Communication Link Prediction Graph for ICS Whitelist Accuracy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In industrial control systems (ICS), anomaly detection using whitelists is prone to false detections due to insufficient learning periods, leading to a burden on analysts and potential failure to handle cyber-attacks effectively.
Innovation Solution
A communication analysis system that creates a communication link prediction graph to determine whether to add unestablished communication links to the whitelist, using a confidence level calculator and a machine learning model to predict normal communication links, reducing false detections and enhancing analyst efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anomaly detection using whitelist is implemented in ICS, then security improvement is achieved, but false detections increase when learning period is insufficient
Solution Approach 1:
The system performs preliminary actions by creating a prediction graph before the whitelist learning period ends, identifying communication links that are likely to be established in the future. This allows the system to proactively add these links to the whitelist, preventing false detections before they occur while maintaining security monitoring.
Solution Approach 2:
The patent introduces a communication link prediction graph as an intermediary between the whitelist and actual communication monitoring. This graph serves as a buffer that predicts future communication patterns, allowing the system to distinguish between legitimate future communications and actual anomalies, thereby reducing false detections while maintaining security.
2Measurement precision
If whitelist learning period is extended to improve accuracy, then false detections decrease, but system response time to cyber-attacks increases
Solution Approach 1:
The system performs preliminary analysis by building a prediction graph that forecasts future communication links before the learning period completes. This allows the whitelist to be proactively updated with predicted legitimate communications, enabling early detection of actual anomalies without waiting for the full learning period, thus reducing response time while maintaining accuracy.
3Ease of operation
If more communication links are added to whitelist to reduce false detections, then analyst burden decreases, but ability to detect actual anomalies decreases
Solution Approach 1:
The prediction graph acts as an intelligent intermediary that selectively adds only those communication links to the whitelist that are predicted to be legitimate based on learned patterns. This prevents indiscriminate addition of links, maintaining the whitelist's effectiveness for detecting actual anomalies while reducing false detections and analyst burden through targeted updates.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A communication analysis system includes: an information obtainer (2501) that obtains past communication information indicating communication performed by a monitoring target (10); a prediction target link extractor (2502) that extracts, based on the past communication information obtained, an unestablished communication link of communication that has not been established in the past communication information, the unestablished communication link being at least one communication link that is a prediction target; a link confidence level calculator (2504) that calculates a confidence level indicating the likelihood that the unestablished communication link extracted will be established as a normal communication link in the future; and a NW graph creator (2506) that creates a NW graph, in which the unestablished communication link and information regarding the unestablished communication link are mapped, as graph information for determining whether to add the communication link to a whitelist (22), using the unestablished communication link extracted, the confidence level calculated, and the past communication information obtained.