Manufacturing Command Anomaly Detection Without Product IDs

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for detecting abnormalities in manufacturing commands, such as cyberattacks, struggle when a command does not contain a product ID, as they rely on product ID-based comparisons between simulated and actual commands.

Innovation Solution

A detection system that compares manufacturing commands based on command destination, name, parameter, and arrival order, even when a product ID is absent, by storing and matching these details in normal and actual command storage regions to identify anomalies.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If product ID-based comparison is used between simulated and actual commands, then detection precision is improved, but the system cannot handle commands without product IDs

Engineering Contradiction:

Improveabnormality detection precisionVSAvoidcapability to handle commands without product ID

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The patent segments the command comparison process into multiple independent comparison dimensions: command destination, command name, command parameter, and arrival order. This segmentation allows the system to compare commands through multiple attributes rather than relying solely on product ID, thereby maintaining detection precision while handling commands without product IDs.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent creates a universal comparison mechanism that works for both commands with product IDs and commands without product IDs. By implementing multi-attribute comparison (destination, name, parameter, order), the system achieves multi-functionality where the same detection mechanism handles all command types uniformly, regardless of whether product ID is present.

Inventive Principle:

Principle #6Universality (Multi-functionality)

2Productivity

If only product ID extraction is performed, then processing speed is improved, but detection reliability deteriorates when product ID is absent

Engineering Contradiction:

Improvecommand processing speedVSAvoidattack detection reliability

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent performs preliminary extraction of multiple attributes (command destination, command name, command parameter, and arrival order) simultaneously rather than sequentially. This preliminary action prepares all necessary comparison data in advance, maintaining processing speed while ensuring reliable detection even when product ID is absent, as all alternative comparison attributes are already ready.

Inventive Principle:

Principle #10Preliminary action

3Adaptability or versatility

If multi-attribute comparison is implemented, then adaptability is improved, but device complexity increases

Engineering Contradiction:

Improvecapability to detect attacks in various command typesVSAvoiddetection system complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The patent merges multiple comparison attributes (command destination, command name, command parameter, arrival order) into a unified comparison framework. By combining these attributes into a single detection process rather than implementing separate systems for each attribute, the patent achieves high adaptability while controlling system complexity through integration.

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS11467565B2Attack/abnormality detection device, attack/abnormality detection method, and attack/abnormality detection program

Publication Date: 2022.10.11 MITSUBISHI ELECTRIC CORP

AI summary

An attack/abnormality detection device includes: a command extraction unit configured to extract elements having the same command destination as a command destination of an additionally received actual manufacturing command from among each of a set of normal manufacturing commands and a set of actual manufacturing commands, which contain information on a command destination and an arrival order, and are stored in a command storage region; and a detection unit configured to detect an attack or an abnormality by comparing details of the commands with each other for each arrival order of both extracted elements.