Attack detection method, attack detection device, and program

Abstract

An attack detection method according to the present invention involves acquiring change-over-time information that indicates the change over time in physical phenomena that occur in a prescribed space, acquiring sensor data obtained by the sensing of physical phenomena by two or more sensors that are fixed in the prescribed space (S2100), acquiring placement information about the placement of the two or more sensors (S2500), and detecting attacks on the two or more sensors on the basis of the change-over-time information, time series data for the sensor data from each of the two or more sensors, and the placement information (S2500).

Description

Attack detection method, attack detection device, and program

[0001] The present disclosure relates to an attack detection method, an attack detection device, and a program.

[0002] In recent years, automated building control has become common. Buildings equipped with a Building Automation System (BAS) are equipped with numerous sensors. These sensors or monitoring devices communicate with each other to accurately capture the rapidly changing conditions of the physical world, respond appropriately to each situation, and create a comfortable space for users.

[0003] On the other hand, if an attacker infiltrates the network of a building automation control system, there is a risk that they may tamper with sensor communications and intentionally cause malfunctions in building systems that could cause discomfort to users or threaten their safety. Therefore, it is desirable to detect attacks via such communications in the sensor communications within a building automation control system.

[0004] Patent Document 1 discloses a method for detecting whether information from outside is from an attacker by comparing and verifying the surrounding conditions sent from outside with the surrounding conditions that can be measured by sensors installed in the vehicle.

[0005] Patent No. 6298021

[0006] It is desirable to detect attacks on sensors such as fire alarms and thermometers installed in facilities such as buildings. However, sensors inside facilities can only measure the situation at the location where they are installed, and therefore cannot compare and verify the situation with that sent from outside. In other words, the technology of Patent Document 1 cannot be used to detect attacks on sensors inside facilities.

[0007] Therefore, the present disclosure provides an attack detection method, an attack detection device, and a program that can detect attacks on sensors that measure the situation at the location where they are placed.

[0008] An attack detection method according to one aspect of the present disclosure acquires time change information indicating the time change of a physical phenomenon occurring in a specified space, acquires sensor data of the physical phenomenon sensed by two or more sensors fixedly positioned in the specified space, acquires placement information regarding the placement of the two or more sensors, and detects an attack against the two or more sensors based on the time change information, the time series data of the sensor data of each of the two or more sensors, and the placement information.

[0009] An attack detection device according to one aspect of the present disclosure includes a first acquisition unit that acquires time change information indicating the time change of a physical phenomenon occurring in a specified space, a second acquisition unit that acquires sensor data obtained by sensing the physical phenomenon using two or more sensors that are fixedly positioned in the specified space, a memory unit that stores placement information regarding the placement of the two or more sensors, and a detection unit that detects attacks against the two or more sensors based on the time change information, the time series data of the sensor data of each of the two or more sensors, and the placement information.

[0010] A program according to one aspect of the present disclosure is a program for causing a computer to execute the attack detection method described above.

[0011] According to one aspect of the present disclosure, it is possible to realize an attack detection method or the like that can detect attacks on sensors that measure the situation at the location where they are placed.

[0012] FIG. 1 is a diagram illustrating an overview of an attack detection system according to an embodiment. FIG. 2 is a block diagram illustrating a functional configuration of an attack detection system according to an embodiment. FIG. 3 is a diagram illustrating an example of sensor information according to an embodiment. FIG. 4 is a diagram illustrating an example of sensor change information according to an embodiment. FIG. 5 is a diagram illustrating an example of visualization information according to an embodiment. FIG. 6 is a diagram illustrating an example of a sensor data DB according to an embodiment. FIG. 7A is a diagram illustrating an example of a correspondence relationship between sensors and sensor groups according to an embodiment. FIG. 7B is a diagram illustrating an example of a correspondence relationship between sensor groups and physical phenomena according to an embodiment. FIG. 7C is a diagram illustrating an example of a correspondence relationship between sensors and sensor types according to an embodiment. FIG. 7D is a diagram illustrating an example of a correspondence relationship between sensor types and sensor type names according to an embodiment. FIG. 7E is a diagram illustrating an example of a correspondence relationship between physical phenomena and physical phenomenon names according to an embodiment. FIG. 8 is a diagram illustrating an image of a sensor group DB according to an embodiment. FIG. 9 is a diagram illustrating an example of a sensor change definition DB according to an embodiment. FIG. 10 is a diagram illustrating an example of a propagation speed DB according to an embodiment. FIG. 11A is a diagram illustrating an example of sensor coordinates according to an embodiment. FIG. 11B is a diagram illustrating an example of a correspondence relationship between sensor groups and maps according to an embodiment. FIG. 11C is a diagram showing an example of the shape of a space in which sensors are arranged according to an embodiment. FIG. 12 is a diagram showing an example of a sensor change sequence DB according to an embodiment. FIG. 13 is a flowchart showing the operation of a sensor according to an embodiment. FIG. 14 is a flowchart showing the operation of an attack detection device according to an embodiment. FIG. 15 is a flowchart showing detailed operations of step S2200 shown in FIG. 14. FIG. 16 is a flowchart showing detailed operations of step S2400 shown in FIG. 14. FIG. 17 is a flowchart showing detailed operations of step S2500 shown in FIG. 14. FIG. 18 is a flowchart showing an example of detailed operations of step S2503 shown in FIG. 17. FIG. 19A is a diagram showing a sensor map for explaining a sensor change sequence verification process under normal circumstances according to an embodiment. FIG. 19B is a diagram showing a sensor change sequence under normal circumstances according to an embodiment.FIG. 20A is a first diagram showing a sensor map for explaining the process of verifying a sensor change sequence when an abnormality occurs according to an embodiment. FIG. 20B is a first diagram showing a sensor change sequence when an abnormality occurs according to an embodiment. FIG. 21A is a second diagram showing a sensor map for explaining the process of verifying a sensor change sequence when an abnormality occurs according to an embodiment. FIG. 21B is a second diagram showing a sensor change sequence when an abnormality occurs according to an embodiment. FIG. 22 is a flowchart showing another example of the detailed operation of step S2503 shown in FIG. 17. FIG. 23A is a diagram showing a sensor map when the physical phenomenon is an illegal intrusion according to an embodiment. FIG. 23B is a diagram showing an example of a door access graph according to an embodiment. FIG. 23C is a diagram showing a sensor change sequence according to an embodiment. FIG. 24 is a diagram showing an image displayed during normal operation according to an embodiment. FIG. 25 is a diagram showing an image displayed during an attack according to an embodiment. FIG. 26 is a first diagram showing an image with a seek bar added according to an embodiment. FIG. 27 is a second diagram showing an image with a seek bar added according to an embodiment.

[0013] (Background to the Invention of the Present Disclosure) Before describing the embodiments of the present disclosure, the background to the invention of the present disclosure will be described.

[0014] In recent years, BASs that automatically control buildings have been introduced into buildings. BACnet (Building Automation and Control Network) is widely used in BASs, but it has been shown that information from devices (e.g., sensors) connected to the BACnet can be tampered with. Furthermore, many sensors exist within a BAS, and they are connected to each other so that they can communicate with each other. Therefore, it is desirable to detect tampering in sensor communications and take countermeasures against attacks at an early stage.

[0015] However, as described in the "Problem to be Solved by the Invention" section, Patent Document 1 does not disclose technology for detecting attacks on sensors that measure the situation at the location where they are installed. For example, while main sensors such as cameras and radars mounted on vehicles can measure the situation at specific coordinates in the physical world from a distance, main sensors installed in buildings such as fire alarms and thermometers can only measure the situation at the location where they are installed. Therefore, the technology in Patent Document 1, which discloses comparing and verifying the situation sent from outside with the situation measured by the sensor, cannot be used to detect attacks on sensors that measure the situation at the location where they are installed, such as fire alarms and thermometers.

[0016] The same can be said for sensors that are placed in a specific space other than a building and measure the situation at that location.

[0017] Therefore, the inventors of the present application have conducted extensive research into attack detection methods etc. that can detect attacks on sensors that measure the situation at the point where they are placed, and have devised the following attack detection method etc. Specifically, they have devised an attack detection method etc. that can detect attacks on sensors by utilizing the placement position of a device (e.g., a sensor) in the physical world and the spread of physical phenomena that can be detected by the device (spatiotemporal information).

[0018] An attack detection method according to a first aspect of the present disclosure acquires time change information indicating the time change of a physical phenomenon occurring in a specified space, acquires sensor data of the physical phenomenon sensed by two or more sensors fixedly positioned in the specified space, acquires placement information regarding the placement of the two or more sensors, and detects an attack against the two or more sensors based on the time change information, the time series data of the sensor data of each of the two or more sensors, and the placement information.

[0019] This makes it possible to detect attacks on sensors based on information from the physical world (e.g., placement information) and information from the cyber world (e.g., information based on sensor data). In other words, attacks on sensors can be detected without using information sent from outside. Therefore, even if a sensor measures the situation at the point where the sensor is placed, it is possible to detect attacks on the sensor.

[0020] Also, for example, the attack detection method according to the second aspect may be the attack detection method according to the first aspect, and may detect an attack on the two or more sensors by determining whether or not there is a contradiction between the time change of the physical phenomenon and the placement information of the two or more sensors based on the time change information, the time series data, and the placement information.

[0021] This makes it possible to detect attacks on sensors without using information sent from outside by determining whether there is a contradiction between the change in physical phenomena over time and the placement information of two or more sensors.

[0022] Also, for example, the attack detection method according to the third aspect may be an attack detection method according to the first or second aspect, in which a plurality of sensors including the two or more sensors are arranged in the specified space, and the two or more sensors may include a sensor among the plurality of sensors that is affected by the physical phenomenon.

[0023] This makes it possible to detect attacks on two or more sensors that are affected by physical phenomena without using information sent from outside.

[0024] Also, for example, an attack detection method according to a fourth aspect may be an attack detection method according to the third aspect, wherein each of the plurality of sensors is grouped into two or more sensor groups, sensor data for each of the plurality of sensors is acquired, and for each of the plurality of sensors, it is determined whether the sensor data of that sensor has changed relative to sensor data acquired a certain time ago, and the two or more sensors are grouped into a sensor group to which a sensor among the plurality of sensors that is determined to have changed belongs.

[0025] This makes it possible to detect attacks on sensors that belong to the sensor group to which the sensor that has undergone the change belongs.

[0026] Furthermore, for example, the attack detection method according to the fifth aspect may be an attack detection method according to the third or fourth aspect, and may acquire aggregated sensor data that aggregates the sensor data of each of the multiple sensors.

[0027] This makes it possible to detect attacks on sensors while reducing the number of communications required to acquire sensor data, since aggregated sensor data is used.

[0028] Also, for example, an attack detection method according to a sixth aspect may be an attack detection method according to any one of the third to fifth aspects, wherein the plurality of sensors include an overhead sensor capable of measuring the physical phenomenon from an overhead perspective, and the time change information may include data measured by the overhead sensor.

[0029] This allows time change information to be obtained using data from the bird's-eye view sensor, making it possible to obtain more accurate time change information.

[0030] Furthermore, for example, an attack detection method according to the seventh aspect may be an attack detection method according to any one of the third to sixth aspects, wherein each of the plurality of sensors is grouped into two or more sensor groups, and a sensor group change sequence indicating the order in which changes occurred in each of the two or more sensor groups may be created by regarding each of the two or more sensor groups as having undergone a change at the time when there is a change in the sensor data of a sensor belonging to that sensor group.

[0031] This makes it possible to detect attacks on sensors using the sensor group change sequence.

[0032] Also, for example, an attack detection method according to the eighth aspect may be an attack detection method according to any one of the first to seventh aspects, and the placement information may include a sensor map indicating the positions at which each of the two or more sensors is placed and the shape of the space in which the two or more sensors are placed.

[0033] In this way, since the positions and spatial shapes of two or more sensors are used, it is possible to accurately determine whether or not there is a contradiction between the time change of a physical phenomenon and the arrangement information of two or more sensors.

[0034] Furthermore, for example, an attack detection method according to a ninth aspect may be an attack detection method according to any one of the first to eighth aspects, and may create a sensor change sequence indicating the order of changes in sensor data acquired a certain time ago for each of the two or more sensors based on the time series data, estimate the location of occurrence of the physical phenomenon based on the sensor change sequence, and the time change information may include information indicating the time change of the physical phenomenon assuming that the physical phenomenon occurred at the estimated location of occurrence.

[0035] This allows the time change of a physical phenomenon to be acquired using the sensor change sequence, even when it is difficult to directly acquire the time change of a physical phenomenon. For example, since it is not necessary to have a sensor that measures the time change of a physical phenomenon, the configuration of the attack detection system can be simplified.

[0036] Furthermore, for example, an attack detection method according to a tenth aspect is an attack detection method according to any one of the first to ninth aspects, in which a weight for the physical phenomenon is set for each of the two or more sensors, and the likelihood of the estimated occurrence location is calculated based on the weight for each of the two or more sensors.

[0037] This makes it possible to calculate an appropriate likelihood according to a physical phenomenon, thereby enabling more accurate calculation of information in the cyber world (e.g., information based on sensor data), thereby improving the accuracy of detecting attacks on sensors, for example.

[0038] Also, for example, an attack detection method according to an eleventh aspect may be an attack detection method according to any one of the first to tenth aspects, in which the propagation speed of the physical phenomenon is acquired, and the time change information includes information generated based on the propagation speed.

[0039] This makes it possible to more accurately calculate the time change of a physical phenomenon by using the propagation speed of the physical phenomenon, which can improve the accuracy of detecting attacks on sensors, for example.

[0040] Furthermore, for example, an attack detection method according to a twelfth aspect is an attack detection method according to any one of the first to eleventh aspects, in which visualization information for displaying information regarding the detection of an attack on the two or more sensors is output to a display device, the visualization information includes information indicating the change in the physical phenomenon over time as information indicating the background of the specified space, and includes image information for displaying an icon indicating each of the two or more sensors at the placement position of the sensor, and a first display mode of the information indicating the change in the physical phenomenon over time and a second display mode of the icon for each of the two or more sensors may be related to each other.

[0041] This allows the time change of a physical phenomenon (for example, the spread of a physical phenomenon) and the sensor change to be displayed in a correlated manner, allowing the user to intuitively recognize the inconsistency between the time change of a physical phenomenon and the sensor change, thereby assisting the user in monitoring the sensor.

[0042] Also, for example, an attack detection method according to a thirteenth aspect may be an attack detection method according to the twelfth aspect, in which in the first display aspect, the change in the physical phenomenon over time is displayed on a color scale, and in the second display aspect, the icon is displayed in color, and the first display aspect and the second display aspect are displayed in the same color for each time.

[0043] By making the color of the icon different from the color of the change over time in the physical phenomenon, the user can intuitively recognize that a contradiction has occurred.

[0044] Furthermore, for example, the attack detection method according to the 14th aspect may be an attack detection method according to the 12th or 13th aspect, and may further display a seek bar to display the change over time of the physical phenomenon up to that point in time and the icon of the sensor that has changed up to that point in time.

[0045] This allows the seek bar to display changes in physical phenomena over time and changes in sensors at a timing desired by the user. For example, it is possible to display information that can help the user recognize attacks on sensors.

[0046] Furthermore, for example, an attack detection method according to the 15th aspect is an attack detection method according to any one of the 12th to 14th aspects, and when the image information includes a difference of a predetermined value or more between the change over time of the physical phenomenon and the time at which each of the two or more sensors changed, the visualization information may further include information that highlights the difference.

[0047] This effectively makes the user aware that there is a difference, that is, that an attack on the sensor may be underway.

[0048] Also, for example, an attack detection method according to a 16th aspect is an attack detection method according to any one of the 1st to 15th aspects, and the physical phenomenon may include at least one of a fire, a gas leak, an intrusion, a temperature rise, and a temperature drop.

[0049] This makes it possible to detect an attack on the sensor when at least one physical phenomenon occurs, such as a fire, a gas leak, an unauthorised entry, a temperature rise, or a temperature drop.

[0050] Also, for example, an attack detection method according to a seventeenth aspect is an attack detection method according to any one of the first to sixteenth aspects, and the specified space may be an indoor space.

[0051] This makes it possible to detect attacks on sensors placed in indoor spaces.

[0052] Also, for example, an attack detection method according to an 18th aspect is an attack detection method according to any one of the 1st to 16th aspects, and the specified space may be an outdoor space.

[0053] This makes it possible to detect attacks on sensors placed in outdoor spaces.

[0054]

[0013] Also, an attack detection device according to one aspect of the present disclosure includes a first acquisition unit that acquires time change information indicating time changes of a physical phenomenon occurring in a predetermined space, a second acquisition unit that acquires sensor data obtained by sensing the physical phenomenon by two or more sensors that are fixedly arranged in the predetermined space, a memory unit that stores arrangement information regarding the arrangement of the two or more sensors, and a detection unit that detects an attack against the two or more sensors based on the time change information, time series data of the sensor data of each of the two or more sensors, and the arrangement information.

[0014] Also, a program according to one aspect of the present disclosure is a program for causing a computer to execute the attack detection method according to any one of the first to eighteenth aspects.

[0055] This provides the same effect as the attack detection method described above.

[0056] These general or specific aspects may be realized as a system, a method, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM, or as any combination of the system, method, integrated circuit, computer program, or recording medium. The program may be pre-stored in the recording medium, or may be supplied to the recording medium via a wide area communication network including the Internet.

[0057] Hereinafter, the embodiments will be specifically described with reference to the drawings.

[0058] The embodiments described below are all comprehensive or specific examples. The numerical values, shapes, components, component placement and connection configurations, steps, and step order shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Furthermore, among the components in the following embodiments, components not described in independent claims are described as optional components.

[0059] Furthermore, each figure is a schematic diagram and is not necessarily an exact illustration. Therefore, for example, the scales of the figures do not necessarily match. Furthermore, in each figure, substantially the same components are given the same reference numerals, and redundant explanations are omitted or simplified.

[0060] Furthermore, in this specification, terms indicating the relationship between elements, such as "same," terms indicating the shape of elements, such as "rectangle," numerical values, and numerical ranges are not expressions that express only the strict meaning, but are expressions that also include a substantially equivalent range, for example, a difference of about a few percent (or about 10%).

[0061] Furthermore, in this specification, ordinal numbers such as "first" and "second" do not refer to the number or order of components unless otherwise specified, but are used for the purpose of avoiding confusion and distinguishing between components of the same type.

[0062] (Embodiment) Hereinafter, an attack detection system including an attack detection device according to the present embodiment will be described with reference to FIGS.

[0063] [1. Configuration of the attack detection system] First, the configuration of the attack detection device according to this embodiment will be described with reference to Figures 1 to 12. Figure 1 is a diagram showing an overview of the attack detection system 1 according to this embodiment. Figure 2 is a block diagram showing the functional configuration of the attack detection system 1 according to this embodiment. Note that Figures 1 and 2 show an exemplary functional configuration of the attack detection system 1, and the functional configuration of the attack detection system 1 is not limited to Figures 1 and 2. Furthermore, hereinafter, an example in which multiple sensors 100 are placed in a building 500 will be described, but the placement location of the sensors 100 is not limited to the building 500.

[0064] 1 , the attack detection system 1 includes an attack detection device 200 and a client device 300. The attack detection system 1 may further include multiple sensors 100 placed in a building 500. Note that the attack detection system 1 only needs to include at least the attack detection device 200.

[0065] The attack detection system 1 is, for example, an attack detection system that includes an attack detection device 200 and multiple sensors 100, and is capable of communication from at least the multiple sensors 100 to the attack detection device 200.It is an information processing system that can detect abnormalities in the sensors 100 (for example, unauthorized writing to the sensor data of the sensors 100) as being caused by an attack by determining whether there is a contradiction between the time change in a physical phenomenon that can be inferred from the time when a change is observed in the sensor data measured by each of the multiple sensors 100, and the placement information of the multiple sensors 100 in the physical world.

[0066] The attack detection device 200 is configured to be able to detect, for example, a discrepancy between the time of change in sensor data and the position of the sensor 100 .

[0067] The client device 300 is configured to be able to visualize and present information about an attack notified by the attack detection device 200 .

[0068] A building 500 in which a building automation control system has been installed is equipped with a large number of sensors 100. If an attacker infiltrates the building automation control system's network and sends false sensor information, it is expected that the information will cause the building automation control system to perform erroneous operations, making it impossible for users to use the building safely and comfortably.

[0069] For example, if sensor information from a fire alarm is falsified and sent, the alarm will sound, causing confusion among users and supervisors, and it is possible that a more serious cyber attack or its preparations will be carried out in the confusion.Furthermore, it is possible that a building supervisor will need to go to the scene to determine whether there is an actual fire or a malfunction, but will not be able to move quickly due to the confusion among users.

[0070] In such a situation, when a fire actually occurs, smoke, heat, carbon dioxide, etc. are generated by the fire and gradually spread from the point of fire outbreak into physical space. The time change of physical phenomena occurring in a given space, such as the spread of smoke, heat, carbon dioxide, etc., can be measured by sensors 100 that are essential to building automatic control systems, such as fire alarms, thermometers, and carbon dioxide concentration meters. The time change of the physical phenomenon can be estimated by observing the time when a change occurs in the sensor data of these sensors 100. Therefore, when a sensor 100 detects the occurrence of a physical phenomenon, if no change is observed in other sensors 100 that should be affected by the physical phenomenon, or if the order or time interval of the changes is abnormal compared to when the physical phenomenon actually occurs, an attack can be detected and a prompt response to the attack can be taken.

[0071] Here, a case has been described in which the communication of a fire alarm is spoofed to verify the time change of a physical phenomenon, namely a fire, but the present disclosure is also applicable to attacks from the perspective of measurement security, in which the communication of other sensors 100 is spoofed and attacks are made from the physical world against the sensor 100 rather than cyber attacks. The present disclosure is also applicable to physical phenomena that can be detected by the sensor 100, such as a simple temperature rise or human movement, rather than a fire. The present disclosure is also applicable not only to building automatic control systems, but also to any other control system that handles a space in which multiple sensors 100 are present.

[0072] The interior of the building 500 is an example of the predetermined space. The predetermined space may be the entire interior of the building 500, a predetermined floor, a predetermined room, or the like.

[0073] 2, multiple sensors 100 are placed in a building 500 and perform sensing of a predetermined physical phenomenon. The multiple sensors 100 may be fixedly placed so that their positions do not change within the building 500. For example, the multiple sensors 100 may be attached to a structure.

[0074] The sensor 100 includes a sensor that measures a physical phenomenon at a specific point and a sensor that can measure changes in a physical phenomenon over time within a certain range. For example, the sensor 100 includes a fire alarm, a thermometer, a carbon dioxide concentration meter, a thermometer, a hygrometer, a human presence sensor, a gas sensor, etc. The sensor 100 also includes a sensor information transmission unit 101 and a sensor data acquisition unit 102.

[0075] The sensor information transmission unit 101 transmits sensor information including the sensor data acquired by the sensor data acquisition unit 102 to the attack detection device 200. The sensor information transmission unit 101 is a communication interface that performs wireless communication with the client device 300. The sensor information transmission unit 101 may be configured to include, for example, a communication circuit (or a communication module). Furthermore, the sensor information transmission unit 101 may transmit the sensor information to the attack detection device 200 via wireless communication, or may transmit the sensor information to the attack detection device 200 via wired communication.

[0076] The sensor data acquiring unit 102 acquires sensor data by performing sensing in the sensor 100. The sensor data acquiring unit 102 may be configured to include a smoke detection element, a gas detection element, a temperature detection element, and the like.

[0077] FIG. 3 is a diagram showing an example of sensor information 30 according to this embodiment.

[0078] The sensor information 30 includes a sensor ID 31, sensor data 32, and a transmission time 33. The sensor information 30 transmitted by the sensor information transmission unit 101 includes at least the sensor ID 31, the sensor data 32, and the transmission time 33.

[0079] The sensor ID 31 is unique information (for example, an ID) for identifying the sensor 100 .

[0080] The sensor data 32 is data measured by the sensor 100 .

[0081] The transmission time 33 is the time when the sensor information 30 is transmitted.

[0082] It should be noted that the sensor information 30 does not include, for example, location information of the sensor 100 (for example, location information of the sensor 100 acquired by a GPS (Global Positioning System) sensor).

[0083] Referring again to FIG. 2 , the attack detection device 200 includes a sensor information receiving unit 201, a sensor data change determination unit 202, a sensor change sequence creation unit 203, a sensor change sequence verification unit 204, a visualization information transmission unit 205, a memory unit that stores a sensor data DB 206, a memory unit that stores a sensor group DB 207, a memory unit that stores a sensor change definition DB 208, a memory unit that stores a propagation speed DB 209, a memory unit that stores a sensor map DB 210, and a memory unit that stores a sensor change sequence DB 211. Each memory unit is realized by, but is not limited to, a semiconductor memory or an HDD (Hard Disk Drive). Furthermore, the attack detection device 200 includes, as its hardware configuration, a non-volatile memory in which a program is stored, a volatile memory that is a temporary storage area for executing the program, an input / output port, a communication interface, a processor that executes the program, and the like. The memory may be a ROM (Read Only Memory) or a RAM (Random Access Memory), and may store programs to be executed by a processor. Each functional configuration of the attack detection device 200 is realized by a processor that executes programs stored in the memory. The attack detection device 200 may be realized by a mobile terminal such as a stationary PC (Personal Computer), a smartphone, or a tablet, a dedicated computer, or may be realized by a server (e.g., a cloud server), or may be realized by a combination thereof.

[0084] The sensor information receiving unit 201 receives the sensor information 30 from the sensor 100. The sensor information receiving unit 201 may receive the sensor information 30 directly from the sensor 100, or may receive the sensor information 30 via another device (for example, a relay device). The sensor information receiving unit 201 is configured to include, for example, a communication circuit (or a communication module), but is not limited to this. The sensor information receiving unit 201 is an example of a second acquisition unit.

[0085] The relay device may collect sensor information 30 from multiple buildings including the building 500 and transmit the sensor information 30 of the building 500 together to the attack detection device 200. The relay device may, for example, periodically transmit the sensor information 30 of the building 500 to the attack detection device 200.

[0086] The sensor data change determination unit 202 is a processing unit that determines whether the sensor information 30 of the sensor 100 received by the sensor information receiving unit 201 has changed (e.g., whether there has been a change of a predetermined amount or more) compared to the sensor information 30 of the sensor 100 in the past (e.g., a certain amount of time ago). The sensor data change determination unit 202 determines whether there has been a change, for example, based on a sensor change definition DB 208 that indicates a definition for determining that there has been a change in the sensor data 32 of the sensor 100. The sensor change definition DB 208 will be described later. The sensor data change determination unit 202 creates sensor change information shown in FIG. 4 below for the sensor 100 for which it has been determined that there has been a change.

[0087] FIG. 4 is a diagram showing an example of sensor change information 40 according to this embodiment.

[0088] 4, the sensor change information 40 includes a sensor ID 41, a sensor group ID 42, and a change time 43. The sensors 100 in the building 500 are grouped in advance into two or more sensor groups (see, for example, FIGS. 7A and 8, which will be described later).

[0089] The sensor ID 41 is unique information (for example, an ID) for identifying the sensor 100 .

[0090] The sensor group ID 42 is unique information (e.g., an ID) for identifying the sensor group to which the sensor 100 belongs. The sensor group ID 42 indicates, for example, the ID of a group of sensors 100 that exist in the same sensor map. The sensor group is a collection of sensors 100 for checking the order in which the sensor data 32 changes.

[0091] The change time 43 indicates the time when a change occurred in the sensor data 32 of the sensor 100. The change time 43 is calculated based on the time series data of the sensor data 32 of the sensor 100. The time series data includes the sensor data 32 acquired at the present time and the sensor data 32 acquired a certain time before the present time.

[0092] Furthermore, if there is an abnormal sensor 100, the sensor data change determination unit 202 determines whether or not there is a change in the sensor data 32 of the other sensors 100 in the sensor group to which the abnormal sensor 100 belongs, based on the sensor data 32 acquired from the sensors 100 in the building 500. For example, when a fire alarm in a certain room changes due to a fire (for example, detects smoke), the sensor data change determination unit 202 determines a change (for example, the presence or absence of a change) in the sensor data 32 of the sensor 100 affected by the fire among the other sensors 100 in the room.

[0093] 2 again, the sensor change sequence creation unit 203 is a processing unit that executes a sensor change sequence creation process based on the sensor change information 40 created by the sensor data change determination unit 202. The sensor change sequence creation unit 203 creates a sensor change sequence that indicates the temporal order in which the sensor data change determination unit 202 determined that there was a change in one or more sensors 100 out of the multiple sensors 100. The sensor change sequence creation process will be described later using FIG. 16 etc.

[0094] The sensor change sequence verification unit 204 is a processing unit that executes a sensor change sequence verification process based on the sensor change sequence created by the sensor change sequence creation unit 203. The sensor change sequence verification process will be described later using FIG. 17 etc. The sensor change sequence verification unit 204 is an example of a detection unit.

[0095] The visualized information sending unit 205 is a processing unit that creates visualized information for presenting the verification result on the client device 300 and sends the visualized information to the client device 300. The visualized information sending unit 205 may be configured to include, for example, a communication circuit (or a communication module). The visualized information includes, for example, information for displaying information regarding the detection of an attack on two or more sensors 100 included in a sensor group. An example of the visualized information will be described with reference to FIG. 5. FIG. 5 is a diagram showing an example of visualized information 50 according to this embodiment.

[0096] As shown in FIG. 5 , the visualization information 50 includes sensor change sequence information 51 , sensor map information 52 , and physical phenomenon occurrence position information 53 .

[0097] The sensor change sequence information 51 includes the sensor change sequence of the sensor 100 .

[0098] The sensor map information 52 includes a map (sensor map) of an area (e.g., a room) in which the sensor 100 is placed. The sensor map information 52 includes, for example, the shape of the room in which the sensor 100 is placed and the position of the sensor in that room.

[0099] The physical phenomenon occurrence position information 53 includes information indicating the occurrence position of the physical phenomenon. For example, if the physical phenomenon is a fire, the physical phenomenon occurrence position information 53 includes the position of the source of the fire. The occurrence position of the physical phenomenon may be a position measured by a bird's-eye view sensor such as a camera that can measure the physical phenomenon from a bird's-eye view, or may be a position estimated using the sensor change sequence and the arrangement information of the sensors 100. The bird's-eye view sensor may be included in multiple sensors 100. Furthermore, data measured by the bird's-eye view sensor (e.g., moving images) is an example of time-varying information.

[0100] The sensor data DB 206 includes the sensor data 32 of each sensor 100 .

[0101] FIG. 6 is a diagram showing an example of the sensor data DB 206 according to this embodiment.

[0102] As shown in FIG. 6, the sensor data DB 206 includes a sensor ID, sensor data 32, and the acquisition time (transmission time) of the sensor data 32.

[0103] The sensor ID is unique information (for example, an ID) for identifying the sensor 100 that is the sender of the sensor data 32 .

[0104] The sensor data 32 indicates measurement data measured by the sensor 100. The measurement data includes, for example, whether or not smoke is detected, the temperature, and the like.

[0105] The acquisition time indicates the time when the sensor data 32 is acquired. The acquisition time may be, for example, the time when the sensor data 32 is transmitted from the sensor 100.

[0106] The sensor group DB 207 includes various information related to the sensor group to which each sensor 100 belongs. The sensor group DB 207 includes, for example, the tables shown in FIGS. 7A to 7E in advance. FIG. 7A is a diagram showing an example of a correspondence relationship between sensors 100 and sensor groups according to this embodiment. FIG. 7B is a diagram showing an example of a correspondence relationship between sensor groups and physical phenomena according to this embodiment. FIG. 7C is a diagram showing an example of a correspondence relationship between sensors 100 and sensor types according to this embodiment. FIG. 7D is a diagram showing an example of a correspondence relationship between sensor types and sensor type names according to this embodiment. FIG. 7E is a diagram showing an example of a correspondence relationship between physical phenomena and physical phenomenon names according to this embodiment.

[0107] 7A, the sensor group DB 207 may include a table in which sensor IDs are associated with sensor group IDs. This allows the user to know which sensor 100 belongs to which sensor group. The number of sensors 100 belonging to each sensor group is not particularly limited, but may be, for example, two or more.

[0108] 7B , the sensor group DB 207 may include a table in which sensor group IDs are associated with physical phenomenon IDs, which are unique information (e.g., IDs) for identifying physical phenomena. For example, a sensor group is associated with one physical phenomenon. When multiple sensors 100 are placed in the same room, different physical phenomena may belong to different sensor groups. This makes it possible to identify the physical phenomenon that affects the sensor group.

[0109] 7C, the sensor group DB 207 may include a table in which sensor IDs are associated with sensor type IDs, allowing the attack detection device 200 to use information indicating the type of sensor the sensor 100 is.

[0110] 7D, the sensor group DB 207 may include a table in which sensor type IDs are associated with sensor type names, allowing the attack detection device 200 to use information indicating the names of sensor types corresponding to the sensor type IDs.

[0111] 7E, the sensor group DB 207 may include a table in which physical phenomenon IDs are associated with physical phenomenon names, allowing the attack detection device 200 to use information indicating the names of physical phenomena corresponding to the physical phenomenon IDs.

[0112] FIG. 8 is a diagram showing an image of the sensor group DB 207 according to this embodiment.

[0113] 8 , in the sensor group DB 207, sensors 100 associated with each physical phenomenon, such as fire, temperature rise, temperature drop, gas leak, and trespassing, are assigned. The building 500 is divided into sections, such as rooms and corridors. Of the sensors 100 in each section, the sensors 100 affected by the physical phenomenon are written within the frame of the section. The physical phenomenon may include, but is not limited to, at least one of fire, temperature rise, temperature drop, gas leak, and trespassing.

[0114] For example, room A is equipped with at least a fire alarm A, thermometers A1 to A3, and a carbon dioxide concentration meter A. When the physical phenomenon is a fire, the fire alarm A, thermometers A1 and A2, and carbon dioxide concentration meter A are grouped together as sensors 100 (e.g., sensors 100 affected by the physical phenomenon) for which a sensor change sequence is to be created. When the physical phenomenon is a temperature rise, the thermometers A1 to A3 are grouped together as sensors 100 for which a sensor change sequence is to be created. One sensor group ID is assigned to the fire alarm A, thermometers A1 and A2, and carbon dioxide concentration meter A, and one sensor group ID is assigned to the thermometers A1 to A3. One sensor 100 may belong to two or more sensor groups.

[0115] In addition, each section may include, for example, two or more sensors 100 that are defined as being affected by the physical phenomenon among the multiple sensors 100 .

[0116] It is preferable that the sensor groups be defined by areas such as rooms and corridors that are affected by a physical phenomenon in a relatively short time (for example, a time equal to or shorter than a predetermined time set based on the propagation speed of the physical phenomenon). Furthermore, since the sensors affected by the physical phenomenon and the definition of the change in the sensor data 32 may differ even within the same room, it is preferable that the sensor groups be defined so that they can be considered separately.

[0117] Referring again to FIG. 2, the sensor change definition DB 208 includes information indicating a definition for determining whether or not there is a change in the sensor data 32 of each sensor 100 .

[0118] 9 is a diagram showing an example of the sensor change definition DB 208 according to this embodiment. The sensor change definition DB 208 is created in advance by a person, for example.

[0119] As shown in FIG. 9, the sensor change definition DB 208 includes a sensor type ID, a physical phenomenon ID, a change definition, and a data type.

[0120] The sensor type ID is unique information (for example, an ID) for identifying the type of the sensor 100 .

[0121] The physical phenomenon ID is unique information (for example, an ID) for identifying a physical phenomenon.

[0122] The change definition and data type are information associated with the physical phenomenon ID. The change definition is a definition for determining that the sensor data 32 has changed when the sensor 100 measures the physical phenomenon. The change definition includes, for example, a threshold value for the difference between the current and past sensor data 32 (e.g., a certain time before the present) of the same sensor.

[0123] For example, when the sensor type ID is "001" and the physical phenomenon ID is "001," the definition of a change in the sensor 100 is when the sensor 100 changes from OFF to ON (for example, when a fire alarm detects a fire (ON)). In other words, when a fire alarm turns ON due to a fire, it is determined that a change has occurred in the fire alarm.

[0124] Furthermore, for example, when the sensor type ID is "002" and the physical phenomenon ID is "001", the change definition of the sensor 100 is that the measurement value of the sensor 100 increases by 10 (for example, the temperature measured by a thermometer increases by 10 degrees). Furthermore, when the sensor type ID is "002" and the physical phenomenon ID is "002", the change definition of the sensor 100 is that the measurement value of the sensor 100 increases by 5 (for example, the temperature measured by a thermometer increases by 5 degrees). In this way, even if the sensor is the same, the change definition may differ if the physical phenomenon is different. Furthermore, even if the sensor type is the same, the change definition may differ if the physical phenomenon is different.

[0125] The data type is the format of data output by the sensor 100. For example, the data type of the sensor 100 whose sensor type ID is "001" and whose physical phenomenon ID is "001" is binary (e.g., ON and OFF). Also, for example, the data type of the sensor 100 whose sensor type ID is "002" and whose physical phenomenon ID is "002" is numeric (e.g., measured temperature).

[0126] Referring again to FIG. 2, the propagation velocity DB 209 includes the velocity at which a physical phenomenon spreads (propagates) through a given space.

[0127] FIG. 10 is a diagram showing an example of the propagation speed DB 209 according to this embodiment.

[0128] As shown in FIG. 10, the propagation velocity DB 209 includes a sensor type ID, a physical phenomenon ID, a propagation velocity (m / s), a medium, and a medium.

[0129] The propagation speed is a speed associated with the sensor type ID and the physical phenomenon ID, and is the speed at which the physical phenomenon spreads.

[0130] A medium refers to an object that spreads (or moves) in a physical phenomenon.

[0131] A medium refers to an object or space that can transmit physical phenomena.

[0132] For example, even if the sensor type ID and the physical phenomenon ID are the same, if there are multiple propagation velocities because the medium and the medium change depending on the position of the sensor 100, the propagation velocity DB 209 may include the medium and the medium. In other words, the propagation velocity DB 209 may not include at least one of the medium and the medium.

[0133] Referring again to FIG. 2, the sensor map will now be described with reference to FIGS. 11A-11C.

[0134] Fig. 11A is a diagram showing an example of coordinates of sensors 100 according to this embodiment. Fig. 11B is a diagram showing an example of a correspondence relationship between sensor groups and maps according to this embodiment. Fig. 11C is a diagram showing an example of the shape of a space in which sensors 100 according to this embodiment are arranged.

[0135] 11A to 11C, the sensor map DB 210 includes coordinates in a sensor group coordinate system linked to a sensor ID (FIG. 11A), a map path indicating a storage location of an image file or the like showing the shape of a space in which sensors 100 belonging to a sensor group linked to a sensor group ID are arranged (FIG. 11B), and an image file showing the shape of the space (FIG. 11C). The image file showing the shape of the space needs to have a uniform scale so that the range of coordinates, domain of definition, etc. can be read. Furthermore, even if it is not an image file, a text file or the like from which the range of coordinates, domain of definition, etc. can be read may be included in the sensor map DB 210 as long as it can restore the shape of the space.

[0136] The coordinates in the sensor group coordinate system are position information indicating the positions where each of the multiple sensors 100 is arranged.

[0137] Referring back to FIG. 2, the sensor change sequence DB 211 includes the sensor change sequences created by the sensor change sequence creation unit 203 .

[0138] FIG. 12 is a diagram showing an example of the sensor change sequence DB 211 according to this embodiment.

[0139] As shown in FIG. 12, the sensor change sequence DB 211 includes a sensor group ID, a sensor ID, a change time, and a state associated with a sequence ID.

[0140] If the current sensor data 32 has changed from the past sensor data 32 in the sensor 100, the change time includes the time at which the change occurred.

[0141] The state refers to the state of the sensor change sequence, and includes, but is not limited to, for example, "completed" and "standby." "Standby" indicates that the sensor change sequence is currently being created. For example, when any sensor 100 in a sensor group changes, a sensor change sequence is created, and it indicates a state in which it is being checked whether there are any sensors in the same sensor group that are considered to have changed due to the same physical phenomenon within a certain period of time. "Completed" indicates that the creation of the sensor change sequence has been completed.

[0142] Referring back to FIG. 2, the client device 300 includes a visualization information receiving unit 301 and a display unit 302 .

[0143] The visualization information receiving unit 301 receives the visualization information 50 from the visualization information transmitting unit 205. The visualization information receiving unit 301 includes, for example, a communication circuit (or a communication module).

[0144] The display unit 302 displays the visualized information 50 from the attack detection device 200. The display unit 302 is, for example, a display such as a liquid crystal display.

[0145] 2. Operation of the Attack Detection System Next, the operation of the attack detection system 1 configured as described above will be described with reference to Fig. 13 to Fig. 27. First, the operation of the sensor 100 will be described with reference to Fig. 13. Fig. 13 is a flowchart showing the operation (attack detection method) of the sensor 100 according to this embodiment.

[0146] 13, first, the sensor data acquisition unit 102 acquires the sensor data 32 (S1001). Note that the timing of acquiring the sensor data 32 may differ depending on the sensor 100.

[0147] Next, the sensor information transmission unit 101 determines whether it is time to transmit the sensor data 32 (S1002), and if it determines that it is time to transmit (Yes in S1002), it transmits the sensor information 30 including the sensor data 32 to the attack detection device 200 (S1003). If the sensor information transmission unit 101 determines that it is not time to transmit (No in S1002), it returns to step S1001 and continues processing.

[0148] The determination in step S1002 may be made based on, for example, whether or not the current time is a preset timing for transmitting the sensor information 30. The transmission timing may be synchronized among all the sensors 100, or may be different for each sensor 100.

[0149] The sensor data 32 may be data sensed while the sensor 100 is fixed (i.e., while the position of the sensor 100 is not moving). The subsequent processing may be performed on the sensor data 32 acquired while the sensor 100 is not moving.

[0150] Next, the operation of the attack detection device 200 will be described with reference to Figures 14 to 27. Figure 14 is a flowchart showing the operation (attack detection method) of the attack detection device 200 according to this embodiment. Note that the sensor group DB 207 is stored in the storage unit, for example, before step S2100 is executed.

[0151] 14 , first, the sensor information receiving unit 201 receives sensor information 30 including sensor data 32 obtained by sensing a physical phenomenon by a plurality of sensors 100 (S2100). The sensor information receiving unit 201 may receive the sensor information 30 periodically, or may receive the sensor information 30 at a predetermined timing. Note that the sensor information 30 received here may be received directly from a single sensor 100, or may be received via a relay device (not shown) or the like. Furthermore, the received sensor information 30 may include aggregated pieces of sensor information 30.

[0152] Note that, in step S2100, it is sufficient that at least the sensor data 32 is acquired. Alternatively, in step S2100, the sensor data 32 from each of the multiple sensors 100 may be acquired. For example, in step S2100, aggregated sensor data in which the sensor data 32 from each of the multiple sensors 100 is aggregated may be acquired. The aggregated sensor data may be acquired, for example, from a relay device that manages the sensors 100 in multiple buildings 500.

[0153] Next, the sensor data change determination unit 202 determines a sensor change based on the sensor information 30 (S2200). The sensor data change determination unit 202 determines whether the currently acquired sensor information 30 has changed compared to the sensor information 30 of the sensor 100 a certain time ago.

[0154] Here, the detailed operation of step S2200 will be described with reference to Fig. 15. Fig. 15 is a flowchart showing the detailed operation (attack detection method) of step S2200 shown in Fig. 14.

[0155] As shown in FIG. 15, the sensor data change determination unit 202 acquires the sensor information 30 of the sensor 100 for which a sensor change is to be determined (S2201).

[0156] Next, the sensor data change determination unit 202 acquires the sensor data 32 for the same sensor ID from the sensor data DB 206 before a predetermined time (e.g., a certain time before) (S2202). The sensor data change determination unit 202, for example, reads the sensor ID 31 from the acquired sensor information 30 and acquires the sensor data 32 for the same sensor ID from the sensor data DB 206 before the predetermined time. Here, "before the predetermined time" may be the sensor data 32 received at the previous transmission timing or the sensor data 32 from a predetermined time before (e.g., several hours before). It is preferable to specify a time (predetermined time) during which a larger difference is likely to appear when a physical phenomenon occurs compared to normal times and which does not impair real-time performance. The predetermined time may be specified in advance for each physical phenomenon, for example.

[0157] Next, the sensor data change determination unit 202 calculates the difference between the sensor data 32 of the received sensor information 30 and the sensor data 32 acquired from the sensor data DB 206 (S2203). Furthermore, the sensor data change determination unit 202 stores the sensor information 30 received in step S2201 in the sensor data DB 206 (S2204).

[0158] Next, the sensor data change determination unit 202 refers to the sensor change definition DB 208 and determines whether the calculated difference is considered a change (whether there is a change) (S2205). In step S2205, the sensor data change determination unit 202 identifies a sensor type ID based on the received sensor ID 31 and the sensor group DB 207, and determines whether the difference calculated in step S2203 includes an item that satisfies the change definition in the sensor change definition DB 208 corresponding to the sensor type ID (e.g., sensor type ID and physical phenomenon ID). In this way, in step S2205, for each of the multiple sensors 100, it is determined whether the sensor data 32 of the sensor 100 has changed from the sensor data 32 acquired a certain time ago.

[0159] Next, if the sensor data change determination unit 202 determines that there is a change (Yes in S2206), it determines a sensor group based on the sensor change definition DB 208 and the difference (S2207). The sensor data change determination unit 202 acquires all physical phenomenon IDs of items that satisfy the change definition based on the sensor change definition DB 208. Then, the sensor data change determination unit 202 identifies the sensor group to which the sensor 100, for which it has been determined that there has been a change, belongs from the sensor group DB 207 using the acquired physical phenomenon ID and the received sensor ID 31. Note that the sensors 100 that belong to the identified sensor group are also referred to as two or more sensors.

[0160] Next, the sensor data change determination unit 202 creates sensor change information 40 including at least the sensor ID 41, the sensor group ID 42, and the change time 43, and transmits the created sensor change information 40 to the sensor change sequence creation unit 203 (S2208). The sensor data change determination unit 202 creates and transmits, for example, sensor change information 40 for each of the identified sensor groups.

[0161] Furthermore, if the sensor data change determination unit 202 determines that there is no change (No in S2206), the process ends.

[0162] 14 again, next, the sensor change sequence creation unit 203 determines whether or not there is a change in the sensor 100 (S2300). When the sensor change information 40 is acquired, the sensor change sequence creation unit 203 may determine that there is a change.

[0163] Next, if the sensor change sequence creation unit 203 determines that there is a change (Yes in S2300), it creates a sensor change sequence (S2400) based on the sensor change information 40. If the sensor change sequence creation unit 203 determines that there is no change (No in S2300), it returns to step S2100 and waits until the next sensor information 30 is received.

[0164] Here, the detailed operation of step S2400 will be described with reference to Fig. 16. Fig. 16 is a flowchart showing the detailed operation (attack detection method) of step S2400 shown in Fig. 14.

[0165] As shown in Figure 16, the sensor change sequence creation unit 203 acquires sensor change information 40 (S2401) and searches for sensor change sequences whose sensor change sequence state is standby among the sensor group IDs listed in the acquired sensor change information 40 (S2402).

[0166] Next, the sensor change sequence creation unit 203 determines whether there are any search results, and if it determines that there are any (Yes in S2403), it registers the sensor change information 40 in the sensor change sequence of the found ID (sensor group ID) (S2404). In other words, if another sensor 100 in the same sensor group has already changed and a sensor change sequence has been created, new sensor change information 40 is registered in that sensor change sequence. In this case, the sensor change sequence ID is not sent to the sensor change sequence verification unit 204.

[0167] Furthermore, if the sensor change sequence creation unit 203 determines that there are no search results (No in S2403), it creates a sensor change sequence and sets the status to standby (S2405). In step S2405, the sensor change sequence creation unit 203 creates a sensor change sequence with a new ID, registers sensor change information 40 in the sensor change sequence, and sets the status to standby. In this way, if there is no changing sensor 100 in the same sensor group, a sensor change sequence for that sensor group has not been created, so a new sensor change sequence is created.

[0168] Next, after creating the sensor change sequence, the sensor change sequence creation unit 203 waits until a predetermined waiting time has elapsed (S2406). The predetermined waiting time may be a uniform time, or may be a time that is predetermined for each sensor group or each physical phenomenon. Furthermore, the length of the predetermined time is preferably the maximum time required for the physical phenomenon to completely propagate through space, but is not limited to this, and may be a time that is shorter or longer than the maximum time.

[0169] Next, after waiting for a predetermined time, the sensor change sequence creation unit 203 determines whether there are any unregistered sensors that belong to a sensor group described in the sensor change sequence on standby but are not registered in the sensor change sequence (S2407). An unregistered sensor is a sensor 100 that belongs to a sensor group but whose sensor change information 40 is not registered in the sensor change sequence. In other words, an unregistered sensor is a sensor 100 that has not changed even after waiting for a predetermined time.

[0170] If there is unregistered sensor change information 40, that is, if there is an unregistered sensor (Yes in S2407), the sensor change sequence creation unit 203 sets the change time 43 to a time sufficiently far from the current time and registers the sensor change information 40 of the unregistered sensor (S2408). A time sufficiently far from the current time is a change time 43 that is temporarily set for the unregistered sensor to facilitate the process of estimating the occurrence position of a physical phenomenon, and may be, for example, a time that is not realistic.

[0171] Furthermore, if there is no unregistered sensor change information 40, that is, if there is no unregistered sensor (No in S2407), the sensor change sequence creation unit 203 proceeds to step S2409.

[0172] Next, after the sensor change information 40 of all sensors 100 belonging to the sensor group has been registered, the sensor change sequence creation unit 203 sets the status of the sensor change sequence to ended (S2409) and sends the sensor change sequence ID indicating the created sensor change sequence to the sensor change sequence verification unit 204 (S2410).

[0173] In this way, based on the sensor change information 40 based on the time series data of the sensor data 32, a sensor change sequence is created that indicates the order in which changes have occurred in each of the two or more sensors 100 relative to the sensor data 32 acquired a certain time ago.

[0174] 14 , next, the sensor change sequence verification unit 204 verifies the sensor change sequence created by the sensor change sequence creation unit 203 (S2500). It can also be said that the sensor change sequence verification unit 204 executes a sensor change sequence verification process. In step S2500, for example, a process of detecting an attack on two or more sensors 100 is executed based on time change information, time-series data of the sensor data 32 of each of the two or more sensors 100, and placement information. For example, in step S2500, the process of detecting an attack on two or more sensors 100 may be executed by determining whether or not there is a contradiction between the time change of a physical phenomenon and the placement information of the two or more sensors based on the time change information, the time-series data, and the placement information.

[0175] Here, the detailed operation of step S2500 will be described with reference to Fig. 17. Fig. 17 is a flowchart showing the detailed operation (attack detection method) of step S2500 shown in Fig. 14.

[0176] 17, the sensor change sequence verification unit 204 acquires a sensor change sequence ID from the sensor change sequence creation unit 203 (S2501). The sensor change sequence ID is, for example, an ID indicating the sensor change sequence to be verified.

[0177] Next, the sensor change sequence verification unit 204 identifies a sensor group and a physical phenomenon from the sensor change sequence indicated by the sensor change sequence ID (S2502). In other words, the sensor change sequence verification unit 204 identifies a sensor group ID and a physical phenomenon ID from the sensor change sequence.

[0178] Next, the sensor change sequence verification unit 204 executes a verification process specific to the identified physical phenomenon (S2503).

[0179] The operation of step S2503 will be described below using examples of physical phenomena, such as a fire and an unauthorised intrusion. First, the operation when the physical phenomenon is a fire will be described with reference to Figures 18 to 21B. Figure 18 is a flowchart showing an example of the detailed operation (attack detection method) of step S2503 shown in Figure 17.

[0180] As shown in FIG. 18 , first, the sensor change sequence verification unit 204 acquires a sensor map using the identified sensor group ID (S2601). The sensor change sequence verification unit 204 identifies a map path associated with the sensor group ID based on, for example, a table showing the correspondence between sensor groups and maps shown in FIG. 11B , and acquires the sensor map based on the identified map path. The acquired sensor map is map information showing the space in which the sensors 100 belonging to the sensor group are arranged. The acquired sensor map includes the coordinates of the sensors 100 and the range and domain of the sensor group coordinates. The sensor map is an example of placement information regarding the placement of two or more sensors 100. In step S2601, the placement information is acquired.

[0181] Next, the sensor change sequence verification unit 204 constructs a sensor map based on the coordinates of the sensor 100 and the value range and domain of the sensor group coordinates, and divides the constructed sensor map into grids of a predetermined size (S2602). Because the grids are used to estimate the occurrence points of physical phenomena, the predetermined size is set with sufficient granularity for this purpose. The predetermined size may be set in advance for each physical phenomenon, for example.

[0182] 19A is a diagram illustrating a sensor map for explaining the process for verifying the sensor change sequence under normal conditions according to this embodiment. FIG. 19A also illustrates an estimated source of the fire (the source of the fire with the highest likelihood). The estimated source of the fire may be obtained, for example, by temporarily placing the source of the fire on map information of the building 500 (e.g., the sensor map shown in FIG. 19A ), estimating the order in which the sensors 100 change based on that position, and estimating the position that is closest to the actual order (the order based on the sensor data 32) as the source of the fire.

[0183] 19A , the sensor map is divided into a plurality of grids. Each sensor 100 is arranged on the sensor map. The sensor map also indicates the positions where each of the two or more sensors 100 included in a sensor group is arranged, and the shape of the space in which the two or more sensors 100 are arranged.

[0184] 18 , the sensor change sequence verification unit 204 assumes that the grid points of the divided grid are the source of the fire and calculates the propagation time from each grid point to each sensor 100 (S2603). The sensor change sequence verification unit 204 acquires the propagation speed DB 209 and, for each grid point of the grid, calculates the propagation time of the physical phenomenon from the source of the fire to each sensor 100 present in the sensor map, assuming that the grid point is the source of the fire, using the acquired propagation speed DB 209. The sensor change sequence verification unit 204 calculates the time change of the physical phenomenon based on the propagation speed DB 209. Because the propagation speed through the air varies depending on the medium, such as smoke, heat, or carbon dioxide, the sensor change sequence verification unit 204 acquires the propagation speed corresponding to the medium from the propagation speed DB 209 and calculates the propagation time to each sensor 100.

[0185] The propagation time is an example of time change information that indicates a change over time of a physical phenomenon occurring in a predetermined space. In step S2603, the time change information is acquired. The sensor change sequence verification unit 204 also functions as a first acquisition unit that acquires the time change information.

[0186] Next, the sensor change sequence verification unit 204 compares the calculated propagation time to each sensor 100 with the sensor change sequence to calculate the likelihood (S2604). The sensor change sequence verification unit 204 calculates the likelihood assuming that one of the grid points is the source of the fire, moves the grid point assumed to be the source of the fire, and calculates the likelihood assuming that the next grid point is the source of the fire. For each grid point, the sensor change sequence verification unit 204 calculates the likelihood assuming that the grid point is the source of the fire.

[0187] 19B is a diagram showing a sensor change sequence in a normal state according to this embodiment, which is created by the sensor change sequence creation unit 203.

[0188] As shown in FIG. 19B, the sensor change sequence for a fire is as follows: thermometer 1, fire alarm, CO ２This includes the sensors 100 changing in the order of the concentration meter and the thermometer 2. Note that although the sensors 100 are arranged at equal intervals in Fig. 19B, the distance between the sensors 100 may be varied depending on the time of change.

[0189] Here, the likelihood is preferably calculated from the difference between the calculated propagation time and the actual change time, the difference between the change order determined from the calculated propagation time and the sensor change sequence, etc. For example, the likelihood may be calculated from the order of changes in each sensor 100 estimated from the assumed fire source and the order of changes actually acquired (for example, the order shown in FIG. 19B , which will be described later). Note that the method for calculating the likelihood is not particularly limited, and any known method may be used.

[0190] Furthermore, a weight for a physical phenomenon may be set for each of the two or more sensors 100, and the likelihood of the occurrence position of the physical phenomenon estimated based on the sensor change sequence in the sensor group to which the two or more sensors 100 belong may be calculated based on the weight of each of the two or more sensors 100. For example, weighting may be performed based on the sensor type or placement position of the sensors 100. Furthermore, weights may be set to distinguish between sensors 100 that are not significantly reflected in the likelihood calculation and sensors 100 that are considered important. The likelihood may be calculated using the weight for each sensor 100, or may be calculated without using the weight.

[0191] 18 , next, the sensor change sequence verification unit 204 sets the grid point with the maximum likelihood from among the likelihoods of each grid point as the coordinates of the fire source (S2605). For example, the sensor change sequence verification unit 204 sets the position of the grid point that is the most likely sequence based on the sensor change sequence in which the sensor 100 has changed as the fire source. Note that the sensor change sequence verification unit 204 may set the grid point with a likelihood equal to or greater than a predetermined value from among the likelihoods of each grid point as the coordinates of the fire source.

[0192] FIG. 19A shows an example in which, when the propagation time is calculated for each grid and verification is performed, the grid point where the fire icon shown in FIG. 19A is located is the grid point with the greatest likelihood.

[0193] 18 again, next, the sensor change sequence verification unit 204 determines whether the maximum likelihood exceeds the threshold value (S2606), and if the maximum likelihood exceeds the threshold value (Yes in S2606), determines that there is no attack (S2607), and if the maximum likelihood is equal to or less than the threshold value (No in S2606), determines that there is an attack (S2608). Determining that there is no attack means that a physical phenomenon has actually occurred (here, a fire has occurred).

[0194] Next, an example of verifying a sensor change sequence during an abnormality (attack) will be described with reference to Figs. 20A and 20B. Fig. 20A is a first diagram showing a sensor map for explaining a process for verifying a sensor change sequence during an abnormality according to this embodiment. Fig. 20B is a first diagram showing a sensor change sequence during an abnormality according to this embodiment. The arrangement positions of the sensors 100 are the same as those in Fig. 19A.

[0195] 20A, there is a discrepancy between the change order estimated from the calculated propagation time and the sensor change sequence shown in Fig. 20B, so the likelihood is low. Similar discrepancies occur at other grid points, reducing the maximum likelihood. Therefore, by determining in step S2606 whether the maximum likelihood exceeds a threshold, it is possible to determine whether an attack has occurred.

[0196] Next, a case where an attack is made to falsify the information of one sensor 100 will be described with reference to Figures 21A and 21B. Figure 21A is a second diagram showing a sensor map for explaining the process of verifying a sensor change sequence in an abnormal situation according to this embodiment. Figure 21B is a second diagram showing a sensor change sequence in an abnormal situation according to this embodiment. Figures 21A and 21B show a case where information on a fire alarm is falsified, and information indicating that the fire alarm has changed is transmitted from the fire alarm to the attack detection device 200, even though the fire alarm has not actually changed.

[0197] Considering the grid point where the fire icon in Fig. 21A is located, there is a discrepancy between the change order estimated from the calculated propagation time and the sensor change sequence shown in Fig. 21B. For example, the difference between the change time described in the sensor change sequence shown in Fig. 21B and the propagation time calculated from the distance becomes large, resulting in a low likelihood, and similar discrepancies occur at other grid points, resulting in a low maximum likelihood. For example, if the grid point where the fire icon in Fig. 21A is located is expected to have the highest likelihood, the difference in calculated propagation time becomes large, resulting in a low maximum likelihood, and therefore it can be determined that there is an attack.

[0198] 21B, no change has occurred in the sensor 100, i.e., there is no sensor change information, so in step S2408 shown in FIG. 16, the change time is set to a time sufficiently distant from that point in time. In this case, as described above, the difference between the change time described in the sensor change sequence and the propagation time calculated from the distance becomes large, so the likelihood decreases and it is possible to detect an abnormality. Note that while it may not be possible to identify the abnormal sensor, it is possible to identify the sensor group to which the abnormal sensor belongs.

[0199] Next, the operation when the physical phenomenon is an illegal intrusion will be described with reference to Figures 22 to 23C. Figure 22 is a flowchart showing another example of the detailed operation (attack detection method) of step S2503 shown in Figure 17.

[0200] 22 , first, the sensor change sequence verification unit 204 acquires a sensor map using the identified sensor group ID (S2701). The sensor change sequence verification unit 204 identifies a map path associated with the sensor group ID based on, for example, the table showing the correspondence between sensor groups and maps shown in FIG. 11B , and acquires the sensor map based on the identified map path. The acquired sensor map is map information showing the space in which the sensors 100 belonging to the sensor group are arranged. The acquired sensor map includes the coordinates of the sensors 100 and the range and domain of the sensor group coordinates.

[0201] FIG. 23A is a diagram showing a sensor map according to this embodiment when the physical phenomenon is trespassing.

[0202] In step S2701, the sensor change sequence verification unit 204 acquires the sensor map shown in Fig. 23A. Here, doors 1 to 5 are provided with opening / closing sensors that detect the opening and closing of the doors. The opening / closing sensors are an example of the plurality of sensors 100.

[0203] Next, the sensor change sequence verification unit 204 acquires a door access graph corresponding to the sensor map (S2702).

[0204] FIG. 23B is a diagram showing an example of a door access graph according to this embodiment.

[0205] As shown in FIG. 23B , the door access graph is a graph that shows the space separated by doors. In the example of FIG. 23B , for example, it can be seen that to go from one of doors 1 and 4 to the other, it is necessary to go via door 2 or door 3. It can also be seen that to go from one of doors 4 and 5 to the other, it is not necessary to go via any other door. By acquiring the door access graph, the sensor change sequence verification unit 204 can detect physically impossible door opening and closing sequences. The door access graph is set in advance and stored in the storage unit.

[0206] 22 again, the sensor change sequence verification unit 204 determines whether there is a contradiction between the sensor change sequence and the transition of the door access graph (S2703). In step S2703, the sensor change sequence verification unit 204 determines whether there is a contradiction between the door access graph and the order in which the doors were opened, which is indicated in the sensor change sequence.

[0207] FIG. 23C is a diagram showing a sensor change sequence according to this embodiment.

[0208] FIG. 23C shows a sensor change sequence in which doors 1, 4, and 5 are opened and closed in this order.

[0209] Next, if the sensor change sequence verification unit 204 determines that there is no contradiction (Yes in S2704), it determines that there is no attack (S2705), and if it determines that there is a contradiction (No in S2704), it determines that there is an attack (S2706). Since the sensor change sequence in Fig. 23C contradicts with the door access graph shown in Fig. 23B, it is determined in step S2704 that there is a contradiction.

[0210] Referring back to FIG. 14, when the verification in step S2500 is completed, the visualization information sending unit 205 may send the visualization information 50 for presenting the verification result to the client device 300.

[0211] [3. Examples of Presentation of Verification Results] Next, examples of presentation of verification results will be described with reference to Figs. 24 to 27. Figs. 24 to 27 illustrate examples in which the verification results are displayed as images using a display device (e.g., display unit 302 of client device 300), but the presentation format is not limited to a display and may also be, for example, audio output. Fig. 24 is a diagram showing an image displayed under normal conditions according to this embodiment. Note that Figs. 24 to 27 describe an example in which the shape of the predetermined space is rectangular.

[0212] As shown in FIG. 24 , when the client device 300 acquires visualization information 50 from the attack detection device 200, it generates an image displaying the verification results using the visualization information 50. In the image shown in FIG. 24 , the coordinates of the grid point with the highest likelihood in the verification process are displayed as the estimated occurrence location, and the spread of the physical phenomenon over time is displayed as a background in the spatial shape of the sensor map (here, rectangular) using a color scale (e.g., gradation), thereby visualizing the verification results. For example, the image may visualize the spread of the physical phenomenon together with the detection timing of the sensor 100. The color scale is an example of a first display mode. Note that if the physical phenomenon is a fire, the estimated occurrence location indicates the estimated location of the fire's source.

[0213] Furthermore, the client device 300 displays the color of the icon placed at the position of each sensor 100 belonging to the sensor change sequence on the sensor map in a color corresponding to the change in the physical phenomenon over time. The color display of the icon placed at the position of the sensor 100 is an example of a second display mode. The second display mode is associated with the first display mode, and for example, the second display mode and the first display mode may be displayed in the same color for each time. It can also be said that the color of the icon is set to a color corresponding to the change time of the corresponding sensor 100. This makes it possible to visualize abnormalities in the sensor 100 by the difference in color between the background and the icon.

[0214] 24, differences in the colors of the color scale and icons are indicated by differences in the density of dot hatching. Areas with the same or similar dot hatching density have the same or similar display colors.

[0215] When the background color and the sensor 100 color are the same, it means that the time at which a physical phenomenon reaches the sensor 100 based on the propagation speed is the same (or close) to the time at which the physical phenomenon is detected by the sensor 100. For example, when the background color and the sensor 100 color are the same, the user can easily know that there is no abnormality in the sensor 100 and that the sensor 100 is in a safe state.

[0216] 24 may be created in the attack detection device 200 based on the visualization information 50, and the created image information may be transmitted to the client device 300. For example, the visualization information 50 may include the image information. Specifically, the visualization information 50 may include information indicating a change in a physical phenomenon over time as information indicating the background of a predetermined space, and may also include image information for displaying icons indicating two or more sensors 100 at the respective locations of the sensors 100.

[0217] Similarly, the images shown in the following Figures 25 to 27 may also be created in the attack detection device 200 based on the visualization information 50, and the created images may be transmitted to the client device 300.

[0218] FIG. 25 shows an image displayed during an attack according to this embodiment.

[0219] As shown in Figure 25, by matching the icon color with the background color, when an attack is made on sensor 100, a discrepancy occurs between the icon color of sensor 100 and the background color, making it possible to visualize abnormalities in an intuitively easy-to-understand manner.

[0220] In addition, if the image information includes a difference of a predetermined value or more between the time change of a physical phenomenon and the time when each change occurred in two or more sensors 100, the image information may include information for highlighting the difference (e.g., an abnormal portion). The information for highlighting the difference may be information for displaying the different portion in a different display mode (such as by flashing, making the text larger, or using a different display color), or may be a predetermined symbol or mark attached to (e.g., superimposed on) the different portion, or may be the normal image shown in FIG. 24 displayed on the same screen alongside the image during an attack shown in FIG. 25. In this case, the attack detection device 200 may create the normal image shown in FIG. 24 by matching the color of the icon of each sensor 100 with the color of the background on which the icon is placed, based on the image during an attack shown in FIG. 25.

[0221] 26 and 27 are diagrams showing images to which a seek bar according to this embodiment has been added. In Fig. 26, the seek bar is positioned at time t1, and displays the extent of the physical phenomenon at time t1 and the icon of sensor 100 that has changed up to time t1. In Fig. 27, the seek bar is positioned at time t2, which is later than time t1, and displays the extent of the physical phenomenon at time t2 and the icon of sensor 100 that has changed up to time t2.

[0222] In this way, the image information may include information for displaying a seek bar for displaying the change over time of the physical phenomenon up to that point in time and the icon of the sensor 100 that has changed up to that point in time. The user can move the seek bar to any position.

[0223] 26 shows an example in which sensor D, which is located at a position not reached by the physical phenomenon, reacts at time t1. In this case, the user can intuitively know that sensor D may be abnormal due to the difference in color display.

[0224] 27 shows an example in which the display color of sensors B and C is the same as the background color. In this case, the user can intuitively know that sensors B and C are normal because the icon and the background are displayed in the same color.

[0225] While the attack detection method according to one or more aspects has been described above based on the embodiments, the present disclosure is not limited to these embodiments. As long as it does not deviate from the spirit of the present disclosure, various modifications conceivable by a person skilled in the art to the present embodiments and embodiments constructed by combining components of different embodiments may also be included in the present disclosure.

[0226] For example, the sensor data change determination unit 202 according to the above embodiment has been described as determining a change in the sensor data 32 based on the sensor change definition DB 208 (i.e., determining using a relative value), but is not limited to this. For example, the sensor data change determination unit 202 may determine whether the current sensor data 32 is within a normal range (i.e., determining using an absolute value).

[0227] Furthermore, in the above embodiment, an example has been described in which the specified space is the interior space of the building 500, but this is not limiting. The specified space may also be a space within a facility. The facility may be a residential facility or a non-residential facility. Examples of residential facilities are detached houses and apartment buildings. Each of the multiple dwelling units in an apartment building may be considered a "facility," or the entire apartment building may be considered a "facility." Examples of non-residential facilities include stores, office buildings, schools, welfare facilities, commercial complexes, hospitals, factories, etc. In this way, the specified space may also be an indoor space. Furthermore, the specified space is not limited to an indoor space and may also be, for example, an outdoor space. The outdoor space may be, for example, a park, an amusement park, etc.

[0228] Furthermore, instead of or in addition to the sensor change sequence, the sensor change sequence creation unit 203 according to the above embodiment may create a sensor group change sequence indicating the order in which changes occurred in each of two or more sensor groups by considering, for each of two or more sensor groups, that a change occurred in the sensor group at the time when a change occurred in the sensor data 32 of the sensors 100 belonging to that sensor group. Furthermore, in step S2603, the sensor change sequence verification unit 204 may assume that lattice points of a grid obtained by dividing multiple sensor maps corresponding to the multiple sensor groups are the source of fire, calculate the propagation time from each lattice point to each sensor group, and determine whether there is a contradiction between the propagation time to each sensor group and the sensor group change sequence, thereby determining the sensor group to which the abnormal sensor 100 belongs.

[0229] Furthermore, the verification processes specific to physical phenomena shown in the above embodiments are merely examples, and are not limited to the above.

[0230] In the above embodiments, each component may be configured with dedicated hardware, or may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU or processor reading and executing a software program recorded on a recording medium such as a hard disk or semiconductor memory.

[0231] The order in which the steps in the flowchart are executed is merely an example for specifically explaining the present disclosure, and other orders may be used. Some of the steps may be executed simultaneously (in parallel) with other steps, or some of the steps may not be executed.

[0232] The division of functional blocks in the block diagram is an example, and multiple functional blocks may be realized as a single functional block, one functional block may be divided into multiple blocks, or some functions may be moved to another functional block.Furthermore, the functions of multiple functional blocks having similar functions may be processed in parallel or in time-sharing by a single piece of hardware or software.

[0233] Furthermore, the attack detection device 200 according to the above embodiment may be realized as a single device or may be realized by multiple devices. When the attack detection device 200 is realized by multiple devices, the components of the attack detection device 200 may be distributed in any manner among the multiple devices. When the attack detection device 200 is realized by multiple devices, the communication method between the multiple devices is not particularly limited, and may be wireless communication or wired communication. Furthermore, wireless communication and wired communication may be combined between the devices.

[0234] Furthermore, in the above embodiment, an example has been described in which the attack detection device 200 and the client device 300 are separate devices, but they may also be integrated devices, for example.

[0235] Furthermore, each component described in the above embodiments may be implemented as software or, typically, as an LSI, which is an integrated circuit. These components may be individually integrated into a single chip, or some or all of them may be integrated into a single chip. Here, the term "LSI" is used, but depending on the level of integration, it may also be referred to as an IC, system LSI, super LSI, or ultra LSI. Furthermore, the integrated circuit implementation method is not limited to LSI, and may be implemented using a dedicated circuit (a general-purpose circuit that executes a dedicated program) or a general-purpose processor. After LSI fabrication, a field programmable gate array (FPGA) that can be programmed or a reconfigurable processor that can reconfigure the connections or settings of circuit cells within the LSI may also be used. Furthermore, if an integrated circuit technology that replaces LSI emerges due to advances in semiconductor technology or a derivative technology, that technology may naturally be used to integrate the components.

[0236] A system LSI is an ultra-multifunctional LSI manufactured by integrating multiple processing units on a single chip, and is specifically a computer system comprising a microprocessor, ROM, RAM, etc. The ROM stores computer programs. The system LSI achieves its functions when the microprocessor operates in accordance with the computer programs.

[0237] Furthermore, one aspect of the present disclosure may be a computer program that causes a computer to execute each of the characteristic steps included in the attack detection method shown in any of FIGS. 13 to 18 and 22 .

[0238] Furthermore, for example, the program may be a program to be executed by a computer. Another aspect of the present disclosure may be a computer-readable non-transitory recording medium on which such a program is recorded. For example, such a program may be recorded on a recording medium and distributed or circulated. For example, the distributed program may be installed in a device having another processor, and the program may be executed by the processor, thereby causing the device to perform each of the above processes.

[0239] The present disclosure is useful for devices that monitor sensors placed in buildings and the like.

[0240] 1 Attack detection system 30 Sensor information 31, 41 Sensor ID 32 Sensor data 33 Transmission time 40 Sensor change information 42 Sensor group ID 43 Change time 50 Visualization information 51 Sensor change sequence information 52 Sensor map information 53 Physical phenomenon occurrence location information 100 Sensor 101 Sensor information transmission unit 102 Sensor data acquisition unit 200 Attack detection device 201 Sensor information reception unit (second acquisition unit) 202 Sensor data change determination unit 203 Sensor change sequence creation unit 204 Sensor change sequence verification unit (first acquisition unit, detection unit) 205 Visualization information transmission unit 206 Sensor data DB 207 Sensor group DB 208 Sensor change definition DB 209 Propagation speed DB 210 Sensor map DB 211 Sensor change sequence DB 300 Client device 301 Visualized information receiving unit 302 Display unit 500 Building

Claims

1. An attack detection method comprising: acquiring time change information indicating the time change of a physical phenomenon occurring in a specified space; acquiring sensor data of the physical phenomenon sensed by two or more sensors fixedly positioned in the specified space; acquiring placement information regarding the placement of the two or more sensors; and detecting an attack against the two or more sensors based on the time change information, the time series data of the sensor data of each of the two or more sensors, and the placement information.

2. The attack detection method described in claim 1, wherein an attack on the two or more sensors is detected by determining whether or not there is a contradiction between the time change of the physical phenomenon and the placement information of the two or more sensors based on the time change information, the time series data, and the placement information.

3. An attack detection method as described in claim 1 or 2, wherein a plurality of sensors including the two or more sensors are arranged in the specified space, and the two or more sensors include a sensor among the plurality of sensors that is affected by the physical phenomenon.

4. The attack detection method according to claim 3, wherein each of the plurality of sensors is grouped into two or more sensor groups, sensor data for each of the plurality of sensors is acquired, and for each of the plurality of sensors, it is determined whether the sensor data of that sensor has changed relative to sensor data acquired a certain time ago, and the two or more sensors are sensors grouped into a sensor group to which a sensor among the plurality of sensors that is determined to have changed belongs.

5. The attack detection method according to claim 3, further comprising acquiring aggregated sensor data obtained by aggregating sensor data from each of the plurality of sensors.

6. The attack detection method according to claim 3, wherein the plurality of sensors include a bird's-eye view sensor capable of measuring the physical phenomenon from a bird's-eye view, and the time change information includes data measured by the bird's-eye view sensor.

7. The attack detection method according to claim 3, wherein each of the plurality of sensors is grouped into two or more sensor groups, and a sensor group change sequence indicating the order in which changes occurred in each of the two or more sensor groups is created by regarding each of the two or more sensor groups as having undergone a change at the time when there is a change in the sensor data of a sensor belonging to that sensor group.

8. The attack detection method according to claim 1 or 2, wherein the placement information includes a sensor map indicating the positions at which the two or more sensors are placed and the shape of the space in which the two or more sensors are placed.

9. An attack detection method as described in claim 1 or 2, wherein a sensor change sequence indicating the order of changes relative to sensor data acquired a certain time ago for each of the two or more sensors is created based on the time series data, and a location where the physical phenomenon occurs is estimated based on the sensor change sequence, and the time change information includes information indicating the change over time of the physical phenomenon when it is assumed that the physical phenomenon occurred at the estimated location of occurrence.

10. An attack detection method as described in claim 9, wherein a weight for the physical phenomenon is set for each of the two or more sensors, and the likelihood of the estimated occurrence location is calculated based on the weight for each of the two or more sensors.

11. The attack detection method according to claim 1 or 2, further comprising: acquiring a propagation speed of the physical phenomenon; and the time change information including information generated based on the propagation speed.

12. An attack detection method as described in claim 1 or 2, wherein visualization information for displaying information relating to the detection of an attack on the two or more sensors is output to a display device, the visualization information including information indicating the change in the physical phenomenon over time as information indicating the background of the specified space, and including image information for displaying an icon indicating each of the two or more sensors at the placement position of the sensor, and a first display mode of the information indicating the change in the physical phenomenon over time and a second display mode of the icon for each of the two or more sensors are correlated.

13. The attack detection method described in claim 12, wherein in the first display mode, the change in the physical phenomenon over time is displayed on a color scale; in the second display mode, the icon is displayed in color; and the first display mode and the second display mode include displaying the same color for each time.

14. The attack detection method according to claim 12, further comprising displaying a seek bar for displaying the time change of the physical phenomenon up to that point in time and the icons of the sensors that have experienced changes up to that point in time.

15. The attack detection method described in claim 12, wherein, when the image information includes a difference of a predetermined value or more between the change over time of the physical phenomenon and the time at which each of the two or more sensors experienced a change, the visualization information further includes information for highlighting the difference.

16. The attack detection method according to claim 1 or 2, wherein the physical phenomenon includes at least one of a fire, a gas leak, an unauthorised entry, a temperature rise, and a temperature drop.

17. The attack detection method according to claim 1 or 2, wherein the specified space is an indoor space.

18. The attack detection method according to claim 1 or 2, wherein the predetermined space is an outdoor space.

19. An attack detection device comprising: a first acquisition unit that acquires time change information indicating the time change of a physical phenomenon occurring in a specified space; a second acquisition unit that acquires sensor data obtained by sensing the physical phenomenon using two or more sensors that are fixedly positioned in the specified space; a memory unit that stores placement information regarding the placement of the two or more sensors; and a detection unit that detects an attack on the two or more sensors based on the time change information, the time series data of the sensor data of each of the two or more sensors, and the placement information.

20. A program for causing a computer to execute the attack detection method according to claim 1 or 2.

Images