Anomaly detection system, anomaly detection method, and program

Abstract

An anomaly detection system (200) includes: a register value collection unit (240) that collects register values of a plurality register numbers from a controller (104); a future state estimation unit (210) that estimates a future state of a control system; a blacklist creation unit (280) that creates a blacklist on the basis of the estimation result; an anomaly determination unit (250) that determines whether the control system will fall into an anomaly state, by collating the collected register values against the blacklist; and an output unit (270) that outputs the determination result. The blacklist creation unit (280): defines, as the blacklist, an estimated register number for which it is estimated that the control system will fall into an anomaly state in the future if the register value is changed, and a range of register values of the estimated register number for which it is estimated that the control system will fall into an anomaly state; and dynamically creates the blacklist in accordance with a combination of the collected register values.

Description

[Technical Field]

[0001] The present disclosure relates to an anomaly detection device, an anomaly detection method, and a program for detecting that a control system will fall into an abnormal state in the future. [Background technology]

[0002] In recent years, cyber attacks on control systems in factories, buildings, power systems, etc. have become more sophisticated, and in addition to conventional border defense measures, security measures that assume intrusion are required. In response to this, systems that detect intrusions into control system networks by attackers within the control system are beginning to be introduced.

[0003] Since control systems often operate using predetermined communication pairs or communication protocols, it is relatively easy to define these communication pairs or combinations of communication protocols as a whitelist. For example, Patent Document 1 discloses a system that uses a whitelist to detect intrusions and attacks.

[0004] Patent Document 1 focuses on the fact that in a control system, communication pairs and communication protocols differ depending on the system state of the control system (operating, stopped, under inspection, etc.), and discloses an intrusion detection system that predefines whitelists for each system state of the control system, selects the whitelist to be applied depending on the control state of the control system, and detects intrusions and attacks. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent No. 6509462 Summary of the Invention [Problem to be solved by the invention]

[0006] The intrusion detection system disclosed in Patent Document 1 can apply a whitelist to a control system with clear boundaries between system state transitions, such as a factory production line. A control system with clear boundaries between system state transitions is one in which the boundaries between system state transitions, such as operating, stopped, and under inspection, can be clearly defined. However, control systems that operate 24 hours a day, 365 days a year, such as social infrastructure, do not have clear boundaries between system state transitions, and the system state may be difficult to define or may include unexpected states. In such cases, applying a whitelist can be difficult, and appropriate anomaly detection may not be possible.

[0007] Furthermore, when a whitelist is defined for a communication pair of IP addresses or for each communication protocol, it is not possible to properly detect anomalies against spoofing attacks that involve changing control values ​​using legitimate protocols defined in the whitelist.

[0008] The present disclosure provides an anomaly detection system and the like that can appropriately detect anomalies. [Means for solving the problem]

[0009] An anomaly detection system according to one aspect of the present disclosure is an anomaly detection system that detects that a control system will fall into an abnormal state in the future, and includes: a register value collection unit that collects register values ​​of multiple register numbers from a controller that controls the control system; a future state estimation unit that estimates the future state of the control system; a blacklist creation unit that creates a blacklist based on the results of the estimation by the future state estimation unit; a blacklist management unit that saves the created blacklist; an anomaly judgment unit that determines whether the control system will fall into an abnormal state by comparing the register values ​​collected by the register value collection unit with the blacklist saved in the blacklist management unit; and an output unit that outputs the results of the judgment by the anomaly judgment unit.The blacklist creation unit defines as a blacklist: among the multiple register numbers for which the register values ​​have been collected by the register value collection unit, estimated register numbers whose register values ​​are estimated to cause the control system to fall into an abnormal state in the future if changed; and a range of register values ​​for the estimated register numbers, which is the range of register values ​​for which the control system is estimated to fall into an abnormal state; and dynamically creates the blacklist according to the combination of register values ​​of the multiple register numbers collected by the register value collection unit. [Effects of the Invention]

[0010] According to the above aspect, it is possible to appropriately detect an abnormality. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram showing an example of the configuration of a control system according to this embodiment. [Figure 2] FIG. 2 is a diagram illustrating an example of the configuration of an anomaly detection system according to this embodiment. [Figure 3] FIG. 3 is a diagram showing an example of a register held by the controller in this embodiment. [Figure 4] FIG. 4 is a diagram showing an example of the learning result of the register number correlation learning unit in this embodiment. [Figure 5]FIG. 5 is a diagram illustrating an example of the configuration of the future state estimation unit in this embodiment. [Figure 6] FIG. 6 is a diagram showing an example of the definition content of the abnormal state definition unit in this embodiment. [Figure 7] FIG. 7 is a diagram showing an example of the contents of the blacklist stored in the blacklist storage unit in this embodiment. [Figure 8] FIG. 8 is a diagram showing an example of the details of the blacklist. [Figure 9] FIG. 9 is a flowchart showing an example of an abnormality detection process in the abnormality detection system according to this embodiment. [Figure 10] FIG. 10 is a flowchart showing an example of the state determination process according to the present embodiment. [Figure 11] FIG. 11 is a diagram illustrating an example of a cluster configuration of a register value set. [Figure 12] FIG. 12 is a flowchart showing an example of the future state estimation process according to this embodiment. [Figure 13] FIG. 13 is a flowchart showing an example of the process (upper abnormal value calculation) of the simulation value determination algorithm in this embodiment. [Figure 14] FIG. 14 is a flowchart showing an example of the blacklist creation process according to this embodiment. [Figure 15] FIG. 15 is a flowchart showing an example of the abnormality determination process according to the present embodiment. [Figure 16] FIG. 16 is a flowchart showing an example of an anomaly detection method according to another embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0012] (Findings that formed the basis of this disclosure) Large-scale control systems in petrochemical plants, which are considered critical infrastructure, generally have tens to hundreds of controllers, and these controllers operate in a balanced manner by performing control using appropriate control logic such as feedback control or sequence control. These controllers have registers, which are areas that store sensor information such as set values ​​or observed values ​​for the controlled object, and the controllers perform control using the values ​​stored in the registers (register values).

[0013] SCADA (Supervisory Control And Data Acquisition) monitors the register values ​​associated with these register numbers to understand the operating status of the control system. Registers are associated with items such as temperature or pressure setpoints and observed values, and some registers have invalid values ​​that could lead to incidents that could endanger human lives. Thresholds are preset in SCADA for such registers, and an alarm is set to sound if the register value deviates from the threshold.

[0014] However, in SCADA, only one threshold can be set for each register number, and the threshold cannot be changed for each system state of the control system.

[0015] Furthermore, even if the SCADA issues an alarm, the cause of the alarm and the indicators of its urgency are not standardized, so the intent of the alarm cannot be immediately determined, and it may take a huge amount of time to respond and recover.In the worst case scenario, the control system may stop operating, causing enormous damage.

[0016] Therefore, below, an anomaly detection system that can appropriately detect anomalies will be described.

[0017] An anomaly detection system according to one aspect of the present disclosure is an anomaly detection system that detects that a control system will fall into an abnormal state in the future, and includes: a register value collection unit that collects register values ​​of multiple register numbers from a controller that controls the control system; a future state estimation unit that estimates the future state of the control system; a blacklist creation unit that creates a blacklist based on the results of the estimation by the future state estimation unit; a blacklist management unit that saves the created blacklist; an anomaly determination unit that determines whether the control system will fall into an abnormal state by comparing the register values ​​collected by the register value collection unit with the blacklist saved in the blacklist management unit; and an output unit that outputs the results of the determination by the anomaly determination unit. The blacklist creation unit defines as a blacklist the estimated register numbers, among the multiple register numbers for which the register values ​​have been collected by the register value collection unit, that are estimated to cause the control system to fall into an abnormal state in the future if their register values ​​are changed, and a range of register values ​​for the estimated register numbers, which is the range of register values ​​for which the control system is estimated to fall into an abnormal state, and dynamically creates the blacklist according to the combination of register values ​​of the multiple register numbers collected by the register value collection unit.

[0018] According to this, the register values ​​held by the controller and collected by the register value collector correspond to the system state of the control system, and the blacklist is dynamically created according to the combination of register values ​​for multiple register numbers collected by the register value collector, making it possible to dynamically create a blacklist for any system state of the control system. In other words, it is possible to create an optimal blacklist for any system state (register value) of the control system. Then, by comparing the created blacklist with the current register values, it becomes possible to determine an abnormality regardless of the system state of the control system, thereby enabling appropriate abnormality detection. Anomaly detection using such an optimal blacklist can reduce false positives or missed detections.

[0019] For example, the blacklist creation unit may create a blacklist based on the results of comparing a combination of register values ​​of multiple register numbers collected by the register value collection unit with a combination of register values ​​of multiple register numbers corresponding to a previously created blacklist.

[0020] According to this, if there is a difference between a combination of register values ​​of a plurality of register numbers corresponding to a previously created blacklist and a currently collected combination of register values ​​of a plurality of register numbers, a blacklist can be created, but if there is no difference, a blacklist corresponding to the currently collected combination of register values ​​of a plurality of register numbers has already been created, so no blacklist can be created. In other words, it is possible to dynamically create a blacklist according to a combination of register values ​​of a plurality of register numbers that has not been collected before.

[0021] For example, the abnormality determination unit may determine whether the control system will fall into an abnormal state by comparing the register value of the estimated register number collected by the register value collection unit with the range of register values ​​of the estimated register number defined in a blacklist stored in the blacklist management unit.

[0022] This allows easy abnormality determination by comparing the register values ​​of the estimated register numbers.

[0023] For example, the future state estimation unit may estimate the future state of the control system using a simulator that simulates the controller and the control system, and the blacklist creation unit may create a blacklist based on the simulation results of the simulator.

[0024] According to this, by using a simulator, it is possible to easily estimate the future state of the control system, and in turn, it is possible to easily create a blacklist.

[0025] For example, the anomaly detection system may have an abnormal state definition unit that defines a register number corresponding to an abnormal state in which the control system will fall and an abnormal range of the register value for that register number, the abnormal range being a range of register values ​​when the control system falls into an abnormal state, and the future state estimation unit may estimate the future state of the control system in a simulation by monitoring whether the register value for the register number defined in the abnormal state definition unit falls within the abnormal range when the register value for the estimated register number is changed. Specifically, the estimated register number may be a register number that has a strong correlation with the register number corresponding to the abnormal state in which the control system will fall, defined in the abnormal state definition unit.

[0026] This allows for reduction in simulation costs compared to simulating all register numbers by monitoring whether the register value of a register number that has a strong correlation with the register number associated with the abnormality becomes an abnormal value when the register value of the register number associated with the abnormality is changed.

[0027] For example, the future state estimation unit may calculate, through simulation, the time until the control system transitions to an abnormal state.

[0028] This allows the importance to be defined by including the time it takes for the control system to transition to an abnormal state when an acceptable range is exceeded, rather than IP address pairs or protocols, in the blacklist. For example, it becomes possible to determine priorities for recovery responses when multiple abnormalities occur.

[0029] For example, the abnormal state definition unit may define, for each type of abnormal state of the control system, a register number corresponding to the abnormal state into which the control system falls, and the abnormal range.

[0030] This allows simulation of various types of abnormal conditions.

[0031] an anomaly detection method according to one aspect of the present disclosure, which is executed by an anomaly detection system that detects that a control system will fall into an abnormal state in the future, and includes: a register value collection step of collecting register values ​​of a plurality of register numbers from a controller that controls the control system; a future state estimation step of estimating a future state of the control system; a blacklist creation step of creating a blacklist based on the results of the estimation in the future state estimation step; a blacklist management step of saving the created blacklist; an anomaly determination step of determining whether the control system will fall into an abnormal state by comparing the register values ​​collected in the register value collection step with the blacklist saved in the blacklist management step; and an output step of outputting the results of the determination in the anomaly determination step, wherein the blacklist creation step defines, as a blacklist, estimated register numbers, among the plurality of register numbers whose register values ​​are collected in the register value collection step, whose register values ​​are estimated to cause the control system to fall into an abnormal state in the future if changed, and a range of register values ​​for the estimated register numbers, which is the range of register values ​​for which the control system is estimated to fall into an abnormal state, and the blacklist is dynamically created according to a combination of register values ​​of the plurality of register numbers collected in the register value collection step.

[0032] This provides an anomaly detection method that can appropriately detect an anomaly.

[0033] A program according to one aspect of the present disclosure is a program that causes a computer to execute the above-described anomaly detection method.

[0034] This makes it possible to provide a program that can appropriately detect abnormalities.

[0035] The embodiments described below each illustrate a specific example of the present disclosure. The numerical values, shapes, components, steps, and step orders shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Furthermore, among the components in the following embodiments, components that are not described in the independent claims that represent the highest concepts are described as optional components. Furthermore, in all embodiments, the respective contents can be combined.

[0036] (Embodiment) The present embodiment will be described with reference to the drawings, in which the same reference numerals are used to designate the same components.

[0037] 1 is a diagram showing an example of the configuration of a control system 1000 according to this embodiment. In FIG. 1, the control system 1000 includes a control network 102, a field network 103, a controller 104, a SCADA 105, an I / O 106, a sensor 107, an actuator 108, and an anomaly detection system 200.

[0038] The control system 1000 is a system in a factory, a building, or the like. The control system 1000 is capable of communicating with an information network 101, which is a network used in an office, or the like. Although not shown, a business server such as a web server or a mail server and an office PC are installed in the information network 101, and the business server and the PC are connected to an internet line 100 as needed.

[0039] The information network 101, the control network 102, and the field network 103 communicate using an appropriate protocol such as TCP / IP or UDP / IP depending on the characteristics of the application on Ethernet (registered trademark) defined by IEEE802.3.

[0040] The control network 102 is equipped with a controller 104, a SCADA 105, and an anomaly detection system 200. The controller 104 and SCADA 105 installed in the control network 102 may communicate with devices installed in the information network 101 from the perspective of production efficiency, etc. The field network 103 is equipped with an I / O 106, a sensor 107, and an actuator 108. In the case of feedback control, for example, the controller 104 performs appropriate control by receiving sensor observation values ​​from the sensor 107 and transmitting optimal operation amounts to the actuator 108. The I / O 106 is connected to a remote I / O device and is used to communicate with the I / O device.

[0041] The controller 104 is a controller that controls the control system 1000, and holds the observation values ​​of the sensors 107 and the operation amounts (register values) of the actuators 108. The SCADA 105 acquires the register values ​​held by the controller 104 and monitors the register values.

[0042] Like the SCADA 105, the anomaly detection system 200 also acquires register values ​​in communication between the controller 104 and the sensors 107 and actuators 108 for anomaly detection. The control parameters acquired by the anomaly detection system 200 may differ from those acquired by the SCADA 105.

[0043] It should be noted that the control system 1000 shown in FIG. 1 has a general configuration, and the control system 1000 does not necessarily have to have all of the configuration shown in FIG.

[0044] FIG. 2 is a diagram showing an example of the configuration of an anomaly detection system 200 according to this embodiment.

[0045] The anomaly detection system 200 is a system that detects that the control system 1000 will fall into an abnormal state in the future. In Fig. 2, the anomaly detection system 200 is composed of a future state estimation unit 210, a state determination unit 220, a register number correlation learning unit 230, a register value collection unit 240, an anomaly determination unit 250, an interface unit 260, an output unit 270, a blacklist creation unit 280, and a blacklist management unit 400.

[0046] The anomaly detection system 200 is a computer including a processor, a communication interface, a memory, and the like. The memory may be a read-only memory (ROM) or a random access memory (RAM), and may store programs executed by the processor. The future state estimation unit 210, the state determination unit 220, the register number correlation learning unit 230, the register value collection unit 240, the anomaly determination unit 250, the blacklist creation unit 280, and the blacklist management unit 400 are implemented by a processor or the like that executes programs stored in the memory. The interface unit 260 and the output unit 270 are implemented by a communication interface or the like. The anomaly detection system 200 may be, for example, an anomaly detection device configured in a single housing. Alternatively, the anomaly detection system 200 may be a system in which its components are distributed across multiple devices. For example, the anomaly detection system 200 may be implemented by a server or the like.

[0047] The blacklist management unit 400 saves and manages the created blacklist. Specifically, the blacklist management unit 400 has a blacklist storage unit 290, which stores the created blacklist. The blacklist will be described in detail later.

[0048] The register value collection unit 240 collects register values ​​of multiple register numbers from the controller 104. Specifically, the register value collection unit 240 collects the register values ​​of all registers held by the controller 104 via the interface unit 260. Here, the registers will be described with reference to FIG. 3.

[0049] FIG. 3 is a diagram showing an example of a register held by the controller 104 in this embodiment.

[0050] Each register is associated with a different register number, and the register corresponding to each register number holds a register value. For example, in the example of Fig. 3, register 2 holds "15.0" indicating the valve opening / closing rate (%), register 10 holds "28" indicating the observed temperature (°C), register 35 holds "27" indicating the set temperature (°C), register 67 holds "50" indicating the threshold value of the set temperature (°C), and register 100 holds "True" indicating the heater operating state (ON / OFF).

[0051] The definitions of these register numbers (that is, information indicating what values ​​are held in the registers of these register numbers) are held in the SCADA 105.

[0052] When these register values ​​change, the controller 104 sends a change notification to the SCADA 105 and the anomaly detection system 200, and the SCADA 105 and the anomaly detection system 200 update the register values ​​they have collected.

[0053] The state determination unit 220 determines whether the combination of register values ​​of the multiple register numbers collected by the register value collection unit 240 is a combination that has been observed in the past. Specifically, the state determination unit 220 compares the combination of register values ​​of the multiple register numbers collected by the register value collection unit 240 with a past blacklist stored in the blacklist storage unit 290 and makes a determination. If the state determination unit 220 determines from the comparison result that the combination of register values ​​collected by the register value collection unit 240 is a combination that has not been observed in the past, the state determination unit 220 notifies the future state estimation unit 210 of the register values ​​of the multiple register numbers collected by the register value collection unit 240.

[0054] The future state estimation unit 210 estimates the future state of the control system 1000. Specifically, the future state estimation unit 210 simulates, based on the notified register values, whether a change in the register value of a particular register number will cause the control system 1000 to fall into an abnormal state in the future.

[0055] The blacklist creation unit 280 creates a blacklist based on the result of estimation by the future state estimation unit 210 (the result of simulation by the future state estimation unit 210). As will be described in detail later, the blacklist creation unit 280 defines, as a blacklist, estimated register numbers, among the multiple register numbers for which the register values ​​have been collected by the register value collection unit 240, that are estimated to cause the control system 1000 to fall into an abnormal state if the register values ​​are changed, and a range of register values ​​for the estimated register numbers that are estimated to cause the control system 1000 to fall into an abnormal state, and dynamically creates a blacklist according to the combination of register values ​​for the multiple register numbers collected by the register value collection unit 240.

[0056] The register number correlation learning unit 230 learns the correlation between registers from the register values ​​collected by the register value collection unit 240. Learning by the register number correlation learning unit 230 is performed at least when the anomaly detection system 200 is introduced, and may be performed periodically, such as once a day or once a month.

[0057] The register number correlation learning unit 230 acquires past register values ​​from a historical server that stores past register values ​​for creating trend graphs or data logging, etc., and learns the correlation between registers. For example, the historical server is installed in the control system network 102, and may be included in the SCADA 105.

[0058] As a result of learning by the register number correlation learning unit 230, for example, when the correlation between the register number indicating the observed pressure value and other register numbers is calculated by correlation analysis, the correlation coefficient between the register number indicating the observed pressure value and the register number indicating the set pressure value is 1.0, and the correlation coefficient between the register number indicating the observed pressure value and the register number indicating the observed temperature value is 0.7. The register number correlation learning unit 230 calculates these for each of the other register numbers. Note that the calculation of the correlation coefficient is not limited to correlation analysis, and other methods may also be used.

[0059] FIG. 4 is a diagram showing an example of the learning result of register number correlation learning section 230 in this embodiment.

[0060] The learning results can be managed by creating a table for each register number in descending order of correlation strength, as shown in Figure 4. For example, in Figure 4, the register numbers that have a strong correlation with register 1 are register 34, register 2, and register 52, in descending order of correlation strength.

[0061] The blacklist management unit 400 stores the simulation results and the created blacklist in the blacklist storage unit 290 and manages them.

[0062] The abnormality determination unit 250 checks the register values ​​collected by the register value collection unit 240 against the blacklist stored in the blacklist management unit 400 to determine whether the control system 1000 will fall into an abnormal state.

[0063] The output unit 270 outputs the result of the determination made by the abnormality determination unit 250. For example, when the abnormality determination unit 250 determines that an abnormality has occurred, the output unit 270 outputs an alert based on the result of the abnormality determination.

[0064] As will be described in more detail later, anomaly detection system 200 makes it possible to create a highly accurate blacklist while also using a blacklist created for previously observed states, thereby reducing the computational costs involved in simulations.

[0065] Next, the future state estimation unit 210 will be described in detail with reference to FIG.

[0066] 5 is a diagram showing an example of the configuration of the future state estimation unit 210 in this embodiment. The future state estimation unit 210 is a function that operates when the state determination unit 220 determines that the combination of register values ​​collected by the register value collection unit 240 has not been observed in the past.

[0067] 5, the future state estimation unit 210 is made up of an abnormal state definition unit 211, a correlation variable extraction unit 212, a simulator 213, a simulation value generation unit 214, a state monitoring unit 215, and a result shaping unit 216. The future state estimation unit 210 estimates the future state of the control system 1000 using the controller 104 and the simulator 213 that simulates the control system 1000.

[0068] The abnormal state definition unit 211 defines abnormal states of the control system 1000. Specifically, the abnormal state definition unit 211 defines register numbers corresponding to abnormal states into which the control system 1000 falls, and abnormal ranges of register values ​​for the register numbers (ranges of register values ​​when the control system 1000 falls into an abnormal state). More specifically, the abnormal state definition unit 211 defines, for each type of abnormal state of the control system 1000, register numbers corresponding to abnormal states into which the control system 1000 falls, and abnormal ranges of register values ​​for the register numbers.

[0069] Fig. 6 is a diagram showing an example of the definition contents of the abnormal state definition unit 211 in this embodiment. For example, in Fig. 6, abnormal states such as pressure rise, water level drop, temperature rise, and motor abnormality are defined. For example, the register number corresponding to the abnormal state of pressure rise that the control system 1000 falls into is register 10, and the abnormal range of the register value when the control system 1000 falls into the abnormal state of pressure rise is "100 or higher." In other words, it is defined that when the register value of register 10 is greater than 100, the control system 1000 is in the abnormal state of pressure rise.

[0070] The content defined by the abnormal state definition unit 211 is predetermined based on the specifications of the control system 1000 at the time of initial setup, but the definition of the abnormal state may be changed during operation of the control system 1000. Furthermore, multiple register numbers may be set for one abnormal state, and when multiple register numbers are set, an abnormal range of the register value is set for each register number.

[0071] The correlation variable extraction unit 212 extracts parameters (register values) of other register numbers held by the controller 104 that have a high correlation coefficient with the register number defined in the abnormal state definition unit 211 based on the learning results of the register number correlation learning unit 230 as shown in Figure 4.

[0072] The simulation value generating unit 214 changes the register value of the register number extracted by the correlation variable extracting unit 212 to a simulation value.

[0073] The simulator 213 executes a simulation of the future state of the control system 1000 using the simulation values ​​of each register number generated by the simulation value generation unit 214 .

[0074] While the simulator 213 is executing a simulation, the state monitoring unit 215 monitors the simulation value of the register number defined in the abnormal state definition unit 211, and monitors whether the control system 1000 will fall into an abnormal state in the future.

[0075] The result forming unit 216 receives the result when an abnormality is detected, and collects and forms information necessary for creating a blacklist.

[0076] The information sent from the status monitoring unit 215 to the result shaping unit 216 includes the type of abnormal state and the transition time to the abnormal state, and the information sent from the simulation value generation unit 214 to the result shaping unit 216 includes the register number that has been changed to the simulation value and the changed value, etc.

[0077] A specific example of the contents of the blacklist will now be described with reference to FIG.

[0078] 7 is a diagram showing an example of the contents of a blacklist stored in blacklist storage unit 290 in this embodiment. Blacklist storage unit 290 stores past blacklists created by blacklist creation unit 280 based on the results of simulations performed by future state estimation unit 210. Blacklist storage unit 290 stores multiple blacklists for past combinations of register values.

[0079] The blacklist shows the criteria for determining whether register values ​​for multiple register numbers are abnormal (specifically, the range estimated by the future state estimation unit 210 when the control system 1000 will fall into an abnormal state) for one combination of register values ​​collected by the register value collection unit 240 (i.e., one system state of the control system 1000). For example, in Fig. 7, when the system state is 1, the criteria for determining whether register numbers such as register 14, register 67, and register 4 are abnormal are shown.

[0080] FIG. 8 is a diagram showing an example of the details of a blacklist. Specifically, FIG. 8 is a diagram showing the criteria for determining an abnormality for one system state in the blacklist. FIG. 8 shows the criteria for determining an abnormality when the system state in FIG. 7 is 1. For example, the criteria for determining an abnormality are composed of a set of a level of importance, a register number, an abnormal range of the register value for the register number, an abnormal state (state prediction) into which the control system 1000 is predicted to fall, and a transition time until the predicted abnormal state is reached. In FIG. 8, a level of importance of 1 indicates the most important register number, and in this case, register 14 is the most important register number. When the register value of register 14 is 150 or greater, the predicted abnormal state is a pressure rise, and the transition time until the predicted state is reached is shown as follows: when the register value is 150, it takes 10 seconds for the abnormal state of pressure rise to occur, and when the register value is 300, it takes 3 seconds for the abnormal state of pressure rise to occur.

[0081] Next, the processing of the anomaly detection system 200 will be described with reference to FIG.

[0082] In this embodiment, the register value collection unit 240 is configured to obtain the register values ​​from the controller 104 via the control network 102, but this is not essential. If all control parameters required for creating a blacklist are managed by the SCADA 105, the register value collection unit 240 may be configured to capture communication between the controller 104 and SCADA 105 using mirroring or the like and extract the register values.

[0083] FIG. 9 is a flowchart showing an example of anomaly detection processing by anomaly detection system 200 in this embodiment.

[0084] The register value collector 240 monitors whether the state of the register values ​​held by the controller 104 has changed (step S510). If there is a register value whose state has changed (YES in step S510), the register value collector 240 collects the register values ​​held by the controller 104, and the anomaly detection system 200 performs a state determination process (step S520). If there is no register value whose state has changed (NO in step S510), the register value collector 240 waits. Details of the state determination process will be described later.

[0085] If, as a result of the state determination process in step S520, it is determined that there is no difference between the current state of the control system 1000 and the past state (NO in step S530), the abnormality determination unit 250 performs abnormality determination process using the blacklist stored in the blacklist memory unit 290 (step S560).

[0086] Furthermore, if it is determined that there is a difference between the current state of the control system 1000 and the past state (YES in step S530), the future state estimation unit 210 uses the register values ​​to perform a simulation (future state estimation process) to determine whether the control system will fall into an abnormal state in the future (step S540). The future state estimation process will be described in detail later.

[0087] Then, the blacklist creating unit 280 creates a blacklist based on the results of the simulation performed by the future state estimating unit 210 (step S550). The blacklist creating process will be described in detail later.

[0088] The abnormality determination unit 250 performs the abnormality determination process using the created blacklist (step S560). The abnormality determination process will be described in detail later.

[0089] 10 is a flowchart showing an example of the state determination process S520 in this embodiment. The state determination process S520 is a process that determines whether to create a new blacklist or use a blacklist stored in the blacklist storage unit 290, and is performed by the state determination unit 220.

[0090] The state determination unit 220 checks whether the combination of register values ​​collected by the register value collection unit 240 has been observed in the past by comparing it with past combinations of register values ​​stored in a register value storage unit (not shown) (step S521). For example, the check can use a nearest neighbor method, and can determine whether the combination of register values ​​collected by the register value collection unit 240 is similar to a combination of register values ​​observed in the past.

[0091] Specifically, the state determination unit 220 searches for the cluster of the nearest register value set and determines whether the deviation (difference) between the register values ​​collected by the register value collection unit 240 and the nearest cluster is equal to or greater than a predetermined value (step S522). If the deviation is smaller than the predetermined value (NO in step S522), the state determination unit 220 determines that there is no difference between the register values ​​collected by the register value collection unit 240 (i.e., the current state of the control system 1000) and a past state (step S523). If the deviation is equal to or greater than the predetermined value (YES in step S522), the state determination unit 220 determines that there is a difference between the current state and a past state of the control system 1000 (step S524).

[0092] 11 is a diagram showing an example of a cluster configuration of past register value combinations (register value sets). In FIG. 11, x1 and y1 represent the register values ​​of each register number, and here, the case where there are two register numbers is shown.

[0093] For example, if the current register value combination is register value set 1, register value set 1 is within the blacklist application range of system state 1, so the deviation is determined to be smaller than the specified value (step S523), and the blacklist of system state 1 in Figure 7 is used.

[0094] Furthermore, when the current register value combination is register value set 2, the nearest cluster to register value set 2 is the blacklist for system state 3, but register value set 2 is not within the blacklist application range for system state 3, so it is determined that the deviation is equal to or greater than the specified value (step S524). Note that for register value set 2, a blacklist application range is set with register value set 2 at the center, and this will be used to collate register value combinations collected by register value collection unit 240 in the future.

[0095] 9 is answered YES or NO, that is, it is determined whether the blacklist creation process is performed in step S550. Therefore, the blacklist creation unit 280 creates a blacklist based on the result of comparing the combination of register values ​​of multiple register numbers collected by the register value collection unit 240 with the combination of register values ​​of multiple register numbers corresponding to blacklists created in the past.

[0096] FIG. 12 is a flowchart showing an example of the future state estimation process S540 in this embodiment.

[0097] First, the future state estimation unit 210 acquires, from the abnormal state definition unit 211, the register number of the monitoring target among the register numbers defined in the abnormal state definition unit 211 (step S551). In this embodiment, when the register number of the monitoring target is a register number indicating a pressure increase, the future state estimation unit 210 acquires register 10 as shown in Fig. 6, and also acquires that the abnormal range is 100 or more. Furthermore, when the register number of the monitoring target is a register number indicating a water level decrease, the future state estimation unit 210 acquires register 67 as shown in Fig. 6, and also acquires that the abnormal range is 0 or less.

[0098] The future state estimation unit 210 refers to the learning result of the register number correlation learning unit 230 in FIG. 4 and acquires a predetermined number of register numbers that are highly correlated with the register number acquired in step S551 (i.e., whose correlation coefficient is equal to or greater than a predetermined value) (step S552). The acquired register numbers are estimated register numbers estimated by the future state estimation unit 210 that, if a register value is changed, the control system 1000 will fall into an abnormal state. For example, the estimated register numbers are register numbers that are highly correlated with the register number corresponding to the abnormal state that the control system 1000 will fall into. For example, if the specified number is two, registers 14 and 4 are acquired from the learning result in FIG. 4 as two register numbers that are highly correlated with register 10, which is monitored to detect a pressure increase. Similarly, register numbers that are highly correlated are acquired for register 67, which is used to detect a drop in the water level, and register 2, which is used to detect a temperature increase.

[0099] The simulator 213 changes the value of the register number extracted in step S552 and performs a simulation to determine whether the control system 1000 will fall into an abnormal state in the future. If multiple register numbers are extracted in step S552, the simulator 213 performs a simulation for each register number individually, and performs simulations for all extracted register numbers. The simulator 213 determines whether an abnormality has occurred in the control system 1000 due to a change in the register value of the register number extracted in step S552, and if an abnormality is determined, it saves the simulation results.

[0100] The simulation environment of the simulator 213 reproduces the virtual environment of the control system 1000. Specifically, the virtual environment includes not only the controller 104 but also the I / O 106, the sensors 107, and the actuators 108. The virtual environment can be realized using, for example, digital twin virtual technology. By performing a simulation in which the control system 1000 reproduced in the virtual environment is operated, the future state of the control system 1000 can be estimated.

[0101] The simulator 213 determines a simulation value based on each register value acquired in step S551 (step S553), and then converts the register value of the register number extracted in step S552 into the determined simulation value (step S554).

[0102] Here, the register value of one register is converted into a simulation value, and the register values ​​acquired by the register value collection unit 240 are used for the values ​​of the other registers. The registers whose register values ​​are converted are those of a specified number of estimated register numbers that have a strong correlation with the register numbers extracted by the register number correlation learning unit 230 and registered in the abnormal state definition unit 211. In this embodiment, when the specified number is two, referring to Figure 4, register 14 and register 4 that have a strong correlation with register 10 indicating a pressure rise in Figure 6 are acquired.

[0103] Thereafter, the simulator 213 executes a simulation of the future state of the control system 1000 over time (step S555).

[0104] As a result of the simulation, the simulator 213 checks whether or not an abnormal state has occurred (step S556). One simulation by the simulator 213 is executed from the current time until a preset specified time has elapsed, for example, one hour later. The state monitoring unit 215 monitors the execution state of the current register values ​​of the register numbers defined in the abnormal state definition unit 211, and the future state estimation unit 210 determines whether or not the control system 1000 will enter an abnormal state. Whether or not the control system 1000 will enter an abnormal state is determined by whether or not the current register value of the register defined in the abnormal state definition unit 211 is within an abnormal range.

[0105] In this way, when the register value of the estimated register number is changed, the future state estimation unit 210 monitors whether the register value of the register number defined in the abnormal state definition unit 211 falls within the abnormal range, thereby estimating the future state of the control system 1000 in a simulation.

[0106] If the control system 1000 falls into an abnormal state (YES in step S556), the state monitoring unit 215 saves the information necessary for creating a blacklist as a simulation result (step S557).

[0107] The information required for creating the blacklist specifically includes the type of abnormal state (e.g., pressure rise, etc.), the time until the abnormal state occurs (e.g., 10 seconds when the simulation value is 150, 3 seconds when the simulation value is 300, etc.), and the register number that has been changed (e.g., register 14, etc.). If the control system 1000 has not fallen into an abnormal state (NO in step S556), the simulator 213 ends the process.

[0108] A specific example of the simulation process (steps S553 to S557) will be described with reference to Fig. 13. The simulation process includes a process for calculating upper abnormal values ​​and a process for calculating lower abnormal values.

[0109] Fig. 13 is a flowchart showing an example of the process of the simulation value determination algorithm in this embodiment. Fig. 13 shows an example of the process of calculating the upper abnormal value, and the future state estimation unit 210 identifies the abnormal range by the following process.

[0110] The simulator 213 acquires the current register value of the register number (estimated register number) acquired in step S552, doubles the value (step S561), and compares the value with a threshold value preset for the estimated register number (step S562). The threshold value is a threshold value preset for an abnormal state, etc., corresponding to the estimated register number. In order to monitor the abnormal state corresponding to the register number acquired in step S551, the register value of the estimated register number correlated with the register number acquired in step S551 is changed. However, if the register value of the estimated register number exceeds the threshold value, the control system 1000 will enter an abnormal state corresponding to the estimated register number, and therefore, processing in step S562 is performed. Note that if a threshold value is not set, it is determined that twice the current register value of the estimated register number is within the threshold value.

[0111] If the doubled value is outside the threshold (YES in step S562), the simulator 213 sets the threshold as the simulation value (step S564), and if the doubled value is within the threshold (NO in step S562), the simulator 213 sets the doubled value as the simulation value (step S563).

[0112] The simulator 213 executes a simulation using the simulation values ​​(step S565) and determines whether the control system 1000 will fall into an abnormal state within a specified period (step S566). The specified period is a period during which the simulation is performed, and is determined appropriately depending on the performance of the simulator 213, etc. For example, if the control system 1000 will fall into an abnormal state within the specified period, the future state estimation unit 210 (simulator 213) calculates, in the simulation, the time until the control system 1000 transitions to the abnormal state.

[0113] If the control system 1000 does not fall into an abnormal state within the specified period (NO in step S566), it is checked whether the number of simulations has reached a predetermined specified number (step S567). If the specified number has not been reached (NO in step S567), the simulator 213 doubles the simulation value again (step S561) and executes the process again. If the number of simulations has reached the specified number (YES in step S567), the process ends. Note that if a threshold value was set as the simulation value in step S564, the simulation value cannot be increased any further, so the process may end even if the number of simulations has not reached the specified number.

[0114] If it is determined that the control system 1000 will fall into an abnormal state (YES in step S566), the simulator 213 calculates the median between the previous simulation value (normal value: double the previous value, or if there is no double the previous value, the current register value of the estimated register number) and the current simulation value (abnormal value: double the current value) (step S568).The simulator 213 then executes a simulation using the median as the simulation value (step S569) and determines whether the control system 1000 will fall into an abnormal state within a specified period (step S570).

[0115] If it is determined that the control system 1000 will fall into an abnormal state (YES in step S570), the simulator 213 saves the abnormal value information as a result (step S572). The saved information includes the estimated register number of the target, the register value (simulation value), the abnormal state that the control system 1000 will fall into, and the transition time to that state. Specifically, the abnormal value information includes a pressure increase as the type of abnormal state, 10 seconds when the simulation value is 150 as the time until the abnormal state occurs, and register 14 as the estimated register number that changed the register value to the simulation value. Furthermore, the simulator 213 defines the current simulation value (median) as an abnormal value (step S573) and checks whether the number of simulations has reached a predetermined specified number (step S574). If the number of simulations has not reached the specified number (NO in step S574), the simulator 213 again calculates the median between the previous normal value and the current abnormal value (step S568) and executes the simulation (step S569).

[0116] If it is determined that the control system 1000 will not fall into an abnormal state (NO in step S570), the simulator 213 defines the current simulation value as a normal value (step S571) and checks whether the number of simulations has reached a predetermined specified number (step S574). If the number of simulations has not reached the specified number (NO in step S574), the simulator 213 again calculates the median between the current normal value and the previous abnormal value (step S568) and executes the simulation (step S569).

[0117] When the number of simulations reaches a predetermined number (YES in step S574), the process ends.

[0118] It should be noted that the more loops there are in this process, i.e., the more times you specify, the more detailed boundary values ​​you can obtain (in other words, the range of register values ​​at which the control system 1000 is estimated to fall into an abnormal state), but the more simulations there are, the longer the processing time will be.

[0119] The lower abnormal value calculation process can be performed by multiplying the value by 2 in step S561 of the upper abnormal value calculation process by 1 / 2, so a description thereof will be omitted. Note that 2 and 1 / 2 are merely examples, and the multiplication factors can be set as appropriate.

[0120] FIG. 14 is a flowchart showing an example of the blacklist creation process S550 in this embodiment.

[0121] The blacklist creating unit 280 acquires the simulation results from the future state estimating unit 210 (step S581), and compiles the simulation results (step S582).

[0122] The aggregation here refers to compiling the simulation results for register numbers where the register values ​​have been converted into simulation values ​​and defining the range in which an abnormal state occurs. For example, if the register value (simulation value), abnormality type, and transition time to the abnormal state when an abnormality is determined as a result of the simulation of the upper abnormal value calculation process for a certain register number A are "150, pressure abnormal, 100 minutes," "300, pressure abnormal, 50 minutes," and "400, pressure abnormal, 10 minutes," respectively, the blacklist for pressure abnormalities for register number A would be listed in the form of "register value: transition time" [150:100, 300:50, 400:10]. The calculation of lower abnormal values ​​is also defined in the same way as the calculation of upper abnormal values.

[0123] The blacklist creation unit 280 assigns an importance to each register number (step S583). For example, the blacklist creation unit 280 calculates the importance based on the magnitude of the impact when the control system 1000 falls into an abnormal state and the transition time to the abnormal state.

[0124] Specifically, when abnormal values ​​are calculated by the upper abnormal value calculation process, the shorter the transition time for the smallest abnormal value, the higher the calculated importance. Also, when abnormal values ​​are calculated by the lower abnormal value calculation process, the shorter the transition time for the largest abnormal value, the higher the calculated importance.

[0125] For example, the importance may be determined based on a policy that places emphasis on the impact when the control system 1000 falls into an abnormal state. For example, suppose there are three elements in the blacklist, one of which is an abnormal pressure rise in 50 minutes (abnormality A), another is an abnormal pressure rise in 45 minutes (abnormality B), and the last is an abnormal temperature in 45 minutes (abnormality C). If the abnormal pressure rise has a much greater impact than the abnormal temperature, the importance would be classified as abnormality B, abnormality A, and abnormality C in descending order. Since the approach to the impact and transition time of an abnormality varies depending on the organization's policy, if a transition time of 5 minutes is determined to be a significant difference, the importance may be classified as abnormality B, abnormality C, and abnormality A in descending order. Furthermore, if both an upper abnormal value and a lower abnormal value exist, the shorter transition time of the upper abnormal value or the lower abnormal value may be used.

[0126] By using the importance level to limit the number of registers for which a blacklist is created, it is possible to create a blacklist that extracts register numbers in descending order of importance.In addition, when multiple alerts occur simultaneously, using the importance level makes it possible to prioritize responses.

[0127] Then, the blacklist creating unit 280 stores the collected results as a blacklist in the blacklist storage unit 290 (step S584).

[0128] In this way, the blacklist creation unit 280 creates a blacklist based on the simulation results of the simulator 213.

[0129] FIG. 15 is a flowchart showing an example of the abnormality determination process S560 of the abnormality determination unit 250 in this embodiment.

[0130] The abnormality determination unit 250 acquires the blacklist for the current combination of register values ​​from the blacklist storage unit 290 (step S591), and extracts the register numbers (estimated register numbers) included in the blacklist (step S592).

[0131] Then, the abnormality determination unit 250 acquires the current register values ​​of the register numbers included in the extracted blacklist from the register value collection unit 240 (step S593).

[0132] The abnormality determination unit 250 compares the acquired register value with the allowable range of each register number included in the blacklist (step S594), and determines whether the acquired register value is within the allowable range (step S595). If the acquired register value is within the allowable range (YES in step S595), the abnormality determination unit 250 terminates the process, and if the acquired register value is not within the allowable range (NO in step S595), the abnormality determination unit 250 transmits the determination result to the output unit 270, which then issues an alert (step S596). Note that if the acquired register value is within the allowable range, the output unit 270 may output information indicating, for example, that the control system 1000 is unlikely to fall into an abnormal state.

[0133] For example, if the blacklist is the blacklist shown in FIG. 8 and the register values ​​collected by the register value collector 240 are the register values ​​shown in FIG. 3, the register value of register 2 is "15.0," which is normal because the abnormal range in the blacklist is "10.0 or less." However, the register value of register 67 is "50," which is normal because the abnormal range in the blacklist is "100 or less." The register value is determined to be abnormal, and the control system 1000 is notified (e.g., an alert is issued) using the determination result that there is a high possibility that the control system 1000 will fall into an abnormal state in the future. The determination result includes blacklist information such as importance: 2, register number: register 67, abnormal range: 100 or less, predicted state: low liquid level, transition time: [30:30 sec, 100:50 sec], and this information is notified as the content of the alert. The importance included in the alert can also be used to triage alerts that are issued simultaneously or that are currently occurring.

[0134] In this way, the abnormality determination unit 250 determines whether the control system 1000 will fall into an abnormal state by comparing the register value of the estimated register number collected by the register value collection unit 240 with the range of register values ​​of the estimated register number defined in the blacklist stored in the blacklist management unit 400.

[0135] As described above, the register values ​​held by the controller 104 and collected by the register value collection unit 240 correspond to the system state of the control system 1000, and the blacklist is dynamically generated according to the combination of register values ​​of multiple register numbers collected by the register value collection unit 240. This makes it possible to dynamically generate a blacklist for any system state of the control system 1000. In other words, it is possible to generate an optimal blacklist for any system state (register value) of the control system 1000. Then, by comparing the generated blacklist with the current register values, it becomes possible to determine an abnormality regardless of the system state of the control system 1000, thereby enabling appropriate abnormality detection. Anomaly detection using such an optimal blacklist can reduce false positives or missed detections.

[0136] (Other embodiments) While the anomaly detection system 200 according to one or more aspects of the present disclosure has been described above based on the embodiments, the present disclosure is not limited to these embodiments. As long as they do not deviate from the spirit of the present disclosure, various modifications conceivable by those skilled in the art to each embodiment and configurations constructed by combining components of different embodiments may also be included within the scope of one or more aspects of the present disclosure.

[0137] For example, in the above embodiment, an example has been described in which the blacklist creation unit 280 creates a blacklist based on the simulation results of the simulator 213, but it is not necessary to use the simulation results of the simulator 213. For example, the future state of the control system 1000 may be estimated by performing learning using various combinations of register values ​​collected in the past.

[0138] For example, in the above embodiment, an example has been described in which the abnormal state definition unit 211 defines, for each type of abnormal state of the control system 1000, a register number and an abnormal range corresponding to the abnormal state into which the control system 1000 falls, but this is not limiting. For example, the abnormal state definition unit 211 may define a register number and an abnormal range for only one abnormal state, and it is not necessary to define a register number and an abnormal range for each type of abnormal state of the control system 1000.

[0139] The present disclosure can be realized not only as anomaly detection system 200 but also as an anomaly detection method including steps (processing) performed by each of the components that make up anomaly detection system 200.

[0140] FIG. 16 is a flowchart showing an example of an anomaly detection method according to another embodiment.

[0141] The anomaly detection method is an anomaly detection method executed by an anomaly detection system that detects that a control system will fall into an abnormal state in the future, and as shown in Figure 16, includes a register value collection step (step S11) that collects register values ​​of multiple register numbers from a controller that controls the control system, a future state estimation step (step S12) that estimates the future state of the control system, a blacklist creation step (step S13) that creates a blacklist based on the result of the estimation in the future state estimation step, a blacklist management step (step S14) that saves the created blacklist, an anomaly determination step (step S15) that determines whether the control system will fall into an abnormal state by comparing the register values ​​collected in the register value collection step with the blacklist saved in the blacklist management step, and an output step (step S16) that outputs the result of the determination in the anomaly determination step. In the blacklist creation step, among the multiple register numbers whose register values ​​are collected in the register value collection step, estimated register numbers whose register values ​​are estimated to cause the control system to fall into an abnormal state in the future if changed, and a range of register values ​​for the estimated register numbers whose register values ​​are estimated to cause the control system to fall into an abnormal state are defined as a blacklist, and the blacklist is dynamically created according to the combination of register values ​​for the multiple register numbers collected in the register value collection step.

[0142] For example, the steps in the anomaly detection method may be executed by a computer (computer system), and the present disclosure may be realized as a program for causing a computer to execute the steps included in the anomaly detection method.

[0143] Furthermore, the present disclosure can be realized as a non-transitory computer-readable recording medium, such as a CD-ROM, on which the program is recorded.

[0144] For example, when the present disclosure is realized as a program (software), each step is performed by running the program using hardware resources such as a computer's CPU, memory, input / output circuits, etc. In other words, each step is performed by the CPU acquiring data from memory or input / output circuits, etc., performing calculations on the data, and outputting the calculation results to memory or input / output circuits, etc.

[0145] Furthermore, each of the components included in the anomaly detection system 200 of the above embodiment may be realized as a dedicated or general-purpose circuit.

[0146] Furthermore, each of the components included in the anomaly detection system 200 according to the above embodiment may be realized as an LSI (Large Scale Integration), which is an integrated circuit (IC).

[0147] Furthermore, the integrated circuit is not limited to an LSI, but may be realized by a dedicated circuit or a general-purpose processor. A programmable FPGA (Field Programmable Gate Array) or a reconfigurable processor, in which the connections and settings of circuit cells within the LSI can be reconfigured, may also be used.

[0148] Furthermore, if an integrated circuit technology that can replace LSI emerges due to advances in semiconductor technology or other derivative technologies, it is natural that each component included in the anomaly detection system 200 may be integrated into an integrated circuit using that technology.

[0149] In addition, this disclosure also includes forms obtained by making various modifications to the embodiments that a person skilled in the art would think of, and forms realized by arbitrarily combining the components and functions in each embodiment within the scope that does not deviate from the intent of this disclosure. [Industrial Applicability]

[0150] The present disclosure is useful for detecting anomalies in control systems. [Explanation of symbols]

[0151] 100 internet lines 101 Information Network 102 Control Network 103 Field Network 104 Controller 105 SCADA 106 I / O 107 Sensors 108 Actuator 200 Anomaly Detection System 210 Future state estimation unit 211 Abnormal condition definition section 212 Correlation variable extraction unit 213 Simulator 214 Simulation Value Generation Unit 215 Status Monitoring Unit 216 Result molding section 220 Status determination unit 230 Register number correlation learning unit 240 Register Value Collection Unit 250 Abnormality judgment section 260 Interface section 270 Output section 280 Blacklist Creation Department 290 Blacklist Storage Unit 400 Blacklist Management Department 1000 Control System

Claims

1. An anomaly detection system that detects that a control system will fall into an abnormal state in the future, a register value collection unit that collects register values ​​of a plurality of register numbers from a controller that controls the control system; a future state estimation unit that estimates a future state of the control system; a blacklist creation unit that creates a blacklist based on the result of estimation by the future state estimation unit; a blacklist management unit for storing the created blacklist; an abnormality determination unit that determines whether the control system falls into an abnormal state by comparing the register values ​​collected by the register value collection unit with a blacklist stored in the blacklist management unit; an output unit that outputs a result of the determination by the abnormality determination unit, The blacklist creation unit defines, as a blacklist, estimated register numbers among the plurality of register numbers for which the register values ​​have been collected by the register value collection unit, which are estimated to cause the control system to fall into an abnormal state in the future if their register values ​​are changed, and a range of register values ​​for the estimated register numbers, which are estimated to cause the control system to fall into an abnormal state, and dynamically creates the blacklist according to a combination of register values ​​for the plurality of register numbers collected by the register value collection unit. Anomaly detection system.

2. the blacklist creation unit creates the blacklist based on a comparison result between a combination of register values ​​of a plurality of register numbers collected by the register value collection unit and a combination of register values ​​of a plurality of register numbers corresponding to a previously created blacklist, The anomaly detection system according to claim 1 .

3. the abnormality determination unit determines whether the control system will fall into an abnormal state by comparing the register value of the estimated register number collected by the register value collection unit with a range of register values ​​of the estimated register number defined in a blacklist stored in the blacklist management unit. The anomaly detection system according to claim 1 .

4. the future state estimation unit estimates a future state of the control system using a simulator that simulates the controller and the control system; The blacklist creation unit creates a blacklist based on a simulation result of the simulator. The anomaly detection system according to any one of claims 1 to 3.

5. the anomaly detection system has an abnormality state definition unit that defines a register number corresponding to an abnormal state that the control system falls into and an abnormal range of a register value of the register number, the abnormal range being a range of register values ​​when the control system falls into an abnormal state; the future state estimation unit estimates the future state of the control system in a simulation by monitoring whether or not the register value of the register number defined in the abnormal state definition unit falls within the abnormal range when the register value of the estimation register number is changed. The anomaly detection system according to claim 4 .

6. The estimated register number is a register number that has a strong correlation with a register number corresponding to an abnormal state into which the control system falls, defined in the abnormal state definition unit. The anomaly detection system according to claim 5 .

7. the future state estimation unit calculates, through a simulation, a time until the control system transitions to an abnormal state. The anomaly detection system according to claim 4 .

8. the abnormal state definition unit defines, for each type of abnormal state of the control system, a register number corresponding to the abnormal state into which the control system falls and the abnormal range. The anomaly detection system according to claim 5 .

9. An anomaly detection method executed by an anomaly detection system that detects that a control system will fall into an abnormal state in the future, comprising: a register value collecting step of collecting register values ​​of a plurality of register numbers from a controller that controls the control system; a future state estimation step of estimating a future state of the control system; a blacklist creation step of creating a blacklist based on the result of the estimation in the future state estimation step; a blacklist management step for storing the created blacklist; an abnormality determination step of determining whether the control system falls into an abnormal state by comparing the register values ​​collected in the register value collection step with the blacklist stored in the blacklist management step; an output step of outputting a result of the determination in the abnormality determination step, In the blacklist creation step, among the plurality of register numbers whose register values ​​are collected in the register value collection step, estimated register numbers whose register values ​​are estimated to cause the control system to fall into an abnormal state in the future if changed, and a range of register values ​​of the estimated register numbers whose register values ​​are estimated to cause the control system to fall into an abnormal state are defined as a blacklist, and the blacklist is dynamically created according to a combination of register values ​​of the plurality of register numbers collected in the register value collection step. Anomaly detection methods.

10. A program that causes a computer to execute the anomaly detection method according to claim 9.

Images