Information processing method, information processing device, and program

Abstract

This information processing method receives a packet, performs first control for converting a first protocol used for the packet to a second protocol different from the first protocol, and performs second control for detecting the abnormality of the packet converted to the second protocol.

Description

Information processing method, information processing device, and program

[0001] The present disclosure relates to an information processing method, an information processing device, and a program.

[0002] Patent Document 1 discloses a gateway system comprising two sub-gateways connected to two networks, respectively. In communication between the two sub-gateways, communication data is converted into a non-standard protocol. Since the non-standard protocol is considered to be difficult to tamper with because the protocol specifications are not disclosed, even if unauthorized communication data from one network infiltrates the gateway system, the communication data can be prevented from infiltrating the other network.

[0003] WO 2008 / 132821

[0004] As such, not only normal packets (notification data) but also malicious packets for cyber attacks are transmitted over the network. Therefore, it is desirable to be able to strengthen network security by detecting abnormalities in packets flowing over the network.

[0005] The present disclosure provides an information processing method and the like that can strengthen security in a network.

[0006] An information processing method according to one aspect of the present disclosure receives a packet, performs a first control to convert a first protocol used in the packet into a second protocol different from the first protocol, and performs a second control to detect an abnormality in the packet converted to the second protocol.

[0007] An information processing device according to one aspect of the present disclosure includes a processor and a memory, and the processor uses the memory to receive a packet, performs a first control to convert a first protocol used in the packet into a second protocol different from the first protocol, and performs a second control to detect an abnormality in the packet converted to the second protocol.

[0008] A program according to one aspect of the present disclosure is a program for causing a computer to execute the information processing method described above.

[0009] According to the present disclosure, it is possible to provide an information processing method and the like that can strengthen security in a network.

[0010] FIG. 1 is a diagram illustrating a configuration of a network system according to an embodiment. FIG. 2 is a diagram illustrating a configuration of a packet analysis unit according to an embodiment. FIG. 3 is a flowchart illustrating a processing procedure executed by the packet analysis unit according to an embodiment. FIG. 4 is a flowchart illustrating an analysis method determination process according to an embodiment. FIG. 5 is a diagram illustrating an analysis score database according to an embodiment. FIG. 6 is a diagram illustrating a sub-table according to an embodiment. FIG. 7 is a flowchart illustrating a packet transmission process according to an embodiment. FIG. 8 is a flowchart illustrating an action execution process according to an embodiment. FIG. 9 is a diagram illustrating an action table according to an embodiment. FIG. 10 is a diagram illustrating an asset information management unit according to an embodiment. FIG. 11 is a diagram illustrating a first example of an asset information update process according to an embodiment. FIG. 12 is a diagram illustrating a second example of an asset information update process according to an embodiment. FIG. 13 is a diagram illustrating a security score database according to an embodiment. FIG. 14 is a flowchart illustrating a processing procedure executed by an anomaly detection unit according to an embodiment. FIG. 15 is a flowchart illustrating a processing procedure executed by a protocol conversion unit according to an embodiment. FIG. 16 is a flowchart illustrating an information processing method according to an embodiment.

[0011] (Findings that Form the Basis of the Present Disclosure) Conventionally, there are many types of protocols used for packets, etc. For example, there are many OT (Operational Technology) protocols for the same industry.

[0012] For example, protocols used in buildings include BACnet, LONWORKS, ModBus, and KNX. To improve interoperability of these protocols, gateways exist that convert between OT protocols.

[0013] However, there are fewer security rules for analyzing OT protocol packets than there are for IT (Internet Technology) protocols, and security for OT protocols is still in its infancy. Also, since there are few users of OT protocols, there are also few security vendors that support them.

[0014] On the other hand, the damage caused by attacks on OT protocols is greater than that caused by attacks on IT protocols. In particular, attacks on control systems can cause physical damage and affect HSE (health, safety, and environment).

[0015] As a result of intensive research, the inventors of the present invention have discovered a method for easily expanding security rules by performing security analysis of communications using one protocol using analysis rules for another protocol.

[0016] Although there are many OT protocols, there is often little difference in functionality between them. For example, in the case of air conditioning equipment, if the equipment to be controlled is the same, such as power operation and temperature setting, the protocol specifications are often similar.

[0017] Therefore, in the present disclosure, security rules for each OT protocol are used while converting the protocol between them. For example, in a building controlled by the BACnet protocol, the security rules for LONWORKS / ModBus / KNX are also converted and the security rules for each protocol are applied.

[0018] Protocol conversion may be performed by a gateway, for example by a dedicated system or by packet replay.

[0019] Since the detailed conditions of security devices are usually not disclosed, it is difficult to manually convert security rules.

[0020] On the other hand, according to the present disclosure, the security rules of the OT protocol can be easily expanded.

[0021] In addition, for example, in order to increase the expected value of conversion accuracy, only protocols whose security rules match the target industry (for example, buildings) or equipment (for example, air conditioning equipment) may be converted to each other.

[0022] Also, for example, in order to exclude packets with low conversion accuracy, only packets that have a high similarity between the packet before conversion and the packet after conversion and then back (after inverse conversion) may be used.

[0023] Hereinafter, the embodiments will be specifically described with reference to the drawings.

[0024] The embodiments described below are all comprehensive or specific examples. The numerical values, shapes, materials, components, component placement and connection configurations, steps, and step order shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Furthermore, among the components in the following embodiments, components that are not recited in the independent claims of the present disclosure are described as optional components. Furthermore, the drawings are not necessarily strict illustrations. In the drawings, substantially identical components are denoted by the same reference numerals, and redundant descriptions may be omitted or simplified.

[0025] Furthermore, in this specification, ordinal numbers such as "first" and "second" do not refer to the number or order of components unless otherwise specified, but are used for the purpose of avoiding confusion and distinguishing between components of the same type.

[0026] Furthermore, in this specification, when a statement is made in contrast to, for example, "greater than a threshold value" or "less than a threshold value," it means that the distinction is made on the basis of the threshold value, and may mean "greater than the threshold value" or "less than the threshold value," respectively.

[0027] (Embodiment) [Overall Configuration] FIG. 1 is a diagram showing the configuration of a network system 10 according to an embodiment.

[0028] The network system 10 is a system that detects abnormalities in packets sent by a monitoring target 200. The network system 10 includes a security system 100, a monitoring target 200, a protocol gateway 300, and a security device 400.

[0029] The security system 100 is a device that receives packets (also called target packets) sent by the monitoring target 200 and detects abnormalities in the received packets (i.e., determines whether or not there is an abnormality in the packets). Specifically, the security system 100 detects abnormalities in packets by itself or by having the security device 400 detect the abnormality in packets.

[0030] Furthermore, for example, the security system 100 converts the protocol (specifically, the type of protocol) of received packets and detects abnormalities in the packets whose protocols have been converted. Specifically, the security system 100 converts the packet protocol by either performing the packet conversion itself or by having the protocol gateway 300 convert the packet protocol.

[0031] In the network system 10, for example, anomalies are detected in packets before and after protocol conversion.

[0032] The monitoring target 200 is a communication device capable of transmitting packets. The device employed as the monitoring target 200 may be determined arbitrarily and is not particularly limited. For example, the monitoring target 200 is a communication-capable device (e.g., an IoT (Internet of Things) device) such as an air conditioning device or lighting device used in a building.

[0033] The protocol gateway 300 is a device capable of converting the protocol of a packet. For example, the protocol gateway 300 converts the protocol (first protocol) used in the packet (specifically, the target packet) into a protocol (second protocol) of a different type from the first protocol.

[0034] For example, the security device 400 is a device having a network security function such as an IDS (Intrusion Detection System). Specifically, the security device 400 is a device that detects packet abnormalities. The security device 400 has, for example, analysis rules (also referred to as security rules) for detecting packet abnormalities (specifically, has information indicating the analysis rules), and detects packet abnormalities using the analysis rules.

[0035] In this way, in the network system 10, the security system 100 receives packets sent by the monitoring target 200, the security system 100 or the protocol gateway 300 converts the protocol of the packets, and the security system 100 or the security device 400 detects anomalies in the packets after the protocol conversion (more specifically, before and after the protocol conversion). In other words, the network system 10 receives packets, converts the first protocol used in the received packets to the second protocol, and detects anomalies in the packets converted to the second protocol. Of course, the network system 10 may also receive packets and detect anomalies in received packets whose protocol has not been converted.

[0036] The security system 100, the monitored object 200, the protocol gateway 300, and the security device 400 are each realized, for example, by a computer. The computer is realized, for example, by a communication interface for communicating with each other, non-volatile memory in which programs are stored, volatile memory which is a temporary storage area for executing the programs, input / output ports for sending and receiving signals, and a processor for executing the programs. The communication interface may be realized, for example, by an antenna and a wireless communication circuit to enable wireless communication, or by a connector to which a communication line is connected to enable wired communication.

[0037] The security system 100 comprises an asset information management unit 110 , a packet analysis unit 120 , a virtual security device unit 130 , a virtual protocol gateway unit 140 , a security score database 150 , and an analysis score database 160 .

[0038] The asset information management unit 110 is a processing unit (functional unit) that manages information about devices present on a network to which the monitoring target 200 is communicatively connected. Specifically, the asset information management unit 110 manages a security score database 150.

[0039] The packet analysis unit 120 is a processing unit that processes packets. For example, the packet analysis unit 120 performs specific processing on received packets that use a specific protocol, such as OT protocol packets. For example, the packet analysis unit 120 determines an analysis rule applicable to the packet, transmits (outputs) the packet to the virtual protocol gateway unit 140 and the protocol gateway 300 according to predetermined conditions to convert the packet's protocol, and then transmits (outputs) the packet to the security device 400 or virtual security device unit 130 that has a valid analysis rule. In other words, the packet analysis unit 120 receives a packet, performs first control to convert a first protocol used in the packet to a second protocol different from the first protocol, and performs second control to detect an abnormality in the packet converted to the second protocol. Specifically, the packet analysis unit 120 receives a packet (target packet) from the monitoring target 200, causes the security device 400 or the virtual security device unit 130 to convert the first protocol used in the received packet into a second protocol different from the first protocol, and causes the security device 400 or the virtual security device unit 130 to detect an abnormality in the packet converted into the second protocol. In other words, the first control is control that causes the security device 400 or the virtual security device unit 130 to convert the first protocol used in the packet into the second protocol different from the first protocol. Furthermore, the second control is control that causes the security device 400 or the virtual security device unit 130 to detect an abnormality in the packet converted into the second protocol.

[0040] The predetermined condition may be determined arbitrarily and is not particularly limited. For example, the packet analysis unit 120 performs protocol conversion for protocols that satisfy the predetermined condition, but does not perform protocol conversion for protocols that do not satisfy the predetermined condition.

[0041] The virtual security device unit 130 is a processing unit that detects packet anomalies using analysis rules. In other words, the virtual security device unit 130 has the function of analyzing packets, just like the security device 400. The virtual security device unit 130 and the security device 400 are each an example of an anomaly detection unit. Note that in the explanation of the virtual security device unit 130 and the security device 400, they may each be described as an anomaly detection unit.

[0042] The network system 10 includes, for example, a plurality of anomaly detection units. For example, in the second control described above, the packet analysis unit 120 performs control to detect an anomaly in the packet converted to the second protocol using at least one of the plurality of anomaly detection units. More specifically, the packet analysis unit 120 outputs the packet converted to the second protocol to at least one of the plurality of anomaly detection units, thereby causing at least one of the anomaly detection units to detect an anomaly in the packet converted to the second protocol. For example, the plurality of anomaly detection units detect an anomaly using different analysis rules.

[0043] Furthermore, for example, two or more of the plurality of anomaly detection units detect anomalies in packets converted to the second protocol using learning models different from each other.

[0044] Examples of the types of learning models (machine learning models) used by the two or more anomaly detection units include supervised learning, unsupervised learning, reinforcement learning, and deep learning. For example, the types of learning models used by the two or more anomaly detection units are different from each other. Furthermore, for example, the data used for machine learning is different between the learning models used by the two or more anomaly detection units.

[0045] The anomaly detection unit may detect anomalies in packets whose protocols have not been converted. For example, the packet analysis unit 120 outputs packets using a first protocol to the first anomaly detection unit, causing the first anomaly detection unit to detect anomalies in the packets, and outputs packets using a second protocol to the second anomaly detection unit, causing the second anomaly detection unit to detect anomalies in the packets. For example, the first protocol and the second protocol are different types, and the first anomaly detection unit and the second anomaly detection unit detect anomalies using different analysis rules.

[0046] The virtual protocol gateway unit 140 is a processing unit that converts the protocol of packets. In other words, the virtual protocol gateway unit 140 has the function of converting the protocol of packets, just like the protocol gateway 300. The virtual protocol gateway unit 140 and the protocol gateway 300 are each an example of a protocol conversion unit. Note that when explaining the virtual protocol gateway unit 140 and the protocol gateway 300, they may each be explained as a protocol conversion unit.

[0047] The network system 10 includes, for example, a plurality of protocol conversion units. For example, in the first control described above, the packet analysis unit 120 controls conversion of a first protocol used in a packet to a second protocol using at least one of the plurality of protocol conversion units. More specifically, the packet analysis unit 120 outputs a packet using the first protocol to at least one of the plurality of protocol conversion units, thereby causing at least one of the protocol conversion units to convert the first protocol used in the packet to the second protocol. For example, the plurality of protocol conversion units convert protocols such that at least one of the protocols before and after conversion is different from each other.

[0048] Any protocol may be used for the protocols before and after conversion. For example, the protocol before conversion (conversion source) (first protocol) is BACNET, and the protocol after conversion (conversion destination) (second protocol) is Modbus. For example, the first protocol may be Modbus, and the second protocol may be BACNET.

[0049] For example, the second protocol is a higher-context protocol than the first protocol. A high-context protocol means a standard that has, for example, more processing procedures, rules, and / or information volume than a low-context protocol. In other words, the second protocol is a standard that has, for example, more processing procedures, rules, and / or information volume than the first protocol. Simply put, the first protocol is a simpler standard than the second protocol.

[0050] The security score database 150 is a database that includes information indicating the security score. The security system 100 includes, for example, a storage unit in which the security score database 150 is stored.

[0051] The security score database 150 is a database for managing security scores, which are numerical values ​​that indicate how secure a device is, for example.

[0052] The security score is a value calculated from the type of device, vulnerability information, and the like.

[0053] The analysis score database 160 is a database that includes information indicating the analysis score. The security system 100 includes, for example, a storage unit in which the analysis score database 160 is stored.

[0054] The analysis score database 160 is, for example, a table for managing analysis scores, which are numerical values ​​that indicate how accurately the security device 400 or the virtual security device unit 130 can analyze packets.

[0055] The storage unit storing the security score database 150 and the storage unit storing the analysis score database 160 may be realized by a single storage device or by separate independent storage devices. The storage unit is realized by a storage device such as a semiconductor memory or an HDD (Hard Disc Drive).

[0056] The storage unit included in the security system 100 may store information used in the security system 100, such as information indicating analysis rules and information indicating predetermined conditions.

[0057] Each processing unit, such as the asset information management unit 110, the packet analysis unit 120, the virtual security device unit 130, and the virtual protocol gateway unit 140, is realized, for example, by a memory and a processor, such as a CPU (Central Processing Unit), that executes a control program stored in the memory. The memory provided in these processing units may be realized by a common memory, or may be realized by one or more independent memories. Furthermore, the processor provided in these processing units may be realized by a common processor for each processing unit, or may be realized by one or more independent processors for each processing unit.

[0058] [Packet Analysis Unit] Next, the packet analysis unit 120 will be described in detail.

[0059] FIG. 2 is a diagram showing the configuration of the packet analysis unit 120 according to the embodiment.

[0060] The packet analysis unit 120 includes a packet receiving block 121 , an analysis method determining block 122 , a packet sending block 123 , and a result receiving block 124 .

[0061] The packet reception block 121 is a functional block that receives packets. Specifically, the packet reception block 121 receives packets transmitted from the monitoring target 200 to the network via a communication interface provided in the security system 100.

[0062] The analysis method determination block 122 is a functional block that determines (decides) the packet analysis method. Specifically, the analysis method determination block 122 uses the security score database 150 and the analysis score database 160 to determine the protocol and analysis rule to use to detect anomalies in packets received by the packet reception block 121. For example, the analysis method determination block 122 determines whether packet protocol conversion will be performed by the virtual protocol gateway unit 140 or the protocol gateway 300. Also, for example, the analysis method determination block 122 determines whether packet anomalies will be detected by the virtual security device unit 130 or the security device 400.

[0063] The packet transmission block 123 is a functional block that transmits (outputs) packets. For example, the packet transmission block 123 converts the protocol by transmitting the packet to the virtual protocol gateway unit 140 or protocol gateway 300 determined by the analysis method determination block 122, and acquires the protocol-converted packet. Also, for example, the packet transmission block 123 transmits the packet to the virtual security device unit 130 or security device 400 determined by the analysis method determination block 122, causing the virtual security device unit 130 or security device 400 to detect an abnormality in the packet.

[0064] The result receiving block 124 is a functional block that receives (acquires) the analysis results. Specifically, the result receiving block 124 acquires the packet abnormality detection results as analysis results from the virtual security device unit 130 or the security device 400 that detected the packet abnormality. Furthermore, for example, the result receiving block 124 executes a predetermined operation based on the packet abnormality detection results (e.g., packets that remain in the first protocol or packets that have been converted to the second protocol).

[0065] The predetermined action may be determined arbitrarily. Examples of the predetermined action include storing the analysis results or outputting an alert. Depending on the detection results, the predetermined action may not be executed. For example, if an abnormality is detected, the result receiving block 124 sends an alert (alert information) indicating that an abnormality has been detected to a terminal such as a computer used by a user of the security system 100, and if no abnormality is detected, the result receiving block 124 does not send the alert.

[0066] FIG. 3 is a flowchart showing a processing procedure executed by the packet analysis unit 120 according to the embodiment.

[0067] First, the packet analysis unit 120 (specifically, the packet reception block 121) receives a packet transmitted from the monitoring target 200 (S100).

[0068] Next, the packet analysis unit 120 (specifically, the analysis method determination block 122) determines the analysis method for the received packet (S200). For example, the packet analysis unit 120 determines which protocol the packet protocol will be converted to in order to detect an anomaly. In other words, the packet analysis unit 120 determines which protocol conversion unit among multiple protocol conversion units (specifically, the virtual protocol gateway unit 140 and the protocol gateway 300) to output the packet to convert the protocol of the packet, and which anomaly detection unit among multiple anomaly detection units (specifically, the virtual security device unit 130 and the security device 400) to output the protocol-converted packet (also called an analysis packet) to in order to detect an anomaly in the packet.

[0069] Next, the packet analysis unit 120 (specifically, the packet transmission block 123) transmits the packet to the anomaly detection unit determined in step S200 using the protocol determined in step S200 (S300). Specifically, the packet analysis unit 120 converts the protocol of the packet using the protocol conversion unit determined in step S200, and causes the anomaly detection unit determined in step S200 to detect an anomaly in the protocol-converted packet.

[0070] Next, the packet analysis unit 120 (specifically, the result receiving block 124) receives the analysis result from the anomaly detection unit, and executes an action (predetermined operation) according to the received analysis result (S400).

[0071] 4 is a flowchart showing the analysis method determination process according to the embodiment, specifically, the details of the process of step S200.

[0072] First, the packet analysis unit 120 extracts the protocol (specifically, information indicating the protocol of the packet) and metadata (also referred to as first metadata) from the received packet (S210).

[0073] Next, the packet analysis unit 120 obtains the security score (also referred to as the first security score) of the sender of the received packet (e.g., the monitoring target 200) and the security score (also referred to as the second security score) of the destination of the packet from the security score database 150 (S220). Note that the destination here does not refer to the security system 100, but to a device to which the packet is sent via the security system 100.

[0074] Next, the packet analysis unit 120 determines a threshold for the analysis score based on the two acquired security scores (S230). The packet analysis unit 120 calculates, for example, the average of the two security scores as the threshold for the analysis score. For example, if the first security score is 60 and the second security score is 70, the threshold for the analysis score is calculated to be 65.

[0075] Next, the packet analysis unit 120 acquires, from the analysis score database 160, records in which the protocol of the received packet is the same as the protocol before conversion (S240). Specifically, the packet analysis unit 120 acquires (extracts) all records in which the protocol before conversion included in each record is the same as the protocol of the received packet, from among the multiple records shown in the analysis score database 160.

[0076] Next, the packet analysis unit 120 refers to the sub-table contained in each of the one or more acquired records, and acquires (extracts) from the one or more acquired records those records in which the metadata of the packet acquired in step S210 satisfies all the conditions indicated in the sub-table contained in the record and whose analysis score is equal to or greater than the threshold determined in step S230 (S250).

[0077] Next, the packet analysis unit 120 determines whether the number of records acquired in step S250 is one or more (S260).

[0078] If the packet analysis unit 120 determines that the number of records obtained in step S250 is one or more (YES in S260), it adds the converted protocol, protocol conversion unit, and anomaly detection unit indicated in each of the one or more records obtained in step S250 to the analysis method (S270).

[0079] If the packet analysis unit 120 determines that the number of records obtained in step S250 is not 1 or more (i.e., 0) (NO in S260), or after performing the processing of step S270, it terminates processing for the obtained records.

[0080] As a result, for example, a received packet is sent to a protocol conversion unit included in the added analysis method, where it is converted into the converted protocol included in the added analysis method, and an abnormality is detected by an anomaly detection unit included in the added analysis method.

[0081] In this way, the packet analysis unit 120, for example, extracts metadata from the packet, selects one or more sub-tables from the multiple table information included in the analysis score database 160 based on the type of the first protocol, and determines whether the metadata satisfies predetermined conditions indicated in the one or more sub-tables and whether the analysis scores indicated in the one or more sub-tables are equal to or greater than a predetermined threshold. For example, in the above-mentioned first control, if the packet analysis unit 120 determines that the metadata satisfies predetermined conditions and the analysis score is equal to or greater than a predetermined threshold, it performs control to convert the first protocol used in the packet to the second protocol.

[0082] The analysis score database 160 is an example of a first database. The sub-table is an example of table information. The protocols, various information, and analysis scores shown in the analysis score database may be determined arbitrarily and are not particularly limited.

[0083] For example, if the metadata does not satisfy a predetermined condition or if the analysis score is less than a predetermined threshold, the packet analysis unit 120 may not convert the first protocol used in the received packet to the second protocol.

[0084] Also, for example, the packet analysis unit 120 obtains a first security score linked to the source of the packet and a second security score linked to the destination of the packet from the security score database 150, and calculates a predetermined threshold value based on the first security score and the second security score.

[0085] The security score database 150 is an example of a second database. The first security score is an example of a first value. The second security score is an example of a second value.

[0086] The predetermined threshold may be arbitrarily determined in advance.

[0087] Also, for example, if no record is acquired in step S240, the process may end.

[0088] 5 is a diagram showing the analysis score database 160 according to the embodiment. Specifically, FIG. 5 shows a main table included in the analysis score database 160.

[0089] The analysis score database 160 includes, for example, information indicating the protocol before conversion, information indicating the protocol after conversion, information indicating the protocol conversion unit, information indicating the anomaly detection unit, and information indicating the sub-table. The above-mentioned records are, for example, the information of each row in the table shown in FIG. 5. For example, the example shown in FIG. 5 specifically shows four records included in the analysis score database 160. "GW1" and "GW2" and the like shown in the protocol conversion unit column indicate the respective identifiers of multiple protocol conversion units. Furthermore, "SEC1" and "SEC2" and the like shown in the anomaly detection unit column indicate the respective identifiers of multiple anomaly detection units.

[0090] For example, if the protocol of the packet received by the packet analysis unit 120 is "BACnet," in step S240, the record of the row whose sub-table is "Table-1" and the record of the row whose sub-table is "Table-2" are obtained.

[0091] FIG. 6 is a diagram showing a sub-table according to the embodiment.

[0092] The sub-table indicated in the record includes, for example, information indicating the destination IP address, information indicating the packet length, information indicating the command (Modbus function code in the example shown in FIG. 6 ), and information indicating the analysis score. For example, in step S250, it is determined whether the destination IP address, packet length, and Modbus function code of the received packet satisfy the respective conditions of the destination IP address, packet length, and Modbus function code indicated in the sub-table. The destination IP address, packet length, and Modbus function code are examples of packet metadata. Furthermore, in step S250, it is determined whether the analysis score indicated in the sub-table is equal to or greater than the threshold calculated in step S230. In step S250, records determined to satisfy the above conditions and be equal to or greater than the threshold are acquired. For example, the packet analysis unit 120 determines whether the received packet satisfies the conditions for each row shown in FIG. 6 . For example, if there is even one row in which the packet satisfies the condition, the packet analysis unit 120 acquires the record containing the sub-table.

[0093] 7 is a flowchart showing a packet transmission process according to the embodiment, specifically showing the details of the process of step S300.

[0094] The packet analysis unit 120 starts processing for each analysis method determined in step S200 (S310). Specifically, the packet analysis unit 120 executes processing in steps S320 to S330 for each of the one or more analysis methods determined in step S200.

[0095] The packet analysis unit 120 transmits the received packet to a protocol conversion unit indicated in the analysis method, and receives the packet whose protocol has been converted from the protocol conversion unit as an analysis packet (S320).

[0096] Next, the packet analysis unit 120 transmits the analysis packet to the anomaly detection unit (S330).

[0097] The packet analysis unit 120 executes these processes for each analysis method and then ends the process (S340).

[0098] 8 is a flowchart showing the action execution process according to the embodiment, specifically showing the details of the process of step S400.

[0099] First, the packet analysis unit 120 receives the analysis result, that is, information indicating the detection result of an abnormality in a packet, from the abnormality detection unit (S410).

[0100] Next, the packet analysis unit 120 determines whether an action has been set for the analysis result (S420). That is, the packet analysis unit 120 determines whether to execute an action, i.e., a predetermined operation, based on the analysis result. Information indicating the action may be included in the analysis result, or an action table indicating actions for the analysis result may be predefined. For example, the security system 100 may store the action table in advance.

[0101] Next, if the packet analysis unit 120 determines that an action has been set for the analysis result (YES in S420), it executes the set action (S430). On the other hand, for example, if the packet analysis unit 120 determines that no action has been set for the analysis result (NO in S420), it ends the process without taking any action.

[0102] FIG. 9 is a diagram illustrating an action table according to the embodiment.

[0103] The action table includes, for example, information indicating the type of analysis result (detection type), information indicating the threat score, and information indicating the action.

[0104] The analysis result includes, for example, information indicating the detection type and information indicating the threat score.

[0105] The information indicating the detection type is information indicating the type of abnormality that has been detected. An example of the detection type is a type indicating an abnormality in which an unauthorized operation is performed on the destination of a packet ("unauthorized operation" shown in FIG. 9). If no abnormality is detected, the detection type will be, for example, "no detection."

[0106] The threat score is an index that indicates the degree of adverse impact of a detected anomaly. For example, the anomaly detection unit determines the threat score so that the greater the damage that is expected to be caused by the anomaly, the higher the threat score.

[0107] For example, if the analysis result indicates "detection type: unauthorized operation" and "threat score: 80," the packet analysis unit 120 sends an email indicating an alert including information indicating a medium level of importance to a terminal such as a computer used by a user of the security system 100. In this case, for example, the packet analysis unit 120 stores the analysis result as a log in a storage unit provided in the security system 100. In this way, for example, the packet analysis unit 120 executes a predetermined operation (action) based on the packet abnormality detection result.

[0108] The contents and correspondences of the detection types, threat scores, and actions included in the action table may be determined arbitrarily and are not particularly limited.

[0109] [Asset Information Management Unit] Next, the asset information management unit 110 will be described in detail.

[0110] FIG. 10 is a diagram showing the asset information management unit 110 according to the embodiment.

[0111] The asset information management unit 110 includes an asset information management block 111 .

[0112] The asset information management block 111 is a functional block that updates the security score database 150 and the like.

[0113] The asset information management block 111 receives asset information from a terminal such as a computer used by an administrator 600 who is a user of the security system 100, and updates the security score database 150 using the received asset information.

[0114] Asset information is information about a device that can be the source and / or destination of a packet, such as the type of device, the IP (Internet Protocol) address of the device, and the version of software used by the device.

[0115] 11 is a diagram showing a first example of an asset information update process according to an embodiment. Specifically, FIG. 11 shows a first example of a process executed by the asset information management unit 110 (more specifically, the asset information management block 111).

[0116] First, the asset information management unit 110 receives the asset information input by the administrator 600 to the terminal (S510).

[0117] Next, the asset information management unit 110 acquires vulnerability information related to the received asset information from the vulnerability database 500 (S520).

[0118] The vulnerability information is information indicating vulnerabilities of devices related to the acquired asset information. The vulnerability database 500 may be stored in a storage unit included in the security system 100, or may be stored in a server (not shown). The asset information management unit 110 may acquire the vulnerability information by communicating with the server.

[0119] Next, the asset information management unit 110 calculates a security score for the device related to the asset information based on the asset information and the acquired vulnerability information (S530). The method for calculating the security score may be determined arbitrarily and is not particularly limited. For example, the asset information management unit 110 calculates the security score based on a database that indicates the correspondence between device types, vulnerabilities, and security scores. The database is stored in advance in, for example, a storage unit provided in the security system 100.

[0120] Next, the asset information management unit 110 registers the asset information, the acquired vulnerability information, and the calculated security score in the security score database 150 (S540).

[0121] This may update the security score database 150 .

[0122] Fig. 12 is a diagram showing a second example of the asset information update process according to the embodiment. Specifically, Fig. 12 shows a second example of the process executed by the asset information management unit 110 (more specifically, the asset information management block 111). For example, after performing the process shown in Fig. 11, the asset information management unit 110 performs the process shown in Fig. 12 at predetermined intervals, such as once a day.

[0123] First, the asset information management unit 110 acquires asset information from the security score database 150 (S610).

[0124] Next, the asset information management unit 110 attempts to reacquire the asset information from the device by communicating with the device related to the asset information (S620).

[0125] The asset information management unit 110 executes the processes of steps S 610 to S 620 for each piece of asset information included in the security score database 150 .

[0126] At this point, the asset information management unit 110 starts processing the acquired asset information (S630). Specifically, for each piece of asset information, if the asset information was acquired in step S620, the asset information management unit 110 starts processing in steps S640 to S660 for the asset information acquired in step S620, or if the asset information was not acquired in step S620, for the asset information acquired in step S610.

[0127] The asset information management unit 110 acquires vulnerability information related to the acquired asset information from the vulnerability database 500 (S640).

[0128] Next, the asset information management unit 110 calculates the security score of the device related to the asset information based on the acquired asset information and the acquired vulnerability information (S650).

[0129] Next, the asset information management unit 110 registers the acquired asset information, the acquired vulnerability information, and the calculated security score in the security score database 150 (S660).

[0130] As a result, even after asset information has been registered once, the security score database 150 can be periodically updated. For example, when the vulnerability database is updated or the version of the software used by the device is updated, the security of the device against cyber attacks may change. Therefore, by periodically updating the security score, it becomes easier to detect abnormalities according to the current security of the device.

[0131] FIG. 13 is a diagram showing the security score database 150 according to the embodiment.

[0132] The security score database 150 includes, for example, information indicating the type of device, information indicating the IP address of the device, information indicating vulnerabilities corresponding to the device, and information indicating the security score.

[0133] The device type is classified by the function of the device, for example, "lighting device," "air conditioner," "security gate," etc. The device type may be further classified by, for example, the manufacturer of the air conditioner, even if both are air conditioners, such as "air conditioner A" and "air conditioner B."

[0134] 14 is a flowchart showing a processing procedure executed by the anomaly detection unit according to the embodiment. Specifically, FIG. 14 shows a specific example of processing for detecting an anomaly in a received packet, which is executed by the virtual security device unit 130 and the security device 400 when the virtual security device unit 130 and the security device 400 receive the packet.

[0135] First, the anomaly detection unit receives a packet transmitted from the packet analysis unit 120 (S710).

[0136] Next, the anomaly detection unit analyzes the received packet to obtain an analysis rule that can be applied to analyzing the packet (S720).

[0137] The information indicating the analysis rules is stored in advance in, for example, a storage unit included in the anomaly detection unit, and the anomaly detection unit acquires one or more analysis rules from the storage unit.

[0138] When there is only one analysis rule, packet analysis may not be performed.

[0139] Next, the anomaly detection unit executes processing for each of the acquired analysis rules (S730). Specifically, the anomaly detection unit executes steps S740 to S750 using each of the acquired one or more analysis rules.

[0140] The anomaly detection unit applies the analysis rule to the received packet (S740). That is, the anomaly detection unit uses the acquired analysis rule to detect an anomaly in the received packet. As a result, the anomaly detection unit obtains an analysis result, which is the result of detecting an anomaly in the packet.

[0141] Next, the anomaly detection unit transmits the analysis result to the packet analysis unit 120 (S750). Note that step S750 may be executed as needed, and for example, if the analysis result is "no detection," the analysis result does not need to be transmitted. For example, if the packet analysis unit 120 does not receive the analysis result for a transmitted packet within a predetermined period after transmitting the packet, it may determine that there is no anomaly in the packet. The predetermined period may be determined arbitrarily in advance and is not particularly limited.

[0142] The anomaly detection unit executes these processes on the packet for each analysis rule, and ends the process for each acquired analysis rule (S760).

[0143] Fig. 15 is a flowchart showing the processing procedure executed by the protocol conversion unit according to the embodiment. Specifically, Fig. 15 shows a specific example of processing for converting the protocol of a received packet, which is executed when the virtual protocol gateway unit 140 and the protocol gateway 300 receive the packet.

[0144] First, the protocol conversion unit receives a packet sent from the packet analysis unit 120 (S810).

[0145] Next, the protocol conversion unit converts the protocol of the received packet (S820).

[0146] Next, the protocol conversion unit transmits the packet whose protocol has been converted to the packet analysis unit 120 (S830).

[0147] [Representative Example] FIG. 16 is a flowchart showing an information processing method according to an embodiment.

[0148] For example, the information processing device includes a processor and a memory, and the processor uses the memory to perform the following processes: The information processing device is, for example, the security system 100 described above.

[0149] First, the information processing device receives a packet (S10). For example, the information processing device receives a packet (target packet) that has been sent from a source device (e.g., the monitoring target 200) connected to the same network to a destination device.

[0150] Next, the information processing device performs a first control to convert the first protocol used in the received packet into a second protocol different from the first protocol (S20). Specifically, the information processing device performs a first control to convert the first protocol used in the received packet into the second protocol different in type from the first protocol using a protocol conversion unit.

[0151] The protocol conversion may be performed by the device that receives the packet (here, an information processing device). Alternatively, the protocol conversion may be performed by the device that receives the packet (here, an information processing device) sending the packet to a device that performs protocol conversion (for example, the protocol gateway 300), causing the device to perform protocol conversion, and receiving the execution result.

[0152] Any protocol may be used as the protocol before and after the conversion. For example, the first protocol may be BACNET and the second protocol may be Modbus. For example, the first protocol may be Modbus and the second protocol may be BACNET.

[0153] Next, the information processing device performs a second control to detect an abnormality in the packet converted to the second protocol (S30). Specifically, the information processing device performs the second control to detect an abnormality in the packet converted to the second protocol using the abnormality detection unit.

[0154] The detection of an anomaly may be performed by a device that receives the packet (here, the information processing device). Alternatively, the detection of an anomaly may be performed by the device that receives the packet (here, the information processing device) transmitting the packet to a device that performs anomaly detection (e.g., the security device 400), causing the device to perform anomaly detection, and receiving the execution result.

[0155] For example, if the information processing device determines that there is an abnormality in a received packet, that is, if an abnormality is detected in the packet, it performs a predetermined operation (the above-mentioned action) according to the type of abnormality (the above-mentioned detection type).

[0156] Furthermore, for example, if the information processing device determines that the received packet is normal, that is, if no abnormality is detected in the packet, the information processing device may transmit (transfer) the packet to the destination.

[0157] If the information processing device determines that a received packet has an abnormality, that is, if an abnormality is detected in the packet, the information processing device does not need to transmit (transfer) the packet to the destination.

[0158] [Effects, etc.] Hereinafter, examples of techniques that can be obtained from the disclosure of this specification will be given, and effects, etc. that can be obtained from the exemplified techniques will be described.

[0159] Technique 1 is an information processing method that receives a packet (S10), performs a first control to convert a first protocol used in the packet into a second protocol different from the first protocol (S20), and performs a second control to detect an abnormality in the packet converted to the second protocol (S30).

[0160] The protocol conversion and anomaly detection may be performed by the device that receives the packet, or the device that receives the packet may transmit the packet to a device that performs protocol conversion and anomaly detection, have the device perform protocol conversion and anomaly detection, and receive the execution result.

[0161] This allows security analysis of communications using a certain protocol to be performed using analysis rules for another protocol. For example, conventionally, there are fewer security rules for analyzing packets employing protocols used in OT than for packets employing protocols used in IT. On the other hand, the damage caused by attacks on OT devices (e.g., cyber attacks) is often greater than that caused by attacks on IT devices. In particular, attacks on control systems can cause physical damage and affect HSEs.

[0162] According to the information processing method of Technology 1, for example, security rules (analysis rules) of protocols used in OT can be easily expanded, thereby enhancing security in the network.

[0163] Technique 2 is an information processing method according to Technique 1, which extracts metadata from a packet, selects one or more pieces of table information from a plurality of pieces of table information included in a first database based on the type of a first protocol, and determines whether the metadata satisfies predetermined conditions indicated in the one or more pieces of table information and whether an analysis score indicated in the one or more pieces of table information is equal to or greater than a predetermined threshold. In the first control (S20), if it is determined that the metadata satisfies the predetermined conditions and the analysis score is equal to or greater than the predetermined threshold, control is performed to convert the first protocol used in the packet to a second protocol.

[0164] The first database is, for example, the above-mentioned analysis score database, and the table information is, for example, the above-mentioned sub-table. The type of data adopted as metadata may be determined arbitrarily. The metadata is, for example, the destination IP address of the received packet, the packet length of the received packet, or the command (function code) included in the received packet. The predetermined condition is, for example, a condition related to the metadata as shown in FIG. 6.

[0165] According to this, for example, for packets that would cause relatively large damage if an abnormality occurs, protocol conversion is performed to detect the abnormality, and for packets that would cause relatively small damage if an abnormality occurs, protocol conversion is not performed. Therefore, by appropriately setting a predetermined threshold, it is possible to easily suppress damage caused by an abnormality without significantly increasing the amount of processing.

[0166] Technique 3 is an information processing method according to Technique 2, in which a first value associated with a source of a packet and a second value associated with a destination of the packet are obtained from a second database, and a predetermined threshold is calculated based on the first value and the second value.

[0167] The second database is, for example, the security score database described above. The first value is, for example, the first security score described above. The second value is, for example, the second security score described above. The second database stores information (identifier) ​​indicating a device and information indicating a value (for example, the security score described above) that are linked together. Specifically, the second database includes information indicating a first value linked with information indicating a source, and information indicating a second value linked with information indicating a destination.

[0168] This makes it possible to more easily suppress damage caused by abnormalities without significantly increasing the amount of processing depending on the source and destination of the packet.

[0169] Technique 4 is the information processing method according to any one of techniques 1 to 3, wherein the second protocol is a higher-context protocol than the first protocol.

[0170] The accuracy of the analysis is more likely to be improved by analyzing packets using the second protocol, which has a higher context than the first protocol, than by analyzing packets using the first protocol, thereby enabling packet anomalies to be detected with high accuracy.

[0171] Technique 5 is an information processing method according to any one of techniques 1 to 4, wherein the first control uses at least one of a plurality of protocol conversion units to perform control to convert a first protocol used in a packet into a second protocol. Specifically, in the information processing method, the first control outputs a packet using the first protocol to at least one of the plurality of protocol conversion units, thereby causing at least one of the protocol conversion units to convert the first protocol used in the packet into the second protocol.

[0172] The multiple protocol conversion units are, for example, the virtual protocol gateway unit 140 and protocol gateway 300 described above. Note that the multiple protocol conversion units may all be included in the device that received the packet. Alternatively, the multiple protocol conversion units may not all be included in the device, but may be connected to the device so as to be able to communicate with it. Alternatively, the multiple protocol conversion units may be partly included in the device, and partly not included in the device, but may be connected to the device so as to be able to communicate with it.

[0173] This allows for easy conversion to a desired protocol in a system including a plurality of devices that convert different protocols, for example.

[0174] Technique 6 is an information processing method according to any one of techniques 1 to 5, wherein the second control performs control to detect an abnormality in the packet converted to a second protocol using at least one of a plurality of anomaly detection units. Specifically, in the information processing method, the second control (S30) outputs the packet converted to the second protocol to at least one of the plurality of anomaly detection units, thereby causing at least one of the anomaly detection units to detect an abnormality in the packet converted to the second protocol.

[0175] The multiple anomaly detection units are, for example, the above-mentioned virtual security device unit 130 and security device 400. Note that the multiple anomaly detection units may all be included in the device that received the packet. Alternatively, the multiple anomaly detection units may not all be included in the device, but may be connected to the device so as to be able to communicate with it. Alternatively, the multiple anomaly detection units may be partly included in the device, and partly not included in the device, but may be connected to the device so as to be able to communicate with it.

[0176] According to this, for example, in a system including a plurality of devices each having a different method for analyzing an anomaly, the accuracy of anomaly detection can be improved by having an appropriate device detect the anomaly.

[0177] Technique 7 is the information processing method according to technique 6, wherein two or more of the plurality of anomaly detection units detect anomalies in packets converted to the second protocol using learning models different from each other.

[0178] This makes it easier to detect various types of abnormalities.

[0179] Technique 8 is the information processing method according to any one of techniques 1 to 7, in which a predetermined operation is executed based on the detection result of an abnormality in the packet converted to the second protocol.

[0180] This makes it easier to suppress damage caused by an abnormality, for example, when the abnormality is detected.

[0181] Technique 9 is an information processing device including a processor and a memory, in which the processor uses the memory to receive packets, perform first control to convert a first protocol used in the packets into a second protocol different from the first protocol, and perform second control to detect an abnormality in the packets converted to the second protocol.

[0182] The information processing device is realized by, for example, a security system 100 .

[0183] The information processing device may be realized by some or all of the components of the security system 100, or by some or all of the components of the network system 10. For example, the information processing device may be realized as a computer that includes the packet analysis unit 120, among the processing units included in the security system 100, but does not include the asset information management unit 110, the virtual security device unit 130, or the virtual protocol gateway unit 140. Furthermore, the information processing device may be realized by one computer or by multiple computers.

[0184] This provides the same effects as the information processing method according to Technique 1.

[0185] Technique 10 is a program for causing a computer to execute the information processing method according to any one of techniques 1 to 8.

[0186] This provides the same effect as the information processing method described in any one of Techniques 1 to 8.

[0187] (Other Embodiments) Although the embodiments have been described above, the present disclosure is not limited to the above-described embodiments.

[0188] For example, the protocol used for the packets may be an OT protocol, an IT protocol, or any other protocol, and may be determined arbitrarily.

[0189] Furthermore, for example, the number of protocol gateways 300 provided in the network system 10 may be any number, and may be one, or two or more. Furthermore, for example, each protocol gateway 300 may have the function of converting the same protocol, or may have the function of converting different protocols. Furthermore, for example, each protocol gateway 300 may have the function of converting to the same protocol, or may have the function of converting to different protocols.

[0190] Furthermore, for example, the number of security devices 400 included in the network system 10 may be any number, such as one, two, or more. Furthermore, for example, each security device 400 may have a function for detecting packet abnormalities using the same security rule, or may have a function for detecting packet abnormalities using different security rules.

[0191] Furthermore, for example, the number of virtual protocol gateway units 140 provided in the security system 100 may be any number, and may be one, two, or more. Furthermore, for example, each virtual protocol gateway unit 140 may have the function of converting the same protocol, or may have the function of converting different protocols. Furthermore, for example, each virtual protocol gateway unit 140 may have the function of converting to the same protocol, or may have the function of converting to different protocols.

[0192] Furthermore, for example, the number of virtual security device units 130 provided in the security system 100 may be any number, and may be one or more than two. Furthermore, for example, each virtual security device unit 130 may have the function of detecting packet abnormalities using the same security rule, or may have the function of detecting packet abnormalities using mutually different security rules.

[0193] Furthermore, for example, if the network system 10 includes one or more protocol gateways 300, the security system 100 may not include a virtual protocol gateway unit 140. Furthermore, for example, if the network system 10 includes one or more security devices 400, the security system 100 may not include a virtual security device unit 130.

[0194] Furthermore, for example, if the security system 100 includes one or more virtual protocol gateway units 140, the network system 10 does not need to include one or more protocol gateways 300. Furthermore, for example, if the security system 100 includes one or more virtual security device units 130, the network system 10 does not need to include one or more security devices 400.

[0195] Furthermore, for example, the information processing device described in the above embodiments may be realized as a single device that has all of the components, or may be realized by allocating each function to multiple devices and having these multiple devices work together.

[0196] In the above-described embodiment, the processing performed by a specific processing unit may be performed by another processing unit. The order of multiple processing operations may be changed, or multiple processing operations may be performed in parallel.

[0197] In the above-described embodiments, each component may be realized by executing a software program suitable for that component, or by a program execution unit such as a CPU or processor reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory.

[0198] Furthermore, each component may be realized by hardware. For example, each component may be a circuit (or integrated circuit). These circuits may form a single circuit as a whole, or each may be a separate circuit. Furthermore, each of these circuits may be a general-purpose circuit or a dedicated circuit.

[0199] Furthermore, the general or specific aspects of the present disclosure may be realized as an apparatus, a system, a method, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM, etc. Furthermore, the general or specific aspects of the present disclosure may be realized as any combination of an apparatus, a system, a method, an integrated circuit, a computer program, and a recording medium.

[0200] In addition, this disclosure also includes forms obtained by applying various modifications to each embodiment that a person skilled in the art would think of, or forms realized by arbitrarily combining the components and functions of each embodiment within the scope of this disclosure.

[0201] The present disclosure is useful for a computer that detects packet anomalies.

[0202] 10 Network system 100 Security system 110 Asset information management unit 111 Asset information management block 120 Packet analysis unit 121 Packet reception block 122 Analysis method determination block 123 Packet transmission block 124 Result reception block 130 Virtual security device unit 140 Virtual protocol gateway unit 150 Security score database 160 Analysis score database 200 Monitoring target 300 Protocol gateway 400 Security device 500 Vulnerability database 600 Administrator

Claims

1. An information processing method comprising: receiving a packet; performing a first control to convert a first protocol used in the packet into a second protocol different from the first protocol; and performing a second control to detect an abnormality in the packet converted into the second protocol.

2. The information processing method of claim 1, further comprising: extracting metadata from the packet; selecting one or more pieces of table information from a plurality of pieces of table information contained in a first database based on the type of the first protocol; determining whether the metadata satisfies a predetermined condition indicated in the one or more pieces of table information and whether the analysis score indicated in the one or more pieces of table information is equal to or greater than a predetermined threshold; and in the first control, if it is determined that the metadata satisfies the predetermined condition and the analysis score is equal to or greater than the predetermined threshold, performing control to convert the first protocol used in the packet to the second protocol.

3. The information processing method according to claim 2, further comprising: obtaining from a second database a first value associated with the source of the packet and a second value associated with the destination of the packet; and calculating the predetermined threshold value based on the first value and the second value.

4. The information processing method according to any one of claims 1 to 3, wherein the second protocol is a higher-context protocol than the first protocol.

5. An information processing method according to any one of claims 1 to 4, wherein the first control uses at least one of a plurality of protocol conversion units to control conversion of the first protocol used in the packet to the second protocol.

6. An information processing method according to any one of claims 1 to 5, wherein the second control uses at least one of a plurality of anomaly detection units to perform control to detect anomalies in the packets converted to the second protocol.

7. The information processing method according to claim 6, wherein two or more of the plurality of anomaly detection units detect anomalies in the packets converted to the second protocol using learning models different from each other.

8. The information processing method according to any one of claims 1 to 7, further comprising: executing a predetermined operation based on the detection result of an abnormality in the packet converted to the second protocol.

9. An information processing device comprising: a processor; and a memory, wherein the processor uses the memory to receive packets, perform first control to convert a first protocol used in the packets into a second protocol different from the first protocol, and perform second control to detect abnormalities in the packets converted into the second protocol.

10. A program for causing a computer to execute the information processing method according to any one of claims 1 to 8.

Images