Data processing device, data processing method and data processing program

Abstract

A communication unit (203) acquires, in a learning phase, communication data communicated by the monitored system and including parameter values ​​capable of estimating the operating state of the monitored system. A state input unit (204) acquires, in the learning phase, learning phase operating state values ​​indicating the learning phase operating state, which is the operating state of the monitored system. In the learning phase, a learning unit (210) performs learning using the learning phase parameter values ​​and learning phase operating state values ​​included in the learning phase communication data, and generates a learning model (215) for estimating the attack detection phase operating state, which is the operating state of the monitored system, from the attack detection phase parameter values ​​included in the attack detection phase communication data, which is communication data communicated by the monitored system in the attack detection phase.

Description

Technical Field

[0001] The present disclosure relates to a technique for detecting an attack on a monitored system.

Background Art

[0002] In recent years, cases where information systems are targeted by cyberattacks have been increasing. As a technique for detecting such cyberattacks, there is the technique of Patent Document 1. In the technique of Patent Document 1, attack detection is performed in consideration of the operating state of the monitored system.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In the technique of Patent Document 1, it is necessary for the user to input the current operating state of the monitored system. It is difficult for the user to determine the operating state of the monitored system. Therefore, if the user misrecognizes the operating state of the monitored system, there is a problem that an attack on the monitored system cannot be correctly detected.

[0005] One of the main objects of the present disclosure is to solve the above problems. More specifically, the main object of the present disclosure is to be able to correctly estimate the operating state of the monitored system and correctly detect an attack on the monitored system.

Means for Solving the Problems

[0006] The data processing apparatus according to the present disclosure is A communication data acquisition unit acquires, in the learning phase preceding the attack detection phase, communication data that includes parameter values ​​capable of estimating the operating state of the monitored system, which is communicated in the attack detection phase for the purpose of attack detection, as learning phase communication data, In the learning phase, a learning phase operation state value acquisition unit acquires a learning phase operation state value that indicates the learning phase operation state, which is the operating state of the monitored system at the time of communication of the learning phase communication data. The system includes a model generation unit that performs learning in the learning phase using the learning phase parameter values, which are parameter values ​​included in the learning phase communication data, and the learning phase operation state values, and generates a state estimation model for estimating the attack detection phase operation state, which is the operation state of the monitored system at the time of communication of the attack detection phase communication data, from the attack detection phase parameter values, which are parameter values ​​included in the attack detection phase communication data, which is communication data communicated by the monitored system in the attack detection phase. [Effects of the Invention]

[0007] According to this disclosure, the operating state of the monitored system can be accurately estimated, and as a result, attacks on the monitored system can be accurately detected. [Brief explanation of the drawing]

[0008] [Figure 1] A diagram showing an example of the overall configuration according to Embodiment 1. [Figure 2] A diagram showing an example of the hardware configuration of the intrusion detection device according to Embodiment 1. [Figure 3] A diagram showing an example of the functional configuration of an intrusion detection device according to Embodiment 1. [Figure 4] A diagram illustrating the overview of the operation of the intrusion detection device during the learning phase according to Embodiment 1. [Figure 5] A diagram illustrating the overview of the operation of the intrusion detection device during the attack detection phase according to Embodiment 1. [Figure 6]Flowchart showing an operation example of the communication data analysis unit according to Embodiment 1. [Figure 7] Diagram showing an example of a process value according to Embodiment 1. [Figure 8] Flowchart showing an operation example of the process value table update unit according to Embodiment 1. [Figure 9] Diagram showing an example of the process value table according to Embodiment 1. [Figure 10] Flowchart showing an operation example of the learning unit according to Embodiment 1. [Figure 11] Diagram showing an overview of the learning procedure according to Embodiment 1. [Figure 12] Flowchart showing an operation example of the detection rule generation unit according to Embodiment 1. [Figure 13] Diagram showing an example of the detection rule according to Embodiment 1. [Figure 14] Flowchart showing an operation example of the state estimation unit according to Embodiment 1. [Figure 15] Diagram showing an overview of the state estimation procedure according to Embodiment 1. [Figure 16] Flowchart showing an operation example of the attack detection unit according to Embodiment 1. [Figure 17] Diagram showing a functional configuration example of the intrusion detection device according to Embodiment 2. [Figure 18] Diagram showing an overview of the operation of the intrusion detection device in the learning phase according to Embodiment 2. [Figure 19] Flowchart showing an operation example of the learning determination unit according to Embodiment 2.

Mode for Carrying Out the Invention

[0009] Hereinafter, embodiments will be described with reference to the drawings. In the following description of the embodiments and the drawings, those denoted by the same reference numerals indicate the same or corresponding parts.

[0010] Embodiment 1. ***Description of Configuration*** FIG. 1 shows the overall configuration according to the present embodiment. In this embodiment, as shown in Figure 1, the intrusion detection device 200, the controlled device 300, and the control device 400 are connected via a network 100.

[0011] The controlled device 300 and the control device 400 communicate communication data (e.g., communication packets) to each other. In Figure 1, one controlled device 300 and one control device 400 are shown, but there may be two or more controlled devices 300 and control devices 400. The controlled device 300 and the control device 400 correspond to the monitored system 500 that is monitored by the intrusion detection device 200. If there is no need to distinguish between the controlled device 300 and the control device 400, the controlled device 300 and the control device 400 are collectively referred to as the monitored system 500.

[0012] The intrusion detection device 200 monitors the monitored system 500 to detect attacks. The intrusion detection device 200 also performs machine learning (hereinafter simply referred to as learning) to estimate the operating state of the monitored system 500. The intrusion detection device 200 acquires communication data transmitted between the controlled device 300 and the control device 400 for learning purposes and attack detection. The intrusion detection device 200 is connected, for example, to the mirror port of a switching hub (not shown) on the network 100. The communication data exchanged between the controlled device 300 and the control device 400 includes parameter values ​​that allow for the estimation of the operating state of the monitored system 500. The intrusion detection device 200 corresponds to a data processing device. Furthermore, the operating procedure of the intrusion detection device 200 corresponds to a data processing method. Additionally, the program that implements the operation of the intrusion detection device 200 corresponds to a data processing program.

[0013] Before describing the details of the configuration example of the intrusion detection device 200, we will provide an overview of how the intrusion detection device 200 operates. The intrusion detection device 200 operates in two main phases: a learning phase and an attack detection phase. The learning phase is performed prior to the attack detection phase. Machine learning is performed during the learning phase. In the attack detection phase, the results of the machine learning are used to detect attacks on the monitored system 500. The following is an overview of the operation of the intrusion detection device 200 during the learning phase and the attack detection phase.

[0014] During the learning phase, the intrusion detection device 200 acquires communication data transmitted between the controlled device 300 and the control device 400 for learning purposes. The communication data acquired by the intrusion detection device 200 during the learning phase is called learning phase communication data. Furthermore, the intrusion detection device 200 obtains a value from the user of the intrusion detection device 200 that indicates the operating status of the monitored system 500 during the communication of learning phase communication data. The operating status of the monitored system 500 during the communication of learning phase communication data is called the learning phase operating status. The value that indicates the learning phase operating status is called the learning phase operating status value. The intrusion detection device 200 acquires a value as a learning phase operating state value, which is, for example, a value indicating one of the following: stopped, started up, running, shut down, maintenance, etc., based on user input.

[0015] Furthermore, the intrusion detection device 200 performs machine learning using learning phase parameter values ​​and learning phase operating state values. The learning phase parameter values ​​are the parameter values ​​included in the learning phase communication data. Then, using machine learning, the intrusion detection device 200 generates a learning model, which is a state estimation model. The learning model is a model for estimating the operating state of the monitored system 500 during the transmission of attack detection phase communication data from attack detection phase parameter values. Attack detection phase communication data is the communication data transmitted by the monitored system 500 during the attack detection phase. Attack detection phase parameter values ​​are the parameter values ​​included in the attack detection phase communication data. The operational state of the monitored system 500 during the transmission of attack detection phase communication data is referred to as the attack detection phase operational state.

[0016] Furthermore, during the learning phase, the intrusion detection device 200 generates detection rules for detecting attacks on the monitored system 500 during the attack detection phase.

[0017] During the attack detection phase, the intrusion detection device 200 acquires communication data (attack detection phase communication data) transmitted by the monitored system 500. Furthermore, the intrusion detection device 200 estimates the attack detection phase operating state using attack detection phase parameter values ​​and a learning model. Furthermore, the intrusion detection device 200 uses detection rules and communication data (attack detection phase communication data) to detect attacks on the monitored system 500.

[0018] Next, we will describe an example configuration of the intrusion detection device 200. Figure 2 shows an example of the hardware configuration of the intrusion detection device 200. Figure 3 shows an example of the functional configuration of the intrusion detection device 200. First, with reference to Figure 2, an example of the hardware configuration of the intrusion detection device 200 will be explained.

[0019] The intrusion detection device 200 is a computer. The intrusion detection device 200 includes, as hardware, a processor 901, a main memory 902, an auxiliary memory 903, a communication device 904, and an input / output device 905. Furthermore, the intrusion detection device 200, as shown in Figure 3, includes a processing unit 201, a storage unit 202, a communication unit 203, a status input unit 204, and a result output unit 205. The functions of the processing unit 201, the communication unit 203, the status input unit 204, and the result output unit 205 are implemented, for example, by a program. The auxiliary storage device 903 stores programs that implement the functions of the processing unit 201, the communication unit 203, the status input unit 204, and the result output unit 205. These programs are loaded from the auxiliary storage device 903 into the main memory device 902. The processor 901 then executes these programs, which then control the operation of the processing unit 201, communication unit 203, state input unit 204, and result output unit 205, which will be described later. Figure 2 schematically shows the state in which the processor 901 is executing a program that implements the functions of the processing unit 201, the communication unit 203, the state input unit 204, and the result output unit 205. The storage unit 202 shown in Figure 3 is implemented, for example, by a main memory 902 and / or an auxiliary storage device 903. Input / output devices 905 include a mouse, keyboard, camera, display, speaker, etc.

[0020] In Figure 3, the processing unit 201 consists of a communication data analysis unit 207, a process value table update unit 208, a communication data detection unit 209, a learning unit 210, a detection rule generation unit 211, a state estimation unit 212, and an attack detection unit 213. Details of each of the communication data analysis unit 207, process value table update unit 208, communication data detection unit 209, learning unit 210, detection rule generation unit 211, state estimation unit 212, and attack detection unit 213 will be described later.

[0021] The memory unit 202 stores the process value table 214, the learning model 215, and the detection rules 216.

[0022] The process value table 214 is a table for managing process values. Process values ​​are parameter values ​​included in communication data. Process values ​​are parameter values ​​that allow for the estimation of the operating state of the monitored system 500. The process value table 214 manages process values ​​in both the learning phase and the attack detection phase. In the learning phase, the process values ​​managed in the process value table 214 correspond to the learning phase parameter values. On the other hand, in the attack detection phase, the process values ​​managed in the process value table 214 correspond to the attack detection phase parameter values.

[0023] The learning model 215 is a state estimation model for estimating the operational state of the monitored system 500 during the attack detection phase.

[0024] Detection rule 216 is a rule for detecting attacks on the monitored system 500 during the attack detection phase.

[0025] Figure 4 shows an overview of the operation of the communication unit 203, state input unit 204, communication data analysis unit 207, process value table update unit 208, communication data detection unit 209, learning unit 210, and detection rule generation unit 211 during the learning phase.

[0026] The communication unit 203 uses the communication device 904 to acquire communication data 219 (learning phase communication data) transmitted from the network 100 to the monitored system 500. The communication unit 203 repeatedly acquires the communication data 219. Each time the communication unit 203 acquires the communication data 219, it outputs the acquired communication data 219 to the communication data analysis unit 207, the communication data detection unit 209, and the detection rule generation unit 211. The communication unit 203 corresponds to the communication data acquisition unit related to this disclosure. Furthermore, the processing performed by the communication unit 203 corresponds to the communication data acquisition processing related to this disclosure.

[0027] When the communication unit 203 acquires communication data, the status input unit 204 obtains a learning phase operation status value 221 from the user of the intrusion detection device 200 via the input / output device 905. The state input unit 204 corresponds to the learning phase operation state value acquisition unit according to this disclosure. Furthermore, the processing performed by the state input unit 204 corresponds to the learning phase operation state value acquisition processing according to this disclosure.

[0028] The communication data analysis unit 207 analyzes the communication data 219. Then, the communication data analysis unit 207 extracts the process value 220 from the communication data 219. In other words, the communication data analysis unit 207 extracts process values ​​220 as learning phase parameter values ​​from the communication data 219.

[0029] The process value table update unit 208 updates the process value table 214. In other words, the process value table update unit 208 updates the process value table 214 with the extracted process value 220 each time the communication data analysis unit 207 extracts a process value 220.

[0030] The communication data detection unit 209 detects that communication data 219 (learning phase communication data) has been acquired by the communication unit 203. The communication data detection unit 209 then outputs the process value table 214 to the learning unit 210 and instructs the learning unit 210 to perform learning.

[0031] The learning unit 210 performs learning using the process values ​​220 and learning phase operation status values ​​221 included in the process value table 214. The process values ​​220 included in the process value table 214 are learning phase parameter values. Then, through learning, the learning unit 210 generates a learning model 215. The learning unit 210 uses learning methods such as support vector machines and neural networks. The learning unit 210 corresponds to the model generation unit in this disclosure. Furthermore, the processing performed by the learning unit 210 corresponds to the model generation processing in this disclosure.

[0032] The detection rule generation unit 211 generates a detection rule 216 using the communication data 219 and the learning phase operation status value 221.

[0033] Figure 5 shows an overview of the operation of the communication unit 203, result output unit 205, communication data analysis unit 207, process value table update unit 208, communication data detection unit 209, state estimation unit 212, and attack detection unit 213 during the attack detection phase.

[0034] The communications unit 203 acquires communication data 219 (attack detection phase communication data) transmitted from the network 100 to the monitored system 500.

[0035] The communication data analysis unit 207 analyzes the communication data 219. Then, the communication data analysis unit 207 extracts the process value 220 from the communication data 219. In other words, the communication data analysis unit 207 extracts the process value 220 from the communication data 219 as an attack detection phase parameter value.

[0036] The process value table update unit 208 updates the process value table 214. In other words, the process value table update unit 208 updates the process value table 214 with the extracted process value 220 each time the communication data analysis unit 207 extracts a process value 220.

[0037] The communication data detection unit 209 detects that communication data 219 (attack detection phase communication data) has been acquired by the communication unit 203. The communication data detection unit 209 then outputs the process value table 214 to the state estimation unit 212 and instructs the state estimation unit 212 to perform state estimation.

[0038] The state estimation unit 212 estimates the current operating state (attack detection phase operating state) of the monitored system 500 using the process values ​​220 included in the process value table 214 and the learning model 215. The process values ​​220 included in the process value table 214 are attack detection phase parameter values. The state estimation unit 212 then outputs the estimated operating state to the attack detection unit 213 as the attack detection phase operating state 222.

[0039] The attack detection unit 213 uses the attack detection phase operation state 222, the detection rule 216, and the communication data 219 (attack detection phase communication data) to detect an attack on the monitored system 500.

[0040] The result output unit 205 outputs the detection result 217 to the user of the intrusion detection device 200 via the input / output device 905. Detection result 217 is the result of the attack detection unit 213's determination of whether or not there was an attack on the monitored system 500. If the attack detection unit 213 determines that an attack has occurred on the monitored system 500, the detection result 217 notifies the user of the detection of the attack. If the attack detection unit 213 determines that there is no attack on the monitored system 500, the detection result 217 notifies the user that there is no attack.

[0041] ***Explanation of operation*** Next, the operation of the intrusion detection device 200 according to this embodiment will be described in detail.

[0042] Figure 6 shows an example of the operation of the communication data analysis unit 207 during the learning phase.

[0043] When the communication unit 203 receives the communication data 219, the communication data analysis unit 207 retrieves the communication data 219 from the communication unit 203. Then, the communication data analysis unit 207 analyzes the communication data 219 (step S211). If the analysis reveals that the communication data 219 contains the process value 220 (YES in step S212), the communication data analysis unit 207 extracts the process value 220 from the communication data 219 (step S213). The communication data analysis unit 207 outputs the extracted process values ​​220 to the process value table update unit 208.

[0044] Figure 7 shows an example of process values ​​220 extracted by the communication data analysis unit 207. In Figure 7, the memory address "0X00001", data attribute "Analog", data value "100", day of the week "Day:Mon", hour "Hour:10", and minute "Min:15" are extracted as the process value 220. The memory address is the memory address to which the data value is to be written or read. The data attribute is either Analog or Digital. The data attribute "Analog" indicates that the data value is an analog value. The data attribute "Digital" indicates that the data value is a digital value. The data value is the value written to or read from the memory address. The day of the week, time, and minute indicate the day of the week, time, and minute on which the communication data 219 was transmitted. The communication data analysis unit 207 does not necessarily have to extract the day of the week, time, and minute as process values ​​220. The process value 220 exemplified in Figure 7 corresponds to the learning phase parameter value. However, the process value 220 extracted as the learning phase parameter value by the communication data analysis unit 207 is not limited to that shown in Figure 7. The learning phase parameter value only needs to be a parameter value that can estimate the operating state of the monitored system 500 during the attack detection phase. For this reason, the communication data analysis unit 207 can extract parameter values ​​other than those shown in Figure 7 as the process value 220 (learning phase parameter value).

[0045] Figure 8 shows an example of the operation of the process value table update unit 208 during the learning phase.

[0046] The process value table update unit 208 determines whether the process value 220 that it is about to write to the process value table 214 is a pair of a memory address and a data value (step S221). If the process value 220 to be written to the process value table 214 is a pair of a memory address and a data value (YES in step S221), the process proceeds to step S222. On the other hand, if the process value 220 to be written to the process value table 214 is not a pair of a memory address and a data value (NO in step S221), the process proceeds to step S224. In the example shown in Figure 7, if the process value table update unit 208 is attempting to write the pair "0x00001" and "100" to the process value table 214, the result in step S221 is determined to be "YES". On the other hand, if the process value table update unit 208 is attempting to write any of "Mon", "10", or "15" to the process value table 214, the result in step S221 is determined to be "NO".

[0047] In step S222, the process value table update unit 208 determines the data attribute of the data value to be written. If the data attribute is "Analog", the process proceeds to step S224. On the other hand, if the data attribute is "Digital", the process proceeds to step S223. In the example in Figure 7, the data attribute of the data value "100" is "Analog," so the process proceeds to step S224.

[0048] In step S223, the process value table update unit 208 encodes data values ​​whose data attribute is "Digital" so that the learning unit 210 can easily perform machine learning. For example, the process value table update unit 208 encodes the data values ​​using one-hot encoding.

[0049] In step S224, the process value table update unit 208 writes the process value 220 to the process value table 214. The process value table update unit 208 writes the data values ​​encoded in step S223 to the process value table 214, associating them with memory addresses, for data values ​​whose data attribute is "Digital". The process value table update unit 208 writes the data values ​​obtained from the communication data analysis unit 207 to the process value table 214, associating them with memory addresses, for data values ​​whose data attribute is "Analog". If a data value has already been written to the same memory address in the process value table 214, the process value table update unit 208 will overwrite it with the new data value. For example, suppose the data value "80" is written to the process value table 214 and associated with the memory address "0X00001". In this case, suppose the process value 220 shown in Figure 7 is obtained by the communication unit 203. The process value table update unit 208 will rewrite the data value for the memory address "0X00001" in the process value table 214 from "80" to "100". Furthermore, the process value table update unit 208 also writes the day of the week (Day), hour (Hour), and second (Min) to the process value table 214. Even if the day of the week, hour, and second have already been written to the process value table 214, the process value table update unit 208 will overwrite them with new values.

[0050] Figure 9 shows an example of a process value table 214. In Figure 9, entries starting with "A," such as "A00001," represent the memory address of an analog value. In other words, "A00001" corresponds to "0X00001" in Figure 7. Entries starting with "D," such as "D00001_OFF," represent the memory address of a digital value. Entries starting with "T," such as "Tday," represent the unit of time. In other words, "Tday" corresponds to "Day" in Figure 7. "Thour" corresponds to "Hour" in Figure 7. "Tminute" corresponds to "Min" in Figure 7.

[0051] Figure 10 shows an example of the operation of the learning unit 210.

[0052] First, the learning unit 210 determines whether or not it has been instructed by the communication data detection unit 209 to perform learning (step S231). The learning unit 210 determines that it has been instructed by the communication data detection unit 209 to perform learning if it has obtained the process value table 214 from the communication data detection unit 209. If the communication data detection unit 209 instructs the system to perform learning, the process proceeds to step S232.

[0053] In step S232, the learning unit 210 performs learning to generate a learning model 215. More specifically, the learning unit 210 obtains the learning phase operation state value 221 from the state input unit 204. Then, the learning unit 210 performs learning using the process value 220 included in the process value table 214 obtained from the communication data detection unit 209 and the learning phase operation state value 221.

[0054] Figure 11 shows an overview of the learning procedure performed in the learning unit 210. The learning unit 210 uses each process value 220 from the process value table 214 as input nodes. The learning unit 210 then uses the learning phase operation state values ​​221 obtained from the state input unit 204 as training data to generate a learning model 215 for state estimation. Figure 11 shows an example of learning based on a neural network. The learning unit 210 may also perform learning using other learning methods (such as support vector machines).

[0055] Figure 12 shows an example of the operation of the detection rule generation unit 211.

[0056] First, the detection rule generation unit 211 acquires communication data 219 from the communication unit 203 and analyzes the acquired communication data 219 (step S241). The detection rule generation unit 211 analyzes the communication data 219 and extracts parameter values ​​from the communication data 219 to be used in generating the detection rule 216. More specifically, the detection rule generation unit 211 extracts the process value 220 and specific parameter values ​​other than the process value 220 as parameter values ​​to be used in generating the detection rule 216. For example, the detection rule generation unit 211 extracts the source address of the communication data 219. Also, for example, the detection rule generation unit 211 extracts the destination address of the communication data 219. Also, for example, the detection rule generation unit 211 extracts the control command notified in the communication data 219. These specific parameter values ​​other than the process values ​​220 extracted by the detection rule generation unit 211 correspond to learning phase additional parameter values.

[0057] Next, the detection rule generation unit 211 generates a detection rule 216. More specifically, the detection rule generation unit 211 obtains the learning phase operation state value 221 from the state input unit 204. Then, the detection rule generation unit 211 generates a detection rule 216 using the parameter value extracted in step S241 and the learning phase operation state value 221.

[0058] Figure 13 shows an example of a detection rule 216 generated by the detection rule generation unit 211. In Figure 13, "Rule No." indicates the identification number for each rule. The "operating state" indicates the learning phase operating state. The detection rule generation unit 211 determines the learning phase operating state from the learning phase operating state value 221. The "Source Address" field shows the source address extracted in step S241. The "Recipient Address" field shows the recipient address extracted in step S241. The "control command" indicates the control command extracted in step S241. The "address" indicates the memory address extracted in step S241. The "Data Setting Range" shows the range from the minimum to the maximum value of the data values ​​extracted from the communication data 219 so far.

[0059] For example, assume that the communication data 219 (hereinafter referred to as "latest communication data 219") containing the process value 220 shown in Figure 7 has "192.168.0.10" as the "source address". Also assume that the latest communication data 219 has "192.168.0.20" as the "destination address". Furthermore, assume that the latest communication data 219 has "analog write" as the "control command". In addition, assume that the "data setting range" of "Rule No. 1" in the detection rule 216 (Figure 13) before receiving the latest communication data 219 is set to "0-80". When the latest communication data 219 is received by the communication unit 203, the learning phase operation status value 221, which corresponds to "stopped," is acquired by the status input unit 204 as the operating status of the monitored system 500. In this case, the detection rule generation unit 211 changes the "data setting range" of "Rule No. 1" from "0-80" to "0-100" so that the data value of the latest communication data 219 is included.

[0060] Values ​​other than those shown in Figure 13 may be included in the detection rule 216. For example, the day of the week, hour, and minute shown in Figure 7 may be included in the detection rule 216.

[0061] Next, we will describe an example of the operation of the intrusion detection device 200 during the attack detection phase. The communication data analysis unit 207 also performs the operations shown in Figure 6 during the attack detection phase. Furthermore, the process value table update unit 208 also performs the operation shown in Figure 8 during the attack detection phase. In the attack detection phase, the communication data analysis unit 207 and the process value table update unit 208 handle attack phase communication data, not learning phase communication data.

[0062] Figure 14 shows an example of the operation of the state estimation unit 212.

[0063] First, the state estimation unit 212 determines whether or not it has been instructed by the communication data detection unit 209 to perform state estimation (step S251). The state estimation unit 212 determines that it has been instructed by the communication data detection unit 209 to perform state estimation if it has obtained the process value table 214 from the communication data detection unit 209. If the communication data detection unit 209 instructs the system to perform state estimation, the process proceeds to step S252.

[0064] In step S252, the state estimation unit 212 estimates the current state of the monitored system 500 (attack detection phase operation state 222). More specifically, the state estimation unit 212 acquires the learning model 215 from the memory unit 202. Then, the state estimation unit 212 estimates the current state of the monitored system 500 using the process values ​​220 included in the process value table 214 acquired from the communication data detection unit 209 and the learning model 215.

[0065] Figure 15 shows an overview of the state estimation procedure performed by the state estimation unit 212. The state estimation unit 212 uses each process value 220 from the process value table 214 as an input node. Then, the state estimation unit 212 estimates the attack detection phase operating state 222 using the learning model 215. Figure 15 shows an example of state estimation based on a neural network. The state estimation unit 212 may perform state estimation using other state estimation methods (such as support vector machines).

[0066] Figure 16 shows an example of the operation of the attack detection unit 213.

[0067] First, the attack detection unit 213 acquires communication data 219 (attack phase communication data) from the communication unit 203 and analyzes the acquired communication data 219 (step S261). The attack detection unit 213 analyzes the communication data 219 and extracts parameter values ​​from the communication data 219 to be used for comparison with the detection rule 216. More specifically, the attack detection unit 213 extracts the parameter values ​​described in the detection rule 216. In other words, the attack detection unit 213 extracts the source address of the communication data 219. The attack detection unit 213 also extracts the destination address of the communication data 219. Furthermore, the attack detection unit 213 extracts the control commands notified in the communication data 219. In addition, the attack detection unit 213 extracts the memory address and data value indicated in the communication data 219. The source address, destination address, and control command extracted by the attack detection unit 213 correspond to the additional parameter values ​​for the attack detection phase.

[0068] Next, the attack detection unit 213 compares the pair of parameter values ​​extracted in step 261 and the attack detection phase operating state 222 with the pair of parameter values ​​and operating states of the detection rule 216. In other words, the attack detection unit 213 determines whether there is a rule that has an operating state that matches the attack detection phase operating state 222 and has a parameter value that matches the parameter value extracted in step 261.

[0069] Then, if there is a matching rule (YES in step S263), the attack detection unit 213 outputs "Detection result (normal)" via the result output unit 205 (step S265). On the other hand, if there is no matching rule (NO in step S263, YES in step S264), the attack detection unit 213 outputs "Detection Result (Abnormal)" via the result output unit 205 (step S266). "Detection result (normal)" indicates that no attack has occurred on the monitored system 500. On the other hand, "Detection result (abnormal)" indicates that an attack has occurred on the monitored system 500.

[0070] Users can take countermeasures against attacks based on the output of "Detection Result (Anomaly)".

[0071] ***Explanation of the effects of the embodiment*** According to this embodiment, the user does not need to determine the operating status of the monitored system. Furthermore, according to this embodiment, the user does not need to input the operating status of the monitored system each time the operating status of the monitored system changes. Furthermore, according to this embodiment, the operating state of the monitored system can be accurately estimated, and as a result, attacks on the monitored system can be accurately detected.

[0072] Embodiment 2. This embodiment will primarily describe the differences from Embodiment 1. Matters not described below are the same as in Embodiment 1.

[0073] ***Explanation of the structure*** Figure 17 shows an example of the functional configuration of the intrusion detection device 200 according to this embodiment. In Figure 17, a learning determination unit 223 is present instead of the communication data detection unit 209 shown in Figure 3. Functional elements other than the learning determination unit 223 are the same as those shown in Figure 1. In this embodiment, as shown in Figure 18, the communication unit 203 outputs the acquired communication data 219 to the communication data analysis unit 207, the learning determination unit 223, and the detection rule generation unit 211 each time it acquires communication data 219. Furthermore, each time communication data 219 is acquired by the communication unit 203, the communication data analysis unit 207 extracts process values ​​220 from the acquired communication data 219, similar to Embodiment 1. Then, the communication data analysis unit 207 modifies the process value table 214 using the extracted process values ​​220. In this embodiment, the communication data analysis unit 207 does not overwrite the original process value table 214 with the modified process value table 214. In other words, in this embodiment, the original process value table 214 and the modified process value table 214 temporarily coexist.

[0074] When the communication unit 203 acquires new communication data 219, the learning determination unit 223 determines whether a new learning model 215 different from the previously generated learning model 215 will be generated by the learning unit 210 if the learning unit 210 performs learning using the process value 220 (referred to as the new process value 220) contained in the new communication data 219. The learning determination unit 223 then instructs the learning unit 210 to perform learning using the new process value 220 only if it determines that a new learning model 215 will be generated. In other words, the learning determination unit 223 instructs the learning unit 210 to perform learning using the new process value 220 only if it determines that a new learning model 215 will be generated. When the learning determination unit 223 instructs the learning unit 210 to perform learning, it outputs the modified process value table 214 to the learning unit 210. More specifically, the learning determination unit 223 compares the process value table 214 before the change with the process value table 214 after the change. If there is a difference between the process value table 214 before the change and the process value table 214 after the change, the learning determination unit 223 determines that a new learning model 215 will be generated. On the other hand, if there is no difference between the process value table 214 before the change and the process value table 214 after the change, the learning determination unit 223 determines that a new learning model 215 will not be generated. The functions of the learning determination unit 223 are implemented by a program, similar to the communication unit 203. The program that implements the functions of the learning determination unit 223 is then executed by the processor 911.

[0075] ***Explanation of operation*** Figure 19 shows an example of the operation of the learning determination unit 223.

[0076] First, the learning determination unit 223 compares the process value table 214 before the change with the process value table 214 after the change (step S271).

[0077] Then, if there is a difference between the process value table 214 before the change and the process value table 214 after the change (YES in step S272), the learning determination unit 223 updates the process value table 214 before the change with the process value table 214 after the change. In other words, the process value table 214 before the change is deleted from the storage unit 202, and only the process value table 214 after the change remains in the storage unit 202. Then, the learning determination unit 223 outputs the modified process value table 214 to the learning unit 210 and instructs the learning unit 210 to perform the learning (step S274). In other words, the learning determination unit 223 instructs the learning unit 210 to perform the learning using the new process values ​​220.

[0078] On the other hand, if there is no difference between the process value table 214 before the change and the process value table 214 after the change (NO in step S272), the process value table 214 after the change is deleted from the storage unit 202 (step S275). In other words, the learning determination unit 223 does not instruct the learning unit 210 to perform learning using the new process values ​​220.

[0079] ***Explanation of the effects of the embodiment*** According to this embodiment, unnecessary learning can be eliminated by not performing learning when no new learning results are obtained.

[0080] Although Embodiments 1 and 2 have been described above, these two embodiments may be implemented in combination. Alternatively, one of these two embodiments may be partially implemented. Alternatively, these two embodiments may be partially combined and implemented. Furthermore, the configurations and procedures described in these two embodiments may be modified as needed.

[0081] ***Supplementary explanation of hardware configuration*** Finally, we will provide supplementary information on the hardware configuration of the intrusion detection device 200. The processor 901 shown in Figure 2 is an integrated circuit (IC) that performs processing. Processor 901 includes components such as a CPU (Central Processing Unit) and a DSP (Digital Signal Processor). The main memory 902 shown in Figure 2 is RAM (Random Access Memory). The auxiliary storage device 903 shown in Figure 2 includes ROM (Read Only Memory), flash memory, HDD (Hard Disk Drive), etc. The communication device 904 shown in Figure 2 is an electronic circuit that performs data communication processing. The communication device 904 is, for example, a communication chip or a NIC (Network Interface Card).

[0082] Furthermore, the auxiliary storage device 903 also stores the OS (Operating System). Then, at least a portion of the OS is executed by processor 901. The processor 901 executes a program that implements the functions of the processing unit 201, storage unit 202, communication unit 203, state input unit 204, and result output unit 205, while executing at least a part of the OS. Processor 901 executes the OS, handling task management, memory management, file management, communication control, and other functions. Furthermore, at least one of the information, data, signal values, and variable values ​​indicating the processing results of the processing unit 201, storage unit 202, communication unit 203, state input unit 204, and result output unit 205 is stored in at least one of the main memory 902, auxiliary storage unit 903, registers in the processor 901, and cache memory. Furthermore, the programs that implement the functions of the processing unit 201, storage unit 202, communication unit 203, status input unit 204, and result output unit 205 may be stored on portable recording media such as magnetic disks, flexible disks, optical disks, compact disks, Blu-ray® discs, and DVDs. A portable recording media containing the programs that implement the functions of the processing unit 201, storage unit 202, communication unit 203, status input unit 204, and result output unit 205 may also be distributed.

[0083] Furthermore, at least one of the "parts" in the processing unit 201, storage unit 202, communication unit 203, state input unit 204, and result output unit 205 may be read as "circuit," "process," "procedure," "processing," or "circuitry." Furthermore, the intrusion detection device 200 may be implemented by a processing circuit. Examples of processing circuits include logic ICs (Integrated Circuits), GAs (Gate Arrays), ASICs (Application Specific Integrated Circuits), and FPGAs (Field-Programmable Gate Arrays). The processing unit 201, storage unit 202, communication unit 203, state input unit 204, and result output unit 205 are each implemented as part of the processing circuit. In this specification, the higher-level concept encompassing both the processor and the processing circuit is referred to as "processing circuitry." In other words, a processor and a processing circuit are specific examples of "processing circuits," respectively. [Explanation of Symbols]

[0084] 100 Network, 200 Intrusion detection device, 201 Processing unit, 202 Memory unit, 203 Communication unit, 204 State input unit, 205 Result output unit, 207 Communication data analysis unit, 208 Process value table update unit, 209 Communication data detection unit, 210 Learning unit, 211 Detection rule generation unit, 212 State estimation unit, 213 Attack detection unit, 214 Process value table, 215 Learning model, 216 Detection rule, 217 Detection result, 219 Communication data, 220 Process value, 221 Learning phase operation state value, 222 Attack detection phase operation state, 223 Learning judgment unit, 300 Controlled device, 400 Control device, 500 Monitored system, 901 Processor, 902 Main memory, 903 Auxiliary memory, 904 Communication device, 905 Input / output device.

Claims

1. a communication data acquisition unit that acquires, as learning phase communication data, communication data that is communicated in a monitored system that is monitored for attack detection in an attack detection phase and that includes parameter values ​​that can estimate an operating state of the monitored system in a learning phase prior to the attack detection phase; a learning phase operation state value acquisition unit that acquires, in the learning phase, a learning phase operation state value indicating a learning phase operation state, which is an operation state of the monitored system at the time of communication of the learning phase communication data; a model generation unit that performs learning in the learning phase using learning phase parameter values, which are parameter values ​​included in the learning phase communication data, and the learning phase operation state values, and generates a state estimation model for estimating an attack detection phase operation state, which is the operation state of the monitored system at the time of communication of the attack detection phase communication data, from the attack detection phase parameter values, which are parameter values ​​included in the attack detection phase communication data, which is communication data communicated by the monitored system in the attack detection phase; A data processing device having a detection rule generation unit that generates a detection rule in the learning phase for detecting attacks on the monitored system in the attack detection phase by comparing the learning phase parameter value with the attack detection phase parameter value and comparing the learning phase operation state indicated by the learning phase operation state value with the attack detection phase operation state.

2. the learning phase communication data includes parameter values ​​other than the learning phase parameter values ​​as learning phase additional parameter values; the attack detection phase communication data includes a parameter value corresponding to the learning phase additional parameter value as an attack detection phase additional parameter value; The detection rule generation unit The data processing device according to claim 1 , further comprising: a learning phase additional parameter value; and generating a detection rule for detecting an attack on the monitored system in the attack detection phase by comparing the learning phase additional parameter value with the attack detection phase additional parameter value.

3. The communication data acquisition unit In the attack detection phase, the attack detection phase communication data is acquired; The data processing device further comprises: a state estimation unit that estimates an operation state of the attack detection phase by using the attack detection phase parameter value and the state estimation model in the attack detection phase; 2. The data processing device as described in claim 1, further comprising an attack detection unit that detects an attack on the monitored system by comparing, in the attack detection phase, the learning phase parameter value included in the detection rule with the attack detection phase parameter value, and comparing the learning phase operation state indicated in the learning phase operation state value included in the detection rule with the attack detection phase operation state estimated by the state estimation unit.

4. the learning phase communication data includes parameter values ​​other than the learning phase parameter values ​​as learning phase additional parameter values; the attack detection phase communication data includes a parameter value corresponding to the learning phase additional parameter value as an attack detection phase additional parameter value; The detection rules include additional learning phase parameter values; The attack detection unit is 4. The data processing device according to claim 3, wherein in the attack detection phase, an attack on the monitored system is detected by comparing the learning phase additional parameter value included in the detection rule with the attack detection phase additional parameter value.

5. A computer acquires, as learning phase communication data, communication data that is communicated in a monitored system that is monitored for attack detection in an attack detection phase and that includes parameter values ​​that can estimate an operating state of the monitored system in a learning phase prior to the attack detection phase; the computer acquires, in the learning phase, a learning phase operation state value indicating a learning phase operation state, which is an operation state of the monitored system at the time of communication of the learning phase communication data; the computer performs learning in the learning phase using learning phase parameter values, which are parameter values ​​included in the learning phase communication data, and the learning phase operation state values, and generates a state estimation model for estimating an attack detection phase operation state, which is the operation state of the monitored system at the time of communication of the attack detection phase communication data, from the attack detection phase parameter values, which are parameter values ​​included in the attack detection phase communication data, which is communication data communicated by the monitored system in the attack detection phase; A data processing method in which the computer generates detection rules in the learning phase for detecting attacks on the monitored system in the attack detection phase by comparing the learning phase parameter values ​​with the attack detection phase parameter values, and comparing the learning phase operation states indicated by the learning phase operation state values ​​with the attack detection phase operation states, the data processing method comprising:

6. a communication data acquisition process for acquiring, as learning phase communication data, communication data that is communicated in a monitored system that is monitored for attack detection in an attack detection phase and that includes parameter values ​​that can estimate an operating state of the monitored system in a learning phase prior to the attack detection phase; a learning phase operation state value acquisition process for acquiring, in the learning phase, a learning phase operation state value indicating a learning phase operation state, which is an operation state of the monitored system at the time of communication of the learning phase communication data; a model generation process for performing learning in the learning phase using learning phase parameter values, which are parameter values ​​included in the learning phase communication data, and the learning phase operation state values, and generating a state estimation model for estimating an attack detection phase operation state, which is the operation state of the monitored system at the time of communication of the attack detection phase communication data, from the attack detection phase parameter values, which are parameter values ​​included in the attack detection phase communication data, which is communication data communicated by the monitored system in the attack detection phase; A data processing program that causes a computer to execute a detection rule generation process that includes the learning phase parameter value and the learning phase operation status value, and generates a detection rule in the learning phase for detecting attacks on the monitored system in the attack detection phase by comparing the learning phase parameter value with the attack detection phase parameter value and comparing the learning phase operation status indicated by the learning phase operation status value with the attack detection phase operation status.