Module Allow Lists for Anomaly Detection in Industrial Control Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting anomalies in industrial control systems, such as those in factories and power stations, face challenges in identifying cyberattacks, particularly when processes execute numerous types of files, making it difficult to distinguish between normal and anomalous operations, especially when a shared library is compromised.
Innovation Solution
An information processing apparatus with a list storage unit and processor that stores allow lists for module processing types, detects system operations, specifies target processes and operation logs, and outputs anomaly information when detected operations are not permitted, ensuring accurate anomaly detection even in complex processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If file monitoring method is used to detect anomaly events, then anomaly detection capability is improved when number of file types is small, but detection accuracy deteriorates when process operates large number of file types
Solution Approach 1:
The patent segments the monitoring approach by introducing module-level allow lists that categorize file operations into specific modules. Instead of monitoring all files uniformly, the system divides file operations into distinct modules (e.g., database operations, network operations) and applies allow lists specific to each module. This segmentation enables precise anomaly detection even when processes operate numerous file types, as each module's operations are evaluated against its own predefined allow list.
Solution Approach 2:
The patent changes the monitoring parameter from individual file-level operations to module-level operation types. By transforming the monitoring granularity from files to modules, the system can handle processes that operate many file types without compromising detection accuracy. The allow lists are defined at the module level with specific operation types (read, write, execute), enabling the system to distinguish between normal and anomalous operations regardless of the total number of file types involved.
2Reliability
If shared library components are monitored, then detection of library invasions is improved, but false positive rate increases due to normal operations
Solution Approach 1:
The patent applies local quality by creating module-specific allow lists that define normal operations for each particular module. Instead of using a single global allow list, the system generates separate allow lists for different modules (e.g., one for database operations, another for network operations). Each allow list contains the specific operation types that are normal for that module, enabling the system to accurately distinguish between normal module operations and actual anomalies, thereby reducing false positives while maintaining reliable cyberattack detection.
3Measurement precision
If allow list method is implemented, then anomaly detection precision is improved, but system complexity increases
Solution Approach 1:
The patent implements universality by designing a unified allow list management mechanism that handles multiple modules through a single framework. The allow lists are organized in a hierarchical structure where module-level allow lists are maintained within a broader system framework. This universal approach enables the system to manage allow lists for numerous modules without proportionally increasing overall system complexity, as the same management mechanisms and data structures are reused across all modules.
Data Source
AI summary
An information processing apparatus according to an embodiment includes a list storage unit and processor. The list storage unit stores therein allow lists for module processing types, and each allow list describes an execution-permitted system operation. The processor functions as an operation detecting unit, a process specifying unit, a log specifying unit, a type specifying unit, and an output unit. The operation detecting unit detects execution of any of system operations. The process specifying unit specifies a target process that has executed execution-detected system operation. The log specifying unit specifies a target operation log. The type specifying unit specifies a type of target module processing that executed execution-detected system operation by analyzing the target operation log. The output unit outputs anomaly information when the allow list for the target module processing type does not include the execution-detected system operation.