Network Graph Analysis for Non-Whitelist ICS Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection systems in industrial control systems (ICS) using whitelists are prone to false detections due to insufficient learning periods, leading to a burden on analysts and potential failure to handle cyber-attacks effectively.
Innovation Solution
A communication analysis system that creates a network graph using past communication information and machine learning to identify similar terminals and communication links, aiding in the analysis of non-whitelist communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a whitelist is used for anomaly detection in ICS communication, then detection effectiveness is improved, but false detections increase when the whitelisting period is insufficient
Solution Approach 1:
The patent introduces an analysis auxiliary graph as an intermediary tool between the whitelist determination and the final anomaly detection. This graph incorporates past communication information and similarity relationships among terminals, allowing the system to contextualize non-whitelist communications and reduce false detections while maintaining detection effectiveness.
Solution Approach 2:
The system performs preliminary actions by creating analysis auxiliary graphs in advance that capture the normal communication patterns and terminal relationships. When anomalies are detected, these pre-computed graphs provide immediate contextual information to help analysts quickly assess whether a non-whitelist communication is truly anomalous or a false detection.
2Productivity
If priority levels are assigned to alerts using machine learning, then alert prioritization is improved, but analyst burden increases due to lack of actionable insights
Solution Approach 1:
The patent implements feedback by providing analysts with actionable insights derived from the analysis auxiliary graphs, such as similar terminal information and communication pattern comparisons. This feedback loop allows analysts to quickly verify or dismiss alerts based on contextual evidence, reducing their burden while maintaining high prioritization accuracy.
Solution Approach 2:
The system replaces the manual mechanical analysis process with automated graph-based analysis that computes similarity relationships and communication patterns. This substitution provides analysts with pre-processed, actionable insights rather than raw data, significantly reducing their cognitive and operational burden.
3Measurement precision
If comprehensive past communication information is collected for whitelist creation, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent extracts only the essential elements needed for anomaly detection from comprehensive past communication information, specifically focusing on terminal similarity relationships and communication patterns relevant to the analysis auxiliary graph. This extraction approach maintains detection accuracy while avoiding the complexity of processing and storing all raw communication data.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
A communication analysis system includes: an information receiver (2101) that receives information indicating analysis target communication performed by a monitoring target (10); an information obtainer (2105) that obtains past communication information indicating communication by the monitoring target (10); a WL determiner (2102) that determines, using the obtained analysis target communication and a whitelist, that non-WL communication has been established in the analysis target communication; a similar terminal extractor (2103) that extracts one or more terminals similar to destination and source terminals included in a non-WL communication link determined; a primary similar communication link extractor (2107) that extracts a past communication link similar to the non-WL communication link as a primary similar communication link from the obtained past communication information using the extracted similar terminals; and a NW graph creator (2109) that creates a NW graph for analysis as graph information for analyzing the non-whitelist communication using the extracted primary similar communication link and the obtained past communication information.