thresholds (Yes in S1505), the anomaly detection unit 150 ends the anomaly detection process. If it is determined that the acquired threshold is not between the minimum and maximum thresholds (the acquired communication volume exceeds the threshold) (No in S1505), the anomaly detection unit 150 performs step S1506. For example, in step S1505, the anomaly detection unit 150 determines whether the acquired communication volume is between the minimum and maximum thresholds of 0 and 1,234.

[0249] (S1506) The anomaly detection unit 150 determines that the communication is abnormal and notifies the anomaly monitoring device 80 on the Internet 10 via the home gateway 20. The anomaly detection unit 150 compares the communication log with the selected threshold, and if the communication log does not satisfy the threshold, determines that there is an abnormality, and outputs the determination result to the anomaly monitoring device 80.

[0250] The abnormality detection unit 150 may perform the abnormality detection process shown in FIG. 18 on each of a plurality of devices including the first device.

[0251] [1.4 Effects of the embodiment] In this embodiment, the home gateway 20 estimates the status of each device from the communication log received, estimates the status of people in the house based on information from each device, and sets (selects) an abnormality detection threshold according to the status of the device and the status of the people. This makes it possible to reduce missed detections of abnormal device operation when no one is present, which was previously impossible to detect, or false detections when the number of people present in the room increases beyond the usual number, such as when guests come.

[0252] [2. Other Modifications] The present disclosure is not limited to the above-described embodiment, and includes the following modifications.

[0253] (1) In the above embodiment, the anomaly detection system targets a home network, but this is one aspect of the anomaly detection system in the present disclosure and is not limited to a home network. For example, any system in which multiple devices are connected to a network, such as a building network, a factory network, or a vehicle network, and the device status and occupancy status can be acquired via the network may be used, and the system may target other network fields. Home networks, building networks, factory networks, vehicle networks, etc. are examples of in-facility networks. Furthermore, in the above embodiment, the person is a resident, but this is not limited thereto and may also be a user of a facility in which a device to be detected by the anomaly detection system is installed.

[0254] (2) In the above embodiment, the anomaly detection system is configured such that each device, including the anomaly detection processing device 70, is connected to the home gateway 20. However, the home gateway 20 may be provided with the functionality of the anomaly detection processing device 70, or a relay device such as a hub may be installed between the home gateway 20 and the devices.

[0255] (3) In the above embodiment, the method of connection to the home network 11 may be via wired communication such as Ethernet (registered trademark), wireless communication such as Wi-Fi (registered trademark) or Bluetooth (registered trademark), or a combination of these.

[0256] (4) In the above embodiment, when the anomaly detection unit 150 of the anomaly detection system detects an anomaly, it notifies the anomaly monitoring device 80, but the destination of the notification is not limited to this. For example, it may notify the device that has been determined to be abnormal, or it may notify another device connected to the home network 11.

[0257] (5) Each device in the above embodiments is specifically a computer system consisting of a microprocessor, ROM, RAM, hard disk unit, display unit, keyboard, mouse, etc. A computer program is recorded in the RAM or hard disk unit. Each device achieves its function when the microprocessor operates in accordance with the computer program. Here, a computer program is composed of a combination of multiple instruction codes that indicate commands to a computer to achieve a predetermined function.

[0258] (6) In each of the above embodiments, some or all of the constituent elements may be configured from a single system LSI (Large Scale Integration). A system LSI is an ultra-multifunctional LSI manufactured by integrating multiple components on a single chip, and specifically, is a computer system configured to include a microprocessor, ROM, RAM, etc. A computer program is recorded in the RAM. The system LSI achieves its functions when the microprocessor operates in accordance with the computer program.

[0259] (7) Some or all of the components constituting each of the above devices may be configured as an IC card or a standalone module that can be attached to each device. The IC card or module is a computer system consisting of a microprocessor, ROM, RAM, etc. The IC card or module may include the above-mentioned ultra-multifunctional LSI. The IC card or module achieves its functions when the microprocessor operates according to a computer program. This IC card or module may be tamper-resistant.

[0260] (8) The present disclosure may be embodied as the methods described above, a computer program for implementing these methods on a computer, or a digital signal comprising this computer program.

[0261] (9) The present disclosure may also be the above computer program or the above digital signal recorded on a computer-readable recording medium, such as a flexible disk, hard disk, CD-ROM, MO, DVD, DVD-ROM, DVDRAM, BD (Blu-ray (registered trademark) Disc), semiconductor memory, etc. The present disclosure may also be the above digital signal recorded on such a recording medium.

[0262] (10) Furthermore, the present disclosure may involve transmitting the above computer program or the above digital signal via a telecommunications line, a wireless or wired communication line, a network such as the Internet, data broadcasting, etc.

[0263] (11) The present disclosure may also be a computer system having a microprocessor and a memory, the memory storing the computer program, and the microprocessor operating in accordance with the computer program.

[0264] (12) The above program or the above digital signal may also be implemented by another independent computer system by recording it on a recording medium and transferring it, or by transferring the program or digital signal via the network, etc.

[0265] (13) The division of functional blocks in the block diagram is an example, and multiple functional blocks may be realized as a single functional block, one functional block may be divided into multiple blocks, or some functions may be moved to another functional block. Furthermore, the functions of multiple functional blocks having similar functions may be processed in parallel or time-shared by a single piece of hardware or software.

[0266] (14) The order of the processes described in the above embodiment is merely an example. The order of the processes may be changed, the processes may be performed in parallel, or some of the processes may not be performed.

[0267] (15) Furthermore, the anomaly detection processing device according to the above embodiments may be realized as a single device or may be realized by multiple devices. When the anomaly detection processing device is realized by multiple devices, the components of the anomaly detection processing device may be distributed in any manner among the multiple devices. When the anomaly detection processing device is realized by multiple devices, the communication method between the multiple devices is not particularly limited and may be wireless communication or wired communication. Furthermore, wireless communication and wired communication may be combined between the devices. In the anomaly detection processing device, for example, the threshold calculation device and the anomaly detection device may be realized by different devices.

[0268] (16) Furthermore, when the threshold calculation device and the anomaly detection device are realized by different devices, the threshold calculation device may transmit the threshold data shown in FIG. 7 to the anomaly detection device, or may obtain the equipment status and occupancy status at the time of obtaining the communication volume of the detection target from the anomaly detection device, select a threshold from the threshold data according to the obtained equipment status and occupancy status, and transmit only the selected threshold to the anomaly detection device.

[0269] (17) Although the above description is of an example in which the threshold calculation device calculates a threshold for each combination of at least an equipment state and an occupancy status, the present invention is not limited to this. The threshold calculation device may acquire the equipment state and occupancy status when communication of the detection target is performed from the anomaly detection device, calculate a threshold for the acquired equipment state and occupancy status based on learning data, and transmit the calculated threshold to the anomaly detection device. In other words, generating threshold data is not a required process.

[0270] (18) In addition, this disclosure also includes forms obtained by applying various modifications to the embodiments, etc. that a person skilled in the art would conceive, or forms realized by arbitrarily combining the components and functions in each embodiment within the scope that does not deviate from the intent of this disclosure. [Industrial Applicability]

[0271] The present disclosure can detect abnormal communications to devices within a home based on the operating status of the devices and the presence or absence of residents in the home. It can also detect abnormal communications to devices outside the home that are connected to a local network that is connected to the Internet via a router or other device in a building, store, factory, vehicle, or other location. [Explanation of symbols]

[0272] 1. Anomaly detection system 10. Internet 11 Home network (network within a facility) 20 Home Gateway 30 Air Conditioner 31 Gas water heater 32 Electric Lock 33 Lighting 40. Television 41 Recorder 50 Controllers 60 Smartphone 61 PC 70 Abnormality detection processing device 80 Abnormality monitoring device 100 Communications Department 110 Device status acquisition unit 120 Occupancy Status Determination Department 130 Communication log collection unit 140 Learning unit (calculation unit) 150 Abnormality detection unit 200 Device status storage unit 210 Occupancy Status Holding Department 220 Communication log storage unit 230 Learning data storage unit

Claims

1. A threshold calculation device that calculates a threshold used in an anomaly detection device that is connected to an intra-facility network and detects abnormal communication in a first device in a facility in which the intra-facility network is installed, a second device different from the first device is provided within the facility; a first device status acquisition unit that acquires a device status of the first device for a first period; a first occupancy status determination unit that determines the occupancy status of people in the facility during the first period based on the information acquired from the second device; a first communication log collection unit that collects a communication log generated by communications transmitted and received by the first device during the first period; a calculation unit that calculates a threshold for communication of the first device during a second period after the first period based on the device state, the occupancy status, and the communication log; the device status includes one or more statuses of the first device; the presence status includes one or more statuses of the person; the calculation unit calculates the threshold value for each combination of the one or more states and the one or more situations. Threshold calculation device.

2. the first device state acquisition unit acquires, as the device state, at least one of a power state and a setting value of the first device based on communication including a device control command for controlling the first device; The threshold calculation device according to claim 1 .

3. the first occupancy status determination unit determines the occupancy status based on information acquired from the first device or a third device other than the first device and the second device; The threshold calculation device according to claim 1 or 2.

4. the communication log includes type information indicating an online type determined based on a destination identifier of the communication log; the type information includes one or more online types in the communication log, the calculation unit further calculates the threshold value for each combination of the one or more online types. The threshold calculation device according to any one of claims 1 to 3.

5. the calculation unit generates learning data in which the device state, the occupancy status, and the communication log are associated with each other, and calculates the threshold value based on the learning data. The threshold calculation device according to any one of claims 1 to 4.

6. The presence status includes the presence or absence of the person in the facility, The calculation unit calculates the threshold value for each of the presence and absence of the person. The threshold calculation device according to any one of claims 1 to 5.

7. the presence status includes at least one of the number of people and their locations within the facility; the calculation unit calculates the threshold value for each of the at least one of the two. The threshold calculation device according to any one of claims 1 to 6.

8. the presence status includes one or more activity information of the person during the first time period; The calculation unit further calculates the threshold value based on the one or more pieces of activity information. The threshold calculation device according to any one of claims 1 to 7.

9. the threshold is a threshold for the communication volume of the first device and includes a maximum value and a minimum value of the communication volume; The threshold calculation device according to any one of claims 1 to 8.

10. An anomaly detection device that is connected to an in-facility network and detects abnormal communication in a first device in a facility in which the in-facility network is installed, a second device different from the first device is provided within the facility; a second device status acquisition unit that acquires a device status of the first device during a second period after the first period; a first occupancy status determination unit that determines the occupancy status of people in the facility during the second period based on information acquired from the second device; a second communication log collection unit that collects a communication log generated by communications transmitted and received by the first device during the second period; an abnormality detection unit that selects a threshold value according to the device state and the occupancy status for the second period from among threshold values ​​calculated by the threshold calculation device according to any one of claims 1 to 9 for each combination of the one or more states and the one or more situations of the first device, and detects the abnormal communication of the first device for the second period based on the selected threshold value and the communication log for the second period. Anomaly detection device.

11. the anomaly detection unit compares the communication log with the selected threshold, and if the communication log does not satisfy the threshold, determines that the communication log is abnormal and outputs a determination result. The anomaly detection device according to claim 10.

12. 1. A threshold calculation method executed by a threshold calculation device that calculates a threshold used in an anomaly detection device that is connected to an intra-facility network and detects abnormal communication in a first device in a facility where the intra-facility network is installed, the method comprising: a second device different from the first device is provided within the facility; Acquire a device status of the first device for a first period; determining the presence status of people in the facility during the first period based on the information acquired from the second device; collect a communication log generated by communications transmitted and received by the first device during the first period; calculating a threshold for communication of the first device during a second period after the first period based on the device state, the occupancy status, and the communication log; the device status includes one or more statuses of the first device; the presence status includes one or more statuses of the person; In calculating the threshold value, the threshold value is calculated for each combination of the one or more states and the one or more situations. Threshold calculation method.

13. An anomaly detection method executed by an anomaly detection device that is connected to an intra-facility network and detects abnormal communication in a first device in a facility in which the intra-facility network is installed, comprising: a second device different from the first device is provided within the facility; acquiring a device state of the first device for a second period after the first period; determining the presence status of people in the facility during the second period based on the information acquired from the second device; collect a communication log generated by communications transmitted and received by the first device during the second period; a threshold value corresponding to the device state and the occupancy status for the second period is selected from the threshold values ​​calculated by the threshold value calculation method according to claim 12 for each combination of the one or more states and the one or more situations of the first device, and the abnormal communication of the first device for the second period is detected based on the selected threshold value and the communication log for the second period; Anomaly detection methods.

Images