Information processing method, information processing device, and program

Abstract

An information processing method according to one aspect of the present disclosure involves: acquiring a packet flowing through a network; and when an operation device receives, from a user via a Graphical User Interface (GUI) displayed on the operation device, an operation for causing the operation device to transmit packets acquired over the network, determining whether the acquired packet is abnormal on the basis of an operation image displayed on the operation device.

Description

Information processing method, information processing device, and program

[0001] The present disclosure relates to a technique for detecting abnormal communications on a network.

[0002] Conventionally, control devices installed in factory facilities, etc., have used their own communication methods and have been connected to other devices via their own communication lines to communicate with them. However, in recent years, with the spread of the Internet, communication standards between control devices have been established that use Ethernet (registered trademark) or IP (Internet Protocol), which are general-purpose protocols that have become faster and cheaper.

[0003] However, in recent years, the use of general-purpose communication standards has increased the risk of control devices being exposed to cyberattacks, including malware. Therefore, attempts are often made to monitor control system networks using Intrusion Detection Systems (IDSs) to detect and address abnormal communications. In control systems, processing basically occurs automatically according to predetermined logic, and the traffic (data) required for that processing also occurs automatically, making it easy to learn the underlying behavior. Therefore, it is common to detect abnormal communications using IDSs that have the function of detecting abnormalities in that behavior.

[0004] Another method for detecting anomalies by linking it to user operation information is disclosed in Patent Document 1. Patent Document 1 discloses a device that determines that there is a high possibility of a cyber attack if an abnormal packet is observed but no user operation has occurred.

[0005] International Publication No. 2022 / 249816

[0006] The present disclosure provides an information processing method and the like that can facilitate appropriate detection of abnormal packets.

[0007] An information processing method according to one aspect of the present disclosure acquires packets flowing through a network, and when an operation to transmit the acquired packets via the network to an operating device is received from a user using a GUI (Graphical User Interface) displayed on the operating device, the information processing method determines whether the acquired packets are abnormal based on an operation image displayed on the operating device.

[0008] An information processing device according to one aspect of the present disclosure includes an acquisition unit that acquires packets flowing through a network, and a determination unit that, when an operation to transmit the acquired packets via the network to an operation device is received from a user using a GUI (Graphical User Interface) displayed on the operation device, determines whether the acquired packets are abnormal based on image information indicating an operation image displayed on the operation device.

[0009] A program according to one aspect of the present disclosure is a program for causing a computer to execute the information processing method.

[0010] According to an information processing method and the like according to one aspect of the present disclosure, it is possible to facilitate appropriate detection of abnormal packets.

[0011] FIG. 1 is a block diagram showing the configuration of a control system in which an anomaly detection device according to an embodiment is used. FIG. 2 is a block diagram showing the configuration of the anomaly detection device according to an embodiment. FIG. 3 is a diagram showing pair information of IP addresses that are targets of anomaly detection by the anomaly detection device according to an embodiment. FIG. 4 is a diagram showing operation information used by the anomaly detection unit according to an embodiment. FIG. 5 is a diagram showing metadata extracted by a metadata extraction unit according to an embodiment. FIG. 6 is a diagram showing a type definition rule for control packets according to an embodiment. FIG. 7 is a diagram showing a control type ID table stored in a main DB corresponding to a screen operation according to an embodiment. FIG. 8 is a diagram showing a packet metadata table stored in a main DB corresponding to a screen operation according to an embodiment. FIG. 9 is a diagram showing a screen operation information table stored in a main DB corresponding to a screen operation according to an embodiment. FIG. 10 is a diagram showing a method in which the anomaly detection unit according to an embodiment detects an anomaly in a control packet based on operation information. FIG. 11 is a flowchart showing an overall view of processing by the anomaly detection device according to an embodiment. FIG. 12 is a flowchart showing processing for extracting a control type ID of a control packet according to an embodiment. FIG. 13 is a flowchart showing processing for calculating an anomaly level according to an embodiment. FIG. 14 is a flowchart showing an information processing method executed by an information processing device according to an embodiment.

[0012] Hereinafter, an embodiment of one aspect of the present disclosure will be described with reference to the drawings. Each embodiment shown here represents a specific example of the present disclosure. Therefore, the numerical values, shapes, components, arrangement and connection of the components, steps (processes), and order of steps shown in the following embodiments are merely examples and do not limit the present disclosure. Among the components in the following embodiments, components not recited in the independent claims are components that can be added arbitrarily. Furthermore, each figure is a schematic diagram and is not necessarily an exact illustration.

[0013] Furthermore, in this specification, when a statement is made in comparison with, for example, "greater than a threshold" or "equal to or less than a threshold," it means that the distinction is made on the basis of the threshold, and may mean "greater than or equal to the threshold" or "less than the threshold," respectively.

[0014] (Embodiment) An anomaly detection device according to an embodiment will be described below. This anomaly detection device associates a communication anomaly with a screen operation.

[0015] [Configuration] Fig. 1 is an example of a block diagram showing the configuration of a control system 10 in which an anomaly detection device 100 according to an embodiment is used. Specifically, Fig. 1 shows the overall configuration of the control system 10 in this embodiment. In this embodiment, each device included in the control system 10 communicates over Ethernet defined by IEEE 802.3 using an appropriate protocol depending on the characteristics of the application, such as TCP / IP or UDP / IP.

[0016] First, each component included in the control system 10 will be described.

[0017] 1 , the control system 10 includes an anomaly detection device 100, a control PC (Personal Computer) 200, an L2SW (Layer 2 Switch) 300, and a PLC (Programmable Logic Controller) 400. Each component of the control system 10 may be located, for example, within a factory, or at least some of the components may be located outside the factory.

[0018] In a control network (e.g., a factory network) used for communication by each device included in the control system 10, each device is connected via an L2SW 300. The control PC 200 and the PLC 400 can communicate with each other via the L2SW 300. The control PC 200 is a device for controlling each piece of production equipment in the factory.

[0019] The control PC 200 is, for example, a desktop personal computer, but may also be realized by a tablet terminal or the like. The control PC 200 is an example of an operation device. The control PC 200 includes, for example, a display device that displays an operation image (operation screen) for transmitting (generating) packets (control packets), an input device that accepts operations (input) from a user, and a control device that controls the image displayed on the display device and performs processing such as transmitting a control packet to the PLC 400 based on the user operation accepted by the input device.

[0020] The display device is, for example, a display that displays images for a user to perform operations, such as a GUI (Graphical User Interface).

[0021] The input device is a device for receiving operations from a user, and is a mouse and / or a keyboard, etc. The input device may be realized by a touch panel, etc.

[0022] The control device is a computer that performs various types of information processing. The control device includes, for example, a communication interface such as a communication circuit for communicating with the information processing device and the controlled device via a network, a non-volatile memory that stores programs, a volatile memory that is a temporary storage area for executing the programs, an input / output port for sending and receiving signals, and a processor that executes the programs.

[0023] A user operates the control PC 200 to transmit a control packet for controlling the PLC 400 (more specifically, a control packet for the PLC 400 to control the production equipment) to the PLC 400. Specifically, the user transmits a control packet to the PLC 400 by operating a GUI displayed on the control PC 200. In this case, the user transmits the control packet to the PLC 400 by, for example, using an input device to click a mouse to select an icon such as a send button on the GUI while viewing the GUI (specifically, an operation screen) displayed on the display device.

[0024] In the following, a user may use an input device to perform an operation such as clicking a mouse to select an icon such as a send button on an operation screen displayed on a display device while viewing the operation screen. For example, in the present disclosure, a screen operation is a general term for an input received on the operation screen of the control PC 200, a click position on the operation screen, keyboard input information, and the like.

[0025] The PLC 400 is a device for automatically controlling each piece of production equipment in a factory, and controls each piece of production equipment according to a predetermined sequence or procedure. Although not shown, the PLC 400 is connected to each piece of production equipment so that it can communicate with them. The PLC 400 can control, for example, multiple motors and multiple actuators. Each of the multiple motors and multiple actuators is assigned an object ID for identification.

[0026] PLC 400 is realized by, for example, a communication interface such as a communication circuit for communication, a non-volatile memory in which a program is stored, a volatile memory which is a temporary storage area for executing the program, an input / output port for sending and receiving signals, and a processor that executes the program.

[0027] The L2SW 300 is a relay device in the control network that performs processing to transmit acquired information to a device corresponding to the information. The L2SW 300 has a mirror port 301 and a normal port 302.

[0028] The mirror port 301 is a port that can capture packets flowing on the network switch. The mirror port 301 is also called a monitor port. The L2SW 300 has many ports for connecting LAN (Local Area Network) cables, and the mirror port 301 copies (mirrores) packets flowing through a specified port. In this embodiment, the anomaly detection device 100 is connected to the mirror port 301 and the normal port 302.

[0029] FIG. 2 is a block diagram showing the configuration of the anomaly detection device 100 according to the embodiment.

[0030] As shown in FIG. 2, the anomaly detection device 100 includes a metadata extraction unit 101, an assignment unit 102, a screen operation extraction unit 103, a main DB 104, an update unit 105, a rule storage unit 106, an anomaly detection unit 107, a first port 108, and a second port 109.

[0031] The anomaly detection device 100 is realized by, for example, a computer device including a communication interface such as a communication circuit for communication, a memory, and a processor that executes a program stored in the memory.

[0032] The metadata extraction unit 101 is a processing unit that observes control packets flowing through the control network via the second port 109. Specifically, the metadata extraction unit 101 acquires control packets flowing through the control network. More specifically, the metadata extraction unit 101 acquires metadata included in the acquired control packets. Specific examples of metadata will be described later. The metadata extraction unit 101 is an example of an acquisition unit.

[0033] The assigning unit 102 is a processing unit that assigns a control type ID to the acquired control packet.

[0034] The control type ID is an identifier that is uniquely determined based on information that may be included in a control packet, such as the source IP address, destination IP address, and command (control content) of the control packet. The control type ID is arbitrarily determined based on, for example, a combination of this information. The assigning unit 102 assigns a control type ID to the acquired control packet based on data (metadata) included in the control packet, and stores the control type ID in the main DB 104. A specific example of how the control type ID is set will be described later.

[0035] The screen operation extraction unit 103 is a processing unit that acquires information based on screen operations by a user on the control PC 200. That is, the screen operation extraction unit 103 acquires information (also referred to as operation information) regarding operations (screen operations) on the control PC 200 by a user who operates the control PC 200. Specifically, the screen operation extraction unit 103 acquires information indicating the user's screen operations from the control PC 200 via the first port 108.

[0036] For example, the screen operation extraction unit 103 acquires, as operation information, screenshots (screenshot images) of the moment the user performs a click and the moment the user performs a key input (keyboard input). Specifically, the screen operation extraction unit 103 acquires operation information including a screenshot (also referred to as an operation image) of a GUI displayed on a display device of the control PC 200 when the user performs at least one of a mouse click on the control PC 200 and a keyboard input on the control PC 200 as an operation on the control PC 200. For example, when the control PC 200 accepts one of these operations from the user, it acquires, as an operation image, a screenshot of the GUI displayed at that time together with the time of acceptance, and transmits the operation image to the anomaly detection device 100.

[0037] The main DB 104 is a storage device that stores control packets to which a control type ID is assigned. Specifically, the main DB 104 stores a control type ID table, which is a database in which the control type ID is associated with each piece of data included in the control packet.

[0038] The update unit 105 is a processing unit that associates screen operations with control packets. Specifically, the update unit 105 associates the acquired control packets with operation information. More specifically, the update unit 105 associates information about user operations on the control PC 200 extracted by the screen operation extraction unit 103 with multiple pieces of metadata extracted by the metadata extraction unit 101 and included in the control packets.

[0039] For example, in linking, the update unit 105 links the control packet acquired by the metadata extraction unit 101 with the operation information acquired by the screen operation extraction unit 103 within a specific time period corresponding to the time when the control packet was acquired.

[0040] The specific time is set to, for example, within one second, but may be set arbitrarily in advance and is not particularly limited.

[0041] The control PC 200 may also transmit the operation information in association with the control packet, in which case the association process executed by the update unit 105 may not be performed.

[0042] The rule storage unit 106 is a storage device that stores information (also called type definition rules) indicating definitions (rules) of types of control packets to be linked to screen operations. The update unit 105 determines, for example, based on the type definition rules, whether the acquired control packet is a control packet to be linked to a screen operation.

[0043] The anomaly detection unit 107 is a processing unit that detects anomalies in observed communications. Specifically, the anomaly detection unit 107 detects anomalies in control packets flowing through the control network. More specifically, the anomaly detection unit 107 observes control packets flowing through the control network via the second port 109. More specifically, the anomaly detection unit 107 acquires control packets flowing through the control network and detects anomalies in the acquired control packets.

[0044] The abnormality detection unit 107 is an example of a determination unit.

[0045] In this embodiment, when the control PC 200 receives an operation from the user to transmit a control packet obtained via a network to the control PC 200 using a GUI displayed on the control PC 200, the abnormality detection unit 107 determines whether the obtained control packet is abnormal based on the operation image displayed on the control PC 200. In other words, the abnormality detection unit 107 determines whether the obtained control packet is abnormal based on the operation image displayed on the control PC 200 at the time the control PC 200 receives an operation from the user to transmit a control packet.

[0046] For example, the anomaly detection unit 107 extracts a feature vector indicating a feature amount of an operation image when determining whether a control packet is abnormal. Furthermore, for example, the anomaly detection unit 107 determines whether an acquired control packet is abnormal based on the feature vector included in the screen operation information table and the extracted feature vector.

[0047] The screen operation information table is information showing the relationship between an operation that causes a control packet to be sent to the control PC 200 and a feature vector that indicates the feature quantities of the image displayed on the control PC 200 when the control PC 200 accepts the operation from a user using a GUI displayed on the control PC 200.

[0048] The screen operation information table is an example of an image information table.

[0049] The screen operation information table may store an operation for transmitting a control packet to the control PC 200 in association with an image displayed on the control PC 200 when the control PC 200 accepts the operation from a user using a GUI displayed on the control PC 200. In this case, the abnormality detection unit 107 may use the image to calculate a feature vector, which is a feature amount of the image.

[0050] The operation image is, for example, the above-mentioned screen shot, and is image data included in the operation information.

[0051] Furthermore, for example, in determining whether a control packet is abnormal, the abnormality detection unit 107 determines that the acquired control packet is abnormal if the distance d between the extracted feature vector and the feature vector closest to it among multiple feature vectors included in the screen operation information table is greater than a predetermined threshold T. On the other hand, for example, if the distance d is equal to or less than the threshold T, the abnormality detection unit 107 determines that the acquired control packet is not abnormal (i.e., normal).

[0052] The threshold value T may be arbitrarily determined in advance and is not particularly limited. Information indicating the threshold value T is stored in advance in a storage device included in the anomaly detection device 100, for example.

[0053] Furthermore, for example, each of the plurality of feature vectors (feature amounts) included in the screen operation information table is associated with a control type ID indicating the type of control packet associated with the feature vector. For example, when determining whether a control packet is abnormal, if the variation among one or more feature vectors associated with the same control type ID among the plurality of feature vectors included in the screen operation information table is greater than a predetermined variation, the anomaly detection unit 107 determines whether the acquired control packet is abnormal without using the one or more feature vectors associated with the same control type ID. On the other hand, for example, when determining whether a control packet is abnormal, if the variation among one or more feature vectors associated with the same control type ID is equal to or less than a predetermined variation, the anomaly detection unit 107 determines whether the acquired control packet is abnormal using the one or more feature vectors associated with the same control type ID. For example, when determining whether a control packet is abnormal, the abnormality detection unit 107 calculates the variation of one or more feature vectors by calculating the average value (specifically, a real number) of the distance d of one or more feature vectors from the center of gravity vector of one or more feature vectors linked to the same control type ID to the power N (N is a value greater than 0).

[0054] The predetermined variation may be arbitrarily determined in advance and is not particularly limited. Information indicating the predetermined variation is stored in advance in a storage device included in the anomaly detection device 100, for example.

[0055] The anomaly detection unit 107 outputs a determination result (detection result) of an anomaly in the control packet. The anomaly detection unit 107 may transmit the detection result to the control PC 200, may output the detection result to a display device connected to the anomaly detection device 100 to display the detection result, or may transmit the detection result to a device that analyzes the control packet.

[0056] The first port 108 is a communication interface connected to the normal port 302 and used to acquire control packets. The first port 108 is implemented, for example, by a connector to which a communication line is connected. Note that the first port 108 may also be implemented by a communication circuit for wireless communication.

[0057] The second port 109 is a communication interface connected to the mirror port 301 and used to acquire control packets. The second port 109 is implemented, for example, by a connector to which a communication line is connected. Note that the second port 109 may also be implemented by a communication circuit for wireless communication.

[0058] Processing units such as the metadata extraction unit 101, the assignment unit 102, the screen operation extraction unit 103, the update unit 105, and the anomaly detection unit 107 are realized by, for example, a memory in which a control program is stored and a processor such as a CPU (Central Processing Unit) that executes the control program. The processor of each processing unit may be realized by a single memory and processor, or may be realized by separate memories and processors.

[0059] The storage devices such as the main DB 104 and the rule storage unit 106 are realized by storage devices such as a hard disk drive (HDD) or a semiconductor memory. Each storage device may be realized by a single storage device or by separate storage devices.

[0060] Next, the processing performed by each processing unit included in the anomaly detection device 100 will be described in detail.

[0061] 3 shows pair information of IP addresses that are targets of anomaly detection (targets of communication monitoring) by the anomaly detection device 100 according to the embodiment. Specifically, FIG. 3 shows communication monitoring target IP address information used by the assignment unit 102. For example, FIG. 3 shows IP addresses of devices that are targets of monitoring by the anomaly detection device 100. Such setting information indicating IP addresses is stored in advance in, for example, a storage device provided in the anomaly detection device 100.

[0062] For example, packets that are the target of the anomaly detection device 100 for storing screen operations and detecting anomalies are limited to communications between IP addresses shown in FIG.

[0063] Fig. 4 is a diagram showing operation information (screen operation information) used by the anomaly detection unit 107 according to the embodiment. Fig. 4 is a diagram showing an image extracted by the screen operation extraction unit 103 according to the embodiment. Specifically, Fig. 4 is an example of operation information extracted by the screen operation extraction unit 103.

[0064] 4 , the present disclosure assumes a situation in which the control system 10 is controlled through screen operations. Therefore, it is assumed that the screen display displayed by the control PC 200 displays items to be controlled and setting values ​​such as control values. One possible method for acquiring screen operations is to install a keylogger in the control PC 200, capture the screen display at the timing when the screen operations should be acquired, and send the captured screen display to the anomaly detection device 100.

[0065] FIG. 5 is a diagram showing metadata (packet metadata) extracted by the metadata extraction unit 101 according to the embodiment.

[0066] As shown in FIG. 5, the metadata included in the control packet includes information such as the time, source IP address, destination IP address, command type, type of object to be controlled (object type), object instance number, and the obtained control value.

[0067] The object type is information indicating what kind of value is being handled.

[0068] The instance number is information that is set for each object and indicates the order of the object.

[0069] 6 is a diagram illustrating a type definition rule for a control packet according to an embodiment. Specifically, FIG. 6 is a diagram illustrating an example of a type definition rule for a control packet to be associated with a screen operation, which is stored in the rule storage unit 106.

[0070] 6, control packets that are associated with screen operations are limited to those whose command type is, for example, “write” or “add.” The update unit 105 assigns a control type ID according to, for example, this type definition rule.

[0071] Note that both "all" and "*" shown in FIG. 6 link control packets of any parameter of that attribute to screen operations. "all" treats all values ​​of that parameter distinctly. On the other hand, "*" treats all values ​​of that parameter without distinction. As a result, differences occur in the control type ID table shown in FIG. 7.

[0072] The type definition rules are, for example, (A) and (B) below.

[0073] (A) When the acquired control packet satisfies any of the conditions of the type definition rules and the control type ID corresponding to the control packet has not already been assigned to the control packet (for example, when no control type ID exists yet), the assignment unit 102 generates a new control type ID and links the attribute values ​​of the acquired control packet (each piece of metadata included in the control packet) to the control type ID.

[0074] (B) When the acquired control packet satisfies any of the conditions of the control packet type definition rules, the assignment unit 102 simply assigns the control type ID to the control packet (more specifically, each piece of metadata contained in the control packet).

[0075] However, the above type definition rules are based on the premise that conditions associated with multiple control type IDs will not match.

[0076] The control type ID may be arbitrarily determined in advance based on a combination of these pieces of information, for example.

[0077] 7 is a diagram showing a control type ID table corresponding to screen operations according to an embodiment and stored in main DB 104. Specifically, FIG. 7 is a diagram showing a control type ID table generated in accordance with the above type definition rules and stored in main DB 104.

[0078] As shown in FIG. 7, the control type ID is incremented each time a control packet with a newly acquired attribute that satisfies the type definition rule is acquired.

[0079] 8 is a diagram showing a packet metadata table corresponding to a screen operation according to an embodiment and stored in the main DB 104. Specifically, FIG. 8 is a diagram showing a packet metadata table including a control type ID to which each control packet belongs.

[0080] The assigning unit 102 assigns the control type ID of each control packet extracted by the metadata extraction unit 101 to the metadata of the control packet while referring to information in the control type ID table stored in the main DB 104, and returns the control type ID to the main DB 104. The main DB 104 updates the packet metadata table by assigning the control type ID given by the assigning unit 102 to metadata included in a control packet whose control type ID is still unknown.

[0081] FIG. 9 is a diagram showing a screen operation information table stored in main DB 104 corresponding to screen operations according to the embodiment.

[0082] When the update unit 105 extracts a screen operation (operation information) associated with a control packet included in the packet metadata table, it adds a new record to the screen operation information table shown in Figure 9 and records the control type ID to which the control packet belongs and the operation information indicating the screen operation.

[0083] The screen operation information table may include feature amounts of operation images (screenshots) included in the operation information. For example, the update unit 105 performs image processing on the operation images to calculate feature vectors indicating the feature amounts of the operation images. The calculation of the feature vectors may be performed by the anomaly detection unit 107.

[0084] FIG. 10 is a diagram showing a method in which the abnormality detection unit 107 according to the embodiment performs abnormality detection based on operation information.

[0085] As shown in FIG. 10A, the screen operation extraction unit 103 acquires operation information when a control packet output by a target for detecting an abnormality is acquired.

[0086] Furthermore, as shown in FIG. 10B, the abnormality detection unit 107 extracts a feature amount of the operation image included in the operation information.

[0087] Also, as shown in (c) of Figure 10, the abnormality detection unit 107 extracts the control type ID indicated by the control packet and extracts one or more operation images in the screen operation information table linked to the same control type ID that occurred in the past.

[0088] 10(d), the anomaly detection unit 107 extracts a feature amount from each of the one or more extracted operation images. As a result, corresponding feature amounts are extracted from each of the one or more operation images, such as extracting "feature amount 1" from "operation image 1" and "feature amount 2" from "operation image 2."

[0089] 10(e), the anomaly detection unit 107 compares a feature vector calculated from the acquired operation image with the extracted feature vector. Specifically, the anomaly detection unit 107 extracts, from among one or more feature vectors extracted from the screen operation information table, a feature vector that is closest to a feature vector extracted from the operation image included in the operation information linked to the acquired control packet. Furthermore, the anomaly detection unit 107 determines whether a distance d between the feature vector calculated from the acquired operation image and the extracted closest feature vector is greater than a predetermined threshold T. For example, if the distance d between the feature vector calculated from the acquired operation image and the extracted closest feature vector is greater than a predetermined threshold T, the anomaly detection unit 107 detects an anomaly between the control packet and the screen operation indicated by the operation information linked to the control packet.

[0090] [Processing Procedure] FIG. 11 is a flowchart showing an overview of the processing performed by the anomaly detection device 100 according to the embodiment.

[0091] 11 , when the anomaly detection device 100 starts the anomaly detection process, it first starts observing control packets (S1010). For example, the metadata extraction unit 101 and the screen operation extraction unit 103 start acquiring control packets and operation information flowing through the control network.

[0092] Next, the assigning unit 102 extracts the control type ID of the acquired control packet (S1020). For example, if a condition is satisfied, the assigning unit 102 associates the control type ID with the acquired control packet and stores the control type ID in the main DB 104. In other words, the assigning unit 102 assigns the control type ID to the acquired control packet.

[0093] Next, the assigning unit 102 determines whether the extracted control type ID is a control type ID of a target for which an abnormality is to be detected (S1030).

[0094] If the assigning unit 102 determines that the extracted control type ID is not a control type ID for which an abnormality is to be detected (NO in S1030), the abnormality detection device 100 ends the process. In this case, the abnormality detection device 100 waits until the next control packet is observed.

[0095] On the other hand, if the assigning unit 102 determines that the extracted control type ID is the control type ID of the target for which an abnormality is to be detected (YES in S1030), the screen operation extraction unit 103 performs a process of acquiring operation information immediately after the control packet is generated (i.e., immediately after the control packet is acquired) (S1040). As a result, the screen operation extraction unit 103 acquires operation information linked to the acquired control packet. Specifically, the screen operation extraction unit 103 acquires an operation image displayed on the control PC 200 when the control PC 200 accepts an operation to send the acquired control packet to the control PC 200 from the user using a GUI displayed on the control PC 200.

[0096] Next, the update unit 105 extracts the feature amount (specifically, the feature vector) of the operation image included in the acquired operation information using a neural network or the like that receives the acquired operation information as input (S1050).

[0097] Next, the update unit 105 determines whether a control packet associated with the same control type ID as the control type ID associated with the acquired control packet has been acquired in the past (S1060).

[0098] If the update unit 105 determines that a control packet associated with the same control type ID as the control type ID associated with the acquired control packet has not been acquired in the past (NO in S1060), it writes the control type ID associated with the acquired control packet, the operation image indicating the screen operation included in the operation information associated with the control packet, and the extracted feature amount into a screen operation information table stored in the main DB 104, thereby storing this information in the main DB 104 (S1120), and terminates the processing.

[0099] On the other hand, if the update unit 105 determines that a control packet associated with the same control type ID as the control type ID associated with the acquired control packet has been acquired in the past (YES in S1060), the abnormality detection unit 107 performs an abnormality degree calculation process (S1070).

[0100] If the calculated abnormality level is equal to or less than the threshold value T as a result of the processing in step S1070 (NO in S1080), the abnormality detection unit 107 determines that the acquired control packet is normal and proceeds to step S1120.

[0101] On the other hand, if the calculated abnormality level is greater than the threshold value T as a result of the processing in step S1070 (Yes in S1080), the anomaly detection unit 107 determines that the acquired control packet is abnormal. In this case, the anomaly detection unit 107 outputs an operation image included in the operation information acquired immediately after the acquired control packet was generated, and an operation image included in the operation information acquired immediately after the previously acquired control packet was generated, which is associated with the same control type ID as the control type ID associated with the acquired control packet. In other words, when the anomaly detection unit 107 determines that the control packet is abnormal, it outputs the operation image associated with the control packet and the operation image associated with a control packet having the same control type ID as the control packet. The anomaly detection unit 107 outputs these operation images to, for example, a display device provided in the anomaly detection device 100, thereby displaying these operation images on the display device in comparison (S1090).

[0102] Next, the anomaly detection unit 107 receives a determination of normal or abnormal input from the user (S1100). The user checks the two displayed operation images, determines whether the acquired control packet is indeed abnormal, and then performs input. The anomaly detection device 100 includes, for example, an input device such as a mouse and / or a keyboard to receive input from the user. The anomaly detection unit 107 receives input from the user via the input device.

[0103] These operation images may be output to the control PC 200, and the control PC 200 may receive a determination of whether the input is normal or abnormal from the user.

[0104] If the input indicates that the information is normal (YES in S1110), the updating unit 105 adds the currently extracted operation information and feature quantity to the screen operation information table as normal data in step S1120, and ends the process. This makes it possible to provide feedback even if the detected information is incorrect.

[0105] On the other hand, if an abnormality is input (NO in S1110), the update unit 105 does not perform step S1120, that is, it determines that the operation information and feature values ​​extracted this time are abnormal data, and ends the process without adding this information to the screen operation information table.

[0106] As a result, the operation information and feature amounts when the control packet is normal are stored (updated) in the screen operation information table.

[0107] 12 is a flowchart showing the process of extracting the control type ID of the control packet according to the embodiment, specifically, the process of step S1020.

[0108] As shown in FIG. 12, when the assignment unit 102 starts the process of extracting the control type ID of the control packet, the assignment unit 102 reads the type definition rule for the control packet stored in the rule storage unit 106 (S1021).

[0109] Next, the assignment unit 102 reads the control type ID table stored in the main DB 104 (S1022).

[0110] Next, the assignment unit 102 determines whether the acquired control packet is a monitored IP address based on the type definition rule (S1023).

[0111] If the assignment unit 102 determines that the acquired control packet is a monitored IP (YES in S1023), it determines whether the acquired control packet is a control packet to be linked to a screen operation (S1024).

[0112] If the assignment unit 102 determines that the acquired control packet is a control packet to be linked to a screen operation (YES in S1024), it determines whether the control type ID to be linked to the acquired control packet has already been assigned to a control packet acquired in the past (S1025).

[0113] If the assignment unit 102 determines that the control type ID associated with the acquired control packet has already been assigned to a control packet acquired in the past (YES in S1025), it assigns a new control type ID to the acquired control packet and updates the control type ID table (S1026).

[0114] If the assignment unit 102 determines that the control type ID associated with the acquired control packet has not already been assigned to a control packet acquired in the past (NO in S1025), or after step S1026, the assignment unit 102 stores information about the acquired control packet (e.g., metadata included in the control packet) in the packet metadata table (S1027), and terminates the process of extracting the control type ID of the control packet.

[0115] In addition, if the assignment unit 102 determines that the acquired control packet is not a monitored IP (NO in S1023), or if it determines that the acquired control packet is not a control packet to be linked to a screen operation (NO in S1024), it terminates the extraction process of the control type ID of the control packet.

[0116] 13 is a flowchart of the abnormality degree calculation process according to the embodiment. Specifically, FIG. 13 is a flowchart showing the details of the process of step S1070.

[0117] As shown in FIG. 13, first, the abnormality detection unit 107 extracts from the screen operation information table all the features of the operation image contained in the operation information associated with the control packet assigned the same control type ID as the control type ID assigned to the control packet observed (acquired) in step S1010 (S1071).

[0118] Next, the anomaly detection unit 107 extracts, from the one or more extracted feature amounts, the feature amount that is closest in distance to the feature amount of the operation image included in the operation information linked to the acquired control packet, and calculates the distance d as the degree of anomaly (S1072). Specifically, the anomaly detection unit 107 calculates the distances between the feature amount of the operation image immediately after the acquired control packet is generated, extracted in step S1050, and all the feature amounts extracted in step S1071, finds the shortest distance among the calculated distances, and calculates the shortest distance as the degree of anomaly.

[0119] (Summary) FIG. 14 is a flowchart showing an information processing method executed by the information processing device according to the embodiment.

[0120] The information processing device is, for example, the anomaly detection device 100 described above.

[0121] First, the information processing device acquires packets flowing through a network (S10). For example, the information processing device acquires packets transmitted to a controlled device on the network. The network is, for example, the control network described above. The controlled device is, for example, the PLC 400 described above. The packets are, for example, the control packets described above, which are packets transmitted to the controlled device to control the controlled device. For example, the information processing device acquires (observes) packets on the network to which the controlled device is connected.

[0122] Next, when the operation device receives an operation from the user using the GUI displayed on the operation device to transmit the packet obtained via the network to the operation device, the information processing device determines whether the obtained packet is abnormal based on the operation image displayed on the operation device (S20). In other words, if the operation device transmits the obtained packet via the network, the information processing device determines whether the packet is abnormal based on the operation image showing the screen display that is estimated to have been displayed on the operation device at the time when the operation to transmit the packet was received by the operation device from the user using the GUI displayed on the operation device.

[0123] The operating device is, for example, the control PC 200 described above.

[0124] A user operates an operation device to transmit a packet to a controlled device. At this time, the user transmits a packet to the controlled device by, for example, using an input device to perform an operation such as clicking a mouse to select an icon such as a send button on a GUI (screen display) displayed on a display device.

[0125] However, there is a possibility that a packet that causes an abnormal control of a controlled device may be transmitted to the controlled device by a malicious third party. Also, there is a possibility that a packet transmitted from an operating device may be tampered with and transmitted to the controlled device so as to cause the controlled device to perform an abnormal control. The information processing device detects such an abnormal packet.

[0126] When the control system 10 is controlled by malware or the like, it is often the case that no user operation is involved. Therefore, there is a high possibility that packet anomalies can be detected by discrepancies between the information contained in the user operation (screen operation) and the acquired packet.

[0127] Based on this idea, in the present disclosure, when a packet is acquired, it is determined whether there is any discrepancy between the screen display normally displayed on the operating device when the packet is generated and the information such as control values ​​included in the packet. As a result, by observing the information on the screen operation immediately after the communication (packet) is generated, it is possible to detect an abnormality in the communication (packet).

[0128] Furthermore, the information processing device makes it easy to understand the screen operations (GUI operations) that cause packets detected as abnormal, thereby enabling efficient analysis at the SOC (Security Operation Center).

[0129] The information processing device may transmit the abnormality detection result to an operation device, may output it to a display device connected to the information processing device, or may output it to a device that analyzes packets.

[0130] The information processing device includes, for example, a processor and a memory, and the processor uses the memory to perform the above-described information processing method.

[0131] (Effects, etc.) Hereinafter, examples of techniques that can be obtained from the disclosure of this specification will be given, and effects, etc. that can be obtained from the exemplified techniques will be described.

[0132] Technique 1 is an information processing method in which a packet flowing through a network is acquired (S10), and when an operation to transmit the acquired packet via the network to an operation device is received from a user using a GUI (Graphical User Interface) displayed on the operation device, a determination is made as to whether the acquired packet is abnormal based on an operation image displayed on the operation device (S20).

[0133] This allows for determining whether there is a difference between information included in the packet and information included in the operation image that indicates the operation performed by the user to cause the operation device to transmit the packet. For example, if there is a difference between information included in the packet and information included in the operation image that indicates the operation performed by the user to cause the operation device to transmit the packet, there is a possibility that the packet has been tampered with by a cyber attack from a third party. Therefore, according to an information processing method according to one aspect of the present disclosure, it is possible to appropriately detect abnormal packets. Furthermore, since the cause of the abnormal packet can be easily identified, the amount of processing required for anomaly analysis can be reduced. Furthermore, anomaly analysis can be performed quickly.

[0134] Technology 2 is an information processing method described in Technology 1, in which the above determination extracts a feature vector indicating the feature amount of the operation image, and determines whether the acquired packet is abnormal based on the feature vector included in the image information table and the extracted feature vector, and the image information table is information indicating the relationship between the operation of transmitting a packet to the operation device and the feature vector indicating the feature amount of the image displayed on the operation device when the operation device accepts the operation from the user using a GUI displayed on the operation device.

[0135] This allows appropriate determination of whether or not there is an abnormality in the packet by using the acquired packet, the acquired operation image, and the image information table.

[0136] Technique 3 is an information processing method described in Technique 2, in which the acquired packet is determined to be abnormal if the distance between the extracted feature vector and the feature vector closest to it among multiple feature vectors included in the image information table is greater than a predetermined threshold.

[0137] This allows appropriate determination of whether or not an abnormality exists in the acquired packet.

[0138] Technique 4 is an information processing method described in Technique 2 or 3, in which a control type ID indicating the type of packet linked to each of the multiple feature vectors included in the image information table is linked, and in the above determination, if the variation among one or more feature vectors linked to the same control type ID among the multiple feature vectors is greater than a predetermined variation, a determination is made as to whether the acquired packet is abnormal without using the one or more feature vectors linked to the same control type ID.

[0139] When the variation is large, there is a possibility that the same packet may be transmitted due to different inputs from the user. Therefore, the variation is calculated as described above, and when the variation is large, the corresponding feature vector is not used for determining an abnormality. This can prevent a decrease in the accuracy of the determination.

[0140] Technique 5 is an information processing method described in Technique 4, in which, in the above determination, if the variation of one or more feature vectors linked to the same control type ID is less than a predetermined variation, the one or more feature vectors linked to the same control type ID are used to determine whether the acquired packet is abnormal.

[0141] This can improve the accuracy of the above determination.

[0142] Technique 6 is an information processing method described in Technique 4 or 5, in which the above determination calculates the variation of one or more feature vectors by calculating the average value of the value obtained by raising the distance of one or more feature vectors from the center of gravity vector of one or more feature vectors linked to the same control type ID to the power of N (N is a real number greater than 0).

[0143] This allows the above-mentioned variations to be calculated with high accuracy.

[0144] Technique 7 is an information processing device including an acquisition unit that acquires packets flowing through a network, and a determination unit that, when the operation device receives an operation from a user using a GUI (Graphical User Interface) displayed on the operation device to transmit the packets acquired via the network to the operation device, determines whether the acquired packets are abnormal based on image information indicating an operation image displayed on the operation device.

[0145] The acquisition unit is, for example, the above-mentioned metadata extraction unit 101. The determination unit is, for example, the above-mentioned anomaly detection unit 107.

[0146] This provides the same effects as the information processing method according to one aspect of the present disclosure.

[0147] The eighth aspect of the present invention is a program for causing a computer to execute the information processing method according to any one of the first to sixth aspects.

[0148] This provides the same effects as the information processing method according to one aspect of the present disclosure.

[0149] (Supplementary Note) As described above, the embodiments have been described as examples of the technology disclosed in this application. However, the technology according to the present disclosure is not limited to these, and can be applied to embodiments in which modifications, substitutions, additions, omissions, etc. are made as appropriate.

[0150] Examples of modified examples of the present disclosure are listed below.

[0151] (1) In the embodiment, the description is based on the premise that a control packet is generated immediately after a screen operation. However, in reality, there are cases where a schedule is set by a screen operation and a control packet is generated according to the schedule. Therefore, it is not necessary to set the control packet to be generated immediately after a screen operation. In such cases, when linking a screen operation with a control packet, the linking can be performed by recognizing that it is a schedule setting screen and the time when the setting was made.

[0152] (2) In the embodiment, if the variation of a feature vector linked to a specific control type ID included in the screen operation information table is greater than a threshold T, the control can be excluded from the control type IDs to be linked as it is unlikely that the control is linked to a screen operation. For example, the mean square error from the center of gravity of the feature vector to each feature vector can be used as a method of calculating the variation.

[0153] (3) In the embodiments, each component of the anomaly detection device 100 may be individually integrated into a single chip using a semiconductor device such as an IC (Integrated Circuit) or an LSI (Large Scale Integration), or may be integrated into a single chip to include some or all of the components. Furthermore, the integrated circuit implementation is not limited to LSI, and may be realized using a dedicated circuit or a general-purpose processor. A field programmable gate array (FPGA), which can be programmed after LSI manufacturing, or a reconfigurable processor, which can reconfigure the connections and settings of circuit cells within an LSI, may also be used. Furthermore, if an integrated circuit technology that replaces LSI emerges due to advances in semiconductor technology or a derivative technology, that technology may be used to integrate functional blocks. Biotechnology, for example, may also be applied.

[0154] (4) The anomaly detection device 100 may be realized as a single device that includes all of the components, or may be realized by assigning each function to multiple devices and having these multiple devices work together.

[0155] (5) A process executed by a specific processing unit may be executed by another processing unit. In addition, the order of multiple processes may be changed, or multiple processes may be executed in parallel.

[0156] (6) The communication standard used by each device may be any standard and is not particularly limited.

[0157] (7) Each component may be realized by executing a software program appropriate for that component. Each component may be realized by a program execution unit such as a CPU or processor reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory.

[0158] (8) Each component may be realized by hardware. For example, each component may be a circuit (or integrated circuit). These circuits may form a single circuit as a whole, or each may be a separate circuit. Furthermore, each of these circuits may be a general-purpose circuit or a dedicated circuit.

[0159] (9) The general or specific aspects of the present disclosure may be realized in an apparatus, a system, a method, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM. Also, the general or specific aspects of the present disclosure may be realized in any combination of an apparatus, a system, a method, an integrated circuit, a computer program, and a recording medium.

[0160] (10) The method of communication between the devices in the above-described embodiment is not particularly limited. In addition, a relay device (such as a broadband router) (not shown) may be involved in the communication between the devices.

[0161] In addition, this disclosure also includes forms obtained by applying various modifications to each embodiment that a person skilled in the art would think of, or forms realized by arbitrarily combining the components and functions of each embodiment within the scope of this disclosure.

[0162] The present disclosure is applicable to devices that detect packet anomalies.

[0163] REFERENCE SIGNS LIST 10 Control system 100 Anomaly detection device 101 Metadata extraction unit 102 Assignment unit 103 Screen operation extraction unit 104 Main DB 105 Update unit 106 Rule storage unit 107 Anomaly detection unit 108 First port 109 Second port 200 Control PC 300 L2SW 301 Mirror port 302 Normal port 400 PLC

Claims

1. An information processing method comprising: acquiring a packet flowing through a network; and, when an operation to transmit the acquired packet via the network to an operation device is received from a user using a GUI (Graphical User Interface) displayed on the operation device, determining whether the acquired packet is abnormal based on an operation image displayed on the operation device.

2. The information processing method of claim 1, wherein the determination comprises extracting a feature vector indicating the feature of the operation image, and determining whether the acquired packet is abnormal based on the feature vector contained in an image information table and the extracted feature vector, and the image information table is information indicating the relationship between an operation to send a packet to the operation device and a feature vector indicating the feature of the image displayed on the operation device when the operation device accepts the operation from a user using a GUI displayed on the operation device.

3. The information processing method of claim 2, wherein the determination is made by determining that the acquired packet is abnormal if the distance between the extracted feature vector and the feature vector closest to it among multiple feature vectors included in the image information table is greater than a predetermined threshold.

4. The information processing method of claim 2, wherein each of the multiple feature vectors included in the image information table is linked to a control type ID indicating the type of packet linked to the feature vector, and in the determination, if the variation of one or more feature vectors among the multiple feature vectors linked to the same control type ID is greater than a predetermined variation, a determination is made as to whether the acquired packet is abnormal without using the one or more feature vectors linked to the same control type ID.

5. The information processing method of claim 4, wherein, in the determination, if the variation of the one or more feature vectors associated with the same control type ID is less than the specified variation, a determination is made as to whether the acquired packet is abnormal using the one or more feature vectors associated with the same control type ID.

6. The information processing method of claim 4, wherein the determination calculates the variation of the one or more feature vectors by calculating the average value of the distance of the one or more feature vectors from the center of gravity vector of the one or more feature vectors linked to the same control type ID to the power of N (N is a real number greater than 0).

7. An information processing device comprising: an acquisition unit that acquires packets flowing through a network; and a determination unit that, when an operation to transmit the packets acquired via the network to an operation device is accepted by the operation device from a user using a GUI (Graphical User Interface) displayed on the operation device, determines whether the acquired packets are abnormal based on image information indicating an operation image displayed on the operation device.

8. A program for causing a computer to execute the information processing method according to any one of claims 1 to 6.

Images