Diagnostic device and diagnostic method

Abstract

This diagnostic device is provided with a calculation device that: calculates an instantaneous attack probability, which is the probability that a cyber attack was performed on equipment to be diagnosed at a prescribed time; calculates an instantaneous failure probability, which is the probability that a failure occurred in the equipment to be diagnosed at the prescribed time; and determines whether or not there was a cyber attack on the equipment to be diagnosed and whether or not there was a failure in the equipment to be diagnosed at the prescribed time on the basis of the instantaneous attack probability and the instantaneous failure probability.

Description

Diagnostic device and diagnostic method

[0001] The present invention relates to a diagnostic device and a diagnostic method.

[0002] Control systems that require stable operation need to deal with both equipment failures and cyber attacks. Binary diagnosis, which diagnoses the status of equipment as a binary value between normal and abnormal, has problems such as being unable to distinguish between an abnormality as a cyber attack and an equipment failure, and being unable to distinguish between cyber attacks that appear normal. Patent Document 1 describes a diagnostic method for diagnosing the status of equipment using a method other than binary diagnosis.

[0003] JP 2019-194830 A

[0004] The technology described in Patent Document 1 had the problem that accurate diagnosis was not possible because there was a mutual dependency between the probability of being under cyber-attack and the probability of equipment failure.

[0005] The present invention aims to provide a diagnostic device and a diagnostic method that can appropriately determine whether or not a cyber attack has occurred and whether or not a device has malfunctioned.

[0006] A diagnostic device according to one aspect of the present invention includes a calculation device that calculates an instantaneous attack probability, which is the probability that a cyber-attack has been carried out on a device to be diagnosed at a specified time, calculates an instantaneous failure probability, which is the probability that a failure has occurred in the device to be diagnosed at the specified time, and determines whether or not a cyber-attack has been carried out on the device to be diagnosed and whether or not a failure has occurred in the device to be diagnosed at the specified time based on the instantaneous attack probability and the instantaneous failure probability.

[0007] According to the present invention, it is possible to appropriately determine whether or not a cyber attack has occurred and whether or not a device has malfunctioned.

[0008] FIG. 1 is a block diagram schematically illustrating the hardware configuration of a diagnostic device according to a first embodiment. FIG. 2 is a block diagram illustrating the functional configuration of the diagnostic device according to the first embodiment. FIG. 3 is a flowchart of an instantaneous failure probability calculation process executed by an instantaneous failure probability calculation unit. FIG. 4 is a flowchart of an instantaneous attack probability calculation process executed by an instantaneous attack probability calculation unit. FIG. 5 is a flowchart of a probability adjustment process executed by a probability adjustment unit. FIG. 6 is a graph illustrating an adjusted instantaneous failure probability and an adjusted instantaneous attack probability. FIG. 7 is a flowchart of a determination process executed by a determination unit. FIG. 8 is a schematic diagram illustrating a display screen of a display device. FIG. 9 is a block diagram illustrating the functional configuration of a diagnostic device according to a second embodiment. FIG. 10 is a flowchart of an instantaneous attack probability calculation process executed by an instantaneous attack probability calculation unit. FIG. 11 is a graph illustrating an adjusted instantaneous failure probability and an adjusted instantaneous attack probability. FIG. 12 is a block diagram illustrating the functional configuration of a diagnostic device according to a third embodiment. FIG. 13 is a graph illustrating an adjusted instantaneous failure probability and an adjusted instantaneous attack probability.

[0009] A diagnostic device according to an embodiment of the present invention will be described with reference to FIGS.

[0010] 1 is a block diagram showing a schematic hardware configuration of a diagnostic device 1 according to a first embodiment. The diagnostic device 1 is a device that diagnoses the health of a device to be diagnosed (e.g., a control device included in a control system) (not shown) and notifies a user of the diagnostic results. The user can use the diagnostic device 1 to diagnose the device to be diagnosed at any time (e.g., a specific time each day), and can take any necessary measures for the device to be diagnosed by referring to the diagnostic results.

[0011] The diagnostic device 1 is composed of a computer equipped with an arithmetic unit 11 such as a central processing unit (CPU), a microprocessing unit (MPU), or a digital signal processor (DSP), a non-volatile memory 12 such as a read-only memory (ROM), a flash memory, or a hard disk drive, a volatile memory 13 called a random access memory (RAM), an input / output interface 14, and other peripheral circuits. These hardware components work together to run software and realize multiple functions. The diagnostic device 1 may be composed of a single computer or multiple computers. The arithmetic unit 11 may be an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), or the like.

[0012] The nonvolatile memory 12 stores programs capable of executing various calculations. In other words, the nonvolatile memory 12 is a storage medium (storage device) from which the programs realizing the functions of this embodiment can be read. The volatile memory 13 is a storage medium (storage device) that temporarily stores the results of calculations performed by the calculation device 11 and signals input from the input interface 14. The calculation device 11 is a device that loads the programs stored in the nonvolatile memory 12 into volatile memory and executes calculations, and performs predetermined calculations on data taken in from the input / output interface 14, the nonvolatile memory 12, and the volatile memory 13 in accordance with the programs.

[0013] The diagnostic device 1 is connected to a parameter database 2, a vulnerability database 3, and a display device 4 via an input / output interface 14. The parameter database 2 and the vulnerability database 3 are storage devices in which predetermined data is stored. The data stored in the parameter database 2 and the vulnerability database 3 will be described in detail later. The display device 4 is a device having a display screen such as an LCD monitor.

[0014] The input section of the input / output interface 14 converts the signals input from the parameter database 2 and the vulnerability database 3 into data that can be calculated by the calculation device 11. The output section of the input / output interface 14 generates an output signal according to the calculation result in the calculation device 11, and outputs the signal to the display device 4.

[0015] FIG. 2 is a block diagram showing the functional configuration of the diagnostic device 1 according to the first embodiment. The diagnostic device 1 includes a time input unit 41, an instantaneous failure probability calculation unit 42, an instantaneous attack probability calculation unit 43, a probability adjustment unit 44, a discrimination unit 45, and an output unit 46. The time input unit 41 inputs the diagnosis time to the instantaneous failure probability calculation unit 42 and the instantaneous attack probability calculation unit 43. The instantaneous failure probability calculation unit 42 calculates the instantaneous failure probability of the device to be diagnosed at the diagnosis time. The instantaneous attack probability calculation unit 43 calculates the instantaneous attack probability of the device to be diagnosed at the diagnosis time. The probability adjustment unit 44 adjusts the instantaneous failure probability and the instantaneous attack probability to have the same dimension. The discrimination unit 45 uses the instantaneous failure probability and the instantaneous attack probability adjusted by the probability adjustment unit 44 to determine whether there is a possibility of a cyber-attack on the device to be diagnosed and whether there is a possibility of a failure of the device to be diagnosed. The output unit 46 outputs the result of the discrimination by the discrimination unit 45 to the display device 4 and notifies the user of the results.

[0016] The parameter database 2 stores shape parameters 21, scale parameters 22, and position parameters 23. The vulnerability database 3 stores publication date data 31 and device data 32. These data will be explained together with the processes that use the data.

[0017] The diagnosis of the equipment to be diagnosed by the diagnostic device 1 is realized by an instantaneous failure probability calculation process, an instantaneous attack probability calculation process, a probability adjustment process, and a discrimination process. These processes will be described in order below.

[0018] 3 is a flowchart of the instantaneous failure probability calculation process executed by the instantaneous failure probability calculation unit 42. In step S100, the time input unit 41 inputs the diagnosis time to the instantaneous failure probability calculation unit 42. In step S110, the instantaneous failure probability calculation unit 42 acquires the shape parameter 21, the scale parameter 22, and the position parameter 23 from the parameter database 2. Each of these parameters is set to a predetermined value depending on the number of past failures of the device to be diagnosed and the time leading up to failure. In step S120, the instantaneous failure probability calculation unit 42 substitutes the shape parameter 21, the scale parameter 22, and the position parameter 23 into the failure density function f(t).

[0019] The failure density function f(t) is a function that represents the probability of failure of the equipment under diagnosis over time. In other words, the failure density function f(t) is a function that represents a time-varying probability distribution. The failure density function f(t) is expressed as the product of the hazard function h(t) and the reliability function R(t). Here, the variable t represents the operating time of the equipment under diagnosis, and t = 0 corresponds to the time when the equipment under diagnosis began operating. The hazard function h(t) is a function that represents the probability that a failure will occur in the equipment under diagnosis at time t, regardless of whether the equipment under diagnosis has actually failed up to time t. In other words, the hazard function h(t) is the conditional probability density that the equipment under diagnosis will fail at time t, under the condition that the equipment under diagnosis has not failed up to time t. If the shape parameter 21 is represented by m, the scale parameter 22 is represented by n, and the location parameter 23 is represented by Γ, the hazard function h(t) is expressed by the following equation (1). h(t) = m / n · {(t - Γ) / n}^(m-1) ... (1) The reliability function R(t) is a function that represents the probability that a failure will not occur in the equipment to be diagnosed until time t, and is expressed by the following equation (2): R(t) = Exp{-(t - Γ / n)^m} ... (2) The failure density function f(t) is a function that represents the probability that a failure will first occur in the equipment to be diagnosed at time t, and is expressed by the following equation (3): f(t) = h(t) · R(t) ... (3) The failure density function f(t) is generally a function that is convex downwards as time passes, like a Weibull distribution, for example.

[0020] The shape parameter 21, represented by the letter m, is a parameter that determines the increase or decrease of the failure density function f(t) over time, i.e., the shape of the probability distribution represented by the failure density function f(t). For example, when m<1, the failure density function f(t) decreases over time. When m>1, the failure density function f(t) increases over time. When m=0, the failure probability remains constant regardless of the passage of time. The scale parameter 22, represented by the letter n, is a parameter that determines the magnitude of the failure density function f(t), i.e., the scale of the probability distribution represented by the failure density function f(t). For example, the maximum value of the failure density function f(t) when n=1 is twice the maximum value of the failure density function f(t) when n=2. The position parameter 23, represented by the letter Γ, is a parameter that determines the phase of the failure density function f(t), i.e., the position of the probability distribution represented by the failure density function f(t). For example, the initial position on the horizontal axis of the failure density function f(t) when Γ=2 is translated by 2 compared to the initial position of the failure density function f(t) when Γ=0.

[0021] 3, the instantaneous failure probability calculation unit 42 substitutes the shape parameter 21, scale parameter 22, and location parameter 23 into the failure density function f(t) of the above equation (3). In the following step S130, the instantaneous failure probability calculation unit 42 calculates the instantaneous failure probability using the failure density function f(t) after substituting each parameter and the diagnosis time. A cumulative failure distribution function F(t) defined as in the following equation (4) is introduced: F(t) = ∫ f(t) dt (4) If the diagnosis time is t1, the instantaneous failure probability calculation unit 42 calculates the instantaneous failure probability by time-integrating the cumulative failure distribution function F(t) from t = 0 to t = t1.

[0022] 4 is a flowchart of the instantaneous attack probability calculation process executed by the instantaneous attack probability calculation unit 43. In step S200, the time input unit 41 inputs the diagnosis time to the instantaneous attack probability calculation unit 43. In step S210, the instantaneous attack probability calculation unit 43 acquires the publication date data 31 and the device data 32 from the vulnerability database 3.

[0023] The vulnerability database 3 stores vulnerability information for the software and hardware that constitute the equipment to be diagnosed. The publication date data 31 indicates the date on which vulnerability information for the software and hardware related to the equipment to be diagnosed was published. The equipment data 32 indicates network connection information for the equipment to be diagnosed and information on programs stored and used within the equipment to be diagnosed. These data are set by collecting vulnerability information published by security-related organizations in various countries in advance via the Internet, for example. For example, the publication date data 31 is generated from vulnerability information published based on the Common Vulnerability Scoring System (CVSS) known as the Common Vulnerability Scoring System, and stored in the vulnerability database 3. Furthermore, by comparing such vulnerability information with the equipment data 32, vulnerabilities that affect the equipment to be diagnosed can be identified.

[0024] In step S220, the instantaneous attack probability calculation unit 43 calculates a security evaluation value for the device to be diagnosed. The security evaluation value is a numerical value that indicates the level of risk of the device to be diagnosed to a cyber-attack, and is set to a larger value, for example, the higher the resistance of the device to cyber-attacks, or the greater the damage that the device to be diagnosed would suffer if it were to be hit by a cyber-attack.

[0025] The instantaneous attack probability calculation unit 43 of the first embodiment calculates the security evaluation value Risk by the following formula (5): Risk = Impact · Likelihood (5) Here, Impact represents the degree of impact (magnitude of impact) on the device to be diagnosed, and Likelihood represents the ease of attack on the device to be diagnosed.

[0026] For example, the aforementioned CVSS defines the security assessment value on the date of vulnerability disclosure as follows, based on the basic characteristics of the vulnerability itself: The basic characteristics of the vulnerability itself include, as a measure of the ease of attack, attack source category X, which is an index of from where the vulnerable component can be attacked, Y, which is an index of the complexity of the conditions required to attack the vulnerable component, privilege level Z, required to attack the vulnerable component, and user involvement level W, required to attack the vulnerable component. Additionally, as a measure of the degree of impact on the device to be diagnosed, there are impact level C on confidentiality, impact I on integrity, and impact A on availability.

[0027] Here, Impact can be expressed as the following equation (6) using availability A, integrity I, and confidentiality C: Impact = 1 - (1 - A) x (1 - I) x (1 - C) (6) Furthermore, Likelihood can be expressed as the following equation (7) using attack source category X, attack condition complexity Y, required privilege level Z, and required user involvement level W: Likelihood = 8.22 x X x Y x Z x W (7) By substituting equations (6) and (7) into equation (5), the following equation (8) is obtained for calculating the security evaluation value Risk: Risk = (1 - (1 - A) x (1 - I) x (1 - C)) x 8.22 x X x Y x Z x W (8) In step S220 of FIG. 4 , the instantaneous attack probability calculation unit 43 calculates the security evaluation value Risk using equation (8).

[0028] In step S230, the instantaneous attack probability calculation unit 43 determines an attack density function a(t). The attack density function a(t) is a function that represents the probability of being first attacked at time t. In other words, the attack density function a(t) is a function that represents a time-varying probability distribution. The attack density function a(t) is set separately (independently) from the failure density function f(t), so there is usually no correlation between the two. In other words, the attack density function a(t) and the failure density function f(t) are functions that represent different probability distributions. The instantaneous attack probability calculation unit 43 assumes a probability distribution having the security evaluation value described above as a parameter and determines an attack density function a(t) that represents that probability distribution. For example, the attack density function a(t) is a function that is convex upward with respect to time or a function that monotonically decreases with respect to time, such as a Gaussian distribution.

[0029] The instantaneous attack probability calculation unit 43 of the first embodiment uses an attack density function a(t) expressed by the following equation (9): a(t)=1 / √(2πσexp{-(t-μ)^2 / 2σ^2}) (9) where μ represents the mean, σ represents the standard deviation, and 2σ^2 represents the variance.

[0030] In step S240, the instantaneous attack probability calculation unit 43 calculates the instantaneous attack probability using the diagnosis time input in step S200 and the attack density function a(t) determined in step S230. A cumulative attack distribution function A(t) defined as in the following equation (10) is introduced: A(t) = ∫ a(t) dt (10) If the diagnosis time is t1, the instantaneous attack probability calculation unit 43 calculates the instantaneous attack probability by time-integrating the cumulative attack distribution function A(t) from t = 0 to t = t1.

[0031] 5 is a flowchart of the probability adjustment process executed by the probability adjustment unit 44. In the probability adjustment process, the probability adjustment unit 44 makes the probability distributions of failures and cyber-attacks at the time of diagnosis into the same dimension so that they can be compared. In the first embodiment, a method using a probability distance measure is adopted as a method for making different probability distributions into the same dimension.

[0032] In step S300, the probability adjustment unit 44 acquires the cumulative failure distribution function F(t) derived in the instantaneous failure probability calculation process by the instantaneous failure probability calculation unit 42 and the cumulative attack distribution function A(t) derived in the instantaneous attack probability calculation process by the instantaneous attack probability calculation unit 43. In step S310, the probability adjustment unit 44 calculates a probability distance measure between the cumulative failure distribution function F(t) and the cumulative attack distribution function A(t).

[0033] The probabilistic distance measure means the distance between different probability distributions (for example, a Weibull distribution and a Gaussian distribution), such as the Kullback-Leibler divergence. The probabilistic distance measure DKL is calculated by the following equation (11): DKL(F(t)||A(t))=∫F(t)log{A(t) / F(t)}dt (11) In this way, in the first embodiment, the Kullback-Leibler divergence is adopted as the probabilistic distance measure.

[0034] In step S320, the probability adjustment unit 44 calculates the adjusted instantaneous failure probability and adjusted instantaneous attack probability at the diagnosis time. The probability adjustment unit 44 multiplies the instantaneous failure probability at the diagnosis time (the value calculated in step S130 of FIG. 3) by the probability distance measure calculated in step S310 to obtain the adjusted instantaneous failure probability. Similarly, the probability adjustment unit 44 multiplies the instantaneous attack probability at the diagnosis time (the value calculated in step S240 of FIG. 4) by the probability distance measure calculated in step S310 to obtain the adjusted instantaneous attack probability.

[0035] For example, if the adjusted instantaneous failure probability is F'(t) and the adjusted instantaneous attack probability is A'(t), the adjusted instantaneous failure probability and the adjusted instantaneous attack probability can be calculated by the following equations (12) and (13): F'(t) = DKL(F(t)∥A(t)) F(t) (12) A'(t) = DKL(F(t)∥A(t)) A(t) (13) Once the adjusted instantaneous failure probability F'(t) and the adjusted instantaneous attack probability A'(t) have been calculated in step S320, the process proceeds to step S330.

[0036] In step S330, the probability adjustment unit 44 outputs the adjusted instantaneous failure probability F′(t) and the adjusted instantaneous attack probability A′(t) at the diagnosis time t1 calculated in step S320 to the determination unit 45.

[0037] FIG. 6 is a graph illustrating the adjusted instantaneous failure probability F'(t) and the adjusted instantaneous attack probability A'(t). In FIG. 6, reference numeral 62 represents the adjusted instantaneous failure probability F'(t), and reference numeral 63 represents the adjusted instantaneous attack probability A'(t). In FIG. 6, the horizontal axis represents elapsed time t, and the vertical axis represents the respective probabilities over time. In FIG. 6, the elapsed time t on the horizontal axis is divided into three phases: initial operation, mid-term operation, and final operation. These phases represent the phases after the device to be diagnosed is introduced and begins operation. That is, the initial operation phase represents the period immediately after the device to be diagnosed begins operation, the mid-term operation phase represents the period after operation is on track, and the final operation phase represents the end of operation. Reference numeral 60 represents the date and time when a vulnerability was discovered in the device to be diagnosed, and reference numeral 61 represents the time when the diagnosis was performed by the diagnosis device 1 (diagnosis time t1). Reference numeral 64 denotes the adjusted instantaneous failure probability F'(t) at the diagnosis time, and reference numeral 65 denotes the adjusted instantaneous attack probability A'(t) at the diagnosis time. For example, in FIG. 6, at diagnosis time t1, the adjusted instantaneous failure probability F'(t)=0.3 and the adjusted instantaneous attack probability A'(t)=0.2.

[0038] [Discrimination Process] Figure 7 is a flowchart of the discrimination process executed by the discrimination unit 45. The discrimination unit 45 compares the adjusted instantaneous failure probability F'(t) and the adjusted instantaneous attack probability A'(t) output by the probability adjustment unit 44 with predetermined thresholds f and a, respectively, to output the presence or absence of a failure and a cyber-attack. The predetermined threshold f is a value based on the failure density function f(t), and the predetermined threshold a is a value based on the attack density function a(t). These thresholds f and a may be statistical values ​​such as the mode, mean, or median of the failure density function f(t) or the attack density function a(t), or may be values ​​specified by the designer of the diagnostic device 1 separately from these statistical values.

[0039] In step S400, the determination unit 45 compares the value of the adjusted instantaneous failure probability F'(t) with a threshold value f. If the value of the adjusted instantaneous failure probability F'(t) is equal to or greater than the threshold value f, the process proceeds to step S410. In step S410, the determination unit 45 compares the value of the adjusted instantaneous attack probability A'(t) with a threshold value a. If the value of the adjusted instantaneous attack probability A'(t) is equal to or greater than the threshold value a, the process proceeds to step S420. In step S420, the determination unit 45 determines that there is a high possibility that both a failure and a cyber-attack have occurred simultaneously. If there is a low possibility that the value of the adjusted instantaneous attack probability A'(t) is less than the threshold value a in step S410, the process proceeds to step S430. In step S430, the determination unit 45 determines that there is a high possibility that a failure has occurred. If there is a low possibility that the value of the adjusted instantaneous failure probability F'(t) is less than the threshold value f in step S400, the process proceeds to step S440. In step S440, the determination unit 45 compares the value of the adjusted instantaneous attack probability A'(t) with a threshold value a. If the value of the adjusted instantaneous attack probability A'(t) is equal to or greater than the threshold value a, the process proceeds to step S450. In step S450, the determination unit 45 determines that there is a high possibility that a cyber-attack has occurred. If the value of the adjusted instantaneous attack probability A'(t) is less than the threshold value a in step S440, the process proceeds to step S460. In step S460, the determination unit 45 determines that there is a low possibility that a failure has occurred and that a cyber-attack has occurred, that is, the diagnosis target device is in a normal state.

[0040] For example, consider a case where the designer has given threshold values ​​of f = 0.4 and a = 0.3, and the adjusted instantaneous failure probability F'(t) = 0.3 and the adjusted instantaneous attack probability A'(t) = 0.2 as shown in Figure 6. In this case, since the adjusted instantaneous failure probability F'(t) is less than the threshold value f in step S400, the process proceeds to step S440, and since the adjusted instantaneous attack probability A'(t) is less than the threshold value a, the process proceeds to step S460. As a result, the determination unit 45 determines that the device to be diagnosed is in a normal state (no failure has occurred and the device has not been subjected to a cyber-attack).

[0041] Fig. 8 is a schematic diagram illustrating an example of a display screen of the display device 4. The output unit 46 outputs the result of the determination by the determination unit 45, i.e., the diagnosis result, to the display device 4. Based on this diagnosis result, the display device 4 displays a screen such as the example shown in Fig. 8.

[0042] The display screen of the display device 4 is provided with a diagnosis date and time display area 90, a diagnosis result display area 91, a diagnosis result detail display area 92, a diagnosis graph display area 93, and a re-diagnosis button 94. The diagnosis date and time display area 90 displays the date and time when the diagnosis was performed (diagnosis time t1). The diagnosis result display area 91 displays the diagnosis results of the device to be diagnosed. The diagnosis result display area 91 displays the diagnosis results in one of the following formats: normal, failure, attack (cyber attack), or failure and attack. The diagnosis result detail display area 92 displays a breakdown (details) of the results displayed in the diagnosis result display area 91. The diagnosis graph display area 93 displays the failure probability distribution and attack probability distribution up to the diagnosis time. For example, a probability distribution like the graph shown in FIG. 6 is displayed. The re-diagnosis button 94 is a button for executing a re-diagnosis. Pressing the re-diagnosis button 94 re-diagnoses the device to be diagnosed at the time the button was pressed, and the re-diagnosis results can be displayed on the display screen of the display device 4.

[0043] According to the above-described first embodiment, the following advantageous effects are achieved.

[0044] (1) The instantaneous attack probability calculation unit 43 (computing device) calculates the instantaneous attack probability, which is the probability that a cyber-attack was carried out on the diagnosis target device at the diagnosis time (predetermined time), and the instantaneous failure probability calculation unit 42 (computing device) calculates the instantaneous failure probability, which is the probability that a failure occurred in the diagnosis target device at the diagnosis time (predetermined time). The determination unit 45 (computing device) then determines whether or not a cyber-attack was carried out on the diagnosis target device and whether or not a failure occurred in the diagnosis target device at the diagnosis time (predetermined time) based on the instantaneous attack probability and the instantaneous failure probability. This allows appropriate determination of the presence or absence of a cyber-attack and the presence or absence of a device failure. Furthermore, because the instantaneous attack probability and the instantaneous failure probability are calculated separately and are uncorrelated, one is not affected by the other, and the probability of a cyber-attack and the probability of a failure can be determined independently.

[0045] (2) The determination unit 45 (arithmetic device) determines whether or not there is a cyber-attack on the equipment to be diagnosed and whether or not there is a malfunction in the equipment to be diagnosed by comparing the instantaneous attack probability and the instantaneous failure probability with predetermined thresholds. In this way, it is possible to determine whether or not there is a cyber-attack and whether or not there is a malfunction independently, without one being affected by the other.

[0046] (3) The instantaneous attack probability calculation unit 43 (computing device) calculates the instantaneous attack probability using an attack density function a(t) (first probability distribution) that represents a time-varying probability distribution. The instantaneous failure probability calculation unit 42 (computing device) calculates the instantaneous failure probability using a failure density function f(t) (second probability distribution) that represents a time-varying probability distribution and is different from the attack density function a(t) (first probability distribution). This allows the presence or absence of a cyber-attack and the presence or absence of a failure to be determined independently, without one being affected by the other.

[0047] (4) The instantaneous failure probability calculation unit 42 (arithmetic unit) calculates the instantaneous failure probability using at least one of the shape parameter 21, the scale parameter 22, and the position parameter 21, which represent the shape, scale, and position characteristics of the probability distribution of the probability of failure of the device to be diagnosed. This makes it possible to accurately determine whether or not the device to be diagnosed has a failure.

[0048] (5) The instantaneous attack probability calculation unit 43 (a computing device) calculates the instantaneous attack probability using a vulnerability database 3 (vulnerability information) related to the hardware or software that constitutes the device to be diagnosed. This makes it possible to accurately determine whether or not a cyber-attack has occurred on the device to be diagnosed.

[0049] (6) The probability adjustment unit 44 (a calculation device) adjusts the instantaneous attack probability and the instantaneous failure probability to have the same dimension. This allows the threshold values ​​for comparing the instantaneous attack probability and the instantaneous failure probability to be determined on a common scale, making it easier to set the threshold values.

[0050] (7) The output unit 46 (computing device) displays the presence or absence of a cyber attack on the equipment to be diagnosed as determined by the determining unit 45 (computing device) and the presence or absence of a malfunction in the equipment to be diagnosed as determined by the determining unit 45 (computing device) on the display device 4. This allows the user of the diagnostic device 1 to accurately understand the diagnosis results.

[0051] <Second embodiment> A diagnostic device according to a second embodiment of the present invention will be described with reference to Figures 9 to 11. Note that components that are the same as or equivalent to those described in the first embodiment will be given the same reference symbols, and differences will be mainly described.

[0052] 9 is a block diagram similar to FIG. 2 , showing the functional configuration of a diagnostic device 100 according to a second embodiment. In addition to the components of the diagnostic device 1 according to the first embodiment, the diagnostic device 100 includes a maintenance risk assessment value calculation unit 47. The maintenance risk assessment value calculation unit 47 calculates a maintenance risk assessment value, which is a numerical value that quantifies the risk associated with the maintenance of the device to be diagnosed. A maintenance inspection database 5 is connected to the diagnostic device 100 in addition to the parameter database 2 and vulnerability database 3 similar to those of the first embodiment.

[0053] The maintenance and inspection database 5 stores maintenance and inspection data 51, maintenance worker data 52, and operation log data 53. The maintenance and inspection data 51 is, for example, information regarding the date and location of maintenance inspection of equipment to be diagnosed by a maintenance worker. The maintenance worker data 52 is information regarding the maintenance worker himself, such as the age and years of service of the maintenance worker. The operation log data 53 is, for example, information regarding maintenance time and the number of operation commands.

[0054] An example of a method for calculating a maintenance risk assessment value by the maintenance risk assessment value calculation unit 47 will be described below. The maintenance risk assessment value L is expressed by the following formula (14): L = T C (14) where T represents the ratio of the actual operation time to the specified operation time, and C represents the ratio of the actual number of operation commands to the specified number of operation commands.

[0055] By comparing the values ​​of the ratio T of operation time and the ratio C of the number of operation commands with predetermined values, the maintenance personnel's degree of familiarity with the operation can be quantitatively measured. For example, if C is greater than 1, it can be determined that the maintenance personnel is not familiar with maintenance operations, and if C is less than 1, it can be determined that the maintenance personnel is familiar with maintenance operations. Similarly, for T, if T is greater than 1, it can be determined that the maintenance personnel is not familiar with maintenance operations, and if T is less than 1, it can be determined that the maintenance personnel is familiar with maintenance operations.

[0056] In addition to the rule-based indicators described above, determining whether a maintenance worker is familiar with maintenance operations can also be performed using machine learning, using as input data sets the age and years of service of the maintenance worker contained in the maintenance worker data 52, and the operation time contained in the operation log data 53.

[0057] Fig. 10 is a flowchart of the instantaneous attack probability calculation process executed by the instantaneous attack probability calculation unit 43, similar to Fig. 4. In the flowchart of Fig. 10, step S225 is added between steps S220 and S230 of the flowchart of Fig. 4. In step S225, the instantaneous attack probability calculation unit 43 adds the maintenance risk assessment value calculated by the maintenance risk assessment value calculation unit 47 to the security assessment value determined in step S220. As a result, subsequent processes targeting the security assessment value take the maintenance risk assessment value into account.

[0058] As shown in formula (5), the security evaluation value is determined by the degree of impact (magnitude of impact) on the diagnosis target device, Impact, and the likelihood of attack on the diagnosis target device. The maintenance risk evaluation value is reflected in the likelihood of attack among these values. As shown in formula (7), Likelihood is a value based on the attack source category X, the complexity of the attack conditions Y, the required privilege level Z, and the required user involvement level W. The instantaneous attack probability calculation unit 43 adds up (reflects) the maintenance risk evaluation value to the security evaluation value by varying the values ​​of the attack source category X and the required privilege level Z according to the maintenance risk evaluation value. For example, the larger the maintenance risk evaluation value, the higher the values ​​of the attack source category X and the required privilege level Z, and the smaller the maintenance risk evaluation value, the lower the values ​​of the attack source category X and the required privilege level Z.

[0059] The method of adding the maintenance risk assessment value to the security assessment value is not limited to the above-mentioned method. For example, the maintenance risk assessment value may be evaluated on the same 10-point scale as the security risk assessment value, and added to the security risk assessment value.

[0060] FIG. 11 is a graph similar to FIG. 6 illustrating the adjusted instantaneous failure probability F'(t) and the adjusted instantaneous attack probability A'(t). Reference numeral 1360 represents the adjusted instantaneous failure probability F'(t), and reference numeral 1370 represents the adjusted instantaneous attack probability A'(t). In FIG. 11, the horizontal axis represents elapsed time t, and the vertical axis represents each probability over time. Reference numeral 1300 represents the date and time when a vulnerability was discovered in the device to be diagnosed, and reference numeral 1310 represents the time when the diagnosis was performed by the diagnosis device 1 (diagnosis time t1). Reference numeral 1330 represents the adjusted instantaneous attack probability A'(t) without taking into account the maintenance risk assessment value at the diagnosis time, and reference numeral 1340 represents the adjusted instantaneous attack probability A'(t) with the maintenance risk assessment value at the diagnosis time taken into account. Reference numeral 1350 represents the adjusted instantaneous failure probability F'(t) at the diagnosis time.

[0061] The adjusted instantaneous attack probability A'(t) fluctuates not only due to conventional security factors but also due to maintenance and inspection work by maintenance personnel. For example, while FIG. 6 considers a case where the adjusted instantaneous attack probability A'(t) = 0.2 at the time of diagnosis, FIG. 11 considers a case where A'(t) = 0.3. This is because the adjusted instantaneous attack probability A'(t) reflects not only vulnerability factors but also maintenance factors. Consider the output result for the adjusted instantaneous attack probability A'(t) reflecting this maintenance factor, for example, when A'(t) = 0.3 and threshold a = 0.2. However, the adjusted instantaneous failure probability F'(t) = 0.3 and threshold f = 0.4 are the same as in FIG. 6. In this case, the discriminator 45 first determines that the possibility of failure is low because F'(t) is smaller than f. Then, the discriminator 45 determines that the possibility of a cyberattack is high because A'(t) is greater than or equal to a. This results in a diagnosis result that the possibility of a cyberattack is high. In this way, the value of the adjusted instantaneous attack probability A'(t) increases due to the addition of the maintenance risk assessment value, and as a result, the diagnosis result changes from the content described in FIG.

[0062] According to the second embodiment described above, the following advantageous effects are achieved.

[0063] (1) The instantaneous attack probability calculation unit 43 (arithmetic device) calculates the instantaneous attack probability using a maintenance risk assessment value based on at least one of the following: maintenance inspection data 51, which is information related to the maintenance inspection of the device to be diagnosed; maintenance staff data 52, which is information related to the maintenance staff who perform the maintenance inspection of the device to be diagnosed; and operation log data 53, which is information related to the operation log of operations performed in the maintenance inspection of the device to be diagnosed. This makes it possible to perform a diagnosis that takes into account the life cycle of the device to be diagnosed.

[0064] <Third embodiment> A diagnostic device according to a third embodiment of the present invention will be described with reference to Figures 12 and 13. Note that the same reference symbols are used to designate components that are the same as or equivalent to those described in the first embodiment, and differences will be mainly described.

[0065] 12 is a block diagram similar to FIG. 2, showing the functional configuration of an assessment device 200 according to the third embodiment. In addition to the parameter database 2 and vulnerability database 3 similar to those in the first embodiment, a physical information database 7 and an access information database 8 are connected to the assessment device 200.

[0066] The physical information database 7 stores temperature data 71, humidity data 72, and vibration data 73. The temperature data 71 is data relating to the temperature of the environment of the diagnosis target device, for example, whether the diagnosis target device is operating at a high temperature or under cooling. The humidity data 72 is data relating to the humidity of the environment of the diagnosis target device, for example, whether the environment in which the diagnosis target device is installed is humid or low. The vibration data 73 is data relating to the magnitude of vibration in the environment in which the diagnosis target device is installed. In addition to these, the physical information database 7 may also store data relating to, for example, wind (air volume and wind speed), radioactivity, dust, etc. in the environment of the diagnosis target device.

[0067] The access information database 8 stores physical access data 81 and network data 82. The physical access data 81 is data related to the security status of the installation location of the diagnosis target device, i.e., data indicating the physical safety of the environment in which the diagnosis target device is installed, such as data indicating whether the room in which the diagnosis target device is installed is locked or whether physical security is in place to allow only specific persons to enter, or whether the diagnosis target device is secured with a wire lock or the like. The network data 82 is data related to the security status of the path for accessing the diagnosis target device from the outside via the network, i.e., data indicating the ease of intrusion into the diagnosis target device from the outside, such as information on the debug port of the diagnosis target device, shell information, and port information used for network communication.

[0068] The instantaneous failure probability calculation unit 42 of the third embodiment calculates the instantaneous failure probability using not only the various parameters in the parameter database 2 but also the various data in the physical information database 7. The instantaneous attack probability calculation unit 43 of the third embodiment calculates the instantaneous attack probability using not only the various data in the vulnerability database 3 but also the various data in the access information database 8.

[0069] FIG. 13 is a graph similar to FIG. 6 illustrating the adjusted instantaneous failure probability F'(t) and the adjusted instantaneous attack probability A'(t). Reference numeral 1550 represents the adjusted instantaneous failure probability F'(t), and reference numeral 1540 represents the adjusted instantaneous attack probability A'(t). In FIG. 13, the horizontal axis represents elapsed time t, and the vertical axis represents each probability over time. Reference numeral 1500 represents the date and time when a vulnerability was discovered in the device to be diagnosed, and reference numeral 1510 represents the time when the diagnosis was performed by the diagnosis device 200 (diagnosis time t1). Reference numeral 1530 represents the adjusted instantaneous failure probability F'(t) taking into account various data in the physical information database 7 at the time of diagnosis, and reference numeral 1520 represents the adjusted instantaneous attack probability A'(t) taking into account various data in the access information database 8 at the time of diagnosis.

[0070] For example, in FIG. 6 , we consider a case where the adjusted instantaneous failure probability at the time of diagnosis F'(t) = 0.3, while in FIG. 13 we consider a case where the adjusted instantaneous failure probability F'(t) = 0.45. Also, in FIG. 6 , we consider a case where the adjusted instantaneous attack probability at the time of diagnosis A'(t) = 0.2, while in FIG. 13 we consider a case where A'(t) = 0.25. These cases indicate that the physical factors (various data in the physical information database 7) affect the device to be diagnosed significantly, while the security factors (various data in the access information database 8) due to external access to the device to be diagnosed are minimal. In this way, by biasing the probability distribution itself based on physical factors and security factors due to external access, more accurate diagnosis can be performed.

[0071] For example, consider the output result when F'(t) = 0.45, threshold value f = 0.4, A'(t) = 0.25, and threshold value a = 0.35. In this case, the discriminator 45 first determines that there is a high possibility of a malfunction because F'(t) is greater than or equal to f. Then, the discriminator 45 determines that there is a low possibility of a cyber attack because A'(t) is less than a. This results in a diagnosis that there is a high possibility of a malfunction. In this way, the diagnosis result has changed from the content described in FIG. 6 due to the addition of physical factors and security factors due to external access.

[0072] According to the above-described third embodiment, the following advantageous effects are achieved.

[0073] (1) The instantaneous failure probability calculation unit 42 (arithmetic device) calculates the instantaneous failure probability using the physical information database 7, which contains information about at least one of the temperature, humidity, vibration, wind, radioactivity, and dust in the physical environment in which the device to be diagnosed operates. This improves the accuracy of the instantaneous failure probability, enabling more accurate diagnosis of the presence or absence of a failure.

[0074] (2) The instantaneous attack probability calculation unit 43 (arithmetic device) calculates the instantaneous attack probability using physical access data 81, which is information about the security status of the installation location of the diagnosis target device, and network data 82, which is information about the security status of the path for accessing the diagnosis target device from the outside via a network. By calculating the instantaneous attack probability using at least one of the physical access data 81 and the network data 82, the accuracy of the calculated instantaneous attack probability is improved, and it is possible to more accurately diagnose the presence or absence of a cyber attack.

[0075] The following modified examples are also within the scope of the present invention, and it is possible to combine the configuration shown in the modified example with the configuration described in the above embodiment, to combine the configurations described in the different embodiments above, or to combine the configurations described in the different modified examples below.

[0076] <Modification 1> The cumulative failure distribution function F(t) may be different from that described in equation (4). For example, the cumulative failure distribution function F(t) may be calculated using a reliability function R(t) instead of the failure density function f(t). In this case, the cumulative failure distribution function F(t) may be defined as 1-R(t), and the instantaneous failure probability may be calculated as 1-R(t1) using the diagnosis time t1. Alternatively, for example, a function having various parameters in the parameter database 2 and time as variables may be calculated in advance from the characteristics of the device to be diagnosed, and the diagnosis time t1 may be substituted into that function to calculate the probability.

[0077] <Modification 2> The security evaluation value Risk may be different from that described in equation (8). For example, the security evaluation value Risk may be calculated by taking into account the current severity of the vulnerability in addition to the basic characteristics of the vulnerability itself, or by using the final vulnerability including the user's usage environment.

[0078] <Modification 3> In the above explanation, the Weibull distribution is used as an example of the failure density function f(t) and the Gaussian distribution is used as an example of the attack density function a(t), but the types of probability distributions are not limited to these. Other probability distributions may also be used as the failure density function f(t) and the attack density function a(t).

[0079] <Modification 4> The calculation method of the adjusted instantaneous failure probability F'(t) and the adjusted instantaneous attack probability A'(t) may be different from that exemplified in equations (12) and (13). For example, after calculating the distance measure, the adjusted instantaneous failure probability F'(t) and the adjusted instantaneous attack probability A'(t) may be calculated by multiplying the calculated distance measure by the failure density function f(t) and the attack density function a(t), and integrating the result from time 0 to the diagnosis time t1. In addition, in each of the above-mentioned embodiments, the instantaneous failure probability and the instantaneous attack probability are made to have the same dimension using the probability distance measure shown in equation (11), but other methods may be used to make the instantaneous failure probability and the instantaneous attack probability comparable.

[0080] <Modification 5> The data stored in the various databases described above (parameter database 2, vulnerability database 3, maintenance and inspection database 5, physical information database 7, and access information database 8) may be different from the data described above. Furthermore, the method of using the data may also be different from that of the above-described embodiments.

[0081] Although the embodiments of the present invention have been described above, the above embodiments merely illustrate some of the application examples of the present invention, and it is not intended that the technical scope of the present invention be limited to the specific configurations of the above embodiments.

[0082] 1, 100, 200...diagnostic device, 2...parameter database, 3...vulnerability database, 4...display device, 5...maintenance and inspection database, 7...physical information database, 8...access information database, 11...arithmetic unit, 12...non-volatile memory, 13...volatile memory, 14...input / output interface, 21...shape parameters, 22...scale parameters, 23...position parameters, 31...publication date data, 32...equipment data, 41...time input unit, 42...instantaneous failure probability calculation unit, 43...instantaneous attack probability calculation unit, 44...probability adjustment unit, 45...discrimination unit, 46...output unit, 47...maintenance risk assessment value calculation unit, 51...maintenance and inspection data, 52...maintenance worker data, 53...operation log data, 71...temperature data, 72...humidity data, 73...vibration data, 81...physical access data, 82...network data

Claims

1. A diagnostic device having a calculation device, which calculates an instantaneous attack probability, which is the probability that a cyber-attack has been carried out on a device to be diagnosed at a specified time, calculates an instantaneous failure probability, which is the probability that a failure has occurred in the device to be diagnosed at the specified time, and determines whether or not a cyber-attack has been carried out on the device to be diagnosed and whether or not a failure has occurred in the device to be diagnosed at the specified time based on the instantaneous attack probability and the instantaneous failure probability.

2. A diagnostic device as described in claim 1, wherein the computing device determines whether or not a cyber-attack has been made on the equipment to be diagnosed and whether or not there is a malfunction in the equipment to be diagnosed by comparing the instantaneous attack probability and the instantaneous failure probability with respective predetermined thresholds.

3. A diagnostic device as described in claim 1, wherein the calculation device calculates the instantaneous attack probability using a first probability distribution that changes over time, and calculates the instantaneous failure probability using a second probability distribution that changes over time and is different from the first probability distribution.

4. A diagnostic device according to claim 1, wherein the computing device calculates the instantaneous failure probability using at least one of parameters representing the shape, scale, and position characteristics of the probability distribution of the probability that the device to be diagnosed will fail.

5. A diagnostic device according to claim 1, wherein the computing device calculates the instantaneous attack probability using vulnerability information related to the hardware or software constituting the device to be diagnosed.

6. A diagnostic device according to claim 1, wherein the calculation device performs an adjustment to make the instantaneous attack probability and the instantaneous failure probability into the same dimension.

7. A diagnostic device as described in claim 1, wherein the arithmetic device displays on a display device whether or not there has been a cyber attack on the equipment to be diagnosed as determined by the arithmetic device, and whether or not there is a malfunction in the equipment to be diagnosed as determined by the arithmetic device.

8. A diagnostic device as described in claim 1, wherein the calculation device calculates the probability of an instantaneous attack using at least one of information regarding the maintenance and inspection of the equipment to be diagnosed, information regarding the maintenance personnel performing the maintenance and inspection of the equipment to be diagnosed, and information regarding the operation log of operations performed during the maintenance and inspection of the equipment to be diagnosed.

9. A diagnostic device according to claim 1, wherein the computing device calculates the instantaneous failure probability using information on at least one of temperature, humidity, vibration, wind, radioactivity, and dust regarding the physical environment in which the device to be diagnosed is operating.

10. A diagnostic device as described in claim 1, wherein the calculation device calculates the instantaneous attack probability using at least one of information regarding the security status of the location where the device to be diagnosed is installed and information regarding the security status of the path for accessing the device to be diagnosed from outside via a network.

11. A diagnostic method comprising: calculating an instantaneous attack probability, which is the probability that a cyber-attack has been carried out on a device to be diagnosed at a specified time; calculating an instantaneous failure probability, which is the probability that a failure has occurred in the device to be diagnosed at the specified time; and determining whether or not a cyber-attack has been carried out on the device to be diagnosed and whether or not a failure has occurred in the device to be diagnosed at the specified time based on the instantaneous attack probability and the instantaneous failure probability.

Images