Monitoring device and monitoring method

Abstract

A monitoring apparatus (200) is provided with a user input acquiring unit (203) for acquiring information based on an input made by a user on a user input apparatus (101), and a communication anomaly detecting unit (206) for detecting observed communication anomaly. The communication anomaly detecting unit (206) detects communication anomaly on the basis of information of a packet in which a device to be monitored is included in the transmission source or destination thereof, and information based on an input corresponding to the packet.

Description

[Technical Field]

[0001] The present disclosure relates to a monitoring device and a monitoring method. [Background technology]

[0002] Conventionally, control systems installed in factory facilities and the like have employed proprietary communication methods and have been connected and operated via proprietary communication lines. However, with the spread of the Internet, communication standards between control devices that utilize general-purpose protocols such as Ethernet (registered trademark) and IP (Internet Protocol), which have become faster and cheaper, are now being used.

[0003] However, the use of general-purpose communication standards also increases the risk of exposure to cyber attacks, including malware.

[0004] For this reason, intrusion detection systems (IDS) are often used to monitor networks in control systems within factory facilities, and attempts are made to detect and deal with abnormal communications. In control systems, processing basically occurs automatically according to predetermined logic, and the traffic required for that processing is generated, making it easy to learn the underlying behavior. For this reason, it is common to use an IDS with behavioral anomaly detection functionality to detect abnormal communications.

[0005] Methods for detecting behavioral anomalies include the method described in Patent Document 1. Patent Document 1 discloses a method for detecting anomalies using the appearance frequency distribution of byte sequences in the payload of normal data. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Patent No. 5307090 Summary of the Invention [Problem to be solved by the invention]

[0007] However, in control systems, human intervention is often required during non-routine operations such as occasional maintenance. Because human intervention tends to differ from operations performed by regular automated processes, IDSs with behavioral anomaly detection capabilities often detect these as abnormal communications.

[0008] The present disclosure provides a monitoring device and a monitoring method that can suppress false detections that may occur due to human operation. [Means for solving the problem]

[0009] A monitoring device according to one aspect of the present disclosure includes a user input acquisition unit that acquires information based on user input to an input device, and a communication anomaly detection unit that detects anomalies in observed communication, and the communication anomaly detection unit detects the communication anomaly based on information about packets that include a monitored device as a sender or destination and information based on the input corresponding to the packets.

[0010] A monitoring method according to one aspect of the present disclosure acquires information based on input by a user to an input device, and detects communication abnormalities based on information of packets that include a monitored device as the source or destination and information based on the input corresponding to the packets. [Effects of the Invention]

[0011] According to the monitoring device and monitoring method according to one aspect of the present disclosure, it is possible to suppress false detections that may occur due to human operation. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 is a block diagram showing the configuration of a control system in which a monitoring device according to an embodiment is used. [Figure 2]FIG. 2 is a block diagram showing the configuration of the monitoring device according to the embodiment. [Figure 3] FIG. 3 is a diagram illustrating setting information related to communication monitoring target IP addresses stored in the setting storage unit according to the embodiment. [Figure 4] FIG. 4 is a diagram illustrating setting information of an anomaly detection algorithm to be used, which is stored in the setting storage unit according to the embodiment. [Figure 5] FIG. 5 is a diagram showing key input information that the monitoring device according to the embodiment obtains from a key logger that operates on the central monitoring and control device. [Figure 6A] FIG. 6A is a diagram illustrating a first example of screen information that the monitoring device according to the embodiment obtains from a key logger operating on a central monitoring and control device. [Figure 6B] FIG. 6B is a diagram illustrating a second example of screen information that the monitoring device according to the embodiment obtains from a key logger operating on the central monitoring and control device. [Figure 6C] FIG. 6C is a diagram illustrating a third example of screen information that the monitoring device according to the embodiment obtains from the key logger operating on the central monitoring and control device. [Figure 6D] FIG. 6D is a diagram illustrating a fourth example of screen information that the monitoring device according to the embodiment obtains from the key logger operating on the central monitoring and control device. [Figure 7] FIG. 7 is a diagram illustrating a detection result output by the communication abnormality detection unit according to the embodiment. [Figure 8A] FIG. 8A is a diagram showing a control command whitelist, which is one type of anomaly detection model. [Figure 8B] FIG. 8B is a diagram showing another control command whitelist, which is one type of anomaly detection model. [Figure 9] FIG. 9 is a diagram showing a maximum / minimum value whitelist, which is one type of anomaly detection model. [Figure 10] FIG. 10 is a flowchart showing an overview of the processing performed by the monitoring device according to the embodiment. [Figure 11] FIG. 11 is a flowchart illustrating the manual setting process of the monitoring device according to the embodiment. [Figure 12] FIG. 12 is a flowchart illustrating the learning process of the monitoring device according to the embodiment. [Figure 13] FIG. 13 is a flowchart illustrating the detection process of the monitoring device according to the embodiment. [Figure 14] FIG. 14 is a block diagram showing the configuration of a control system in which a monitoring device according to the first modification of the embodiment is used. [Figure 15] FIG. 15 is a flowchart illustrating the learning process of the monitoring device according to the second modification of the embodiment. [Figure 16] FIG. 16 is a diagram showing an example of data obtained by parsing a control packet. [Figure 17] FIG. 17 is a diagram showing text information obtained when OCR (Optical Character Recognition) is performed using screen information as input. [Figure 18] FIG. 18 is a diagram showing an example of data obtained by parsing a control packet and associating it with text information obtained by performing OCR on screen information. [Figure 19] FIG. 19 is a diagram illustrating an example of an anomaly detection model according to the second modification of the embodiment. [Figure 20] FIG. 20 is a flowchart illustrating the detection process of the monitoring device according to the second modification of the embodiment. [Figure 21] FIG. 21 is a flowchart illustrating the learning process of the monitoring device according to the third modification of the embodiment. [Figure 22] FIG. 22 is a flowchart illustrating the detection process of the monitoring device according to the third modification of the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0013] (How one aspect of the present disclosure was achieved) Cyber ​​attacks on Industrial Control Systems (ICS) are on the rise. Since a normally formatted command sequence used to control equipment can become a serious attack on an ICS, once an attacker has penetrated the system, they can more easily launch attacks that cannot be detected by conventional IDSs that use signatures to detect anomalies than on IT systems.

[0014] Therefore, in order to quickly detect and respond to attacks on ICS, it is possible to apply a communication anomaly detection algorithm that utilizes machine learning. Machine learning anomaly detection algorithms can detect communications that have characteristics that differ from normal communications, and therefore can detect attacks that cannot be detected by signatures.

[0015] However, when an anomaly detection algorithm that utilizes machine learning was actually applied to ICS, it was found that many false positives occurred.A careful investigation into the causes of the false positives revealed that the false positives were not due to routine mechanical processing, but rather to communications resulting from maintenance, interrupt processing by system administrators, and so on, which were mistakenly detected as anomalies.

[0016] The inventors have therefore conducted extensive research to solve this problem, and have discovered that false detections can be avoided by detecting communication anomalies by linking device operation information generated during maintenance, interrupt processing by a system administrator, and other such events. As a result, the inventors have devised the monitoring device and monitoring method described below.

[0017] A monitoring device according to one aspect of the present disclosure includes a user input acquisition unit that acquires information based on user input to an input device, and a communication anomaly detection unit that detects anomalies in observed communication, and the communication anomaly detection unit detects the communication anomaly based on information about packets that include a monitored device as a sender or destination and information based on the input corresponding to the packets.

[0018] The monitoring device detects communication anomalies based on information based on input corresponding to packets, and when a communication anomaly is detected, it can estimate with high accuracy whether the communication anomaly is caused by a user's input (operation). Therefore, the monitoring device can suppress false positives that may occur due to human input. Such a monitoring device can accurately determine whether the communication anomaly is likely to be caused by malware, a cyber attack, or the like.

[0019] Also, for example, the information based on the input may include history information indicating a history of input by the user to the input device at the time of transmitting the packet, and the communication anomaly detection unit may switch a detection method for detecting the communication anomaly depending on the history information.

[0020] This allows a detection method based on history information to be used, thereby making it possible to suppress erroneous detections that may occur due to human input.

[0021] Also, for example, the history information may include information indicating whether or not the user made an input to the input device at the time the packet was transmitted, and the communication anomaly detection unit may switch the detection method for detecting the communication anomaly depending on whether or not the user made an input to the input device.

[0022] This allows the use of a detection method depending on whether or not a user has input to the input device, thereby making it possible to suppress false detections that may occur due to human input.

[0023] Furthermore, for example, the communication anomaly detection unit may switch a model for detecting the communication anomaly as the switching of the detection method.

[0024] This allows switching between models for detecting communication anomalies, thereby reducing false positives that can occur due to human input.

[0025] Also, for example, if there is input from the user to the input device when the packet is transmitted, the communication anomaly detection unit may not detect the communication anomaly using a model for detecting the communication anomaly, and if there is no input from the user to the input device when the packet is transmitted, may detect the communication anomaly using the model.

[0026] This prevents communication abnormalities from being detected if a user inputs into the input device when a packet is transmitted, thereby more reliably suppressing false detections that may occur due to human input.

[0027] Also, for example, the information based on the input may include screen information showing the display screen of the monitored device at the time the packet is transmitted, and the communication abnormality detection unit may detect the communication abnormality based on information of a packet that includes the monitored device as the source or destination and the screen information corresponding to the packet.

[0028] This makes it possible to use screen information corresponding to the packet to suppress false detections that may occur due to human input.

[0029] Furthermore, for example, the communication abnormality detection unit may detect the communication abnormality based on the coordinates and values ​​of a character string obtained by performing OCR (Optical Character Recognition) on the screen information corresponding to the packet, and the values ​​obtained by parsing the packet.

[0030] This makes it possible to determine whether the packet was generated by a user input, using the value input by the user and the value contained in the transmitted packet.

[0031] Furthermore, for example, the communication anomaly detection unit may identify target coordinates on the display screen based on attribute information of the packet, and detect the communication anomaly based on whether or not a value displayed at the identified target coordinates among the coordinates of one or more of the character strings matches a value obtained by parsing the packet.

[0032] As a result, if the value entered by the user matches the value contained in the transmitted packet, it can be determined that the packet was generated by a user input.

[0033] Furthermore, for example, the system may further include a communication learning unit that learns the model based on a predetermined learning period.

[0034] This allows a model to be generated for detecting abnormalities using a monitoring device.

[0035] Furthermore, for example, the communication learning unit may generate as the model a first list learned based on attribute information of a packet when the user inputs to the input device at the time of transmitting the packet during the learning period, and a second list learned based on attribute information of the packet when the user does not input to the input device at the time of transmitting the packet during the learning period.

[0036] This makes it possible to generate two lists for detecting communication anomalies. By switching between these lists to detect anomalies, it is possible to reduce false positives that can occur due to human input.

[0037] Furthermore, for example, the communication learning unit may generate a first machine learning model trained by machine learning using attribute information of a packet when the user inputs to the input device at the time of sending the packet during the learning period as input information and a detection result indicating normality or abnormality as correct answer information, and a second machine learning model trained by machine learning using attribute information of a packet when the user does not input to the input device at the time of sending the packet during the learning period as input information and a detection result indicating normality or abnormality as correct answer information.

[0038] This makes it possible to generate two machine learning models for detecting communication anomalies. By switching between these machine learning models to detect anomalies, it is possible to reduce false positives that can occur due to human input.

[0039] Furthermore, for example, the device may further include a communication learning unit that learns a model for identifying target coordinates on the display screen based on a predetermined learning period.

[0040] This allows a model to be generated for detecting abnormalities using a monitoring device.

[0041] Furthermore, for example, the model may be a list in which attribute information of packets is associated with target coordinates on the display screen.

[0042] This makes it possible to detect communication abnormalities using the target coordinate values ​​according to the attribute information of the packet, thereby making it possible to more reliably determine whether the packet was generated by user input.

[0043] Furthermore, for example, the target coordinates may be coordinates that display a value that matches a value obtained by parsing a packet on the display screen when the packet is transmitted during the learning period.

[0044] This makes it possible to detect communication abnormalities using the values ​​of such target coordinates, thereby making it possible to more reliably determine whether the packet in question was generated by a user input.

[0045] Also, for example, software capable of transferring information based on the input to the monitoring device may be installed on the monitored device, and the user input acquisition unit may acquire the information based on the input by the software transferring the information based on the input.

[0046] This allows the software to easily obtain information based on the input.

[0047] Furthermore, for example, the monitoring device may further include a transfer device connected between the input device and the monitored device and capable of transferring information based on the input to the monitoring device, and the user input acquisition unit may acquire the information based on the input by the transfer device transferring the information based on the input.

[0048] This allows for easy acquisition of information based on the input using hardware.

[0049] Furthermore, for example, the monitored device may be a control device for controlling production equipment arranged in a factory.

[0050] This makes it possible to suppress false detections that may occur due to human input in factories where interruptions due to maintenance or the like are likely to occur, which can contribute to improving productivity in factories.

[0051] In addition, a monitoring method according to one aspect of the present disclosure acquires information based on input by a user to an input device, and detects communication abnormalities based on information of packets that include the monitored device as the source or destination and information based on the input corresponding to the packets.

[0052] This provides the same effects as the above-mentioned monitoring device.

[0053] These general or specific aspects may be realized as a system, a method, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM, or as any combination of the system, method, integrated circuit, computer program, or recording medium. The program may be pre-stored in the recording medium, or may be supplied to the recording medium via a wide area communication network including the Internet.

[0054] Specific examples of a monitoring device and a monitoring method according to an aspect of the present disclosure will be described below with reference to the drawings. Each of the embodiments shown here represents a specific example of the present disclosure. Therefore, the numerical values, shapes, components, component arrangement and connection forms, steps, and step order shown in the following embodiments are merely examples and do not limit the present disclosure. Of the components in the following embodiments, components not recited in independent claims are optional components that can be added.

[0055] Furthermore, each figure is a schematic diagram and is not necessarily an exact illustration. Therefore, for example, the scales of the figures do not necessarily match. Furthermore, in each figure, substantially the same components are given the same reference numerals, and redundant explanations are omitted or simplified.

[0056] Furthermore, in this specification, terms indicating relationships between elements such as coincidence, as well as numerical values ​​and numerical ranges, are not expressions that express only the strict meaning, but also expressions that include a substantially equivalent range, for example, a difference of a few percent (e.g., about 10%).

[0057] (Embodiment) A monitoring device according to an embodiment of the present invention will now be described. This monitoring device associates communication abnormalities with user operations.

[0058] Fig. 1 is an example of a block diagram showing the configuration of a control system 1 in which a monitoring device 200 according to an embodiment is used. Fig. 1 shows the overall configuration of the control system 1 according to this embodiment. In this embodiment, each device communicates over Ethernet defined by IEEE802.3 using an appropriate protocol according to the characteristics of the application, such as TCP / IP or UDP / IP.

[0059] Each component of Fig. 1 will be described. As shown in Fig. 1, the control system 1 includes a central monitoring and control device 100, a user input device 101, a PC (Personal Computer) 110, a PLC (Programmable Logic Controller) 120, an L2SW (L2 switch) 140, and a monitoring device 200. Each component of the control system 1 may be located, for example, within a factory, or at least some of the components may be located outside the factory.

[0060] In a control network (for example, a network within a factory), each device is connected via an L2SW 140. The central monitoring and control device 100, the PC 110, and the PLC 120 can communicate with each other via the L2SW 140.

[0061] The central monitoring and control device 100 is a control device for controlling each component, each production facility (each machine), etc. of the control system 1. The central monitoring and control device 100 controls each component, each production facility, etc. based on input (operation) acquired via a user input device 101.

[0062] Although the central monitoring and control device 100 will be described as an example of a monitored device that is a monitored object of the monitoring device 200, other devices that operate based on input from a user may also be monitored by the monitoring device 200. Furthermore, the monitored object may be a plurality of devices.

[0063] The central monitoring and control device 100 is equipped with a user input device 101 such as a mouse, a keyboard, etc. The user input device 101 is connected to the central monitoring and control device 100, and the central monitoring and control device 100 receives input from the user via the user input device 101.

[0064] The user input device 101 receives input from the user for maintenance, interrupt processing, etc. The user input device 101 may also obtain input from the user by voice, gesture, or the like.

[0065] The PC 110 is a device for controlling each piece of production equipment in the factory.

[0066] The PLC 120 is a device for automatically controlling each piece of production equipment in a factory, and controls each piece of production equipment according to a predetermined sequence or procedure. Although not shown, the PLC 120 is connected to each piece of production equipment so that it can communicate with them. The PLC 120 can control, for example, multiple motors, multiple actuators, etc. Each of the multiple motors and multiple actuators is assigned an object ID for identification.

[0067] The L2SW 140 performs a process of transmitting the acquired information to a device corresponding to the information. The L2SW 140 has a mirror port 140a. The mirror port 140a is a port that can capture packets flowing on the network switch. The mirror port 140a is also called a monitor port. The L2SW 140 has many ports for connecting LAN (Local Area Network) cables, and the mirror port 140a copies (mirrores) packets flowing through a specified port. In this embodiment, the monitoring device 200 is connected to the mirror port 140a.

[0068] The monitoring device 200 monitors whether there are any abnormalities in the communications on the control network. The monitoring device 200 acquires all communications between the central monitoring and control device 100, the PC 110, and the PLC 120 in promiscuous mode from the mirror port 140a of the L2SW 140. The monitoring device 200 is also connected to a normal port in addition to the mirror port 140a, and is therefore able to communicate with the central monitoring and control device 100.

[0069] FIG. 2 is a block diagram showing the configuration of a monitoring device 200 according to an embodiment.

[0070] As shown in FIG. 2, the monitoring device 200 includes a setting input unit 201, a setting storage unit 202, a user input acquisition unit 203, a user input information storage unit 204, a communication learning unit 205, a communication anomaly detection unit 206, and an anomaly detection model storage unit 207.

[0071] The monitoring device 200 is realized by a computer device including, for example, a memory and a processor that executes programs stored in the memory. In this case, the various functions realized by the monitoring device 200 are realized by the processor that constitutes the monitoring device 200 executing the programs stored in the memory that constitutes the monitoring device 200.

[0072] The setting input unit 201 accepts setting information such as the setting of the target IP (Internet Protocol) address for monitoring communications, the type of anomaly detection algorithm to be used, the learning period and re-learning frequency, etc., via port 1 (port number 1) via file upload or the like, and stores it in the setting memory unit 202.

[0073] The setting storage unit 202 is a storage device that stores information acquired via the setting input unit 201. The setting storage unit 202 stores setting information such as the setting of the target IP addresses for communication monitoring, the type of anomaly detection algorithm to be used, the learning period, and the re-learning frequency. The setting storage unit 202 is realized by, for example, but is not limited to, a semiconductor memory. The information stored in the setting storage unit 202 will be described below with reference to FIGS. 3 and 4.

[0074] Fig. 3 is a diagram showing setting information related to IP addresses to be monitored for communication, which is stored in the setting storage unit 202 according to the embodiment. Fig. 4 is a diagram showing setting information related to anomaly detection algorithms to be used, which is stored in the setting storage unit 202 according to the embodiment.

[0075] As shown in Fig. 3, the setting information regarding IP addresses to be monitored for communication is a list of IP addresses to be monitored for communication. In the example of Fig. 3, three IP addresses are listed, but the number of IP addresses is not particularly limited as long as it is one or more.

[0076] 4, the setting information of the anomaly detection algorithm is a list in which the anomaly detection algorithm, ON / OFF, learning period, re-learning frequency, and model switching depending on whether or not there is a user input in the last N seconds are associated with each other. Note that ON / OFF, learning period, re-learning frequency, and model switching depending on whether or not there is a user input in the last N seconds are examples of parameters.

[0077] The anomaly detection algorithm indicates the type of algorithm, and includes a control command WL (White List) algorithm, a maximum / minimum value WL algorithm, and a payload sequence anomaly detection algorithm.

[0078] ON / OFF indicates whether or not the algorithm is used to detect communication anomalies. A check mark means ON, and in the example in Figure 4, the control command WL algorithm and maximum / minimum value WL algorithm are ON.

[0079] The learning period indicates a period for learning a model (anomaly detection model) used when performing anomaly detection.

[0080] The retraining period indicates the period for retraining the model. For example, the control command WL algorithm is retrained every 7 days using information accumulated over 14 days.

[0081] Model switching based on whether or not there has been a user input in the last N seconds indicates whether or not to switch the model used for anomaly detection depending on whether or not the user has made an input to the user input device 101 in the last N seconds before the communication was observed. In the example of Fig. 4, the control command WL algorithm switches the model depending on whether or not the user has made an input to the user input device 101 in the last 5 seconds before the communication was observed, and the maximum / minimum value WL algorithm uses the same model (does not switch the model) regardless of whether or not the user has made an input to the user input device 101 in the period immediately before the communication was observed.

[0082] It should be noted that N (seconds) is not limited to 5 (seconds) and may be any number of seconds up to, for example, 300 (seconds). N is set in advance by, for example, a user.

[0083] Returning to FIG. 2, the description of the monitoring device 200 will continue.

[0084] The user input acquisition unit 203 acquires information based on user input to the user input device 101. The user input acquisition unit 203 monitors information related to user input to the central monitoring and control device 100 via port 1 and stores the information in the user input information storage unit 204. Specifically, the user input acquisition unit 203 operates a keylogger on the central monitoring and control device 100, sequentially receives keystroke information, captured screen information, and associated time information obtained from the keylogger, and stores the information in the user input information storage unit 204. The keylogger may be started by directly operating the central monitoring and control device 100, or may be started by accessing the central monitoring and control device 100 from the monitoring device 200 via SSH (Secure SHell) or the like. A keylogger is a general term for software for recording the content of operations on the user input device 101. In this embodiment, the keylogger is software that can transfer information input to the user input device 101 to the monitoring device 200.

[0085] The user input information storage unit 204 stores information based on the user's input to the user input device 101, which is acquired by the user input acquisition unit 203. The user input information storage unit 204 stores, for example, at least one of key input information (see FIG. 5) and screen information (see FIGS. 6A to 6D), which will be described later. The user input information storage unit 204 is realized, for example, by a semiconductor memory, but is not limited to this.

[0086] FIG. 5 is a diagram showing key input information that monitoring device 200 according to the embodiment obtains from a key logger operating in central monitoring and control device 100. As shown in FIG.

[0087] As shown in FIG. 5, by using a key logger, the monitoring device 200 can acquire key input information including key information entered by a user and the time of input at the central monitoring and control device 100. The key input information includes information indicating whether or not a user input was made to the user input device 101 at the time of packet transmission. The key input information is history information (time-series information) indicating the history of key information entered by the user. The key information is a history of operations on the user input device 101, etc. The history information includes the history of user input to the user input device 101 at the time of packet transmission. For example, the example in FIG. 5 indicates that the key input "pws" was made at 9:01:01 on January 10, 2020. Information based on input may include such history information.

[0088] The time of packet transmission refers to a predetermined period of time including the time the packet is transmitted. The time of packet transmission may be based on a first time when the packet is transmitted, and may be a period between the first time and a second time that is a predetermined time before the first time, or may be a predetermined period of time including times before and after the first time. The predetermined period of time is, for example, 300 seconds or less, but is not limited to this. The time of packet transmission may also be a predetermined period of time including the time the packet is observed by the L2SW 140 or the monitoring device 200, for example.

[0089] 6A, 6B, 6C, and 6D are diagrams showing examples of screen information that the monitoring device 200 according to the embodiment obtains from a keylogger operating on the central monitoring and control device 100. The screen information shows the display screen of the central monitoring and control device 100 when a packet is transmitted. The screen information may be, for example, a screenshot of the display screen of the central monitoring and control device 100. The screen information displays information corresponding to a user's input to the user input device 101 (for example, when a user inputs a number, that number).

[0090] 6A and 6B show screen information in which the set value is 1250 in common, but the current value is different. Also, FIGS. 6C and 6D show screen information in which the set value is 1150 in common, but the current value is different. Also, as shown in FIGS. 6A, 6B, 6C, and 6D, the screen information also includes time information. FIGS. 6A, 6B, 6C, and 6D show, for example, time-series data of the screen information.

[0091] As shown in Figures 6A, 6B, 6C and 6D, by using a keylogger, the monitoring device 200 can obtain screen information of the central monitoring and control device 100 and the time information when the screen was displayed.

[0092] User input acquisition unit 203 acquires the user's key input information shown in Fig. 5 or the user's screen information shown in Fig. 6A, 6B, 6C or 6D using software such as a key logger, and stores it in user input information storage unit 204. In this embodiment, user input acquisition unit 203 only needs to acquire at least the user's key input information shown in Fig. 5.

[0093] In this way, software capable of transferring information based on input to the user input device 101 to the monitoring device 200 is installed in the central monitoring and control device 100, which is the device to be monitored, and the user input acquisition unit 203 acquires the information based on the input by the software transferring the information based on the input. Note that the method by which the user input device 101 acquires information based on the input to the user input device 101 is not limited to this.

[0094] For example, a transfer device (not shown) may be provided that is connected between the user input device 101 and the central monitoring and control device 100 and is capable of transferring information based on user input to the user input device 101 to the monitoring device 200, and the user input acquisition unit 203 may acquire information based on the input by the transfer device transferring the information based on the input.

[0095] Communication learning unit 205 learns the communications acquired from mirror port 140a based on the set information, and stores the learned anomaly detection model 207a in anomaly detection model storage unit 207. Communication learning unit 205 learns (generates) anomaly detection model 207a based on a learning period (see FIG. 4) set in advance for each type of anomaly detection algorithm. In this embodiment, communication learning unit 205 generates a list such as that shown in FIGS. 8A and 8B, which will be described later, as anomaly detection model 207a.

[0096] The communication anomaly detection unit 206 detects anomalies in the observed communication. The communication anomaly detection unit 206 detects communication anomalies based on information about packets whose source or destination is the central monitoring and control device 100 and information based on input corresponding to the packets (for example, history information). The communication anomaly detection unit 206 detects a communication anomaly in the monitored object using an anomaly detection model at the designated detection start time, and outputs a detection result 208 as shown in FIG. 7.

[0097] FIG. 7 is a diagram showing the detection result 208 output by the communication error detection unit 206 according to the embodiment.

[0098] As shown in FIG. 7, the detection result 208 is a table in which time, source IP, destination IP, command, most recent user input, and abnormality level are associated with each other.

[0099] The time indicates the time when the packet was observed, that is, the time when communication took place.

[0100] The source IP indicates the IP address of the source of the packet, and the destination IP indicates the IP address of the destination of the packet.

[0101] The command indicates an instruction to be executed by a device having a destination IP. Examples of the command include, but are not limited to, "write" and "read."

[0102] The most recent user input indicates the time at which a user input to the user input device 101 occurred immediately before the packet was observed. The first row of the detection result 208 indicates that a user input to the user input device 101 occurred one second before the packet was observed, and the second row of the detection result 208 indicates that there was no user input to the user input device 101 immediately before the packet was observed (for example, in the last five seconds). Note that in the first row of the detection result 208, the user input to the user input device 101 performed at 9:20:12 on January 10, 2020 is an input corresponding to the packet observed at 9:20:13 on January 10, 2020.

[0103] The abnormality level indicates the degree of abnormality in communication. For example, the upper limit of the abnormality level is 100, and the closer to 100 the level, the higher the degree of abnormality.

[0104] The anomaly detection model storage unit 207 stores one or more anomaly detection models 207a generated by the communication learning unit 205. The anomaly detection model storage unit 207 is realized by, for example, a semiconductor memory, but is not limited to this.

[0105] 8A and 8B are diagrams showing a control command whitelist, which is one type of anomaly detection model 207a. Fig. 8A shows a control command whitelist when there is no recent user input, and Fig. 8B shows a control command whitelist when there is recent user input. The control command whitelist is a model used, for example, when detecting communication anomalies using a control command WL algorithm.

[0106] 8A and 8B, the control command whitelist is a list in which source IPs, destination IPs, and observation commands are associated with each other. In anomaly detection using the control command whitelist, tuples of source IPs, destination IPs, and observation commands observed during a learning period are stored, and anomalous communication is detected when a tuple not included in the whitelist is observed.

[0107] In the control command WL algorithm in the setting information described in Figure 4, "Model switching based on whether or not there has been user input in the last N seconds" is ON, so models with and without recent user input are learned separately, and models for both patterns are shown in Figures 8A and 8B.

[0108] 9 is a diagram showing a maximum / minimum value whitelist, which is one type of anomaly detection model 207a. The control command whitelist is a model used, for example, when detecting communication anomalies using a maximum / minimum value WL algorithm.

[0109] As shown in Fig. 9, the control command whitelist is a list in which device IPs, object IDs, and maximum / minimum values ​​are associated with each other. The device IP is, for example, a destination IP. The object ID is identification information for identifying a specific object from among multiple objects connected to a device (e.g., PLC 120) having the device IP. The maximum / minimum values ​​are standard values ​​for the control value.

[0110] In anomaly detection using a maximum / minimum value whitelist, the device IP observed during the learning period and the maximum and minimum values ​​that have ever been observed as object ID values ​​within that device are stored, and if a value that deviates from the range of values ​​stored as the value of that object ID is observed, it is detected as anomalous communication.In the maximum / minimum value WL algorithm in the setting information shown in Figure 4, "Model switching based on presence or absence of user input in the last N seconds" is turned off, so the model does not change depending on whether or not there was recent user input, and one model is shown in Figure 9.

[0111] The communication learning unit 205 learns the control command whitelist shown in FIG. 8A, FIG. 8B or FIG. 9, and the communication anomaly detection unit 206 detects, as an anomaly, communication that deviates from the learned behavior.

[0112] The anomaly detection model 207a may be a blacklist instead of a whitelist, that is, the anomaly detection model 207a may be a list that can detect, as an anomaly, communications that match learned behavior.

[0113] FIG. 10 is a flowchart showing an overview of the processing of the monitoring device 200 according to the embodiment.

[0114] 10, the processing of the monitoring device 200 begins with a process for manually configuring settings (manual configuration process) (S1100), followed by a learning process (S1200), and finally a detection process (S1300). However, these processes do not necessarily have to be performed in this order. The manual configuration process (S1100) may be performed again during or after the learning process (S1200), or the learning process (S1200) may be performed again after the detection process (S1300).

[0115] FIG. 11 is a flowchart showing the manual setting process (S1100) performed by the monitoring device 200 according to the embodiment.

[0116] As shown in FIG. 11, in the manual setting process, the setting input unit 201 first sets the monitored IP address list shown in FIG. 3 (S1101), and then the user input acquisition unit 203 sets the anomaly detection algorithm and parameters to be used (S1102), as shown in FIG. 4.

[0117] In step S1101, for example, the setting input unit 201 receives input of the IP addresses of one or more monitoring target devices from the user, generates setting information including the received IP addresses, and stores it in the setting storage unit 202.

[0118] In step S1102, for example, the setting input unit 201 receives settings of the anomaly detection algorithm and parameters to be used from the user, generates setting information including the received anomaly detection algorithm and parameters, and stores it in the setting storage unit 202.

[0119] The information set in the manual setting process (S1100) is not necessarily limited to the IP address to be monitored and the anomaly detection algorithm and parameters to be used. In step S1100, other information such as the type of command to be monitored and the threshold for the degree of anomaly to be output as an alert may also be set.

[0120] Fig. 12 is a flowchart showing the learning process of the monitoring device 200 according to the embodiment. Fig. 12 shows the learning process performed by the communication learning unit 205 of the monitoring device 200 according to the embodiment.

[0121] 12, in the learning process, first, communication learning unit 205 reads information about the anomaly detection algorithm to be used from setting storage unit 202 (S1201). In this step, information required for learning is extracted for each anomaly detection algorithm to be used, such as parameters required for learning the algorithm and whether model separation is required depending on whether or not there is user input. Step S1201 is performed by reading the setting information shown in FIG. 4 from setting storage unit 202.

[0122] Next, the actual learning process begins. The monitoring device 200 acquires learning target packets via the mirror port 140a of the L2SW 140 connected to port 2 (port 2) in Figure 2 (step S1202). The learning target packets are packets in communications observed during the learning period.

[0123] In order to perform learning with all anomaly detection algorithms for each learning target packet, the communication learning unit 205 starts learning with the target anomaly detection algorithm (S1203).

[0124] The communication learning unit 205 reads the setting information of the target anomaly detection algorithm from the setting storage unit 202, and determines whether model switching based on the presence or absence of user input in the last N seconds is ON or OFF for the anomaly detection algorithm (S1204).

[0125] If model switching based on the presence or absence of user input in the last N seconds is OFF (NO in S1204), there is no model switching, and so communication learning unit 205 continues learning of the base model (S1207). The base model is an anomaly detection model learned using packets when there was no recent user input as learning target packets (model with no recent user input), but it may also be an anomaly detection model learned using packets acquired during the learning period as learning target packets regardless of whether there was a recent user input.

[0126] If model switching based on the presence or absence of user input in the last N seconds is ON (YES in S1204), the communication learning unit 205 acquires user input from the time the packet was observed up to N seconds ago (S1205).

[0127] The user input is acquired through a key logger installed in the central monitoring and controlling device 100 to be monitored, and the user's key input information shown in Fig. 5 or the screen information shown in Fig. 6A, 6B, 6C or 6D is acquired. Time information is linked to the key input information or the screen information.

[0128] Next, the distance learning unit 205 determines whether or not there has been a user input within the past N seconds based on the key input information or screen information (S1206).

[0129] If it is determined that there is no user input (NO in S1206), the distance learning unit 205 learns the base model (model without recent user input) (S1207), and if it is determined that there is user input (YES in S1206), the distance learning unit 205 learns the model with recent user input (S1208).

[0130] In step S1207, the base model is trained using the attribute information of the packet determined to have no user input. Specifically, the attribute information of the packet observed in step S1202 is added to the control command whitelist as shown in FIG. 8A.

[0131] In step S1208, a recent user input presence model is trained using attribute information of the packet determined to have a user input. Specifically, the attribute information of the packet observed in step S1202 is added to the control command whitelist as shown in FIG. 8B.

[0132] In this way, the communication learning unit 205 generates two anomaly detection models: a control command whitelist (anomaly detection model) generated from packets for which a user input has occurred within the last N seconds, and a control command whitelist (anomaly detection model) generated from packets for which no user input has occurred within the last N seconds. It can also be said that the communication learning unit 205 generates a control command whitelist (an example of a first list) as shown in Fig. 8B generated based on attribute information of packets for which a user input has occurred to the user input device 101 when the packets are transmitted during the learning period, and a control command whitelist (an example of a second list) as shown in Fig. 8A generated based on attribute information of packets for which a user input has not occurred to the user input device 101 when the packets are transmitted during the learning period.

[0133] Next, the communication learning unit 205 determines whether or not there is an unlearned anomaly detection algorithm (an anomaly detection algorithm that has not been learned for the learning target packet) (S1209). If there is an unlearned anomaly detection algorithm (YES in S1209), the communication learning unit 205 performs step S1203 for the target anomaly detection algorithm. If there is no anomaly detection algorithm that has not been learned for the learning target packet (NO in S1209), that is, if learning for the learning target packet has been completed for all anomaly detection algorithms for the learning target packet, the communication learning unit 205 determines whether or not there is a next learning target packet (S1210). If there is a next learning target packet (YES in S1210), the communication learning unit 205 performs step S1202. If there is no next learning target packet (NO in S1210), that is, if learning has been completed for all learning target packets, the communication learning unit 205 saves all anomaly detection models (S1211) and ends the learning process.

[0134] Next, an anomaly detection process using the anomaly detection model generated as described above will be described with reference to Fig. 13. Fig. 13 is a flowchart showing the detection process (S1300) of the monitoring device 200 according to the embodiment. Fig. 13 is a flowchart showing the detection process performed by the communication anomaly detection unit 206 of the monitoring device 200.

[0135] As shown in FIG. 13, in the detection process, the communication anomaly detection unit 206 first reads information on the anomaly detection algorithm to be used from the setting information, and reads out the anomaly detection model 207a (S1301).

[0136] Next, the communication error detection unit 206 starts the actual detection process. The communication error detection unit 206 acquires the detection target packet via the mirror port 140a of the L2SW 140 connected to port 2 (S1302).

[0137] The communication anomaly detection unit 206 determines whether the target anomaly detection model is a model that performs model switching depending on the presence or absence of a user input within the last N seconds, based on the setting information shown in FIG. 4 (S1303).

[0138] If model switching based on the presence or absence of user input in the last N seconds is OFF (NO in S1303), there is no model switching, so the communication anomaly detection unit 206 performs anomaly detection using the base model (S1306). The base model is, for example, a model without recent user input (for example, the control command whitelist shown in FIG. 8A).

[0139] If model switching based on the presence or absence of user input in the last N seconds is ON (YES in S1303), the communication anomaly detection unit 206 acquires user input from the time the detection target packet was acquired up to N seconds ago (S1304).

[0140] The user input can be obtained by obtaining the user's key input information shown in Fig. 5 or the screen information shown in Fig. 6A, 6B, 6C, or 6D through a key logger installed in the central monitoring and control device 100 to be monitored. Time information is linked to the key input information or the screen information.

[0141] The communication anomaly detection unit 206 determines whether or not there has been a user input within N seconds prior (S1305). For example, the communication anomaly detection unit 206 determines whether or not there has been a user input between the time the detection target packet was acquired and the time N seconds prior to that time, using the key input information shown in FIG.

[0142] If it is determined that there is no user input (NO in S1305), the communication anomaly detection unit 206 performs anomaly detection using a model with no recent user input (S1306), and if it is determined that there is user input (YES in S1305), the communication anomaly detection unit 206 performs anomaly detection using a model with recent user input (S1307).

[0143] In step S1306, the communication anomaly detection unit 206 determines the packet to be detected as normal if the attribute information of the packet to be detected matches any of the control command whitelists shown in Fig. 8A, and determines the packet to be abnormal if the attribute information of the packet to be detected does not match any of the control command whitelists shown in Fig. 8A. In addition, in step S1307, the communication anomaly detection unit 206 determines the packet to be normal if the attribute information of the packet to be detected matches any of the control command whitelists shown in Fig. 8B, and determines the packet to be abnormal if the attribute information of the packet to be detected does not match any of the control command whitelists shown in Fig. 8B.

[0144] In this way, the communication anomaly detection unit 206 switches the detection method for detecting a communication anomaly based on the history information. In the example of FIG. 13, the communication anomaly detection unit 206 switches the detection method for detecting a communication anomaly depending on whether or not there has been a user input to the user input device 101. The switching of the detection method is realized, for example, by switching the anomaly detection model used for detection. Note that when there has been a user input to the user input device 101, the communication anomaly detection unit 206 switches the anomaly detection model used for detection regardless of the user input content. In other words, the anomaly detection model is determined regardless of the user input content.

[0145] If an abnormality is detected in step S1306 or step S1307, communication abnormality detection unit 206 outputs detection result 208 (see FIG. 7). Note that if no abnormality is detected in step S1306 or step S1307, communication abnormality detection unit 206 may output a detection result indicating normality.

[0146] Next, the communication anomaly detection unit 206 determines whether or not there is an anomaly detection model for which anomaly detection has not been performed on the detection target packet (S1308). If there is an anomaly detection model for which anomaly detection has not been performed on the detection target packet (YES in S1308), the communication anomaly detection unit 206 performs step S1303 again for the target anomaly detection algorithm. If there is no anomaly detection algorithm for which anomaly detection has not been performed on the detection target packet (NO in S1308), that is, if anomaly detection for the detection target packet has been completed for all anomaly detection algorithms, the communication anomaly detection unit 206 determines whether or not there is a next detection target packet (S1309). If there is a next detection target packet (YES in S1309), the communication anomaly detection unit 206 performs step S1302 again. If there is no next detection packet (NO in S1309), that is, if it is determined that anomaly detection has been completed for all detection target packets, the communication anomaly detection unit 206 ends the detection process.

[0147] (First Modification of the Embodiment) In the above embodiment, an example has been described in which the monitoring device 200 acquires user input from the central monitoring and control device 100 via a network using a key logger or the like, but the method of acquiring user input is not limited to this. In this modified example, a configuration in which the monitoring device 200 acquires user input directly from the user input device 101 will be described with reference to Fig. 14. Fig. 14 is a block diagram showing the configuration of a control system 1a in which the monitoring device 200 according to modified example 1 of the embodiment is used.

[0148] 14, a configuration may be adopted in which a user input device 101 is directly connected to a monitoring device 200, and user input is transmitted to a central monitoring and control device 100 via the monitoring device 200. The monitoring device 200 is directly connected to, for example, the central monitoring and control device 100, the user input device 101, and the L2SW 140. In this case, the monitoring device 200 can directly obtain user keystroke information, mouse operation information, and the like.

[0149] (Modification 2 of the embodiment) In the above embodiment, an example has been described in which anomaly detection is performed by determining only whether or not a user input is present, but anomaly detection may also be performed using the content of the user input. In this modified example, a monitoring method for performing anomaly detection using the content of the user input will be described with reference to Figures 15 to 20. The learning method and detection method according to this modified example differ from the learning process and detection process according to the embodiment.

[0150] In this modification, the communication anomaly detection unit 206 detects a communication anomaly based on information about a packet whose source or destination is the central monitoring and control device 100 and screen information corresponding to the packet. For example, the communication anomaly detection unit 206 detects a communication anomaly based on the coordinates and values ​​of a character string obtained by performing OCR on the screen information and the values ​​obtained by parsing the observed communication. The following describes this with reference to the drawings.

[0151] The screen information corresponding to a packet is information indicating the display screen from which the packet was generated, and is information indicating the display content that was displayed on the display screen when the packet was transmitted.

[0152] Fig. 15 is a flowchart showing the learning process (S1200a) of a monitoring device according to a second modification of the embodiment. Fig. 15 shows a method for generating an anomaly detection model for detecting anomalies using screen information changed by user input. Fig. 16 is a diagram showing an example of data obtained by parsing a control packet (packet).

[0153] In this modification, the processing of the monitoring device 200 is such that a learning process (S1200a) is performed instead of the learning process (S1200) shown in Fig. 10, and a detection process (S1300a shown in Fig. 20, which will be described later) is performed instead of the detection process (S1300). Note that each component of the control system according to this modification may be the same as that of the control system 1 according to the embodiment, and the following description will be given using each component of the control system 1.

[0154] 15, the communication learning unit 205 first observes all communications, then performs communication parse processing, and acquires one line of the communication parse result (S1401). The communication parse processing is processing that performs packet field analysis and identifies what information is being communicated. Acquiring one line of the communication parse result means acquiring the communication parse result for one communication (for example, the result for each line shown in FIG. 16).

[0155] As shown in FIG. 16, the parsing result includes information such as time, source IP, destination IP, command, object ID, and current value.

[0156] The time indicates the time the packet was observed. The source IP and destination IP are information obtained by analyzing the header portion of the packet. The command, object ID, and current value are information obtained by analyzing the data portion of the packet. The current value indicates a numerical value such as a control value or sensor value input by the user to the user input device 101. In step S1401, it is assumed that the result of the bottommost row of the three rows (the result with the time 2020-1-19 9:25:45) is obtained.

[0157] Referring again to FIG. 15, the communication learning unit 205 then acquires a group of input screen information items from a time close to the target parse result (for example, 5 seconds before and after) (S1402). For example, the communication learning unit 205 acquires screen information for 5 seconds before and after 9:25:45 on January 19, 2020, from the central monitoring and control device 100 via software such as a keylogger. The number of screen information items included in the 5 seconds before and after is not particularly limited. For example, in step S1402, multiple pieces of screen information are acquired at predetermined time intervals for the 5 seconds before and after the acquisition, but for example, only one piece of screen information may be acquired.

[0158] Next, the distance learning unit 205 performs OCR (Optical Character Recognition) on all of the acquired screen information to acquire the numerical information and its position information displayed on the screen (S1403). The position information indicates coordinates on the display screen.

[0159] FIG. 17 is a diagram showing text information obtained when OCR is performed using screen information as input.

[0160] As shown in Fig. 17, the OCR results are obtained in a form in which the start coordinates of the rectangle correspond to the text information. Fig. 17 shows an example in which the symbol "x" is displayed in a rectangle whose start coordinates are x=1053, y=128 on the screen, the word "Current Value" is displayed in a rectangle whose start coordinates are x=210, y=418 on the screen, the number "1212" is displayed in a rectangle whose start coordinates are x=659, y=418 on the screen, the word "Set Value" is displayed in a rectangle whose start coordinates are x=210, y=724 on the screen, and the number "1250" is displayed in a rectangle whose start coordinates are x=659, y=724 on the screen.

[0161] Next, the communication learning unit 205 extracts all location information of data whose numerical values ​​match the information in the "Current Value" column written in the communication parsing result from all screen information obtained by OCR, and links these to the rows of the communication parsing result as value-matching OCR coordinates (S1404). The communication learning unit 205 links the numerical values ​​included in the communication parsing result with information indicating the position on the screen where the numerical values ​​are displayed. Note that "numerical match" does not only mean that the numerical values ​​match exactly, but may also mean that the numerical values ​​are within a predetermined range. The value-matching OCR coordinates indicate coordinates that display a value that matches the value obtained by parsing the communication on the display screen when a packet is sent during the learning period, and are an example of target coordinates.

[0162] The coordinates in the OCR result that match the current value 1250 on the third line in Fig. 16 are x = 659, y = 724. Also, the coordinates of the OCR result numeric value 1212 that is within a predetermined range of the current value 1250 on the third line in Fig. 16 are x = 659, y = 418. In other words, the coordinates of the OCR result that are associated with the current value 1250 on the third line in Fig. 16 are x = 210, y = 724 and x = 659, y = 418.

[0163] FIG. 18 is a diagram showing an example of data obtained by parsing a control packet and associating it with text information obtained by performing OCR on screen information.

[0164] As shown in Figure 18, the linking result is the data shown in Figure 16 with the item of value-matching OCR coordinates added. In the communication parse result of the third line, x=659, y=724 and x=659, y=418 are linked as value-matching OCR coordinates. In this way, for example, multiple coordinates may be linked to one line.

[0165] 15 again, the communication learning unit 205 determines whether or not the next communication parse result exists (S1405). If the next communication parse result exists (YES in S1405), the communication learning unit 205 performs the process of step S1401 on the next communication parse result.

[0166] If there is no next communication parse result (NO in S1405), that is, if this linking has been performed on all communication parse results, the communication learning unit 205 extracts all sets of communication parse results that have identical attribute information (source IP, destination IP, command, object ID, etc.) and contain very close coordinate information, such as the same value-matching OCR coordinates or x- and y-coordinates all falling within a predetermined range (for example, within ±3) (S1406). In the example of FIG. 18, the first and third lines have the source IP of "192.168.1.101," the destination IP of "192.168.1.102," the command of "write," the object ID of "analog output 101," and the same value-matching OCR coordinates (x=659, y=724). Therefore, in step S1406, the attribute information that appears on the first and third lines (source IP is "192.168.1.101", destination IP is "192.168.1.102", command is "write", object ID is "analog output 101") and the value-matching OCR coordinates (x=659, y=724) are output.

[0167] Next, the communication learning unit 205 also extracts a set of communication parse results in which all but one attribute of the attribute information (such as source IP, destination IP, command, and object ID) match and the value match OCR coordinates are the same or nearby (S1407). The process of step S1407 may be performed on, for example, data other than that extracted in the extraction result of step S1406, among the data shown in FIG. 18. For example, in the process of step S1407, it is not necessary to extract information that is in an inclusive relationship with the attribute information extracted in step S1406 (for example, the first row shown in FIG. 19, which will be described later).

[0168] Next, the communication learning unit 205 outputs the extraction results of steps S1406 and S1407 as an anomaly detection model (S1408).

[0169] FIG. 19 is a diagram illustrating an example of an anomaly detection model according to the second modification of the embodiment. "***" in FIG. 19 indicates that the attribute information is not particularly limited. For example, the first line in FIG. 19 shows the value-matching OCR coordinates for which all attributes except for the object ID match, and is the communication parse result extracted in step S1407. The second and third lines in FIG. 19 show the value-matching OCR coordinates for which all four attributes match, and are the communication parse result extracted in step S1406.

[0170] 19, the anomaly detection model is information in which attribute information (here, source IP, destination IP, command, and object ID) is linked to value-matching OCR coordinates. In other words, the anomaly detection model does not include numerical values ​​such as current values ​​and set values.

[0171] Note that the attribute information in the first and second rows shown in FIG. 19 is in an inclusive relationship. In this case, the attribute information with more matching information is given priority. In other words, between the first and second rows shown in FIG. 19, the second row is given priority. For example, the information in the first row shown in FIG. 19 does not have to be included in the anomaly detection model.

[0172] In the above, the source IP, destination IP, command, and object ID are listed as examples of attribute information, but other attribute information may also be included. Also, although an example has been given in which extraction is performed when up to three pieces of attribute information match, this is not limiting, and for example, extraction may be performed when at least one piece of attribute information matches.

[0173] As described above, the communication learning unit 205 according to this modification learns an anomaly detection model for identifying target coordinates on the display screen based on a predetermined learning period.

[0174] Next, an anomaly detection method using the anomaly detection model generated as described above will be described with reference to Fig. 20. Fig. 20 is a flowchart showing the detection process (S1300a) of the monitoring device 200 according to the second modification of the embodiment.

[0175] In the detection process shown in FIG. 20, the communication anomaly detection unit 206 first observes all communications, then performs communication parsing processing, and acquires one line of the communication parsing result (S1501).

[0176] Next, the communication anomaly detection unit 206 determines whether the acquired communication parse result matches the combination of attribute information of the anomaly detection model extracted in the learning process (S1502).

[0177] If the acquired communication parse result does not match any of the combinations of attribute information of the anomaly detection model (NO in S1502), the communication anomaly detection unit 206 performs the process of step S1508.

[0178] If the acquired communication parse result matches any of the combinations of attribute information of the anomaly detection model (YES in S1502), the communication anomaly detection unit 206 acquires a group of input screen information from a time close to the target communication parse result (for example, 5 seconds before or after) (S1503).

[0179] The communication error detection unit 206 performs OCR on the acquired group of input screen information, and acquires the numerical information and its position information displayed on the screen (S1504).

[0180] Next, the communication anomaly detection unit 206 compares the anomaly detection model with the value indicated in the communication parse result (S1505). For example, the communication anomaly detection unit 206 compares the value indicated in the communication parse result with the full-image information of the input screen information group obtained by OCR in step S1504 and the value indicated in the coordinate information of the anomaly detection model obtained during learning. The communication anomaly detection unit 206 acquires, from the anomaly detection model, value-matching OCR coordinates associated with the attribute information determined as Yes in step S1502, and extracts values ​​corresponding to the value-matching OCR coordinates in the input screen information group obtained by OCR. Then, the communication anomaly detection unit 206 compares the values ​​extracted from the input screen information group with the values ​​included in the communication parse result.

[0181] If there is no coordinate information of an anomaly detection model with a matching value (NO in S1505), the communication anomaly detection unit 206 determines that an anomaly has occurred and outputs a detection result indicating that an anomaly has occurred (S1507).

[0182] If there is coordinate information of an anomaly detection model with matching values ​​(YES in S1505), the communication anomaly detection unit 206 determines that there is no anomaly and determines whether there is a next communication parse result (S1508). If there is a next communication parse result (YES in S1508), the communication anomaly detection unit 206 performs the process of step S1501 on the next communication parse result, and if there is not a next communication parse result (NO in S1508), the detection process ends.

[0183] In this modified example, in order to link user input with communication anomaly detection, the control value by the user is obtained using OCR of the entire screen and learning is performed to link the numerical information, but instead of performing the learning process, the position where the user's control value is displayed can be linked in advance with the attribute information of the communication parse result in which the control value is reflected in the value column.

[0184] As described above, the communication anomaly detection unit 206 according to this modified example identifies target coordinates on the display screen based on the attribute information of the observed packet, and detects a communication anomaly based on whether or not a value displayed at the identified target coordinates among the coordinates of one or more character strings matches a value obtained by parsing the observed communication.

[0185] (Third Modification of the Embodiment) In the above embodiment, an example has been described in which an anomaly detection model is switched depending on whether or not a user input is present. However, whether or not an anomaly detection is performed may also be switched depending on whether or not a user input is present. Switching whether or not an anomaly detection is performed is an example of switching a detection method. For example, it is possible not to switch models depending on whether or not a user input is present in both the learning process and the detection process, but simply to reflect the presence of a recent user input in the detection result when an anomaly is detected. The simplest example is to not perform anomaly detection when a recent user input is present.

[0186] In the present modification, a monitoring method for switching whether or not to perform anomaly detection depending on whether or not a user input is present will be described below with reference to Fig. 21 and Fig. 22. Fig. 21 is a flowchart showing the learning process (S1200b) of the monitoring device 200 according to the third modification of the embodiment.

[0187] In this modification, the processing of the monitoring device 200 is such that a learning process (S1200b) is performed instead of the learning process (S1200) shown in Fig. 10, and a detection process (S1300b shown in Fig. 22, which will be described later) is performed instead of the detection process (S1300). Note that each component of the control system according to this modification may be the same as that of the control system 1 according to the embodiment, and the following description will be given using each component of the control system 1.

[0188] The processes in steps S1601 to S1605 and steps S1607 to S1610 shown in FIG. 21 are similar to the processes in steps S1201 to S1205, step S1207, and steps S1209 to S1211 shown in FIG. 12, and therefore will not be described again.

[0189] The distance learning unit 205 determines whether or not there has been a user input within the past N seconds based on the key input information or screen information (S1606).

[0190] If it is determined that there is no user input (NO in S1606), the distance learning unit 205 learns the base model (model with no recent user input) (S1607), and if it is determined that there is user input (YES in S1606), the distance learning unit 205 proceeds to step S1608 without learning the anomaly detection model. In other words, in this modified example, a model with recent user input is not generated. In this modified example, for example, of the control command whitelists shown in Figures 8A and 8B, only the control command whitelist shown in Figure 8A is generated.

[0191] Next, the detection process by the communication abnormality detection unit 206 will be described with reference to Fig. 22. Fig. 22 is a flowchart showing the detection process (S1300b) by the monitoring device 200 according to the third modification of the embodiment.

[0192] The processes in steps S1701 to S1704 and steps S1706 to S1708 shown in FIG. 22 are similar to the processes in steps S1301 to S1304, step S1306, step S1308, and step S1309 shown in FIG. 13, and therefore will not be described.

[0193] The communication anomaly detection unit 206 determines whether or not there was a user input within N seconds prior based on the key input information or screen information (S1705). For example, the communication anomaly detection unit 206 determines whether or not there was a user input between the time the detection target packet was acquired and the time N seconds prior to that time, using the key input information shown in FIG.

[0194] If it is determined that there is no user input (NO in S1705), the communication anomaly detection unit 206 performs anomaly detection in a model without recent user input (S1706), and if it is determined that there is user input (YES in S1705), the communication anomaly detection unit 206 proceeds to step S1707 without performing anomaly detection. That is, in this modified example, anomaly detection is performed only if there has been no user input within the last N seconds.

[0195] In this manner, in this modified example, if there is user input to the user input device 101 when a packet to be detected is transmitted, the communication anomaly detection unit 206 does not detect the communication anomaly using the anomaly detection model for detecting communication anomalies, and if there is no user input to the user input device 101 when a packet to be detected is transmitted, the communication anomaly detection unit 206 detects the communication anomaly using the anomaly detection model (base model).

[0196] A model when there is user input to the user input device 101 at the time of packet transmission may have less data (key input information or screen information) for generating the model than a model when there is no user input to the user input device 101 at the time of packet transmission. Generally, the detection performance of an anomaly detection model improves when there is a large amount of data for model generation, so by not detecting a communication anomaly when there is user input, it is possible to prevent communication anomaly detection from being performed using a model with low detection performance.

[0197] 22 may be executed only when, for example, the number of pieces of data used to generate a model when a user inputs to user input device 101 at the time of packet transmission is small. Communication anomaly detection unit 206 may determine whether the number of pieces of data used to generate the model is equal to or greater than a predetermined value, and if the number of pieces of data is equal to or greater than the predetermined value, execute the detection process shown in FIG. 13, or if the number of pieces of data is less than the predetermined value, execute the detection process shown in FIG.

[0198] (Other embodiments) As described above, the embodiments and the like have been described as examples of the technology disclosed in this application. However, the technology according to the present disclosure is not limited to these, and can be applied to embodiments in which appropriate modifications, substitutions, additions, omissions, etc. are made. For example, as long as they do not deviate from the spirit of the present disclosure, various modifications that a person skilled in the art would conceive of to the present embodiments, and embodiments constructed by combining components of different embodiments, may also be included in the present disclosure.

[0199] For example, in the above embodiment and the like, an example has been described in which the monitoring device 200 generates a control command whitelist as shown in Figures 8A and 8B, but the present invention is not limited to this, and the control command whitelist may be acquired from an external device. In other words, the monitoring device 200 may not generate an anomaly detection model, but may instead acquire it from an external device.

[0200] Furthermore, in the above embodiments, the anomaly detection model is described as a list, but is not limited to this and may be, for example, a machine learning model. In this case, communication learning unit 205 may generate a first machine learning model generated by machine learning using attribute information of a packet when a user inputs to user input device 101 at the time of packet transmission during the learning period as input information and normal or abnormal as output information (correct answer information), and a second machine learning model generated by machine learning using attribute information of a packet when a user inputs to user input device 101 at the time of packet transmission during the learning period as input information and normal or abnormal as correct answer information. Furthermore, communication learning unit 205 may generate one machine learning model generated by machine learning using only attribute information of a packet when a user inputs to user input device 101 at the time of packet transmission during the learning period as input information and normal or abnormal as correct answer information.

[0201] Furthermore, in the above-described embodiments, an example has been described in which the monitored device (central monitoring and control device) is a control device for controlling production equipment in a factory, but the use of the monitored device is not limited to this. The monitored device may be a device that performs communication that does not depend on human input, such as constant communication that is performed mechanically, and communication that occurs due to human input. The monitored device may also be a device used in facilities such as hospitals, schools, and homes, for example.

[0202] In the embodiments, each component of the monitoring device 200 may be integrated individually as a single chip using semiconductor devices such as ICs (Integrated Circuits) or LSIs (Large Scale Integration), or may include some or all of the components on a single chip. While LSIs are used here, they may also be referred to as ICs, system LSIs, super LSIs, or ultra LSIs depending on the level of integration. Furthermore, the integration method is not limited to LSIs; dedicated circuits or general-purpose processors may also be used. Field-programmable gate arrays (FPGAs), which can be programmed after LSI fabrication, or reconfigurable processors, which allow the reconfiguration of the connections and settings of circuit cells within LSIs, may also be used. Furthermore, if an integrated circuit technology that can replace LSIs emerges due to advances in semiconductor technology or other derivative technologies, that technology may be used to integrate functional blocks. Biotechnology, for example, is also a possibility. A system LSI is an ultra-multifunctional LSI manufactured by integrating multiple processing units on a single chip, and is specifically a computer system consisting of a microprocessor, ROM (Read Only Memory), RAM (Random Access Memory), etc. Computer programs are stored in the ROM. The system LSI achieves its functions when the microprocessor operates in accordance with the computer program.

[0203] In the above embodiments, each component may be configured with dedicated hardware, or may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU or processor reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory.

[0204] The order in which the steps in the flowchart are executed is merely an example for specifically explaining the present disclosure, and an order other than the above may be used. Also, some of the steps may be executed simultaneously (in parallel) with other steps, or some of the steps may not be executed.

[0205] The division of functional blocks in the block diagram is an example, and multiple functional blocks may be realized as a single functional block, one functional block may be divided into multiple blocks, or some functions may be moved to another functional block.Furthermore, the functions of multiple functional blocks having similar functions may be processed in parallel or in time-sharing by a single piece of hardware or software.

[0206] Furthermore, the monitoring device 200 according to the above-described embodiments and the like may be realized as a single device or may be realized by multiple devices. When the monitoring device 200 is realized by multiple devices, the components of the monitoring device 200 may be distributed in any manner among the multiple devices. When the monitoring device 200 is realized by multiple devices, the communication method between the multiple devices is not particularly limited, and may be wireless communication or wired communication. Furthermore, wireless communication and wired communication may be combined between the devices.

[0207] Another aspect of the present disclosure may be a computer program that causes a computer to execute each of the characteristic steps included in the data generation method shown in any of FIGS. 10 to 13, 15, and 20 to 22.

[0208] Furthermore, for example, the program may be a program to be executed by a computer. Another aspect of the present disclosure may be a computer-readable non-transitory recording medium on which such a program is recorded. For example, such a program may be recorded on a recording medium and distributed or circulated. For example, the distributed program may be installed in a device having another processor, and the program may be executed by the processor, thereby causing the device to perform each of the above processes. [Industrial Applicability]

[0209] The present disclosure is useful for a monitoring device and a monitoring method for determining whether or not detected abnormal communication on a network is caused by a user operation. [Explanation of symbols]

[0210] 1, 1a Control System 100 Central monitoring and control device 101 User Input Device 110 PC 120 PLC 140 L2SW 140a Mirror Port 200 Monitoring equipment 201 Setting input section 202 Setting memory unit 203 User Input Acquisition Unit 204 User input information storage unit 205 Correspondence Learning Department 206 Communication error detection unit 207 Anomaly detection model memory unit 207a Anomaly detection model 208 Detection Results

Claims

1. a user input acquisition unit that acquires information based on an input by a user to an input device; a communication anomaly detection unit that detects anomalies in the observed communication, the information based on the input includes history information indicating a history of inputs made by the user to the input device at the time of transmitting the packet, or screen information indicating a display screen of the monitoring target device at the time of transmitting the packet, the communication anomaly detection unit detects the communication anomaly based on information of a packet whose source or destination includes the monitoring target device and the history information or the screen information corresponding to the packet; monitoring equipment.

2. the information based on the input includes the history information; the communication anomaly detection unit switches a detection method for detecting the communication anomaly in accordance with the history information. The monitoring device of claim 1 .

3. the history information includes information indicating whether or not the user has made an input to the input device at the time of transmitting the packet; the communication anomaly detection unit switches a detection method for detecting the communication anomaly depending on whether or not there has been an input from the user to the input device. The monitoring device according to claim 2 .

4. the communication anomaly detection unit switches a model for detecting the communication anomaly as the switching of the detection method; The monitoring device according to claim 3.

5. the communication anomaly detection unit does not detect the communication anomaly using a model for detecting the communication anomaly if there is an input from the user to the input device when the packet is transmitted, and detects the communication anomaly using the model if there is no input from the user to the input device when the packet is transmitted. The monitoring device according to claim 3.

6. the information based on the input includes the screen information, the communication anomaly detection unit detects the communication anomaly based on information of a packet whose source or destination includes the monitoring target device and the screen information corresponding to the packet; The monitoring device of claim 1 .

7. The communication anomaly detection unit detects the communication anomaly based on coordinates and values ​​of a character string obtained by performing OCR (Optical Character Recognition) on the screen information corresponding to the packet and values ​​obtained by parsing the packet. The monitoring device according to claim 6.

8. the communication anomaly detection unit identifies target coordinates on the display screen based on attribute information of the packet, and detects the communication anomaly based on whether a value displayed at the identified target coordinates among the coordinates of the one or more character strings matches a value obtained by parsing the packet. The monitoring device according to claim 7.

9. The system further includes a communication learning unit that learns the model based on a predetermined learning period.

6. The monitoring device according to claim 4 or 5.

10. the communication learning unit generates, as the model, a first list learned based on attribute information of a packet when there is an input from the user to the input device at the time of transmitting the packet during the learning period, and a second list learned based on attribute information of the packet when there is no input from the user to the input device at the time of transmitting the packet during the learning period; The monitoring device of claim 9.

11. The communication learning unit generates a first machine learning model trained by machine learning using, as input information, attribute information of a packet when there is input to the input device by the user at the time of transmitting the packet during the learning period, and a detection result indicating normality or abnormality as correct answer information, and a second machine learning model trained by machine learning using, as input information, attribute information of a packet when there is no input to the input device by the user at the time of transmitting the packet during the learning period, and a detection result indicating normality or abnormality as correct answer information. The monitoring device of claim 9.

12. The apparatus further includes a communication learning unit that learns a model for identifying target coordinates on the display screen based on a predetermined learning period. The monitoring device according to claim 8.

13. the model is a list in which attribute information of packets is associated with target coordinates on the display screen; 13. The monitoring device of claim 12.

14. The target coordinates are coordinates that display a value that matches a value obtained by parsing a packet on the display screen when the packet is transmitted during the learning period.

14. The monitoring device of claim 13.

15. software installed in the monitoring target device that can transfer information based on the input to the monitoring device; the user input acquisition unit acquires information based on the input by the software transferring the information based on the input; The monitoring device according to any one of claims 1 to 8 and 12 to 14.

16. Further, a transfer device is connected between the input device and the monitored device, and is capable of transferring information based on the input to the monitoring device, the user input acquisition unit acquires information based on the input by the transfer device transferring the information based on the input; The monitoring device according to any one of claims 1 to 8 and 12 to 14.

17. the monitored device is a control device for controlling production equipment arranged in a factory, The monitoring device according to any one of claims 1 to 8 and 12 to 14.

18. Acquire information based on an input by a user to an input device; Detect anomalies in observed communications, the information based on the input includes history information indicating a history of inputs made by the user to the input device at the time of transmitting the packet, or screen information indicating a display screen of the monitoring target device at the time of transmitting the packet, In detecting the communication abnormality, the monitoring target device detects the communication abnormality based on information of a packet included in a source or destination of the packet and the history information or the screen information corresponding to the packet. Monitoring method.

Images