Information processing method, information processing device, and program

Abstract

An information processing method according to an aspect of the present disclosure detects packet anomalies, and when a packet anomaly is detected, uses the packet as a basis for outputting an operation screen that is presumed to create the packet.

Description

Information processing method, information processing device, and program

[0001] The present disclosure relates to an information processing method, an information processing device, and a program for detecting an abnormality in a packet.

[0002] Conventionally, control devices installed in factory facilities, etc., have used their own communication methods and have been connected to other devices via their own communication lines to communicate with them. However, in recent years, with the spread of the Internet, communication standards between control devices have been established that use Ethernet (registered trademark) or IP (Internet Protocol), which are general-purpose protocols that have become faster and cheaper.

[0003] However, in recent years, the use of general-purpose communication standards has increased the risk of control devices being exposed to cyberattacks, including malware. Therefore, attempts are often made to monitor control system networks using Intrusion Detection Systems (IDSs) to detect and address abnormal communications. In control systems, processing basically occurs automatically according to predetermined logic, and the traffic (data) required for that processing also occurs automatically, making it easy to learn the underlying behavior. Therefore, it is common to detect abnormal communications using IDSs that have the function of detecting abnormalities in that behavior.

[0004] Another method for detecting anomalies by linking it to user operation information is disclosed in Patent Document 1. Patent Document 1 discloses a device that determines that there is a high possibility of a cyber attack if an abnormal packet is observed but no user operation has occurred.

[0005] International Publication No. 2022 / 249816

[0006] Anomaly detection at the communication level is an effective means of monitoring cybersecurity. However, it requires a significant amount of analytical work to identify the impact that the detected event may have on the control system and the cause of the detected event in communication.

[0007] The present disclosure provides an information processing method and the like that makes it easy to understand the cause of the generation of an abnormal packet.

[0008] An information processing method according to one aspect of the present disclosure detects a packet abnormality, and when a packet abnormality is detected, outputs an operation screen that is estimated to cause the packet based on the packet.

[0009] An information processing device according to one aspect of the present disclosure includes a detection unit that detects packet abnormalities, and an output unit that, when a packet abnormality is detected, outputs an operation screen that is estimated to cause the packet based on the packet.

[0010] A program according to one aspect of the present disclosure is a program for causing a computer to execute the information processing method.

[0011] According to an information processing method and the like according to one aspect of the present disclosure, the cause of the generation of an abnormal packet can be easily understood.

[0012] FIG. 1 is a block diagram showing the configuration of a control system in which a screen operation output device according to an embodiment is used. FIG. 2 is a block diagram showing the configuration of the screen operation output device according to an embodiment. FIG. 3 is a diagram showing pair information of IP addresses that are targets for screen operation estimation by the screen operation output device according to an embodiment. FIG. 4 is a diagram showing setting information for an anomaly detection algorithm used by an anomaly detection unit according to an embodiment. FIG. 5 is a diagram showing a maximum / minimum value whitelist, which is one of the algorithms used by the anomaly detection unit according to an embodiment. FIG. 6 is a diagram showing an image extracted by a screen operation extraction unit according to an embodiment. FIG. 7 is a diagram showing metadata extracted by a metadata extraction unit according to an embodiment. FIG. 8 is a diagram showing a type definition rule for control packets according to an embodiment. FIG. 9 is a diagram showing a control type ID table stored in a main DB corresponding to screen operations according to an embodiment. FIG. 10 is a diagram showing a packet metadata table stored in a main DB corresponding to screen operations according to an embodiment. FIG. 11 is a diagram showing a screen operation information table stored in a main DB corresponding to screen operations according to an embodiment. FIG. 12 is a diagram showing the contents of link setting parameters according to an embodiment. FIG. 13 is a diagram showing an example of an operation screen output by a visualization unit when an anomaly detection unit according to an embodiment detects an abnormal packet. Fig. 14 is a diagram showing a method in which the updating unit estimates a position where an abnormal screen operation is being performed and highlights it as a location where the visualization unit according to the embodiment displays the position of a text box. Fig. 15 is a diagram showing the contents of a display position specification setting parameter according to the embodiment. Fig. 16 is a flowchart showing an overall image of processing by a screen operation output device according to the embodiment. Fig. 17 is a flowchart showing processing for linking a control packet with a screen operation according to the embodiment. Fig. 18 is a flowchart showing display position update processing according to the embodiment. Fig. 19 is a flowchart showing screen operation output processing according to the embodiment. Fig. 20 is a flowchart showing an information processing method executed by an information processing device according to the embodiment.

[0013] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. Each embodiment shown here represents a specific example of the present disclosure. Therefore, the numerical values, shapes, components, component arrangements and connection forms, steps (processes), and step orders shown in the following embodiments are merely examples and do not limit the present disclosure. Of the components in the following embodiments, components not recited in independent claims are optional components that can be added. Furthermore, each figure is a schematic diagram and is not necessarily a precise illustration.

[0014] (Embodiment) A screen operation output device according to an embodiment will be described below. This screen operation output device associates a communication abnormality with a screen operation.

[0015] [Configuration] Fig. 1 is an example of a block diagram showing the configuration of a control system 10 in which a screen operation output device 100 according to an embodiment is used. Specifically, Fig. 1 shows the overall configuration of the control system 10 in this embodiment. In this embodiment, each device included in the control system 10 communicates over Ethernet defined by IEEE 802.3 using an appropriate protocol depending on the characteristics of the application, such as TCP / IP or UDP / IP.

[0016] First, each component included in the control system 10 will be described.

[0017] 1 , the control system 10 includes a screen operation output device 100, a control PC (Personal Computer) 200, an L2SW (Layer 2 Switch) 300, and a PLC (Programmable Logic Controller) 400. Each component of the control system 10 may be located, for example, within a factory, or at least some of the components may be located outside the factory.

[0018] In a control network (e.g., a factory network) used for communication by each device included in the control system 10, each device is connected via an L2SW 300. The control PC 200 and the PLC 400 can communicate with each other via the L2SW 300. The control PC 200 is a device for controlling each piece of production equipment in the factory.

[0019] The control PC 200 is, for example, a desktop personal computer, but may also be realized by a tablet terminal or the like. The control PC 200 is an example of an operation device. The control PC 200 includes, for example, a display device that displays an operation screen for transmitting (generating) packets (control packets), an input device that accepts operations (inputs) from a user, and a control device that controls the screen (image) displayed on the display device and performs processing such as transmitting control packets to the PLC 400 based on the user operations accepted by the input device.

[0020] The display device is, for example, a display that displays an operation screen such as a GUI (Graphical User Interface) for a user to perform an operation.

[0021] The input device is a device for receiving operations from a user, and is a mouse and / or a keyboard, etc. The input device may be realized by a touch panel, etc.

[0022] The control device is a computer that performs various types of information processing. The control device includes, for example, a communication interface such as a communication circuit for communicating with the information processing device and the controlled device via a network, a non-volatile memory that stores programs, a volatile memory that is a temporary storage area for executing the programs, an input / output port for sending and receiving signals, and a processor that executes the programs.

[0023] A user operates the control PC 200 to transmit a control packet for controlling the PLC 400 (more specifically, a control packet for the PLC 400 to control the production equipment) to the PLC 400. Specifically, the user transmits a control packet to the PLC 400 by operating a GUI displayed on the control PC 200. In this case, the user transmits the control packet to the PLC 400 by, for example, using an input device to click a mouse to select an icon such as a send button on the GUI while viewing the GUI (specifically, an operation screen) displayed on the display device.

[0024] In the following, a user may use an input device to perform an operation such as clicking a mouse to select an icon such as a send button on an operation screen displayed on a display device while viewing the operation screen. For example, in the present disclosure, a screen operation is a general term for an input received on the operation screen of the control PC 200, a click position on the operation screen, keyboard input information, and the like.

[0025] The PLC 400 is a device for automatically controlling each piece of production equipment in a factory, and controls each piece of production equipment according to a predetermined sequence or procedure. Although not shown, the PLC 400 is connected to each piece of production equipment so that it can communicate with them. The PLC 400 can control, for example, multiple motors and multiple actuators. Each of the multiple motors and multiple actuators is assigned an object ID for identification.

[0026] PLC 400 is realized by, for example, a communication interface such as a communication circuit for communication, a non-volatile memory in which a program is stored, a volatile memory that is a temporary storage area for executing the program, an input / output port for transmitting and receiving signals, and a processor that executes the program, etc. PLC 400 is an example of a controlled device.

[0027] The L2SW 300 is a relay device in the control network that performs processing to transmit acquired information to a device corresponding to the information. The L2SW 300 has a mirror port 301 and a normal port 302.

[0028] The mirror port 301 is a port that can capture packets flowing on the network switch. The mirror port 301 is also called a monitor port. The L2SW 300 has many ports for connecting LAN (Local Area Network) cables, and the mirror port 301 copies (mirrores) packets flowing through a specified port. In this embodiment, the screen operation output device 100 is connected to the mirror port 301 and the normal port 302.

[0029] The screen operation output device 100 is a device that detects abnormalities in packets flowing through a control network. Specifically, the screen operation output device 100 detects abnormalities in control packets transmitted to the PLC 400 via the control network.

[0030] The control packet includes, for example, a control value for controlling the PLC 400. When the PLC 400 receives (acquires) the control packet, it controls the motor, actuator, etc. using the control value included in the control packet.

[0031] FIG. 2 is a block diagram showing the configuration of the screen operation output device 100 according to the embodiment.

[0032] As shown in FIG. 2, the screen operation output device 100 is composed of a screen operation extraction unit 101, a metadata extraction unit 102, an abnormality detection unit 103, an assignment unit 104, a main DB 105, a linking unit 106, a linking parameter storage unit 107, a rule storage unit 108, a specific parameter storage unit 109, an update unit 110, a visualization unit 111, a first port 112, and a second port 113.

[0033] The screen operation output device 100 is realized by, for example, a computer device including a communication interface such as a communication circuit for communication, a memory, and a processor that executes a program stored in the memory.

[0034] The screen operation extraction unit 101 is a processing unit that acquires information based on screen operations by a user on the control PC 200. That is, the screen operation extraction unit 101 acquires information (also referred to as operation information) regarding operations (screen operations) on the control PC 200 by a user who operates the control PC 200. Specifically, the screen operation extraction unit 101 acquires information indicating the user's screen operations from the control PC 200 via the first port 112.

[0035] For example, the screen operation extraction unit 101 acquires, as operation information, screenshots (screenshot images) of the moment the user performs a click and the moment the user performs a key input (keyboard input). Specifically, the screen operation extraction unit 101 acquires operation information including a screenshot of a screen (operation screen) displayed on a display device of the control PC 200 when the user performs at least one of clicking a mouse of the control PC 200 and inputting a key on the keyboard of the control PC 200 as an operation on the control PC 200. For example, when the control PC 200 accepts one of these operations from the user, it acquires a screenshot of the operation screen (GUI) displayed at that time together with the time of acceptance and transmits the screenshot to the screen operation output device 100.

[0036] The metadata extraction unit 102 is a processing unit that observes control packets flowing through the control network via the second port 113. Specifically, the metadata extraction unit 102 acquires control packets flowing through the control network. More specifically, the metadata extraction unit 102 acquires metadata included in the acquired control packets. Specific examples of metadata will be described later.

[0037] The anomaly detection unit 103 is a processing unit that detects anomalies in observed communications. Specifically, the anomaly detection unit 103 detects anomalies in control packets flowing through the control network. More specifically, the anomaly detection unit 103 observes control packets flowing through the control network via the second port 113. More specifically, the anomaly detection unit 103 acquires control packets flowing through the control network and detects anomalies in the acquired control packets.

[0038] The abnormality detection unit 103 is an example of a detection unit.

[0039] The assigning unit 104 is a processing unit that assigns a control type ID to the acquired control packet.

[0040] The control type ID is an identifier that is uniquely determined based on information that may be included in a control packet, such as the source IP address, destination IP address, and command (control content) of the control packet. The control type ID is arbitrarily determined based on, for example, a combination of this information. The assigning unit 104 assigns a control type ID to the acquired control packet based on data (metadata) included in the control packet, and stores the control type ID in the main DB 105. A specific example of how the control type ID is set will be described later.

[0041] The main DB 105 is a storage device that stores control packets to which a control type ID is assigned. Specifically, the main DB 105 stores a control type ID table, which is a database in which the control type ID is associated with each piece of data included in the control packet.

[0042] The linking unit 106 is a processing unit that links screen operations with control packets. Specifically, the linking unit 106 links the acquired control packets with operation information. More specifically, the linking unit 106 links information about user operations on the control PC 200 extracted by the screen operation extraction unit 101 with multiple pieces of metadata included in the control packets extracted by the metadata extraction unit 102. For example, the linking unit 106 assigns a control type ID to the acquired operation information. In this way, control packets assigned the same control type ID are associated with the operation information.

[0043] For example, in linking, the linking unit 106 links a control packet acquired by the metadata extraction unit 102 with operation information acquired by the screen operation extraction unit 101 within a specific time period corresponding to the time when the control packet was acquired.

[0044] The specific time may be arbitrarily determined in advance and is not particularly limited.

[0045] The control PC 200 may also transmit the operation information in association with a control packet, in which case the association unit 106 does not need to associate the control packet with the operation information.

[0046] The linking parameter storage unit 107 is a storage device that stores information indicating the conditions under which the linking unit 106 links a screen operation with a control packet. For example, the linking parameter storage unit 107 stores the conditions for acquiring a screen operation, and the range of difference between the time at which the screen operation is acquired and the time at which the control packet is acquired that is allowed for linking. The screen operation extraction unit 101 and the linking unit 106 each perform processing based on the information (conditions) stored in the linking parameter storage unit 107, for example.

[0047] The rule storage unit 108 is a storage device that stores information (also called type definition rules) indicating definitions (rules) of types of control packets to be linked to screen operations. The linking unit 106 determines, for example, based on the type definition rules, whether the acquired control packet is a control packet to be linked to a screen operation.

[0048] The specific parameter storage unit 109 is a storage device that stores information (conditions) for specifying the position on the operation screen displayed on the control PC 200 of various pieces of information. For example, the screen operation extraction unit 101 acquires a screenshot of the operation screen displayed on the control PC 200 as information indicating the user's screen operation. For example, the update unit 110, based on the conditions stored in the specific parameter storage unit 109, specifies the position on the acquired screenshot of the control value.

[0049] The update unit 110 is a processing unit that estimates the position where a control value is displayed based on the operation information linked by the linking unit 106. Specifically, the update unit 110 identifies the position where the control value is displayed in an acquired image (e.g., a screenshot of the operation screen) showing the user's screen operation. More specifically, when a screen operation linked to a control packet assigned a new control type ID is acquired, the update unit 110 extracts a control packet assigned the same control type ID as the acquired control type ID from the screen operation information table in the main DB 105. Furthermore, the update unit 110 performs OCR (Optical Character Recognition) on the image showing the screen operation. Furthermore, the update unit 110 extracts a location where a numerical value in the output obtained by OCR matches a control value included in the control packet, and extracts the position of a message box or the like containing the numerical value in the image.

[0050] In this way, for example, the update unit 110 estimates, based on the operation information, the position on the operation screen (for example, the above-mentioned screenshot) where the control value that is included in the control packet transmitted to the PLC 400 and that controls the PLC 400 is displayed. For example, in estimating the position where the control value is displayed, the update unit 110 estimates the position where the control value is displayed using at least one of the output obtained by OCR of the screenshot, the coordinates indicating the clicked position, and the keyboard input information.

[0051] The coordinates indicating the clicked position are, for example, coordinates indicating the position on the GUI of the mouse pointer that moves on the operation screen displayed on the display device by the mouse when the user clicks the mouse.The keyboard input information is, for example, information indicating what kind of input was made on the keyboard at what position on the operation screen (for example, whether the enter key was pressed or a number was entered).

[0052] The visualization unit 111 is a processing unit that visualizes an operation screen that may cause an abnormal packet to be generated. Specifically, when the anomaly detection unit 103 detects an abnormality in a control packet, in other words, when it detects an abnormal control packet, the visualization unit 111 visualizes an operation screen that is estimated to have caused the detected abnormal control packet. In other words, when an abnormality in a control packet is detected, the visualization unit 111 outputs an operation screen that is estimated to have caused the packet based on the control packet. For example, assuming that the control PC 200 transmitted the abnormal packet via a network, the visualization unit 111 outputs an image of the operation screen (also referred to as an estimated image) that is estimated to have been displayed on the control PC 200 when the control PC 200 received an operation from a user to transmit the abnormal packet to the control PC 200. The estimated image is, for example, an image based on a screenshot of the operation screen displayed on the control PC 200.

[0053] For example, if a user mistakenly causes the control PC 200 to transmit an abnormal control packet to the control PC 200, an operation screen that is estimated to have been displayed on the control PC 200 when the control PC 200 transmitted the control packet is output. However, if an operator (attacker) other than the control PC 200 transmits a control packet without using the operation screen, no operation screen is generated. Therefore, the visualization unit 111 takes both of these cases into consideration and estimates and outputs the operation screen that would appear if an operation screen were used to transmit an abnormal control packet.

[0054] The visualization unit 111 is an example of an output unit.

[0055] For example, the visualization unit 111 outputs an operation screen that is estimated to cause an abnormal control packet based on the control packet and operation information linked by the linking unit 106.

[0056] For example, if the visualization unit 111 does not acquire operation information associated with a control packet of the same type as the control packet in which the abnormality was detected, it outputs an estimated image (i.e., an operation screen estimated to cause the abnormal control packet) based on metadata included in the control packet in which the abnormality was detected. For example, the visualization unit 111 extracts control packets similar to the control packet in which the abnormality was detected based on a control type ID determined based on the metadata included in the control packet in which the abnormality was detected, and estimates an operation screen when the control packet in which the abnormality was detected is transmitted using a screenshot included in the operation information associated with the extracted control packet, and outputs the estimated operation screen. For example, the visualization unit 111 generates and outputs an operation screen in which the portion of the screenshot included in the operation information associated with the extracted control packet in which metadata is displayed is replaced with the metadata included in the control packet in which the abnormality was detected.

[0057] The criteria for determining whether control packets are similar may be arbitrarily determined in advance and are not particularly limited. For example, control packets that have at least a part of the same type of metadata included in the control packets are selected as similar control packets.

[0058] Also, for example, when the visualization unit 111 acquires operation information linked to a control packet of the same type as the control packet in which an abnormality was detected, it outputs a screenshot included in the operation information linked to the control packet of the same type as the control packet in which an abnormality was detected, as an operation screen that is estimated to cause the abnormal control packet.

[0059] The criteria for determining whether control packets are the same may be arbitrarily determined in advance and are not particularly limited. For example, control packets having the same type of metadata included in the control packets or having the same assigned control type ID are selected as the same control packets.

[0060] Furthermore, when outputting an operation screen that is estimated to cause an abnormal control packet, the visualization unit 111 may output an operation screen in which a position where a control value is displayed is highlighted. For example, when the abnormality detection unit 103 determines that a control packet is abnormal because the control value included in the control packet is abnormal, the visualization unit 111 may generate an operation screen in which a position where the control value is displayed is highlighted.

[0061] The highlighting may be performed in any manner as long as it is different from other areas. For example, the color of the area where the control value is displayed may be changed, or the area may be surrounded by a frame, or the area may be flashed when displayed.

[0062] The first port 112 is a communication interface connected to the normal port 302 and used to acquire control packets. The first port 112 is implemented, for example, by a connector to which a communication line is connected. Note that the first port 112 may also be implemented by a communication circuit for wireless communication.

[0063] The second port 113 is a communication interface connected to the mirror port 301 and used to acquire control packets. The second port 113 is implemented, for example, by a connector to which a communication line is connected. Note that the second port 113 may also be implemented by a communication circuit for wireless communication.

[0064] Processing units such as the screen operation extraction unit 101, the metadata extraction unit 102, the anomaly detection unit 103, the assignment unit 104, the linking unit 106, the update unit 110, and the visualization unit 111 are realized by, for example, a memory in which a control program is stored and a processor such as a CPU (Central Processing Unit) that executes the control program. The processor of each processing unit may be realized by a single memory and processor, or may be realized by separate memories and processors.

[0065] The storage devices such as the main DB 105, the linking parameter storage unit 107, the rule storage unit 108, and the specific parameter storage unit 109 are realized by storage devices such as a hard disk drive (HDD) or a semiconductor memory. Each storage device may be realized by a single storage device or by separate storage devices.

[0066] Next, the processing performed by each processing unit included in the screen operation output device 100 will be specifically described.

[0067] Fig. 3 is a diagram showing pair information of IP addresses that are targets of screen operation estimation by the screen operation output device according to the embodiment. Specifically, Fig. 3 shows communication monitoring target IP address information used by the linking unit 106. For example, Fig. 3 shows IP addresses of devices that are targets of monitoring by the screen operation output device 100. Setting information indicating such IP addresses is stored in advance in, for example, a storage device provided in the screen operation output device 100.

[0068] Packets that are the subject of the screen operation output device 100 to store and visualize screen operations are limited to communications between IP addresses shown in FIG.

[0069] FIG. 4 is a diagram showing setting information of an anomaly detection algorithm used by the anomaly detection unit 103 according to the embodiment.

[0070] As shown in FIG. 4, the anomaly detection unit 103 holds an algorithm used for packet anomaly detection and its setting parameters, and performs learning processing and anomaly detection processing according to the settings.

[0071] For example, the user of the screen operation output device 100 inputs whether to use algorithms such as a maximum / minimum value whitelist and payload sequence anomaly detection in the anomaly detection algorithm used by the anomaly detection unit 103, as well as the learning period and frequency of re-learning for executing these.

[0072] The method of detecting an anomaly in a packet used by the anomaly detection unit 103 is not limited to these, and any method may be used.

[0073] 5 is a diagram illustrating a maximum / minimum value whitelist, which is one of the algorithms used by the anomaly detection unit 103 according to the embodiment. Specifically, FIG. 5 illustrates an example of parameters stored by the anomaly detection unit 103 when the maximum / minimum value whitelist is used as the anomaly detection algorithm.

[0074] 5 , when a maximum / minimum value whitelist is used in the anomaly detection algorithm, the object type, instance number, and range of allowable values ​​are stored in advance in a storage device provided in the screen operation output device 100. For example, when a control packet notifying the relevant object type and instance number or a control packet for writing is acquired, the anomaly detection unit 103 detects the control packet as abnormal if the value deviates from the range of allowable values.

[0075] The object type is information indicating what kind of value is being handled.

[0076] The instance number is information that is set for each object and indicates the order of the object.

[0077] 6 is a diagram showing an image extracted by screen operation extraction unit 101 according to the embodiment. In other words, FIG. 6 is an example of operation information (screen operation information) extracted by screen operation extraction unit 101.

[0078] 6 , the present disclosure assumes a situation in which the control system 10 is controlled through screen operations. Therefore, it is assumed that the operation screen displayed by the control PC 200 displays items to be controlled and setting values ​​such as control values. One possible method for acquiring screen operations is to install a keylogger in the control PC 200, and have the control PC 200 capture the operation screen at the timing when the screen operations should be acquired and transmit the captured image to the screen operation output device 100.

[0079] FIG. 7 is a diagram showing the metadata (packet metadata) extracted by the metadata extraction unit 102 according to the embodiment.

[0080] As shown in FIG. 7, the metadata included in the control packet includes information such as the time, source IP address, destination IP address, command type, type of object to be controlled (object type), object instance number, and the obtained control value.

[0081] 8 is a diagram illustrating a type definition rule for a control packet according to an embodiment. Specifically, FIG. 8 is a diagram illustrating an example of a type definition rule for a control packet to be associated with a screen operation, which is stored in the rule storage unit 108.

[0082] 8, control packets that are associated with screen operations are limited to those whose command type is, for example, “write” or “add.” The assigning unit 104 assigns a control type ID according to, for example, this type definition rule.

[0083] Note that both "all" and "*" shown in FIG. 8 link any control packet of a parameter of that attribute to a screen operation. "all" treats all values ​​of that parameter distinctly. On the other hand, "*" treats all values ​​of that parameter without distinction. As a result, differences occur in the control type ID table shown in FIG. 9.

[0084] The type definition rules are, for example, (A) and (B) below.

[0085] (A) When the acquired control packet satisfies any of the conditions of the type definition rules and the control type ID corresponding to the control packet has not already been assigned to the control packet (for example, when no control type ID exists yet), the assignment unit 104 generates a new control type ID and links the attribute values ​​of the acquired control packet (each piece of metadata included in the control packet) to the control type ID.

[0086] (B) When the acquired control packet satisfies any of the conditions of the control packet type definition rules, the assignment unit 104 simply assigns the control type ID to the control packet (more specifically, each piece of metadata contained in the control packet).

[0087] However, the above type definition rules are based on the premise that conditions associated with multiple control type IDs will not match.

[0088] The control type ID may be arbitrarily determined in advance based on a combination of these pieces of information, for example.

[0089] 9 is a diagram showing a control type ID table corresponding to screen operations according to an embodiment and stored in main DB 105. Specifically, FIG. 9 is a diagram showing a control type ID table generated in accordance with the type definition rules and stored in main DB 105.

[0090] As shown in FIG. 9, the control type ID is incremented each time a control packet with a newly acquired attribute that satisfies the type definition rule is acquired.

[0091] 10 is a diagram showing a packet metadata table corresponding to a screen operation according to an embodiment and stored in the main DB 105. Specifically, FIG. 10 is a diagram showing a packet metadata table including a control type ID type to which each control packet belongs.

[0092] The assigning unit 104 assigns the control type ID of each control packet extracted by the metadata extraction unit 102 to the metadata contained in the control packet while referring to information in the control type ID table stored in the main DB 105, and returns the control type ID to the main DB 105. The main DB 105 updates the packet metadata table by assigning the control type ID given by the assigning unit 104 to metadata contained in a control packet whose control type ID is still unknown.

[0093] FIG. 11 is a diagram showing a screen operation information table stored in main DB 105 corresponding to screen operations according to the embodiment.

[0094] When the linking unit 106 extracts a screen operation (operation information) linked to a control packet included in the packet metadata table, the linking unit 106 adds a new record to the screen operation information table shown in Fig. 11 and records the control type ID and the operation information indicating the screen operation in association with each other. In this way, the linking unit 106 links the control packet and the operation information to which the same control type ID is assigned. In addition, the operation information is included in the screen operation information table in this way, for example.

[0095] 12 is a diagram showing the contents of the association setting parameters according to the embodiment. Specifically, FIG. 12 is a diagram showing the settings used when the association unit 106 associates a control packet with a screen operation.

[0096] The screen operation extraction unit 101 acquires screen operations of the control PC 200 in accordance with the screen operation acquisition conditions shown in Fig. 12. In addition, for example, an allowable range of the difference between the time when the linking unit 106 acquires the control packet to be linked (control packet observation time) and the time when the linking screen operation is acquired (screen operation observation time) is set in advance.

[0097] 12 , when the user clicks on the control PC 200 or presses the Enter key on the keyboard, the screen operation extraction unit 101 acquires, as operation information, a screenshot of the operation screen displayed on the control PC 200 at that time and information indicating the time when such an operation was performed. For example, the control PC 200 is set in advance to transmit the operation information at such times.

[0098] In addition, in the example shown in FIG. 12, the linking unit 106 links the control packet and operation information if the value obtained by subtracting the screen operation observation time from the control packet observation time is between 0.0 and 1.0 seconds, and does not link the control packet and operation information if the value is not between 0.0 and 1.0 seconds.

[0099] The screen operation output device 100 and the control PC 200 may include a clock unit such as an RTC (Real Time Clock).

[0100] FIG. 13 is a diagram showing an example of an operation screen output by the visualization unit 111 when the anomaly detection unit 103 according to the embodiment detects an abnormal packet.

[0101] As shown in Figure 13, when the abnormality detection unit 103 detects an abnormal control packet, the visualization unit 111 extracts metadata related to the control packet in which the abnormality was detected from the packet metadata table stored in the main DB 105.

[0102] Thereafter, the visualization unit 111 identifies the source IP, destination IP, command type, object type, and instance number from the metadata included in the control packet in which the abnormality was detected.

[0103] Furthermore, the visualization unit 111 extracts, from the control type ID table, an estimated value (estimated display position) of the position information of the operation screen involved in the generation of the control packet including this attribute information (metadata).

[0104] Furthermore, the visualization unit 111 obtains the screen operation for the control type ID from the screen operation information table, and outputs the operation screen (such as a screenshot) for that control type ID by replacing it with one in which the estimated display position is highlighted with the observed value (i.e., the value contained in the control packet).

[0105] For example, if the setting value of OBJ2 in Fig. 13 corresponds to (object type, instance number) = (analog value, 201), and a control packet that writes a value of 100 to (analog value, 201) is acquired, it is detected that the value deviates from the maximum value in the maximum / minimum value whitelist shown in Fig. 5. This control packet corresponds to control type ID = 4 from the control type ID table shown in Fig. 9, and it is known that the estimated display position is pos: (910, 950) size: (70, 21), so the control value is displayed in an emphasized manner at this position.

[0106] FIG. 14 is a diagram showing a method for acquiring an estimated display position for each control type ID stored in the main DB 105. Specifically, FIG. 14 is a diagram showing a method by which the updating unit 110 estimates a position where the visualization unit 111 according to the embodiment highlights and displays an abnormal screen operation as a location where an abnormal screen operation is being performed, and a position of a text box. (a) of FIG. 14 is an example of information included in the packet metadata table. (b) of FIG. 14 is an example of an output obtained by performing OCR on a screenshot included in the acquired operation information. (c) of FIG. 14 is an example of a screenshot included in the acquired operation information.

[0107] For example, when the linking unit 106 acquires new operation information linked to a control packet with a specific control type ID, the updating unit 110 extracts the control packet linked to the control type ID from the screen operation information table stored in the main DB 105. Furthermore, for example, the updating unit 110 performs OCR on a screenshot included in the operation information, extracts a location where the control value matches the OCR output, and extracts a message box containing the value indicated at that location. As a result, the updating unit 110 extracts the position (specifically, coordinates) where the control value included in the control packet is indicated in the screenshot included in the operation information. Furthermore, the screenshot is also used, for example, as an operation screen output by the visualization unit 111. In other words, the updating unit 110 extracts the position where the control value included in the control packet is indicated in the screenshot included in the operation information, thereby extracting the position where the control value is indicated in the operation screen that is estimated to cause an abnormal control packet.

[0108] 14 , the update unit 110 obtains a control value (31.0 in this example) included in the corresponding control packet from the packet metadata table. Next, the update unit 110 identifies a value (31 in this example) that is the same as the obtained control value in the OCR output. Next, the update unit 110 obtains the coordinates of the identified value (x=910, y=950 in this example) to identify the position where the control value is indicated in the screenshot.

[0109] FIG. 15 is a diagram showing the contents of the display position specifying setting parameters according to the embodiment.

[0110] The update unit 110 identifies the position where the control value is indicated in the screenshot based on the conditions shown in FIG. 15, for example.

[0111] For example, the "item" indicates a condition, and the "value" indicates a value for determining whether the corresponding condition is satisfied.

[0112] For example, when determining whether an "item" satisfies the condition for the "minimum number of times a screen operation is acquired to determine a display position," the update unit 110 determines whether operation information associated with the corresponding control packet has been acquired five or more times. For example, if operation information associated with the corresponding control packet has been acquired five or more times, the update unit 110 identifies the position where the control value is indicated in the screenshot, as described above. On the other hand, if operation information associated with the corresponding control packet has not been acquired five or more times, the update unit 110 does not identify the position using the operation information.

[0113] When extracting a location where the control value and the OCR output match (for example, a message box), the update unit 110 may determine the position of the extracted message box not from only one piece of screen operation information, but may extract it from operation information that satisfies the minimum number of times of acquisition of screen operations shown in Fig. 15 or more, and may determine the position only when the same coordinates are extracted from operation information with a predetermined positional matching rate or more. This can increase reliability.

[0114] The predetermined position matching rate is the rate of matching between the control value included in the control packet and the numerical value output by the OCR. The predetermined position matching rate may be determined arbitrarily and is not particularly limited.

[0115] Furthermore, even if the same control value is actually shown, the value shown in the screenshot and the control value included in the control packet do not necessarily match in value. For example, the control value included in the control packet may be a constant multiple of the value shown in the screenshot. Therefore, even if a and b exist such that the relationship Y = aX + b (a and b are, for example, integers) holds for a value included in the screenshot (e.g., X) and a value included in the control packet (e.g., Y), X and Y may be considered to be the same value, and the position of the control value may be identified.

[0116] [Processing Procedure] FIG. 16 is a flowchart showing an overall view of the processing of the screen operation output device 100 according to the embodiment.

[0117] 16, when the screen operation output device 100 starts the screen operation output process, it starts observing control packets (S1200). For example, the screen operation extraction unit 101 and the metadata extraction unit 102 start acquiring control packets and operation information flowing through the control network.

[0118] Next, the attachment unit 104 and the linking unit 106 perform a process of linking the observed control packet with the screen operation (operation information) (S1300).

[0119] Next, the assigning unit 104 determines whether the control packet observed this time is the first control packet with the assigned control type ID (S1400). In other words, the assigning unit 104 determines whether the assigned control type ID is the first control type ID that has been assigned.

[0120] If the assigning unit 104 determines that the control packet observed this time is the first control packet with the assigned control type ID (YES in S1400), the processing ends. In this case, the screen operation output device 100 waits until the next control packet is observed.

[0121] On the other hand, if the assignment unit 104 determines that the control packet observed this time is not the first control packet with the assigned control type ID (NO in S1400), that is, if the control type ID has been assigned to the observed control packet in the past, the anomaly detection unit 103 performs an anomaly detection process on the observed control packet (S1500).

[0122] If the abnormality detection unit 103 detects an abnormal control packet (YES in S1600), that is, if it determines that the observed control packet is abnormal, the screen operation output device 100 performs screen operation output processing (S1800).

[0123] On the other hand, if the abnormality detection unit 103 does not detect an abnormal control packet (NO in S1600), that is, if it determines that the observed control packet is not abnormal, the screen operation output device 100 executes a display position update process (S1700).

[0124] 17 is a flowchart showing the process of linking a control packet with a screen operation according to an embodiment of the present invention, specifically, the process of step S1300.

[0125] 17, when the attaching unit 104 starts the process of linking a control packet with a screen operation, first, it reads the link setting parameters between the control packet and the screen operation as shown in Fig. 12 (S1301). Here, the parameters read include the conditions for acquiring the screen operation, and the range of the difference between the time when the operation information is acquired and the time when the control packet is observed that is allowed when linking.

[0126] Next, the assignment unit 104 determines whether the control packet observed in step S1200 is a communication between IP addresses that are targets of monitoring and are included in the communication monitoring target IP address information shown in FIG. 3 (S1302).

[0127] If a corresponding IP address pair exists (YES in S1302), the assignment unit 104 next determines whether the observed control packet is a control packet that can be linked to a screen operation based on the type definition rules shown in Figure 8 (S1303).

[0128] When the assignment unit 104 determines that the control packet is a control packet to be associated (YES in S1303), the assignment unit 104 determines whether a control type ID has already been assigned to the control packet (S1304).

[0129] If a control type ID has not already been assigned to the control packet (NO in S1304), the assigning unit 104 assigns a new control type ID and updates the control type ID table shown in FIG. 9 (S1305).

[0130] If a control type ID has already been assigned to the control packet (YES in S1304), or after step S1305, the assignment unit 104 stores information such as metadata contained in the observed packet in the packet metadata table shown in Figure 10 (S1306).

[0131] Next, the linking unit 106 determines whether there is a screen operation that satisfies the linking condition indicated in the linking setting parameter (S1307).

[0132] If such a screen operation exists (YES in S1307), the associating unit 106 stores the screen operation associated with the control type ID in the screen operation information table shown in FIG. 11 (S1308), and ends the process.

[0133] If NO in step S1302, NO in step S1303, or NO in step S1307, the screen operation output device 100 ends the linking process.

[0134] 18 is a flowchart of the display position update process according to the embodiment. Specifically, FIG. 18 is a flowchart showing the details of the process in step S1700.

[0135] 18, when the update unit 110 starts the display position update process, first, it reads the setting parameters for specifying the display position shown in Fig. 15 (S1701). These setting parameters are parameters that indicate the conditions for linking a control value with a display position when a control packet is linked with a screen operation.

[0136] Next, the update unit 110 extracts screen operations associated with the control type ID of the observed control packet using the screen operation information table shown in Fig. 11 (S1702). For example, the update unit 110 extracts screen operations associated with the control type ID of the observed control packet from the screen operation information table. Here, multiple past screen operations associated with the same control type ID are extracted.

[0137] Next, the update unit 110 performs a process of estimating the screen display position corresponding to the control type ID (S1703). One possible method for estimating the display position is to find a location where the control value included in the control packet matches the text data obtained by OCR of the screen operation information (screenshot), and then extract the text box in which that value is displayed, as shown in Fig. 14. In addition, in cases where multiple screen operations are extracted, one possible method is to perform the same process for each screen operation and use the average value of the center positions of the text boxes extracted corresponding to each screen operation or the median value of the text box sizes.

[0138] Next, the update unit 110 compares the estimated display position already recorded in the control type ID table with the display position estimated in step S1703 (S1705).

[0139] If the estimated display position already recorded in the control type ID table differs from the display position estimated in step S1703 (YES in S1705), the update unit 110 determines that there has been a change in the estimated display position and performs an update (S1706). Specifically, the update unit 110 updates the estimated display position in the control type ID table with the display position estimated in step S1703.

[0140] On the other hand, if the estimated display position already recorded in the control type ID table is the same as the display position estimated in step S1703 (NO in S1705), or if step S1706 has been completed, the screen operation output device 100 terminates the display position update process.

[0141] 19 is a flowchart of the screen operation output process according to the embodiment, specifically, the process of step S1800.

[0142] As shown in FIG. 19, when the screen operation output process is started, the metadata extraction unit 102 first extracts metadata included in a control packet in which an abnormality has been detected in the abnormality detection process (S1801).

[0143] If the update unit 110 determines that this control packet is not a control packet that is to be linked to a screen operation (NO in S1802), the screen operation output device 100 ends the screen operation output process.

[0144] On the other hand, if the control packet is a control packet to be linked to a screen operation (YES in S1802), the update unit 110 obtains the control type ID of the control packet using the control type ID table shown in Figure 9 (S1803).

[0145] Next, the update unit 110 uses the control type ID table to obtain information (position information) indicating the position (estimated display position) where the control value included in the control packet is estimated to be indicated (S1804).

[0146] Next, the update unit 110 acquires the control value included in the observed control packet using the packet metadata table shown in FIG. 10 (S1805).

[0147] Next, the update unit 110 uses the screen operation information table to extract screen operations when a control packet with the same control type ID as the control packet in which the abnormality was detected was transmitted (S1806). For example, the visualization unit 111 extracts, from the screen operation information table shown in Fig. 11, the screen operation (screen shot) acquired at the time closest to the current time (specifically, the time when the process is being executed) among the screen operations (screen shots) when the same control type ID was controlled.

[0148] Next, the update unit 110 generates an image (estimated image) in which an image of a portion of the acquired screen operation (screenshot) where the control value is estimated to be displayed is highlighted with the control value acquired in step S1805, as shown in Fig. 13 (S1807). That is, the update unit 110 generates an image in which the control value displayed in the screenshot is overwritten with the control value included in the control packet.

[0149] Next, the visualization unit 111 outputs an image in which the control value is highlighted (i.e., an image in which the control value is overwritten) as an operation screen (i.e., an estimated image) that is estimated to cause a packet in which an abnormality has been detected (S1808).

[0150] (Summary) FIG. 20 is a flowchart showing an information processing method executed by the information processing device according to the embodiment.

[0151] The information processing device is, for example, the above-mentioned screen operation output device 100.

[0152] First, the information processing device detects an abnormality in a packet flowing through a network (S10). Specifically, the information processing device detects an abnormality in a packet transmitted to a controlled device on the network. The network is, for example, the control network described above. The controlled device is, for example, the PLC 400 described above. The packet is, for example, the control packet described above, which is transmitted to the controlled device to control the controlled device. For example, the information processing device acquires (observes) packets on the network to which the controlled device is connected and determines whether the acquired packets contain an abnormality, thereby detecting the packet abnormality.

[0153] Next, when an abnormality in the packet is detected, the information processing device outputs, based on the packet, an operation screen that is estimated to have caused the packet (S20).

[0154] The operating device is, for example, the control PC 200 described above.

[0155] A user operates an operation device to transmit a packet to a controlled device. At this time, the user transmits a packet to the controlled device by, for example, using an input device to perform an operation such as clicking a mouse to select an icon such as a send button on a GUI (operation screen) displayed on a display device.

[0156] However, there is a possibility that a packet that causes an abnormal control of a controlled device may be transmitted to the controlled device by a malicious third party. Also, there is a possibility that a packet transmitted from an operating device may be tampered with and transmitted to the controlled device so as to cause the controlled device to perform an abnormal control. The information processing device detects such an abnormal packet.

[0157] Here, when an abnormal packet is detected, that is, when an abnormality in a packet is detected, assuming that the packet was transmitted from the operation device to the controlled device, the information processing device outputs an operation screen that is estimated to have been displayed at the time the operation device transmitted the packet. For example, the information processing device visualizes the operation screen by outputting the operation screen to the operation device and displaying the operation screen on a display device provided in the operation device.

[0158] For example, when a user actually performs a screen operation that generates an abnormal packet, the information processing device reproduces the screen operation and highlights important points. In such a case, for example, the information processing device outputs an image (screen shot) of the GUI, which is the operation screen when the screen operation was performed.

[0159] Alternatively, for example, when a screen operation that generates an abnormal packet is not actually performed by a user, the information processing device simulates an operation screen (image) that generates the packet and highlights important points. In such a case, for example, the information processing device outputs, as an operation screen, an image (screen shot) of a screen operation performed when a packet of the same type as the packet is transmitted.

[0160] Conventionally, anomaly detection at the communication level has been an effective means of monitoring cybersecurity, but it is difficult to grasp the impact that detected events may have on the system.

[0161] Here, when the information processing device detects abnormal communication, it can visualize the screen operation that caused the communication.

[0162] Therefore, according to the information processing device, it is easy to understand the screen operation (GUI operation) that generates a packet detected as abnormal, and analysis at a Security Operation Center (SOC) can be performed efficiently. Furthermore, even if the packet does not originate from a screen operation by a user, such as a packet by an attacker, it is easy to quickly understand the impact of an attack by the packet, because it is possible to understand the screen operation that may generate the packet.

[0163] The information processing device may transmit the operation screen to an operation device, may output it to a display device connected to the information processing device, or may output it to a device that analyzes packets.

[0164] The information processing device includes, for example, a processor and a memory, and the processor uses the memory to perform the above-described information processing method.

[0165] (Effects, etc.) Hereinafter, examples of techniques that can be obtained from the disclosure of this specification will be given, and effects, etc. that can be obtained from the exemplified techniques will be described.

[0166] Technique 1 is an information processing method that detects an abnormality in a packet flowing through a network (S10), and if an abnormality in the packet is detected, outputs an operation screen that is estimated to have caused the packet based on the packet (S20).

[0167] According to this, by checking the operation screen, the user can confirm what operation using the GUI displayed on the operation device may cause an abnormal packet to be generated. Therefore, according to the information processing method according to one aspect of the present disclosure, the cause of the abnormal packet can be easily understood. Furthermore, since the cause of the abnormal packet can be easily understood, the amount of processing required for an abnormality analysis can be reduced. Furthermore, an abnormality analysis can be performed quickly.

[0168] Technique 2 is an information processing method described in Technique 1, which acquires operation information related to a user's operation on an operation device, acquires packets, associates the acquired packets with the operation information, and outputs an operation screen based on the associated packets and operation information.

[0169] The operation information is, for example, information included in the above-mentioned screen operation information table.

[0170] According to this, by using the information on the linked packets and operation information, when an abnormal packet is detected, it can be easily understood, for example, what user operation would generate a packet similar to the detected packet.

[0171] In addition, if it is known in advance what operation a user will perform when a packet is generated, the packet and operation information indicating the operation may be stored in advance in a storage device provided in an information processing device that executes the information processing method. In such a case, the packet and operation information indicating the operation may be acquired from the storage device. Also, for example, information linking the packet and the operation information indicating the operation may be stored in advance in a storage device provided in an information processing device that executes the information processing method.

[0172] Furthermore, for example, the acquired packets may be packets flowing on a network, or in cases where it is known in advance what kind of packets will flow on the network, the packets may be stored in advance in a storage device included in an information processing device that executes the information processing method. For example, packets stored in the storage device may be acquired.

[0173] Technique 3 is an information processing method described in Technique 2, in which, when the user performs an operation on the operation device by clicking a mouse of the operation device or by inputting data on a keyboard of the operation device, the operation information includes a screenshot of a screen displayed on a display device of the operation device.

[0174] This allows the operation information to be easily acquired.

[0175] Technique 4 is an information processing method according to Technique 2 or 3, in which the linking involves linking an acquired packet with operation information acquired within a specific time period corresponding to the time the packet was acquired.

[0176] When a packet is generated by a user operation, it is highly likely that the packet will be generated immediately after the user operation. Therefore, by linking the acquired packet with operation information acquired within a specific time period corresponding to the time the packet was acquired, it becomes easier to correctly link the user operation with the packet generated by the user operation.

[0177] Technique 5 is an information processing method described in Technique 3, which estimates, based on operation information, a position on an operation screen where a control value for controlling the controlled device is displayed and is included in a packet sent to the controlled device.

[0178] When an abnormal packet causes a controlled device to perform an abnormal operation, it is highly likely that the control value for controlling the controlled device is set to an abnormal value in the abnormal packet. In this way, for example, an operation screen showing the estimated position can be output, making it easy for the user to understand whether such a control value is appropriate.

[0179] Technique 6 is an information processing method according to Technique 5, in which the position where the control value is displayed is estimated using at least one of an output obtained by OCR (Optical Character Recognition) of the screenshot, coordinates indicating the clicked position, and keyboard input information.

[0180] This allows the position where the control value is displayed to be correctly estimated.

[0181] Technique 7 is the information processing method according to Technique 5 or 6, in which an operation screen is output in which the position where the control value is displayed is highlighted.

[0182] That is, in this information processing method, for example, an operation screen is estimated, a position where a control value is displayed on the estimated operation screen is estimated, and the estimated operation screen is output with the estimated position emphasized. This makes it easy for a user to understand whether the control value is appropriate. Note that an operation screen may be output in which the control value on the operation screen is replaced with the control value contained in an abnormal packet. This makes it easy for a user to understand whether the control value is abnormal, for example, when the control value of a packet output from an operation device has been tampered with.

[0183] Technique 8 is an information processing method described in any one of Techniques 2 to 7, in which, if operation information associated with a packet of the same type as the packet in which an abnormality is detected is not obtained, an operation screen is output based on metadata included in the packet in which an abnormality is detected.

[0184] For example, an operation screen is output based on operation information associated with a packet (e.g., a packet having the same control type ID) that includes the same type of metadata as the metadata included in the packet in which an abnormality was detected (i.e., the abnormal packet). Information associating such packets with images may be stored in advance in a storage device included in the information processing device. This makes it possible to easily estimate what user operation caused the abnormal packet to be output, even if there is no operation information associated with the abnormal packet.

[0185] Technique 9 is an information processing method described in any one of Techniques 3, 5 to 7, in which, when operation information associated with a packet of the same type as the packet in which an abnormality is detected is acquired, a screenshot included in the operation information associated with the packet of the same type is output as an operation screen.

[0186] This makes it easy to estimate what user operation causes an abnormal packet to be output.

[0187] Technique 10 is an information processing device that includes a detection unit that detects packet abnormalities, and an output unit that, when a packet abnormality is detected, outputs an operation screen that is estimated to cause the packet based on the packet.

[0188] The detection unit is, for example, the above-mentioned anomaly detection unit 103. The output unit is, for example, the above-mentioned visualization unit 111.

[0189] This provides the same effects as the information processing method according to one aspect of the present disclosure.

[0190] Technique 11 is a program for causing a computer to execute the information processing methods described in Techniques 1 to 9.

[0191] This provides the same effects as the information processing method according to one aspect of the present disclosure.

[0192] (Supplementary Note) As described above, the embodiments have been described as examples of the technology disclosed in this application. However, the technology according to the present disclosure is not limited to these, and can be applied to embodiments in which modifications, substitutions, additions, omissions, etc. are made as appropriate.

[0193] Examples of modified examples of the present disclosure are listed below.

[0194] (1) In the embodiment, the description is based on the premise that a control packet is generated immediately after a screen operation. However, in reality, there are cases where a schedule is set by a screen operation and a control packet is generated according to the schedule. Therefore, it is not necessary to set the control packet to be generated immediately after a screen operation. In such cases, when linking a screen operation with a control packet, the linking can be performed by recognizing that it is a schedule setting screen and the time when the setting was made.

[0195] (2) In the embodiment, it is described that the screenshot captured closest to the current time is used in step S1806, but it does not necessarily have to be the screenshot captured closest to the current time. For example, the screenshot to be linked may be randomly selected from one or more screenshots used to estimate the display position of the control value.

[0196] (3) In the embodiment, it is described that the relevant portion is highlighted in step S1808. Possible ways of highlighting include changing the color, surrounding the portion with a frame, or displaying an image with a mouse pointer.

[0197] (4) In the embodiment, to estimate the display position, OCR is performed on a screenshot showing an operation screen displayed on a display device, the output (text information) is acquired, and the degree of match between the text information and a control value is determined, after which the coordinates of the display position are estimated. However, the estimation (determination) of the coordinates of the display position does not necessarily have to be based on a match between the character recognition results. For example, a method of determining whether a screen operation corresponds to a control value can be a method of acquiring and determining the most recent key input (keyboard input). Also, a method of estimating the display position can be a method of determining the display position based on the position of the most recent click. The method of determining a screen operation corresponding to a control value and the method of estimating the display position are not limited to those described above, and any combination thereof may be used.

[0198] (5) In the embodiment, a process for estimating the position where a value included in a control packet such as a control value is displayed is performed, but a link between the screen configuration of the control PC 200 and a control type ID corresponding to a user operation may be acquired in advance from a setting file, etc. In this case, the display position and display format (text box, button, etc.) of the user interface related to the operation of the object to be controlled can be read from the setting file, and the display state can be accurately reproduced, making the display position estimation process itself unnecessary.

[0199] (6) The screen operation output device 100 may be realized as a single device that has all of the components, or may be realized by assigning each function to multiple devices and having these multiple devices work together.

[0200] (7) A process executed by a specific processing unit may be executed by another processing unit. In addition, the order of multiple processes may be changed, or multiple processes may be executed in parallel.

[0201] (8) The communication standard used by each device may be any standard and is not particularly limited.

[0202] (9) Each component may be realized by executing a software program appropriate for that component. Each component may be realized by a program execution unit such as a CPU or processor reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory.

[0203] (10) Each component may be realized by hardware. For example, each component may be a circuit (or integrated circuit). These circuits may form a single circuit as a whole, or each may be a separate circuit. Furthermore, each of these circuits may be a general-purpose circuit or a dedicated circuit.

[0204] (11) The general or specific aspects of the present disclosure may be realized as an apparatus, a system, a method, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM. Also, the general or specific aspects of the present disclosure may be realized as any combination of an apparatus, a system, a method, an integrated circuit, a computer program, and a recording medium.

[0205] (12) The method of communication between the devices in the above-described embodiment is not particularly limited. Furthermore, communication between the devices may involve a relay device (such as a broadband router, not shown).

[0206] In addition, this disclosure also includes forms obtained by applying various modifications to each embodiment that a person skilled in the art would think of, or forms realized by arbitrarily combining the components and functions of each embodiment within the scope of this disclosure.

[0207] The present disclosure is applicable to devices that detect packet anomalies.

[0208] 10 Control system 100 Screen operation output device 101 Screen operation extraction unit 102 Metadata extraction unit 103 Abnormality detection unit 104 Assignment unit 105 Main DB 106 Linking unit 107 Linking parameter storage unit 108 Rule storage unit 109 Specific parameter storage unit 110 Update unit 111 Visualization unit 112 First port 113 Second port 200 Control PC 300 L2SW 301 Mirror port 302 Normal port 400 PLC

Claims

1. An information processing method comprising: detecting an abnormality in a packet; and, if an abnormality in the packet is detected, outputting, based on the packet, an operation screen that is estimated to cause the packet.

2. The information processing method according to claim 1, further comprising the steps of: acquiring operation information relating to a user's operation on an operating device; acquiring a packet; linking the acquired packet to the operation information; and outputting the operation screen based on the linked packet and the operation information.

3. The information processing method of claim 2, wherein the operation information is acquired by acquiring the operation information including a screenshot of a screen displayed on a display device of the operation device when the user performs at least one of clicking a mouse of the operation device and inputting information on a keyboard of the operation device as an operation on the operation device.

4. The information processing method according to claim 2, wherein the linking comprises linking an acquired packet with the operation information acquired within a specific time period corresponding to a time when the packet was acquired.

5. The information processing method according to claim 3, further comprising estimating a position on the operation screen where a control value for controlling the controlled device is displayed and is included in a packet transmitted to the controlled device based on the operation information.

6. The information processing method according to claim 5, wherein the estimation of the position at which the control value is displayed is performed using at least one of an output obtained by OCR (Optical Character Recognition) of the screenshot, coordinates indicating the clicked position, and information on the keyboard input.

7. The information processing method according to claim 5, wherein, in outputting the operation screen, the operation screen is output in which the position where the control value is displayed is emphasized.

8. The information processing method according to claim 2, further comprising: outputting the operation screen based on metadata contained in the packet in which the abnormality is detected when the operation information associated with a packet of the same type as the packet in which the abnormality is detected is not obtained.

9. The information processing method according to claim 3, wherein, when operation information associated with a packet of the same type as a packet in which an abnormality has been detected is acquired, the screenshot included in the operation information associated with the packet of the same type is output as the operation screen.

10. An information processing device comprising: a detection unit that detects an abnormality in a packet; and an output unit that, when an abnormality in the packet is detected, outputs, based on the packet, an operation screen that is estimated to cause the packet.

11. A program for causing a computer to execute the information processing method according to any one of claims 1 to 9.

Images