ICS Communication Graph Analysis for Non-Whitelist Anomalies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication analysis systems in industrial control systems (ICS) face challenges in efficiently detecting anomalous communication not included in whitelists, leading to false detections and burdens on analysts due to insufficient learning periods and varying whitelist effectiveness across sites.
Innovation Solution
A communication analysis system that creates a network graph using past communication information and machine learning to identify similar terminals and communication links, aiding in the analysis of non-whitelist communication, and provides graphical tools for analysts to validate and update the whitelist.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If whitelist-based anomaly detection is used in ICS communication analysis, then detection capability is improved, but false detection rate increases and analyst burden increases
Solution Approach 1:
The patent introduces an analysis auxiliary graph as an intermediary between the whitelist determination and final anomaly detection. This graph provides contextual information about communication patterns, allowing analysts to verify whether non-whitelist communications are truly anomalous or part of normal operational patterns, thereby reducing false detections while maintaining detection capability
Solution Approach 2:
The patent adds a new dimension of analysis by creating visual graphs that show communication relationships and patterns. Instead of relying solely on whitelist matching, the system presents multi-dimensional communication context including terminal relationships, communication frequencies, and pattern deviations, enabling more accurate anomaly assessment
2Reliability
If whitelist learning period is extended to improve accuracy, then detection reliability is improved, but system response time deteriorates
Solution Approach 1:
The system performs preliminary actions by continuously building and updating the analysis auxiliary graph with communication data as it arrives. This ongoing preparation ensures that when anomalies need to be detected, the contextual information is already available, eliminating the need for extended learning periods before the system can provide reliable detection
Solution Approach 2:
The patent implements continuous data collection and graph updating, maintaining an ever-current understanding of communication patterns. This continuous action ensures the system remains responsive and accurate without requiring periodic extended learning phases, as the whitelist and contextual graphs are continuously refined in real-time
3Measurement precision
If detailed communication analysis is performed to reduce false detections, then detection precision is improved, but system complexity increases
Solution Approach 1:
The patent segments the analysis system into distinct functional modules: whitelist determination, analysis auxiliary graph creation, and anomaly detection. Each module handles a specific aspect of the analysis, making the overall complex system manageable and maintainable while still providing detailed communication analysis capabilities through the coordinated work of these specialized components
Data Source
AI summary
A communication analysis system includes: an information receiver that receives information indicating analysis target communication performed by a monitoring target; an information obtainer that obtains past communication information indicating communication by the monitoring target; a WL determiner that determines, using the obtained analysis target communication and the whitelist, that non-WL communication has been established in the analysis target communication; a similar terminal extractor that extracts one or more terminals similar to destination and source terminals included in a non-WL communication link determined; a primary similar communication link extractor that extracts a past communication link similar to the non-WL communication link as a primary similar communication link from the obtained past communication information using the extracted similar terminals; and a NW graph creator that creates a NW graph for analysis as graph information for analyzing the non-whitelist communication using the extracted primary similar communication link and the obtained past communication information.