Incident response system and method

Abstract

The present invention improves stability in power supply. An incident response system 1 comprises a memory 4 and a CPU 3. The CPU functions as an intrusion detection unit 51, a suspected component extraction unit 52, a degeneration plan devising unit 53, an outage evaluation unit 54, and a restoration instruction unit 56 by executing a program. The intrusion detection unit detects a damaged component in which a security incident has occurred. The suspected component extraction unit extracts a suspected component having a log from the damaged component. The degeneration plan devising unit devises a degeneration plan for subjecting a suspected subordinate component that is subordinate to the suspected component to a degeneration operation. The outage failure evaluation unit calculates an outage load amount and an outage time of the suspected component for when the suspected subordinate component is subjected to the degeneration operation on the basis of the degeneration plan, and evaluates the effect of an outage on a power grid. The restoration instruction unit instructs restoration of the suspected subordinate component that has been subjected to the degeneration operation on the basis of the degeneration plan.

Description

Incident response system and method

[0001] The present invention relates to an incident response system and method.

[0002] Control systems, which have traditionally been operated in closed environments, are increasingly being used in open network environments due to the advancement of open systems, DX (Digital Transformation), and system integration.

[0003] Even power systems can be linked to IT (Information Technology) business systems through the use of wide-area communications such as fifth-generation mobile communications systems (5G) and cloud computing. This increases the risk of security incidents, such as virus infections and unauthorized external operations. For example, there have been cases where security incidents caused by open communications environments and IT systems have led to infrastructure failures, including power outages.

[0004] Japanese Patent Laid-Open No. 2003-129999 describes a method of storing access permission information for each of a plurality of network interface units, and determining whether or not access to a network interface unit is permitted based on the access permission information.

[0005] JP 2013-041370 A

[0006] In Patent Document 1, unauthorized operations can be quickly blocked based on predefined accessibility information. However, there is a risk that the power outage range will expand, and the technology is based on the premise that unauthorized applications use communication paths that are different from normal ones. It does not describe how to deal with cases where legitimate applications and communication paths are hijacked, or how to deal with cases where a simulated intrusion occurs.

[0007] The present invention has been made in view of the above-mentioned problems, and an object of the present invention is to provide a technique for improving the stability of power supply.

[0008] In order to achieve the above object, the present invention provides an incident response system comprising a memory in which a program is stored and a CPU, wherein the memory comprises a communication operation database that stores logs of a plurality of components that control a power system, and the CPU, by executing the program, functions as an intrusion detection unit that detects a victim component among the plurality of components in which a security incident has occurred, an extraction unit that extracts a suspect component that has a log from the victim component detected by the intrusion detection unit based on the log stored in the communication operation database, a degeneration plan formulation unit that formulates a degeneration plan for degrading operation of a suspected lower-level component that is lower than the suspected component extracted by the extraction unit, an evaluation unit that calculates the power outage load and power outage duration of the suspected component when the suspected lower-level component is operated in degraded operation based on the degeneration plan formulated by the degeneration plan formulation unit, and evaluates the impact of a power outage on the power system based on the calculated power outage load and power outage duration, and a recovery instruction unit that instructs the restoration of the suspected lower-level component that has been operated in degraded operation based on the degeneration plan.

[0009] According to the present invention, the stability of the power supply can be improved.

[0010] 10. A configuration diagram of a power system and computer components. A configuration diagram of a computer component. A software configuration diagram of a computer component. A diagram showing an example of the data structure of system configuration information. A diagram showing an example of the data structure of control task information. A diagram showing an example of the data structure of system configuration information. A diagram showing an example of the data structure of load information. A diagram showing an example of the data structure of control configuration plan information. A diagram showing an example of the data structure of impact assessment information. A flowchart showing the overall processing by an incident response system. A flowchart showing detailed processing of S5 in FIG. 10. A diagram showing an HMI display screen.

[0011] Hereinafter, specific examples of an incident response system and method according to an embodiment of the present invention will be described with reference to the drawings. Note that the present invention is not limited to the examples, but is defined by the claims.

[0012] FIG. 1 is a diagram illustrating the configuration of a power system and computer components.

[0013] The power system 10 has a plurality of substation facilities 11 and a plurality of switches 12 electrically connected between the substation facilities 11. The substation facilities 11 include a transformer 13 and a plurality of switches 14. The downstream of the switches 12 is electrically connected to a load L. The information about the load L may include the number of consumers W.

[0014] A computer component 20 that controls various facilities included in the power system 10 is communicatively connected to the power system 10. The computer component 20 has an IT operation layer 21, a supervisory control layer 22, and a field control layer 23. The IT operation layer 21, supervisory control layer 22, and field control layer 23 form a hierarchical structure in order from the top.

[0015] The IT operations layer 21 includes a data center (DC in the figure) 24 and an information distribution system 25. The data center 24 stores various types of data. The information distribution system 25 may be a workstation. The information distribution system 25 will also be referred to simply as a component hereinafter. The data center 24 and the information distribution system 25 are communicatively connected to each other via a business network 26. The business network 26 may be, for example, a wide area network (WAN). The business network 26 is communicatively connected to the external Internet via a firewall (FW in the figure) 27. The data center 24 and the information distribution system 25 function as examples of "components." The data center 24 and the information distribution system 25 will also be referred to simply as components hereinafter.

[0016] The monitoring and control layer 22 includes, for example, a substation monitoring and control system 28, multiple distribution control systems 29, and a firewall network monitor (hereinafter referred to as FW network monitor) 30. The substation monitoring and control system 28 and the distribution control system 29 may be control servers (Ctrl servers in the figure). The substation monitoring and control system 28 remotely monitors and controls a control controller 35 of the field control layer 23, which will be described later. The distribution control system 29 remotely monitors and controls a control controller 36 of the field control layer 23, which will be described later. The substation monitoring and control system 28, the multiple distribution control systems 29, and the FW network monitor 30 are communicatively connected to one another via a monitoring and control network 31. The FW network monitor 30 is provided between the information distribution system 25 and the monitoring and control network 31. The FW network monitor 30 has log collection software and collects communication logs and operation logs of the substation monitoring and control system 28 and the distribution control system 29. A firewall (FW in the figure) 32 is provided between a plurality of power distribution control systems 29 in the monitoring and control network 31. The power transformation monitoring and control system 28 and the power distribution control system 29 function as examples of "components." The power transformation monitoring and control system 28 and the power distribution control system 29 will also be simply referred to as components hereinafter.

[0017] The field control layer 23 includes a control controller 35 that is communicatively connected downstream of the substation monitoring control system 28, and a plurality of control controllers (devices) 36 that are communicatively connected downstream of a plurality of power distribution control systems 29. The plurality of control controllers 36 are communicatively connected to one another via a field network 37. The control controller 35 controls the substation equipment 11. The control controller 36 controls the switch 12. The control controller 35 and the control controller 36 function as examples of "components." Hereinafter, the control controller 35 and the control controller 36 will also be simply referred to as components.

[0018] FIG. 2 is a configuration diagram of the computer components.

[0019] A routing network monitor 38 is further communicatively connected to the field network 37. The routing network monitor 38 is provided between the field network 37 and the monitoring control network 31. The routing network monitor 38 has log collection software and collects communication logs and operation logs of the control controller 35 and the control controller 36.

[0020] An HMI (Human Machine Interface) 39 is also communicatively connected to the monitoring and control network 31. The HMI 39 may be a touch panel that is operated by a user.

[0021] An incident response system 1 is also communicatively connected to the business network 26. The incident response system 1 has log analysis software, and accumulates and analyzes logs of the components 28, 29, 35, and 36 collected by the FW network monitor 30 and the routing network monitor 38, as well as logs of the component 25. The incident response system 1 also has configuration optimization software, and formulates an optimal degeneration plan for the power system 10 and the computer component 20.

[0022] FIG. 3 is a software configuration diagram of the computer component.

[0023] The controller 35 has a control logic 35 a that controls the substation equipment 11. The controller 36 has a control logic 36 a that controls the switch 12.

[0024] The routing network monitor 38a, which is communicatively connected to the substation monitoring and control system 28, has a status monitoring display unit 40, a control instruction unit 41, and a system information database (hereinafter referred to as DB) 42. The status monitoring display unit 40 monitors the status of the control controller 35 and displays the status of the control controller 35 to the user. The control instruction unit 41 controls the control controller 35 in accordance with instructions input by the user. The system information DB 42 stores various information about the substation equipment 11. Like the routing network monitor 38a, the substation monitoring and control system 28 has the status monitoring display unit 40, the control instruction unit 41, and the system information DB 42.

[0025] The routing network monitor 38b, which is communicatively connected to the power distribution control system 29, has a status monitoring display unit 42, a control instruction unit 43, and a system information DB 44. The status monitoring display unit 42 monitors the status of the control controller 36 and displays the status of the control controller 36 to the user. The control instruction unit 43 controls the control controller 36 in accordance with instructions input by the user. The system information DB 44 stores various information about the switch 12. Like the routing network monitor 38b, the power distribution control system 29 has the status monitoring display unit 42, the control instruction unit 43, and the system information DB 44.

[0026] The FW network monitor 30 has a log collection and transmission unit 45, a communication management unit (access control unit) 46, and a communication and operation log DB 47. The log collection and transmission unit 45 collects communication logs and operation logs of the substation monitoring and control system 28 and the power distribution control system 29, and transmits the collected communication logs and operation logs to the incident response system 1. The communication management unit 46 manages communication from the information distribution system 25 to the monitoring and control network 31. The communication and operation log 47 stores the communication logs and operation logs of the substation monitoring and control system 28 and the power distribution control system 29 collected by the log collection and transmission unit 45.

[0027] The business network 26 is communicatively connected to various business systems 2, an information distribution system 25, and an incident response system 1.

[0028] The information distribution system 25 has a power system information DB 47, a power system information display application 48, and an analysis and optimization application 49. The power system information DB 47 stores various data on the power system 10. The information display application 48 displays the data stored in the power system information DB 47 to the user. The analysis and optimization application 49 analyzes the data stored in the power system information DB 47 and optimizes the analyzed data.

[0029] The incident response system 1 includes a CPU 3 and a memory 4. The CPU 4 executes programs stored in the memory 4, which will be described later, to function as a log collection unit 50, an intrusion detection unit 51, a suspicious component extraction unit 52 as an example of an "extraction unit," a degeneration plan development unit 53, a power outage evaluation unit 54 as an example of an "evaluation unit," a recovery plan development unit 55, and a recovery instruction unit 56.

[0030] The log collection unit 50 collects the communication logs and operation logs of the components 28, 29, 35, and 36 collected by the FW network monitor 30 and the routing network monitor 38, as well as the communication logs and operation logs of the components 24 and 25. The intrusion detection unit 51 detects a damaged component in which a security incident has occurred among the components 25, 28, 29, 35, and 36 included in the computer component 20. A damaged component is a component that is likely to have been the subject of unauthorized intrusion. The damaged component may be detected, for example, by a virus scan. Specifically, the intrusion detection unit 51 extracts the damaged component based on the operation log and communication log for each of the components 28, 29, 35, 36, 24, and 25, and system configuration information as an example of "equipment status."

[0031] The suspect component extraction unit 52 extracts suspect components that have logs from the victim component detected by the intrusion detection unit 51 within a certain period of time. The suspect component extraction unit 52 extracts components that have accepted communication and operation from the victim component, i.e., components lower than the victim component (hereinafter referred to as suspected lower-level components). The degeneration plan creation unit 53 creates a degeneration plan for degenerating the suspected lower-level components. The degeneration plan is a change plan for degenerating the monitoring and control configuration of the power system 10.

[0032] The degeneration operation may include control transfer, autonomous operation, and shutdown of a component. For example, the degeneration planning unit 53 determines whether a task of the suspect component can be inserted (inserted) into the spare time within the control period from among other components that can communicate with the control target, and if the determination result is true, transfers control. At this time, the degeneration planning unit 53 evaluates the risk that the inserted task will not be executed due to non-steady processing as the transferable time. Furthermore, when operating the suspected lower-level component autonomously, the degeneration planning unit 53 evaluates the autonomous operation available time for the suspected lower-level component that received operation input from the suspected component based on the data freshness required for the operation input (data generated within m minutes is required for correct operation). Furthermore, if control transfer and autonomous operation are not possible, the degeneration planning unit 53 shuts down the suspected component and the suspected lower-level component.

[0033] The power outage evaluation unit 54 calculates the power outage load and power outage duration of the suspected lower-level component when the suspected lower-level component is operated in a degraded state based on the degraded state plan formulated by the degraded state plan formulation unit 53. The power outage evaluation unit 54 evaluates the impact of the power outage on the power system 10 based on the calculated power outage load and power outage duration. The power outage evaluation unit 54 may determine the degraded state plan that has the least impact on the power outage. The impact of the power outage may be the integrated value of the power outage load and the power outage duration. The restoration plan formulation unit 55 formulates restoration plans for the damaged component, the suspected component, and the suspected lower-level component that has been operated in a degraded state. The restoration instruction unit 56 instructs restoration work for the damaged component, the suspected component, and the suspected lower-level component that has been operated in a degraded state based on the restoration plan formulated by the restoration plan formulation unit 50.

[0034] The memory 3 has a communication and operation history DB 57 as an example of a “communication operation database”, a system configuration information DB 58, a task specification information DB 59, a failure history DB 60, a system configuration DB 61, a demand information DB 62, and a recovery plan DB 63. The memory 3 stores programs executed by the CPU 3.

[0035] The communication and operation history DB 57 stores the communication logs and operation logs of the components 28, 29, 35, and 36 collected by the FW network monitor 30 and the routing network monitor 38, as well as the communication logs and operation logs of the components 24 and 25. The system configuration information DB 58 stores system configuration information of various components included in the computer component 20.

[0036] The task specification information DB 59 stores control tasks executed by various components included in the computer component 20. The failure history DB 60 stores the history of damaged components. The system configuration DB 61 stores system configuration information within the power system 10. The demand information DB 62 stores information on the load L in the power system 10. The recovery plan DB 63 stores recovery plans for damaged components, suspected components, and suspected lower-level components that have been put into degenerate operation.

[0037] FIG. 4 is a diagram illustrating an example of the data structure of the system configuration information.

[0038] The system configuration information DB 58 stores system configuration information. The system configuration information is a table that stores, as item values ​​(column values), an ID 401, a source 402, a destination and control target 403, a target task 404, and a last communication date 405. The ID 401 is an identifier that identifies a component. The source 402 is the source of the task. The destination and control target 403 is the destination (control target) of the task. The target task 404 indicates the type of task. The last communication date 405 is the time of the last communication log.

[0039] FIG. 5 is a diagram illustrating an example of the data structure of the control task information.

[0040] Control task information is stored in the task specification DB 59. The control task information is a table that stores, as item values ​​(column values), an ID 501, a task name 502, an execution component 503, an input source 504, an output destination 505, an execution type 505, an input freshness 507, a control period 508, a CPU time 509, and a last execution time 510.

[0041] ID 501 is an identifier that identifies the task. Task name 502 is the name of the task. Execution component 503 is the component that executed the task. Input source 504 is the input source of the task. Output destination 505 is the output destination of the task. Execution type 505 is the execution type of the task, which is either periodic stationary or non-stationary. Input freshness 507 is the freshness of data required for correct operation. Control period 508 is the period for executing the task. CPU time 509 is the execution time by the CPU for each task. Final execution time 510 is the final execution time of the task.

[0042] FIG. 6 is a diagram illustrating an example of the data structure of the system configuration DB.

[0043] The system configuration DB 61 stores system configuration information. The system configuration information is a table that stores, as item values ​​(column values), an ID 601, a system line name 602, and a connected device 603. The ID 601 is an identifier that identifies a system line within the power system 10. The system line name 602 is the name of the system line. The connected device 603 is a device that is connected to the system battle.

[0044] FIG. 7 illustrates an example of the data structure of the load information.

[0045] The demand information DB stores load information. The load information is a table that stores, as item values ​​(column values), an ID 701, a system line name 702, a maximum load 703, and a number of contracted consumers 704. The ID 701 is an identifier that identifies a system line within the power system 10. The system line name 702 is the name of the system line. The maximum load 703 is the maximum load amount on the system line. The number of contracted consumers 704 is the number of contracted consumers electrically connected to the system line.

[0046] FIG. 8 is a diagram illustrating an example of the data structure of the control configuration planning information.

[0047] The recovery plan DB stores control configuration plan information and impact assessment information. The control configuration plan information is a table that stores, as item values ​​(column values), an ID 801, a source 802, a source and control target 803, a target task 804, a change type 805, a possible continuation time 806, and a recovery time 807.

[0048] ID 801 is an identifier that identifies a component. Source 802 is the source of the task. Destination and controlled object 803 is the destination (controlled object) of the task. Target task 804 indicates the type of task. Change type 805 is either transfer (function transfer), autonomous operation, or stop. Continuation time 806 is the time during which function transfer or autonomous operation can be continued. Recovery time 807 is the time required to recover the component.

[0049] FIG. 9 is a diagram illustrating an example of the data structure of the impact assessment information.

[0050] The impact assessment information is a table that stores the following item values ​​(column values): ID 901, impact range 902, type 903, maximum load 904, duration 905, power outage time 906, impact amount 907, and assessment value.

[0051] ID 901 is an identifier that identifies the degradation plan. Impact range 902 is the range affected by the degradation plan. Type 903 is the type of degradation plan, which is transfer, autonomous operation, or shutdown. Maximum load 904 is the maximum load amount for each impact range. Duration 905 is the duration of degraded operation for each impact range (time during which function transfer is possible or time during which autonomous operation is possible). Power outage duration 906 is the power outage time required for recovery. Impact amount (power outage impact) 907 is the value obtained by integrating the maximum load and power outage time when the duration (time during which function transfer is possible or time during which autonomous operation is possible) is shorter than the expected recovery time, and is the amount of impact during the power outage for each impact range. Evaluation value 908 is the evaluation value for each degradation plan.

[0052] FIG. 10 is a flowchart showing the overall processing by the incident response system.

[0053] First, the log collection unit 50 collects the communication logs and operation logs of the components 28, 29, 35, and 36 collected by the FW network monitor 30 and the routing network monitor 38, and the communication logs and operation logs of the components 24 and 25 (S1).

[0054] The intrusion detection unit 51 detects a victim component in which a security incident has occurred among the components 25, 28, 29, 35, and 36 included in the computer component 20, and determines whether an intrusion has been detected (S2).

[0055] If the determination result in S2 is true, the degeneration planning unit 53 extracts a suspicious component that has communicated with the victim component (S3). The degeneration planning unit 53 determines whether a suspicious component has been extracted from all components (S4).

[0056] If the determination result in S4 is true, the degeneration plan formulation unit 53 calculates a degeneration plan for stopping the suspect component and performing recovery work, and the power outage assessment unit 54 calculates the impact amount (S5). The power outage assessment unit 54 selects the degeneration plan with the least impact amount (S6). The recovery instruction unit 56 stops the damaged component and the suspect component determined to be stopped, and cuts off communication (S7).

[0057] The recovery instruction unit 56 performs recovery work for the stopped components (S8), and restarts the stopped components to return to the normal control configuration (S9).

[0058] FIG. 11 is a flowchart showing the detailed process of S5 in FIG.

[0059] The degeneration planning unit 53 extracts components that can communicate with the suspected lower-level component (S501). The degeneration planning unit 53 determines whether there is room to accept control tasks in a steady state (S502).

[0060] If the determination result in S502 is true, the degeneration planning unit 53 extracts the processing time, startup frequency, and interval of the non-stationary task (S503). The degeneration planning unit 53 determines whether the control task can be accepted in a non-stationary state (S504). If the determination result in S504 is true, the degeneration planning unit 53 sets the transferable time to a sufficiently large value (S505).

[0061] If the determination result in S504 is false, the degeneration planning unit 53 estimates the next startup time of the non-routine task and sets it as the transferable time (S506).

[0062] The degeneration planning unit 53 determines whether the control task can be accepted in a steady state (S507). If the determination result in S504 is true, the degeneration planning unit 53 stops the suspected lower-level component (S508) and proceeds to S509.

[0063] If the determination result in S504 is false, the degeneration planning unit 53 proceeds to S509. In S509, the degeneration planning unit 53 calculates the load amount of the devices controlled by the suspected lower-level component and downstream of the suspected lower-level component from the system configuration. The degeneration planning unit 53 calculates the expected power outage duration from the difference between the expected recovery time of the suspected component and the time available for handover or autonomous operation (S510). The degeneration planning unit 53 determines the amount of influence of the control configuration change as the sum of the load amount calculated in S509 and the expected power outage duration calculated in S510 (S511).

[0064] If the determination result in S502 is false, the degeneration planning unit 53 determines whether the suspected lower-level component is capable of autonomous operation (S512).

[0065] If the determination result of S512 is false, the degeneration planning unit 53 proceeds to S507. If the determination result of S512 is true, the degeneration planning unit 53 obtains the data freshness requirement of the suspicious lower-level component (S513). The degeneration planning unit 53 sets the data freshness requirement as the autonomous operation available time (S514).

[0066] FIG. 12 is a diagram showing the display screen of the HMI.

[0067] A column 121 showing the component in which the intrusion was detected and the component that will be affected is displayed in the upper left of the display screen 120 of the HMI 39. A column 122 showing the proposed degeneration plan is displayed in the lower left of the display screen 120. A column 123 showing the degenerated simulation and its evaluation (impact of power outage) is displayed in the lower right of the display screen 120.

[0068] According to this configuration, the incident response system 1 includes a memory 4 and a CPU 3. The memory 4 includes a communication and operation history database 57 that stores logs of multiple components that control the power system 10. The CPU 3 includes an intrusion detection unit 51, a suspected component extraction unit 52, a degeneration plan development unit 53, a power outage evaluation unit 54, and a restoration instruction unit 56. The intrusion detection unit 51 detects a victim component, among multiple components that control the power system 10, in which a security incident has occurred. The suspected component extraction unit 52 extracts a suspected component that has logs from the victim component. The degeneration plan development unit 53 develops a degeneration plan for degrading operation of suspected lower-level components that are lower than the suspected component. The power outage evaluation unit 54 calculates the power outage load and power outage duration of the suspected component when the suspected lower-level component is operated in degraded operation based on the degeneration plan, and evaluates the impact of the power outage on the power system 10 based on the calculated power outage load and power outage duration. The restoration instruction unit 56 instructs the restoration of the suspected lower-level component that has been operated in degraded operation based on the degeneration plan.

[0069] This allows the stability of the power supply to be improved by selecting a degeneration plan that minimizes the impact of a power outage.

[0070] Furthermore, the power outage evaluation unit 54 calculates the power outage impact as an integrated value of the power outage load amount and the power outage duration, thereby enabling the power outage impact to be calculated with high accuracy using a simple configuration.

[0071] Furthermore, the degeneration plan formulation unit 53 extracts, from among the multiple components, a function transfer component to which the function of the suspected lower-level component can be transferred, and formulates the degeneration plan for transferring the function of the suspected lower-level component to the extracted function transfer component. The power outage evaluation unit 54 calculates the power outage time as the difference between the estimated recovery time of the suspected component and the function transfer possible time of the function transfer component. This makes it possible to minimize the impact of the power outage.

[0072] Furthermore, if the degeneration planning unit 53 cannot extract a function transfer component, it extracts an autonomous operation component capable of autonomous operation from among the suspected lower-level components, and the power outage evaluation unit 54 calculates the power outage time as the difference between the estimated recovery time of the suspected component and the autonomous operation possible time of the autonomous operation component. This allows the component capable of autonomous operation to operate as much as possible.

[0073] Furthermore, if the degeneration plan formulation unit 53 cannot extract the function transfer component and the autonomous operation component, the power outage assessment unit 54 assesses the suspected lower-level component as having stopped functioning. This allows the suspected lower-level component to be quickly stopped.

[0074] Furthermore, if the function transfer available time and the autonomous operation available time are shorter than the expected recovery time, the power outage evaluation unit 54 calculates the load amount of the suspected lower-level component that will be stopped as the power outage load amount of the power grid 10. This allows the power outage load amount to be calculated appropriately.

[0075] Furthermore, the power outage evaluation unit 54 calculates the autonomous operation possible time of the autonomous operation component based on the data freshness required for the operation input from the suspect component to the lower component. This makes it possible to appropriately extract the autonomous operation possible time of the autonomous operation component.

[0076] Furthermore, the suspicious component extractor 52 extracts suspicious components based on the operation log, communication log, and equipment status for each of the plurality of components, thereby improving the accuracy of extracting suspicious components.

[0077] The present invention is not limited to the above-described embodiments, but includes various modifications. For example, the above-described embodiments have been described in detail to clearly explain the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with other configurations.

[0078] 1...incident response system, 3...CPU, 4...memory, 10...power system, 25...information distribution system, 28...substation monitoring and control system, 29...power distribution control system, 35...controller, 36...controller, 51...intrusion detection unit, 52...suspicious component extraction unit, 53...degradation plan formulation unit, 54...power outage evaluation unit, 56...restoration instruction unit, 57...communication and operation database

Claims

1. An incident response system comprising a memory having a program stored therein and a CPU, wherein the memory comprises a communication operation database storing logs of a plurality of components that control a power system, and wherein the CPU, by executing the program, functions as: an intrusion detection unit that detects a victim component among the plurality of components in which a security incident has occurred; an extraction unit that extracts a suspect component having a log from the victim component detected by the intrusion detection unit based on the logs stored in the communication operation database; a degeneration plan formulation unit that formulates a degeneration plan for degenerating operation of a suspected lower-level component that is lower than the suspect component extracted by the extraction unit; an evaluation unit that calculates a power outage load and power outage duration of the suspected component when the suspected lower-level component is operated in degenerated operation based on the degeneration plan formulated by the degeneration plan formulation unit, and evaluates an impact of a power outage on the power system based on the calculated power outage load and power outage duration; and a restoration instruction unit that instructs the restoration of the suspected lower-level component that has been operated in degenerated operation based on the degeneration plan.

2. The incident response system according to claim 1, wherein the evaluation unit calculates the power outage impact as an integrated value of the power outage load amount and the power outage duration.

3. The incident response system of claim 2, wherein the degeneration plan drawing unit extracts a function transfer component from among the plurality of components that is capable of transferring the function of the suspected sub-component, and draws up the degeneration plan for transferring the function of the suspected sub-component to the extracted function transfer component, and the evaluation unit calculates the power outage duration as the difference between the expected recovery time of the suspected component and the time during which the function can be transferred from the function transfer component.

4. The incident response system of claim 3, wherein when the degeneration planning unit is unable to extract the function transfer component, it extracts an autonomous driving component capable of autonomous operation from among the suspected lower-level components, and the evaluation unit calculates the power outage duration as the difference between the expected recovery time of the suspected component and the time during which the autonomous driving component is capable of autonomous operation.

5. The incident response system of claim 4, wherein the evaluation unit evaluates the suspected lower-level component as out of function when the degeneration plan creation unit is unable to extract the function transfer component and the autonomous driving component.

6. The incident response system of claim 5, wherein the evaluation unit calculates the load of the suspected sub-component that will be stopped as the power outage load of the power grid when the function transfer time and the autonomous operation time are shorter than the expected recovery time.

7. The incident response system of claim 6, wherein the evaluation unit calculates the autonomous driving possible time of the autonomous driving component based on the data freshness required for operation input from the suspect component to the lower component.

8. The incident response system according to claim 1, wherein the extraction unit extracts the suspicious components based on an operation log, a communication log, and an equipment status for each of the plurality of components.

9. An incident response method comprising the steps of: detecting a victim component in which a security incident has occurred among a plurality of components that control a power system; extracting a suspect component having a log from the victim component; formulating a degeneration plan for degrading operation of a suspected sub-component that is lower than the suspect component; calculating a power outage load and power outage duration of the suspect component when the suspected sub-component is operated in degraded mode based on the degeneration plan, and evaluating the calculated integrated values ​​of the power outage load and power outage duration as the power outage impact on the power system; and instructing the restoration of the suspected sub-component that has been operated in degraded mode based on the degeneration plan.

Images