Analysis system and analysis method

Abstract

To generate information for reproducing a system by using a digital twin.SOLUTION: An analysis system executes an analysis process for controlling models of a plurality of control processes for controlling a system, and analyzing relevance between components of models of the control process by use of event logs of each control process. The analysis process includes: a process for selecting a target component of a model of a first control process; a process for acquiring as a target log related to the target component; a process for calculating an index indicating a relevance between a log of events of a second control process and the target log; a process for specifying an event log related to the target component on the basis of the index; a process for specifying a related component of the second control process related to the specified event log; and a process for recording the target component and the related component in association with each other.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a technology for generating information for reproducing a system using a digital twin. [Background technology]

[0002] In recent years, the integration of OT (Operational Technology) systems with IT has progressed in order to realize automatic control and efficiency improvements in OT systems. Safety, continuity, and real-time performance are important in OT systems.

[0003] The integration of OT systems with IT has made security an issue. Applying security measures to OT systems can affect safety, continuity, and real-time performance. Therefore, it is necessary to analyze the scope and content of the impact of security measures and consider security measures that do not affect safety, continuity, and real-time performance.

[0004] Simulation technology that uses digital twins to recreate OT systems in cyberspace and analyze the scope and content of the impact of security measures is attracting attention.

[0005] OT systems can be divided into multiple control processes with different control targets, such as control processes related to communications and control processes related to control performed by OT systems. Control performed by OT systems is the control that OT systems inherently perform, such as the control of plants, buildings, and infrastructure facilities.

[0006] To achieve a simulation, each control process must be modeled. For example, models of multiple control processes must be generated, such as control processes related to communication, which represent the connectivity and network configuration of data communications between devices via a communication network, and control processes related to control performed by OT systems, such as controlling the behavior of control devices involved in processes. Setting up models manually places a heavy burden on users, which is an issue. Therefore, a method for automatically generating models using process mining technology using logs is known.

[0007] For example, Patent Document 1 discloses a device that "acquires the application log of an application program AP, extracts log data relating to a series of work processes from the acquired application log as blocks, extracts patterns from the blocks in which multiple related log data are arranged in chronological order, extracts patterns from the extracted patterns that have specific log data in common, and generates a business processing flow based on the specific log data." [Prior art documents] [Patent documents]

[0008] [Patent Document 1] Japanese Patent Application Publication No. 2017-227944 Summary of the Invention [Problem to be solved by the invention]

[0009] Conventional technology can be used to generate control process models. However, in the case of systems that are controlled based on multiple control processes, such as OT systems, conventional technology cannot grasp the relationships between the control process models. Therefore, in order to reproduce an OT system using a digital twin and perform a simulation, it is necessary to separately set the relationships between the control process models.

[0010] The present invention aims to provide a technology for understanding the relationship between models of multiple control processes in a system that is controlled based on multiple control processes, such as an OT system. [Means for solving the problem]

[0011] A representative example of the invention disclosed in the present application is as follows: That is, an analysis system that generates information for reproducing a system using a digital twin, the system is controlled based on a plurality of control processes having different control targets, the analysis system includes a processor, a storage device connected to the processor, and a computer having a network interface connected to the processor, and manages models of each of the plurality of control processes, the models of the control processes being composed of components that represent processes included in the control processes, the analysis system acquires an event log for each of the plurality of control processes, and executes an analysis process that analyzes the relevance of the components of the model of a first control process and the components of the model of a second control process, the event log of the control processes includes parameters for identifying the components, and the analysis process executes an analysis process that analyzes the relevance of the components of the model of the first control process before the first control process. a first process for selecting a target component from the components of the model; a second process for acquiring the event log of the first control process related to the target component as a target log; a third process for comparing, for each of the event logs of the second control process, parameters contained in the target log with parameters contained in the event log of the second control process, and calculating an index representing the relevance with the target log; a fourth process for identifying the event log of the second control process related to the target component based on the index; a fifth process for identifying the component of the model of the second control process related to the identified event log of the second control process as a related component; and a sixth process for recording the target component and the related components in association with each other. [Effects of the Invention]

[0012] According to the present invention, it is possible to grasp the relationship between models of a plurality of control processes for controlling a system. Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0013] [Figure 1] FIG. 1 is a diagram illustrating an example of the configuration of an analysis device according to a first embodiment. [Figure 2] FIG. 1 is a diagram illustrating an example of a control system according to a first embodiment. [Figure 3] FIG. 3 is a diagram illustrating an example of event log information managed by the analysis apparatus according to the first embodiment. [Figure 4] FIG. 3 is a diagram illustrating an example of event log information managed by the analysis apparatus according to the first embodiment. [Figure 5] FIG. 10 is a diagram illustrating an example of determination rule information according to the first embodiment. [Figure 6] FIG. 2 is a diagram illustrating an example of a model of a control process according to the first embodiment. [Figure 7] FIG. 2 is a diagram illustrating an example of a model of a control process according to the first embodiment. [Figure 8A] 4 is a flowchart illustrating an example of an analysis process executed by the analysis device of the first embodiment. [Figure 8B] 4 is a flowchart illustrating an example of an analysis process executed by the analysis device of the first embodiment. [Figure 9] FIG. 2 is a diagram showing an example of a weight matrix used in the analysis process of the first embodiment. [Figure 10] FIG. 4 is a diagram showing an example of analysis result information generated by the analysis device of the first embodiment. [Figure 11] FIG. 2 is a diagram showing an example of a screen presented by the analysis device of the first embodiment. [Figure 12] FIG. 2 is a diagram showing an example of a screen presented by the analysis device of the first embodiment. [Figure 13] FIG. 2 is a diagram showing an example of a screen presented by the analysis device of the first embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0014] Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention should not be construed as being limited to the description of the embodiments shown below. Those skilled in the art will readily understand that the specific configuration can be changed without departing from the concept or spirit of the present invention.

[0015] In the configuration of the invention described below, the same or similar configurations or functions are denoted by the same reference numerals, and redundant explanations will be omitted.

[0016] In this specification, the terms "first," "second," "third," etc. are used to identify components and do not necessarily limit the number or order.

[0017] To facilitate understanding of the invention, the position, size, shape, range, etc. of each component shown in the drawings etc. may not represent the actual position, size, shape, range, etc. Therefore, the present invention is not limited to the position, size, shape, range, etc. disclosed in the drawings etc. [Example]

[0018] FIG. 1 is a diagram illustrating an example of the configuration of the analysis device of the first embodiment.

[0019] The analysis device 100 analyzes the relationship between models of control processes of a control system that is controlled based on multiple control processes. The analysis device 100 has a processor 110, a main memory device 111, a secondary memory device 112, and a network interface 113. The analysis device 100 may also have input devices such as a keyboard, a mouse, and a touch panel, as well as an output device such as a display.

[0020] The processor 110 is a computing device that controls the entire analysis device 100, and executes programs stored in the main memory device 111. The processor 110 executes processing in accordance with the programs, thereby operating as a functional unit (module) that realizes a specific function. In the following description, when processing is described using a functional unit as the subject, this indicates that the processor 110 is executing a program that realizes the functional unit.

[0021] The main memory device 111 is a storage device, such as a volatile or non-volatile memory, that stores programs executed by the processor 110 and information executed by the programs. The main memory device 111 is also used as a work area.

[0022] The secondary storage device 112 is a storage device that permanently stores information, and is, for example, an HDD (Hard Disk Drive) or an SSD (Solid State Drive). The programs and information stored in the main storage device 111 may be stored in the secondary storage device 112. In this case, the processor 110 reads the programs and information from the secondary storage device 112 and loads them into the main storage device 111.

[0023] The network interface 113 communicates with external devices via a network.

[0024] The main storage device 111 stores programs that implement the log acquisition unit 120 and the analysis unit 121 , and also holds the determination rule information 122 .

[0025] The determination rule information 122 is information for managing rules for determining the relationship between the event logs (event logs) of the two control processes.

[0026] The log acquisition unit 120 acquires an event log for each of the multiple control processes. The event log may be acquired directly from the control system, or may be acquired from an external system different from the control system. Alternatively, the user may input the event log.

[0027] The analysis unit 121 analyzes the relationship between the models of the control processes based on the event logs of each of the plurality of control processes and the determination rule information 122 .

[0028] The functional units of the analysis device 100 may be configured such that multiple functional units are combined into one functional unit, or one functional unit may be divided into multiple functional units for each function. The functions of the analysis device 100 may be realized using multiple computers.

[0029] Fig. 2 is a diagram illustrating an example of a control system according to the first embodiment. Fig. 2 illustrates the configuration of an OT system. The OT system is controlled based on, for example, a control process related to communication and a control process related to control performed by the OT system. Numbers represent packets.

[0030] The analysis apparatus 100 manages the acquired event logs of each control process as event log information. Figures 3 and 4 are diagrams showing examples of event log information managed by the analysis apparatus 100 of the first embodiment.

[0031] 3 shows event log information 300 that manages event logs for control processes related to communication. The event log information 300 stores records including ID 301, transmission start time 302, transmission end time 303, protocol 304, source MAC 305, destination MAC 306, source IP 307, destination IP 308, source port 309, and destination port 310. One record corresponds to one event log. Note that the fields included in the record are not limited to those described above.

[0032] ID 301 is a field for storing the ID of the event log. The event of the control process related to communication is the transmission of a packet. Transmission start time 302 and transmission end time 303 are fields for storing the transmission start time and transmission end time of the packet. Protocol 304 is a field for storing the communication protocol.

[0033] Source MAC 305, source IP 307, and source port 309 are fields for storing the MAC address, IP address, and port number of the communication device that is the source of the packet. Destination MAC 306, destination IP 308, and destination port 310 are fields for storing the MAC address, IP address, and port number of the communication device that is the destination of the packet.

[0034] 4 shows event log information 400 that manages event logs for control processes related to control performed by an OT system. The event log information 400 stores records including an ID 401, a processing start time 402, a processing end time 403, a device name 404, a MAC address 405, an IP address 406, and sensor information 407. One record corresponds to one event log. Note that the fields included in the record are not limited to those described above.

[0035] ID 401 is a field for storing the ID of the event log. An event of a control process related to control performed by an OT system is a specific control of the OT. Processing start time 402 and processing end time 403 are fields for storing the start time and end time of the control.

[0036] The device name 404, MAC address 405, and IP address 406 are fields for storing the name, MAC address, and IP address of the device to be controlled. The sensor information 407 is a field for storing measurement information of the sensor that monitors the device to be controlled.

[0037] FIG. 5 is a diagram illustrating an example of the determination rule information 122 according to the first embodiment.

[0038] The determination rule information 122 stores a determination table 500 for each pair of control processes. The determination table 500 stores records including a parameter (1) 501, a parameter (2) 502, a determination rule 503, and a weight 504. One record exists for each pair of parameters.

[0039] Parameter (1) 501 is a field that stores identification information of a parameter included in the event log of a control process that forms a pair. Parameter (2) 502 is a field that stores identification information of a parameter included in the event log of another control process that forms a pair. In FIG. 5, parameter (1) 501 stores the "transmission start time" included in the event log of a control process related to communication, and parameter (2) 502 stores the "processing start time" included in the event log of a control process related to control performed by the OT system.

[0040] The determination rule 503 is a field for storing a rule for determining whether two parameters corresponding to the parameter (1) 501 and the parameter (2) 502 are similar to each other. For example, a conditional expression is stored in the determination rule 503. The weight 504 is a field for storing a weight to be set when the two parameters are similar to each other.

[0041] The analysis device 100 generates a model of a control process by performing process mining using an event log. The model of a control process is composed of components that represent processes included in the control process. FIGS. 6 and 7 are diagrams illustrating an example of the model of a control process according to the first embodiment.

[0042] 6 shows model information 600 for managing a model of a control process related to communication. A model of a control process related to communication is a model in which the flow of communication is a component.

[0043] The model information 600 stores records including an ID 601, a device name 602, a connected device name 603, a target device name 604, a source MAC 605, a source IP 606, and a payload 607. One record corresponds to one flow (component). Note that the fields included in the record are not limited to those described above.

[0044] ID 601 is a field that stores the ID of the flow. Device name 602 is a field that stores the name of the communication device that is the source of communication. Connected device name 603 is a field that stores the name of the communication device that is the destination of communication. Connected device name 604 is a field that stores the name of the device that is the target of control implemented by the OT system through communication. Source MAC 605 and source IP 606 are fields that store the MAC address and IP address of the communication device that is the source of communication. Payload 607 is a field that stores the information to be transmitted.

[0045] 7 shows model information 700 for managing a model of a control process related to control performed by an OT system. The model of a control process related to control performed by an OT system is a model with control as a component.

[0046] The model information 700 stores records each including an ID 701, a control name 702, and a control device name 703. One record corresponds to one control (component). Note that the fields included in the record are not limited to those described above.

[0047] ID 701 is a field for storing the ID of the control. Control name 702 is a field for storing the name of the control. Control device name 703 is a field for storing the name of the device to be controlled.

[0048] The information defining the components of the control process model includes parameters contained in the event log of the control process.

[0049] Alternatively, the user may generate the model information 600 and 700 and set it in the analysis device 100 .

[0050] 8A and 8B are flowcharts illustrating an example of analysis processing executed by the analysis device 100 of the first embodiment. Fig. 9 is a diagram illustrating an example of a weight matrix used in the analysis processing of the first embodiment. Fig. 10 is a diagram illustrating an example of analysis result information generated by the analysis device 100 of the first embodiment.

[0051] When the analysis device 100 receives an execution instruction specifying two control processes, it starts the analysis process. The analysis device 100 allocates the two control processes to control process 1 and control process 2. For example, the allocation is performed based on the importance in the control system. The user may specify the allocation of the control processes in advance.

[0052] In the case of analysis processing of the control process of an OT system, the control process related to the control performed by the OT system is referred to as control process 1, and the control process related to communication is referred to as control process 2.

[0053] The analysis device 100 starts loop processing of the components of the model of the control process 1 (step S101). The analysis device 100 selects one component from the components of the model of the control process 1.

[0054] The analysis apparatus 100 identifies an event log related to the selected component from the event logs of the control process 1 (step S102).

[0055] Based on the event log identified in step S102, the analysis apparatus 100 extracts event logs to be compared from the event logs of the control process 2 (step S103). For example, event logs whose execution times are within a predetermined range are extracted. Note that the processing of step S103 may be omitted.

[0056] The analytical apparatus 100 starts loop processing of the event logs of the control process 1 (step S104). The analytical apparatus 100 selects one event log (first event log) from the event logs identified in step S102.

[0057] The analysis device 100 initializes the weight matrix 900 (step S105). Specifically, the analysis device 100 generates the weight matrix 900 in which the parameters of the event log of the controlled process 1 are the column components and the parameters of the event log of the controlled process 2 are the row components. The analysis device 100 sets all components of the weight matrix 900 to 0.

[0058] The analytical apparatus 100 starts loop processing of the event log of the control process 2 (step S106). The analytical apparatus 100 selects one event log (second event log) from the event logs extracted in step S103.

[0059] The analytical device 100 starts loop processing of the parameters in the event log (first event log) of the control process 1 (step S107). The analytical device 100 selects one parameter (first parameter) from the parameters in the first event log.

[0060] The analytical device 100 starts loop processing of the parameters in the event log (second event log) of the control process 2 (step S108). The analytical device 100 selects one parameter (second parameter) from the parameters in the event log of the control process 2.

[0061] The analysis apparatus 100 refers to the determination rule information 122, acquires the determination rule for the first parameter and the second parameter, and calculates a weight based on the determination rule (step S109). If the determination rule is met, the analysis apparatus 100 overwrites the value of the weight 504 to the element of the weight matrix 900 corresponding to the first parameter and the second parameter. If the determination rule is not met, the analysis apparatus 100 overwrites 0 to the element of the weight matrix 900 corresponding to the first parameter and the second parameter. Note that if there is no determination rule corresponding to the combination of parameters, the analysis apparatus 100 calculates 0 as the weight.

[0062] The analytical device 100 determines whether or not the processing has been completed for all parameters in the second event log (step S110).

[0063] If processing has not been completed for all parameters in the second event log, the analytical device 100 returns to step S108 and selects a new second parameter.

[0064] When the processing has been completed for all parameters in the second event log, the analysis apparatus 100 determines whether the processing has been completed for all parameters in the first event log (step S111).

[0065] If processing has not been completed for all parameters in the first event log, the analytical apparatus 100 returns to step S107 and selects a new first parameter.

[0066] When processing has been completed for all parameters of the first event log, the analysis device 100 calculates a relevance score that represents the relevance between the first event log and the second event log based on the weight matrix 900 (step S112). For example, the analysis device 100 calculates the sum or maximum value of the weights of the components of the weight matrix 900 as the relevance score. The analysis device 100 stores data that associates the ID of the first event log, the ID of the second event log, the relevance score, and the weight matrix 900 in a work area.

[0067] The analysis apparatus 100 determines whether or not the processing has been completed for all the event logs extracted in step S103 (step S113).

[0068] If the processing has not been completed for all of the event logs extracted in step S103, the analysis apparatus 100 returns to step S106 and selects a new second event log.

[0069] When the processing has been completed for all the event logs extracted in step S103, the analysis apparatus 100 determines whether the processing has been completed for all the event logs identified in step S102 (step S114).

[0070] If processing has not been completed for all event logs identified in step S102, the analysis apparatus 100 returns to step S104 and selects a new first event log.

[0071] When the processing for all the event logs identified in step S102 has been completed, the analysis apparatus 100 identifies the event log of the control process 2 that is related to the component selected in step S101 (step S115).

[0072] For example, the analysis device 100 identifies a predetermined number of event logs of the control processes 2 in descending order of relevance score, or identifies event logs of the control processes 2 whose relevance scores are greater than a threshold.

[0073] The analysis device 100 refers to the model information of the controlled process 2 based on the event log identified in step S115, and identifies the components of the model of the controlled process 2 that are related to the event log (step S116). This identifies the components of the model of the second controlled process that are related to the components of the model of the first controlled process.

[0074] The analysis device 100 updates the analysis result information 1000 (step S117). The analysis result information 1000 stores records including a component (1) 1001 and a component (2) 1002. One entry exists for each component of the model of the control process 1. The analysis device 100 adds a record to the analysis result information 1000, and sets the ID of the component of the model of the control process 1 selected in step S101 to component (1) of the added record. The analysis device 100 also sets the ID of the component of the model of the control process 2 identified in step S116 to component (2) 1002 of the added record. Two or more IDs may be set for component (2) 1002.

[0075] The analysis apparatus 100 determines whether the processing has been completed for all components of the model of the control process 1 (step S118).

[0076] If the processing has not been completed for all components in the model of the control process 1, the analysis apparatus 100 returns to step S101 and selects a new component.

[0077] When the processing is completed for all components of the model of the control process 1, the analysis apparatus 100 ends the analysis processing.

[0078] 11, 12, and 13 are diagrams showing examples of screens presented by the analysis device 100 of the first embodiment.

[0079] Screen 1100 in FIG. 11 is a screen used to set parameters for the control protocol event log.

[0080] The user operates button 1101 to add a setting field for the control protocol. The user operates button 1102 to add a setting field for the event log parameters. The user operates button 1103 to set the parameter information for the control protocol event log in the analysis device 100. The analysis device 100 determines the format of the event log information based on the parameter information for the control protocol event log.

[0081] A screen 1200 in FIG. 12 is a screen used to set a determination rule.

[0082] The user sets the name of the control protocol in input field 1201 and the parameters in input field 1202. The user sets the name of the control protocol in input field 1203 and the parameters in input field 1204. The user sets a determination rule in input field 1205 and a weighting value in input field 1206. The user operates button 1207 to set the determination rule in the analysis device 100. The analysis device 100 sets the received determination rule in the determination table 500 corresponding to the combination of control processes set in input field 1201 and input field 1203.

[0083] 13 is a screen for displaying analysis results. Analysis result information 1000 is displayed on screen 1300. When the user selects a record in analysis result information 1000 and operates button 1301, weight matrix 900 is displayed.

[0084] The analysis device 100 of the first embodiment can generate information indicating the relevance of components between models of controlled processes by using the event log of the controlled processes and the information on the models of the controlled processes. Based on the information, the relevance of components between models of controlled processes can be grasped.

[0085] The present invention is not limited to the above-described embodiments, but includes various modifications. For example, the above-described embodiments are provided to explain the present invention in detail, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, some of the configurations of each embodiment can be added to, deleted from, or replaced with other configurations.

[0086] Furthermore, the above-described configurations, functions, processing units, processing means, etc. may be partially or entirely implemented in hardware, for example, by designing them as integrated circuits. The present invention can also be realized by software program code that implements the functions of the embodiments. In this case, a storage medium on which the program code is recorded is provided to a computer, and a processor included in the computer reads the program code stored in the storage medium. In this case, the program code itself read from the storage medium implements the functions of the above-described embodiments, and the program code itself and the storage medium on which it is stored constitute the present invention. Examples of storage media for providing such program code include flexible disks, CD-ROMs, DVD-ROMs, hard disks, solid-state drives (SSDs), optical disks, magneto-optical disks, CD-Rs, magnetic tapes, non-volatile memory cards, and ROMs.

[0087] Furthermore, the program code that realizes the functions described in this embodiment can be implemented in a wide range of program or script languages, such as assembler, C / C++, perl, Shell, PHP, Python, and Java (registered trademark).

[0088] Furthermore, the program code of the software that realizes the functions of the embodiments may be distributed via a network and stored in a storage means such as a computer's hard disk or memory, or in a storage medium such as a CD-RW or CD-R, and the processor of the computer may read and execute the program code stored in the storage means or storage medium.

[0089] In the above-described embodiment, the control lines and information lines are shown as those considered necessary for the explanation, and not all control lines and information lines are necessarily shown in the product. All components may be interconnected. [Explanation of symbols]

[0090] 100 Analyzer 110 processors 111 Main memory 112 Secondary storage device 113 Network Interface 120 Log acquisition unit 121 Analysis Department 122 Judgment rule information 300 Event Log Information 400 Event Log Information 500 Judgment table 600, 700 model information 900 Weight Matrix 1000 Analysis result information 1100, 1200, 1300 screen

Claims

1. An analysis system that generates information for reproducing a system using a digital twin, the system is controlled based on a plurality of control processes with different control targets; The analysis system comprises: a computer having a processor, a storage device connected to the processor, and a network interface connected to the processor; managing a model of each of the plurality of control processes; the model of the control process is composed of components that represent processes included in the control process; The analysis system comprises: acquiring a log of events for each of the plurality of control processes; performing an analysis process for analyzing the association between the components of the model of the first control process and the components of the model of the second control process; the log of events of the control process includes a parameter identifying the component; The analysis process includes: a first process for selecting a target component from the components of the model of the first controlled process; a second process of acquiring a log of the event of the first control process related to the target component as a target log; a third process of comparing, for each of the event logs of the second control process, a parameter included in the target log with a parameter included in the event log of the second control process, and calculating an index representing a relevance with the target log; a fourth process for identifying a log of the event of the second control process associated with the target component based on the indicator; a fifth process of identifying the component of the model of the second controlled process that is associated with the event log of the identified second controlled process as a related component; and a sixth process of associating and recording the target component and the related component.

2. 10. The analysis system of claim 1, The system comprises: It is an operational technology system, Controlled based on a control process relating to communication and a control process relating to control implemented by the operational technology system; the first control process is a control process related to control performed by the operational technology system; The analysis system is characterized in that the second control process is a control process related to the communication.

3. 10. The analysis system of claim 1, retaining judgment information that stores data relating combinations of parameters to be compared, judgment rules, and weights; In the third process, a weight of each of the event logs of the second control process is calculated as the index; In the fourth process, the event log of the second control process associated with the target component is identified based on the sum of the weights of each of the event logs of the second control process.

4. An analytical method for generating information for reproducing a system using a digital twin, the method being performed by an analytical system, the method comprising: the system is controlled based on a plurality of control processes with different control targets; The analysis system comprises: a computer having a processor, a storage device connected to the processor, and a network interface connected to the processor; managing a model of each of the plurality of control processes; the model of the control process is composed of components that represent processes included in the control process; The analysis method includes: a first step in which the computer acquires an event log of each of the plurality of control processes; a second step of executing, by the computer, an analysis process for analyzing a relationship between the components of the model of the first control process and the components of the model of the second control process; the log of events of the control process includes a parameter identifying the component; The second step includes: a third step in which the computer selects a target component from the components of the model of the first control process; a fourth step in which the computer acquires, as a target log, a log of the event of the first control process related to the target component; a fifth step in which the computer compares, for each of the event logs of the second control process, a parameter included in the target log with a parameter included in the event log of the second control process, and calculates an index representing a relevance with the target log; a sixth step of the computer identifying, based on the indicator, a log of the events of the second control process associated with the target component; a seventh step in which the computer identifies, as relevant components, the components of the model of the second controlled process that are associated with the event log of the identified second controlled process; an eighth step in which the computer associates and records the target component and the related component.

5. The analysis method according to claim 4, The system comprises: It is an operational technology system, Controlled based on a control process relating to communication and a control process relating to control implemented by the operational technology system; the first control process is a control process related to control performed by the operational technology system; The analysis method is characterized in that the second control process is a control process related to the communication.

6. The analysis method according to claim 4, the analysis system holds judgment information that stores data associating combinations of parameters to be compared, judgment rules, and weights; the fifth step includes a step of calculating, by the computer, a weight of each of the logs of the events of the second control process as the index; The sixth step is an analysis method characterized in that it includes a step in which the computer identifies the event log of the second control process associated with the target component based on the total value of the indicators of each of the event logs of the second control process.

Images