Cross-Network Anomaly Detection for Industrial and IoT Protocols
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively detect cyberattacks that traverse multiple networks, such as those targeting industrial control systems, vehicles, homes, and buildings, due to the use of different dedicated communication protocols.
Innovation Solution
A detection system that integrates information collectors, detectors, and notifiers across networks to identify anomalous communication patterns, utilizing protocols like CAN, ECHONET Lite, and BACnet, and provides notifications to affected networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate anomaly detection systems are operated for each network field (vehicle, home, building), then each system can be optimized for its specific protocol, but the systems cannot detect cyberattacks that traverse multiple networks
Solution Approach 1:
The patent merges separate anomaly detection systems into a single integrated detection system that handles multiple network fields (vehicle, home, building) simultaneously. The integrated system collects logs from different networks and uses a unified detection mechanism to identify cross-network cyberattacks, thereby achieving both protocol optimization and cross-network detection capability.
Solution Approach 2:
The detection system is designed with universal functionality to handle multiple network types and protocols (CAN, ECHONET Lite, BACnet) within a single system. The system can detect anomalies across different network fields and identify attack patterns that traverse multiple networks, making it adaptable to various network environments without requiring separate specialized systems.
2Adaptability or versatility
If integrated anomaly detection systems are implemented across multiple networks, then cross-network cyberattack detection is enabled, but system complexity increases
Solution Approach 1:
The integrated detection system is segmented into functional modules: a log collection unit that gathers logs from different networks, a detection unit that analyzes logs for anomalies using protocol-specific knowledge, and a notification unit that alerts about detected attacks. This segmentation allows the system to handle multiple networks through standardized functional blocks, reducing overall system complexity while maintaining cross-network detection capability.
3Measurement precision
If comprehensive log analysis across multiple networks is performed, then detection accuracy improves, but processing load increases
Solution Approach 1:
The detection system applies local quality by analyzing logs from each network field using protocol-specific detection rules and characteristics. Instead of applying a single generic detection method to all networks, the system tailors its analysis to the specific protocols (CAN for vehicles, ECHONET Lite for homes, BACnet for buildings), which improves detection accuracy while managing processing load through targeted analysis rather than uniform comprehensive scanning.
Data Source
AI summary
A detection system includes an obtainer that obtains a first log, the first log being a log of communication in a first network; a determiner that determines whether the first log obtained by the obtainer includes anomaly information indicating anomalous communication in a second network; and a controller that, when the determiner has determined that the first log includes the anomaly information, performs control of notifying of an anomaly in the second network.