JP2019168869A - Incident detection system and method thereof - Google Patents

Abstract

To collect logs from a specific control device among a plurality of control devices when an incident occurs, and to analyze and collect the collected logs.SOLUTION: A monitoring device connected to a plurality of control devices and an incident detection device through a network includes: a selection unit for selecting a collection object apparatus and a collection item related to a log on the basis of incident information in the case of receiving the incident information from the incident detection device; and a log collection unit for transmitting a collection command including a collection item to a specific control device to be a collection object apparatus to the specific control device, and collecting a designated log from the specific control device. Each control device includes a log management unit for transmitting the designated log following a collection command to the monitoring device in the case of receiving the collection command from the monitoring device. The monitoring device includes: an abnormality determination unit for comparing the designated log collected by the log collection unit with abnormality determination reference and determining the existence/nonexistence of abnormality of the designated log; and an output unit for outputting information based on a determination result of the abnormality determination unit.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an incident detection system and method.

  Control systems used in social infrastructure and automobiles such as electric power, railways, water, and gas are required to operate devices such as valves and actuators based on sensor information to maintain preset pressures and temperatures. The In order to realize this operation, in embedded devices such as controllers, information from sensors is periodically acquired, the status is confirmed, other controllers and servers are notified, and control is performed as necessary. Is required. For this reason, in a control system, periodic communication occurs and processing is usually performed based on the communication data.

  On the other hand, the control system has been using a dedicated OS (Operating System) and a dedicated protocol so far and is installed in an isolated state in an area that cannot be accessed from an external network such as the Internet. Service) attacks have been considered unrelated to cyber attacks. However, there are increasing cases of using general-purpose OSs and general-purpose protocols for cost reduction, and connection with information system systems is also progressing to improve efficiency.

  In recent years, computer viruses targeting control systems have been discovered, and technologies for detecting security incidents such as malware infections and unauthorized access from outside are required in control systems as well as information systems. Yes. In order to correctly detect a security incident in the system, it is necessary to perform comprehensive detection using a log of each device in addition to a security sensor that monitors a network or the like.

  In order to deal with such problems, there is known a technique for detecting a security incident by utilizing the data handled by each control device in addition to the security sensor for monitoring the network and analyzing the relationship between the two data ( For example, see Patent Document 1).

JP 2014-179074 A

  In the control system, the CPU (Central Processing Unit) load of each device and the bandwidth used for the network are determined in advance when the system is built, and if it deviates from the set value, there is a possibility of affecting the control system business. is there. However, in the conventional technology, since the operation log on the device side is continuously collected, the amount of logs increases, the load on the device and the network load increase, and there is a possibility of affecting the operation of the control system. there were.

  An object of the present invention is to collect logs from a specific control device among a plurality of control devices when an incident occurs, and to analyze and manage the collected logs.

  In order to solve the above-mentioned problem, the present invention is connected to a network, collects and manages logs related to a control target, and detects incidents that occur in the network, and detects incident information. An incident detection device to be generated, and a monitoring device that monitors the network and transmits / receives information to / from each of the plurality of control devices and the incident detection device, the monitoring device from the incident detection device When incident information is received, a selection unit that selects a collection target device and a collection item related to the log based on the received incident information, and a command for a specific control device that is the collection target device selected by the selection unit A collection command including the collection item selected by the selection unit via the network. And a log collection unit that collects a specified log according to the collection command from the specific control device via the network, and the control device is configured to monitor the monitoring device. A log management unit that transmits the specified log according to the received collection command to the monitoring device via the network when the collection command is received from a device, and the monitoring device includes at least the log collection unit An abnormality determination unit that compares the specified log and the abnormality determination criterion by collecting the specified log to determine whether there is an abnormality in the specified log, and an output unit that outputs information based on a determination result of the abnormality determination unit. It is further characterized by including.

  According to the present invention, when an incident occurs, logs can be collected from a specific control device among a plurality of control devices, and the collected logs can be analyzed and managed. As a result, the influence on the control device and the network can be analyzed. It is possible to detect a security incident in the entire system in consideration of the state of the control device while minimizing.

It is a block diagram which illustrates the structure of the incident detection system for control systems to which 1st embodiment of this invention was applied. It is a block diagram which illustrates the hardware constitutions of the control apparatus, monitoring apparatus, and incident detection apparatus in 1st embodiment of this invention. It is a flowchart which illustrates the processing flow which collects a log from each apparatus after incident detection, and performs abnormality analysis in the incident detection system for control systems to which 1st embodiment of this invention was applied. It is a flowchart which illustrates the processing flow which selects the collection object apparatus and collection object item which are implemented with a monitoring apparatus in the incident detection system for control systems to which 1st embodiment of this invention was applied. It is a block diagram which illustrates the abnormal equipment information output screen which a monitoring apparatus outputs in the incident detection system for control systems to which 1st embodiment of this invention was applied. It is a block diagram which illustrates the structure of the log stored in the log storage part of each control apparatus in the incident detection system for control systems to which 1st embodiment of this invention was applied. It is a block diagram which illustrates the structure of the collection command transmitted to each control apparatus from the monitoring apparatus in the incident detection system for control systems to which 1st embodiment of this invention was applied. It is a block diagram which illustrates the structure of the incident information stored in the incident information storage part of a monitoring apparatus in the incident detection system for control systems to which 1st embodiment of this invention was applied. It is a block diagram which illustrates the structure of the attack pattern stored in the attack pattern storage part of the monitoring apparatus in the incident detection system for control systems to which 1st embodiment of this invention was applied. It is a block diagram which illustrates the structure of the apparatus list stored in the apparatus list storage part of a monitoring apparatus in the incident detection system for control systems to which 1st embodiment of this invention was applied. It is a block diagram which illustrates the structure of the collection item stored in the collection item storage part of a monitoring apparatus in the incident detection system for control systems to which 1st embodiment of this invention was applied. It is a block diagram which illustrates the structure of the abnormality determination reference | standard stored in the abnormality determination reference | standard storage part of the monitoring apparatus in the incident detection system for control systems to which 1st embodiment of this invention was applied. It is a block diagram which illustrates the structure of the incident detection system for control systems to which 2nd embodiment of this invention was applied. It is a flowchart which illustrates the processing flow at the time of collecting a log from each control apparatus in the incident detection system for control systems to which 2nd embodiment of this invention was applied. It is a flowchart which illustrates the processing flow which collects a log from a log collection server after incident detection in the incident detection system for control systems to which 2nd embodiment of this invention was applied.

  An embodiment of the present invention will be described. Note that the present invention is not limited thereby.

  In this embodiment, when an incident detection device (security sensor) detects an incident (security incident) on the network, the monitoring device selects a device (control device) that collects logs according to the state of the incident that occurred In addition, an incident detection system that collects and analyzes logs from selected devices and outputs the analysis results is provided.

  Specifically, the range of devices affected by the incident is estimated based on whether the incident state is attempted (failed) or achieved (successful), and logs corresponding to the content of the incident are collected only from the devices that are expected to be affected. Then, it is determined whether the device is in an abnormal state based on the collected log, and information on the abnormal device is output as a determination result.

  More specifically, in the monitoring device, incident information generated in the incident detection system is collected and analyzed, and when the incident is unsuccessful, logs are collected from devices included in the occurrence area (zone), If the incident has been completed, logs are collected from devices included in an area (zone) that will be adversely affected by intrusion / infection in the future. Logs are collected based on the type of incident that occurred (log category). After that, it is verified whether or not the collected log meets the abnormality judgment criteria. If there is a match, the information of the abnormal device in the incident detection system is displayed together with the judgment reason (foundation).

  FIG. 1 is a configuration diagram of an incident detection system for a control system to which the first embodiment of the present invention is applied.

As illustrated in FIG. 1, the control system incident detection system according to the present embodiment includes control devices 10 ₁ to 10 _n , a monitoring device 20, an incident detection device 30, and a network 40.

The control devices 10 ₁ to 10 _n include control processing units 101 _{1 to} 101 _n that perform control processing related to a control target, log extraction units 102 _{1 to} 102 _n that extract logs stored in the control device, and a control device Log storage units 103 _{1 to} 103 _n for storing the logs collected in step ₁ and communication units 104 _{1 to} 104 _{n for} communicating with the network 40. At this time, the control devices 10 ₁ to 10 _n are connected to the network 40 and collect and manage logs related to the control target.

  The monitoring device 20 selects an incident information acquisition unit 201 for acquiring incident information generated in the incident detection system from another device, for example, the incident detection device 30 and the like, and a device selection for selecting a device (control device) for collecting logs. Unit 202, a collection item selection unit 203 that selects log items to be collected from the selected device, a log collection unit 204 that collects logs from the selected device, and an abnormality determination unit that determines whether there is an abnormality from the collected logs 205, a communication unit 206 that communicates with the network 40, an input / output unit 207 that inputs information from an input device (such as a keyboard) and outputs a determination result generated by the abnormality determination unit 205, and an incident information acquisition unit The incident information storage unit 208 that stores the incident information acquired in 201, and the device selection unit 202 An attack pattern storage unit 209 that stores an attack pattern that is assumed to be used when selecting a device, a device list storage unit 210 that stores a list of devices installed in the incident detection system, and a collection item selection unit A collection item storage unit 211 that stores log items to be collected for each type of incident used in 203, and a determination criterion used by the abnormality determination unit 205, which is a determination criterion for the presence or absence of abnormality in the collected logs And an abnormality determination reference storage unit 212 for storing.

  The incident detection device 30 includes a communication unit 301 that communicates with the network 40, an incident detection unit 302 that monitors the network 40 and detects the occurrence of an incident on the network 40, and a result detected by the incident detection unit 302 as incident information. And an incident information storage unit 303 for storing. At this time, the incident detection unit 302 is configured as a security sensor that detects that an illegal packet has flowed through the network 40 as the occurrence of an incident, for example. A plurality of incident detection devices 30 may be arranged in the incident detection system for the control system.

FIG. 2 is a configuration diagram illustrating the hardware configuration of the control devices 10 ₁ to 10 _n , the monitoring device 20, and the incident detection device 30. The control devices 10 ₁ to 10 _n , the monitoring device 20, and the incident detection device 30 include a communication device 11, an input / output device 12, a storage device 13, a CPU 14, and a memory 15 via an internal communication line 16 such as a bus. Connected and configured.

A processing flow in the incident detection system for a control system according to the present embodiment will be described. The processing flow described below is for a control system by loading a program stored in the storage device 13 of the control device 10 ₁ to 10 _n , the monitoring device 20 or the incident detection device 30 into the memory 15 and executing it by the CPU 14. It is executed by each processing unit embodied on a device constituting the incident detection system. Each program may be stored in the storage device 13 in advance, or may be introduced through other storage media or communication media (network or carrier wave propagating through the network) when necessary.

  FIG. 3 is a diagram showing a processing flow in which logs are collected from each device after an incident is detected and an abnormality analysis is performed in the incident detection system for a control system to which the first embodiment of the present invention is applied.

  First, the monitoring device 20 collects incident information from the incident detection device 30 and stores the collected incident information (incident information A801 in FIG. 8) in the incident information storage unit 208 (S301 (expressed as S301; the same applies hereinafter)). ). Here, the incident information may be collected via the network 40 or by a removable device such as a USB (Universal Serial Bus) memory.

  Next, when selecting a collection target using the collected incident information, the monitoring device 20 selects a log collection target device and a log collection target item (S302). Details of the collection target selection will be described later in FIG.

Next, the monitoring device 20 transmits a collection command A301 in which the selected collection item (including log category A703 and collection condition A706 in FIG. 7) is described to the selected device (log collection target device). . Here, it is assumed that, for example, the control device 10 _n is selected as the log collection target device as the specific control device specified by the collection command A301. If there are a large number of selected devices, prioritize the devices that are most likely to be attacked, such as the devices that are performing important operations or those with the lowest IP (Internet Protocol) address. May be performed.

Next, the control device 10 _n extracts the log (the log A 601 in FIG. 6 and the designated log specified by the collection command A 301) from the log storage unit 103 _n based on the received collection command A 301 ( S303). Next, the control device 10 _n transmits the extracted log A 302 to the monitoring device 20.

Next, the monitoring device 20, using the log A302 received from the control unit 10 _n, the abnormality determination (S304). Here, the abnormality determination is a log received from the received log A 302 (control device 10 _n and extracted attack pattern (extracted attack pattern in S405 in FIG. 4) in S302, the log information A601 in FIG. 6 The recorded log) and the abnormality determination criterion (abnormality determination criterion A1201 in FIG. 12) stored in the abnormality determination criterion storage unit 212 are used to determine whether the content of the log A302 matches the abnormality determination criterion. . The configuration of the abnormality determination standard will be described in detail in FIG. 12 below.

  Next, the monitoring device 20 verifies whether there is an abnormality from the result of the abnormality determination (S305). As a result, when it is determined that there is no abnormality, the monitoring device 20 ends the process (S306). On the other hand, if it is determined that there is an abnormality, the monitoring device 20 identifies the abnormality ID (Identification) determined as abnormal from the abnormality determination criterion (abnormality determination criterion A1201 in FIG. 12) stored in the abnormality determination criterion storage unit 212. ) To extract the degree of abnormality (S307). Next, the monitoring device 20 extracts an item (collection item) that matches the abnormal condition from the collection item storage unit 211 based on the abnormality ID, and a determination reason (determination reason A510 in FIG. 5) based on the extracted item. Is generated (S308). Next, the monitoring device 20 outputs information on the abnormal device to the screen (S309). Here, an example of screen output will be described in detail in FIG. 5 below.

  The steps from S302 to S308 may be executed every time new incident information is acquired, may be executed at a certain interval, or in response to a request from an incident detection system administrator or the like. May be executed. Even when the collection target is selected in S302, the timing for transmitting the collection command A301 may be changed according to the state of the incident detection system, the execution status of the business, and the like.

  FIG. 4 shows a collection target device (log collection target device) and a collection target item (log collection target item) executed by the monitoring device 20 in the control system incident detection system to which the first embodiment of the present invention is applied. It is the figure which showed the processing flow which selects.

  First, the monitoring apparatus 20 starts a collection target selection process (S401). Next, the monitoring apparatus 20 analyzes the incident information (incident information A801 in FIG. 8) stored in the incident information storage unit 208, and the occurrence status of incidents included in the incident information (whether the attack content has already occurred). , Information for identifying whether or not the attempt is unsuccessful (S402). Here, the configuration of the incident information is described in detail in FIG. 8 below. Next, the monitoring device 20 identifies whether the acquired incident occurrence status is attempted (success) or attempted (failure) (S403). When the occurrence status of the incident is identified as attempted (failed), the monitoring apparatus 20 estimates the area (occurrence area) where the incident occurred using the device list stored in the device list storage unit 210. (S404). Here, the configuration of the device list will be described in detail in FIG.

  On the other hand, if the incident occurrence status is identified as attempted (successful) in S403, the monitoring device 20 uses the device list stored in the device list storage unit 210 and the attack stored in the attack pattern storage unit 209. From the pattern, extract the attack pattern that matches the attack content (attack information) included in the incident information that has occurred, and indicate the areas (zones) and devices (control devices, etc.) that are considered to be affected by the incident in the future An area (influence area) is estimated (S405). Here, the structure of the attack pattern will be described in detail in FIG. 9 below.

  Next, the monitoring apparatus 20 extracts devices included in the corresponding region from the device list stored in the device list storage unit 210 using the information regarding the regions extracted in S404 and S405 (S406). Next, the monitoring apparatus 20 detects the attack contents (A805) included in the incident information (incident information A801 in FIG. 8) analyzed in S402, and the collection items (collection items in FIG. 11) stored in the collection item storage unit 211. A1101) is used to extract the collection target log (log category A1103) and the collection condition (A1104) that match the attack content (A805) (S407). Here, the configuration of the collection items will be described in detail in FIG.

  Next, the monitoring device 20 selects a collection date and time based on the occurrence date and time included in the incident information analyzed in S402 (S408). Here, the collection date / time is selected by selecting a predefined time width such as one day before or after the incident occurrence date / time or one hour before / after. Next, the monitoring device 20 ends the process (S409).

  FIG. 5 is a diagram showing an abnormal equipment information output screen output by the monitoring device 20 in the incident detection system for the control system to which the first embodiment of the present invention is applied.

  The abnormal device information output screen A501 is an output screen of the input / output unit 207, and includes a system configuration A502 and an abnormal device list A503. Here, the system configuration A502 is a list of devices (control devices A to D) included in the incident detection system, including the connection status with the network 40, and a device (control device) in which an abnormality has occurred. For A and C), the display may be switched depending on the degree of abnormality. For example, the display colors of the large abnormality degree device (control device A) A504 and the small abnormality degree device (control device C) A505 are changed depending on the degree of abnormality. The abnormal device list A503 includes an incident ID A506, a date and time A507, a device A508, an abnormality degree A509, and a determination reason A510. Here, each incident information included in the abnormal device list A503 may be switched in display depending on the degree of abnormality corresponding to the system configuration A502. For example, the display colors of the incident information display area A511 belonging to the incident ID “001” and the incident information display area A512 belonging to the incident ID “002” are changed depending on the degree of abnormality. Note that the constituent elements of the abnormal device information output screen A501 are not limited to the above, and it is sufficient that at least the above elements are included. Moreover, the order of the components of the abnormal device information output screen A501 is not limited to the above.

  Incident information belonging to incident IDs “001” and “002” includes date and time A507, device A508, abnormality degree A509, and determination reason A510. “2017/12/15 12:00:00” is recorded in the date and time A507 of the incident ID “001”, “control device A” is recorded in the device A508, and “large” is recorded in the abnormality degree A509. Is recorded in the determination reason A510, and “2017/12/20 20:00: 00” is recorded in the date and time A507 of the incident ID “002”. In the device A 508, “control device C” is recorded, in the abnormality level A 509 “small” is recorded, and in the determination reason A 510 “process start timing abnormality (log)” is recorded. By clicking “(log)” of “process activation frequency abnormality (log)” or “process activation timing abnormality (log)” in the determination reason A510, the information of the log A601 in FIG. 6 is enlarged and displayed. The

FIG. 6 exemplifies a configuration of logs stored in the log storage units 103 _{1 to} 103 _n of the control devices 10 ₁ to 10 _{n in} the incident detection system for control systems to which the first embodiment of the present invention is applied. FIG.

  The log A 601 includes a log generation date / time A 602, a log category A 603 indicating the type of log, and log contents A 604. Here, the log category, for example, identifies contents operated by each control device (control device) such as process activation and external communication, and the output destination changes depending on the contents. For example, when “process activation” is recorded in the log category A 603, information of “process name” and “success or failure of process activation” is recorded in the log content A 604. In the log content A 604, information for identifying whether the incident occurrence state is successful (achieved) or failed (unsuccessful) is recorded. The constituent elements of the log A 601 are not limited to the above, and it is sufficient that at least the above elements are included. Further, the order of the components of the log A 601 is not limited to the above.

FIG. 7 is a configuration diagram illustrating a configuration of a collection command transmitted from the monitoring device 20 to each of the control devices 10 ₁ to 10 _n in the incident detection system for the control system to which the first embodiment of the present invention is applied. .

  The collection command A 701 includes the collection target device address A 702 indicating the device address extracted in S 406 in FIG. 4, the log category A 703 belonging to the collection item extracted in S 407 in FIG. 4, and the collection date and time selected in S 408 in FIG. It includes a collection start date / time A704 and a collection end date / time A705, and a collection condition A706 belonging to the collection item extracted in S407 of FIG. The information recorded in the collection start date / time A704 and the collection end date / time A705 indicates a period during which the log of the identified device is collected. Collection condition A706 indicates a condition to be collected in the log of the identified device. Here, the collection condition indicates a specific keyword included in the log, and indicates information such as authentication failure, process start success, and communication timeout. The constituent elements of the collection command A 701 are not limited to the above, and it is sufficient that at least the above elements are included. Further, the order of the constituent elements of the collection command A701 is not limited to the above.

  FIG. 8 is a configuration diagram illustrating the configuration of incident information stored in the incident information storage unit 208 of the monitoring device 20 in the incident detection system for the control system to which the first embodiment of the present invention is applied.

  Incident information A801 includes an incident ID A802 that identifies an incident, an occurrence date and time A803, an occurrence device A804, an attack content A805, and an occurrence situation A806. In the occurrence date / time A803, information related to the date / time when the incident occurred is recorded. In the generation device A 804, information such as the name of the device (for example, the name of the incident detection device 30) where the occurrence of the incident is detected is recorded. The attack content A805 records the content of the incident, for example, information indicating that an illegal packet exists. In the occurrence status A806, information for identifying whether the attack content has already occurred or has been attempted is recorded. For example, when an unauthorized login occurs for a device, information of “achieved” or “successful” is recorded. When an attempt of unauthorized login is made, information of “attempted” or “failure” is recorded. Is done. The constituent elements of the incident information A801 are not limited to the above, and it is sufficient that at least the above elements are included. Further, the order of the constituent elements of the incident information A801 is not limited to the above.

  FIG. 9 is a configuration diagram illustrating the configuration of attack patterns stored in the attack pattern storage unit 209 of the monitoring device 20 in the incident detection system for the control system to which the first embodiment of the present invention is applied.

The attack pattern A901 is composed of an attack pattern IDA 902 for identifying an attack pattern and attack pattern information A903. Here, attack pattern information A903 includes attack order A904 ₁ ~A904 _n, a region IDA905 ₁ ~A905 _n identifies a region in the incident detection system consists of an attack content A906 ₁ ~A906 _n. There is only one attack pattern information A903 for one attack pattern ID, but there may be a plurality of attack pattern information A903. When there are a plurality of attack pattern information A903 for one attack pattern ID, the attack order A904, the area IDA905, and the attack content A906 increase sequentially from 1 to n according to the time series, and which area (specified by the area ID) It is possible to define what kind of attacks (contents of attacks) will occur in order. Note that the constituent elements of the attack pattern A901 are not limited to the above, and it is sufficient that at least the above-described elements are included. Further, the order of the components of the attack pattern A901 is not limited to the above.

  FIG. 10 is a configuration diagram illustrating the configuration of the device list stored in the device list storage unit 210 of the monitoring device 20 in the control system incident detection system to which the first embodiment of the present invention is applied.

  The device list A1001 includes an area IDA1002 for identifying an area in the incident detection system, an apparatus IDA1003 for identifying each apparatus (each control apparatus), and an IP address A1004 held by each apparatus (each control apparatus). In the area IDA 1002, for example, information for identifying the network 40 is recorded as an area in the incident detection system. In the device IDA 1003, for example, information relating to a manufacturing number for identifying each device (each control device) is recorded. Here, the same information as the IP address A 1004 may be used as the device IDA 1002. Note that the constituent elements of the device list A1001 are not limited to the above, and it is sufficient that at least the above elements are included. Further, the order of the components of the device list A1001 is not limited to the above.

  FIG. 11 is a configuration diagram illustrating the configuration of collection items stored in the collection item storage unit 211 of the monitoring device 20 in the incident detection system for the control system to which the first embodiment of the present invention is applied.

  The collection item A1101 includes an attack pattern IDA1102 that identifies an attack pattern, a log category A1103 that indicates the type of log, and a collection condition A1104 that indicates a specific keyword included in the log. The contents of the log category A1103 are the same as those of the log category A703 belonging to the collection command A701 in FIG. The contents of the collection condition A1104 are the same as those of the collection condition A706 belonging to the collection command A701 in FIG. Note that the constituent elements of the collection item A1101 are not limited to the above, and it is sufficient that at least the above-described elements are included. Further, the order of the constituent elements of the collection item A1101 is not limited to the above.

  FIG. 12 is a configuration diagram illustrating a configuration of an abnormality determination criterion stored in the abnormality determination criterion storage unit 212 of the monitoring device 20 in the control system incident detection system to which the first embodiment of the present invention is applied. .

  The abnormality determination criterion A1201 includes an abnormality IDA 1202 that identifies an abnormality, an attack pattern IDA 1203 that identifies an attack pattern, a log category A 1204 that indicates a log category, an abnormality degree A 1205 that indicates the magnitude of the abnormality, and the number of log entries A log number A1206 indicating log generation frequency, a log frequency A1207 indicating log generation frequency, and a log timing A1208 indicating log generation timing. Note that the constituent elements of the abnormality determination criterion A1201 are not limited to the above, and it is sufficient that at least the above-described elements are included. In addition, the order of the components of the abnormality determination criterion A1201 is not limited to the above.

  According to this embodiment, logs can be collected from a specific control device among a plurality of control devices when an incident occurs, and the collected logs can be analyzed and managed. For this reason, it is possible to suppress a load on a control device (apparatus) other than a specific control device or a network when collecting logs. In addition, since a specific log specified by the collection command only needs to be transmitted in a specific control device, the load on the specific control device can be reduced. As a result, it is possible to detect a security incident in the entire system in consideration of the state of the control device while minimizing the influence on the control device and the network.

  FIG. 13 is a configuration diagram of an incident detection system for a control system to which the second embodiment of the present invention is applied.

As illustrated in FIG. 13, the incident detection system for the control system according to the present embodiment includes control devices 10 ₁ to 10 _n , a monitoring device 20, an incident detection device 30, a network 40, and a log collection server 50. Has been.

The control devices 10 ₁ to 10 _n communicate with the control processing units 101 _{1 to} 101 _n that perform control processing of the control target, log storage units 103 _{1 to} 103 _n that store logs collected by the control device, and the network 40. And performing communication units 104 _{1 to} 104 _n . The log extraction unit 102 is excluded from the constituent elements.

  The components of the monitoring device 20 and the incident detection device 30 are the same as those in FIG.

The log collection server 50 includes a communication unit 501 that communicates with the network 40, a log collection unit 502 that collects logs from the control devices 10 ₁ to 10 _n, and a log extraction that extracts logs in response to requests from the monitoring device 20 Unit 503 and an integrated log storage unit 504 that stores logs collected from the control devices 10 ₁ to 10 _n .

Here, the hardware configuration of the log collection server 50 is the same as that shown in FIG.
A processing flow in the incident detection system for a control system according to the present embodiment will be described. In the processing flow described below, a program stored in the storage device 13 of the control devices 10 ₁ to 10 _n , the monitoring device 20, the incident detection device 30, or the log collection server 50 is loaded into the memory 15 and executed by the CPU 14. By this, it is executed by each processing unit embodied on the apparatus constituting the incident detection system for the control system. Each program may be stored in the storage device 13 in advance, or may be introduced through other storage media or communication media (network or carrier wave propagating through the network) when necessary.

  FIG. 14 is a flowchart showing a processing flow when collecting logs from each control device in the incident detection system for a control system to which the second embodiment of the present invention is applied.

_First , the control devices 10 ₁ to 10 _n generate logs as normal processing (S1401 _{1 to} S1401 _n ). Next, the control devices 10 ₁ to 10 _n transmit the generated logs A 1401 ₁ to A 1401 _n to the log collection server 50.

Next, the log collection server 50 stores the received log in the integrated log storage unit 504 (S1402 ₁ to S1402 _n ). Next, the log collection server 50 transmits responses A1402 _{1 to} A1402 _n indicating the log storage results to the control devices 10 ₁ to 10 _n .

  FIG. 15 is a flowchart showing a processing flow for collecting logs from the log collection server after detecting an incident in the incident detection system for a control system to which the second embodiment of the present invention is applied.

  First, the monitoring device 20 collects incident information from the incident detection device 30 and stores it in the incident information storage unit 208 (S1501). Here, the incident information may be collected via a network or a removable device such as a USB memory. Next, using the collected incident information, the monitoring device 20 selects a log collection target device and a log collection target item as a collection target (S1502). The details of the collection target selection are as described in FIG.

  Next, the monitoring apparatus 20 transmits to the log collection server 50 a collection command A1501 (collection command having the same configuration as the collection command A301) in which log collection target devices and log collection items are described.

  Next, the log collection server 50 extracts a log from the integrated log storage unit 504 based on the received collection command A1501 (S1503). Next, the log collection server 50 transmits the extracted log A 1502 (log having the same configuration as the log A 302) to the monitoring device 20.

  Next, the monitoring device 20 performs abnormality determination using the log A 1502 received from the log collection server 50 (S1504). Here, the abnormality determination is performed in the attack pattern extracted in the process of S1502 (the attack pattern matching the attack content included in the incident information), the log received from the log collection server 50, and the abnormality determination criterion storage unit 212. Using the stored abnormality determination standard (abnormality determination standard A1201 in FIG. 12), determination is made based on whether or not the abnormality determination standard is met. The configuration of the abnormality determination standard is as described in FIG.

  Next, the monitoring apparatus 20 verifies whether there is an abnormality as a result of the abnormality determination (S1505). As a result, when it is determined that there is no abnormality, the monitoring device 20 ends the process (S1506). On the other hand, if it is determined that there is an abnormality, the monitoring device 20 extracts the degree of abnormality from the abnormality determination criteria stored in the abnormality determination criterion storage unit 212 based on the abnormality ID determined to be abnormal (S1507). .

  Next, the monitoring device 20 extracts items that match the abnormal condition based on the abnormality ID, and generates a determination reason based on the extracted items (S1508). Next, the monitoring device 20 outputs information on the abnormal device to the screen (S1509). Here, an example of the screen output is as described in FIG.

  According to the present embodiment, the same effects as in the first embodiment can be obtained, and at the normal time, the log collection server collects logs from the respective control devices, and when an incident occurs, the monitoring device from the log collection server. Since logs are collected, the load on each control device can be further reduced when an incident occurs.

  In addition, this invention is not limited to said embodiment, A various deformation | transformation is possible within the range of the summary.

  For example, when the function of the incident detection device 30 is included in the monitoring device, the function of the log collection server 50 is included, the control device 10, the monitoring device 20, the incident detection device 30, or the log collection server 50 does not include a communication function with the network 40, and communicates with the network 40 via another device. Even in the case of this embodiment, there is no essential change in the processing performed in the entire system.

  In addition, a selection unit in which the device selection unit 202 and the collection item selection unit 203 are integrated can be configured. At this time, when receiving the incident information from the incident detection device 30, the selection unit selects a collection target device and a collection item regarding the log based on the received incident information. In this case, the selection unit changes the device belonging to the collection target device based on the information on the success or failure of the attack when the information on the success or failure of the attack is added to the received incident information as information indicating the incident status. To do. As a result, the device that is the target of log collection can be changed according to the information on the success or failure of the attack.

  Specifically, when the information indicating success of the attack is added to the received incident information, the selection unit will be affected by the incident based on the attack pattern stored in the attack pattern storage unit 209 in the future. Is predicted, and a device belonging to the predicted region is selected as a device belonging to the collection target device. In addition, when information indicating failure of the attack is added to the received incident information, the selection unit belongs to a device to be collected a device around the device in which the incident has occurred or a device that belongs to the network 40 in which the incident has occurred. Select as equipment. Further, in this case, the log collection unit 204 specifies a collection command A301 including a collection item selected by the selection unit via the network 40, which is a command for a specific control device that is a collection target device selected by the selection unit. The specified log according to the collection command A301 is collected from the specific control device via the network 40.

  In addition, the log extraction unit 102, the log storage unit 103, and the communication unit 104 in each control device can be integrated to form a log management unit. At this time, when receiving the collection command A 301 from the monitoring device 20, the log management unit transmits a designated log according to the received collection command A 301 to the monitoring device 20 via the network 40.

  Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Further, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment.

10 ₁ to 10 _n : control device, 11: communication device, 12: input / output device, 13: storage device, 14: CPU, 15: memory, 16: internal signal line, 101 _{1 to} 101 _n : control processing unit, 102 _{1 to} 102 _n : log extraction unit, 103 _{1 to} 103 _n : log storage unit, 104 _{1 to} 104 _n : communication unit, 20: monitoring device, 201: incident information acquisition unit, 202: device selection unit, 203: collection item Selection unit 204: Log collection unit 205: Abnormality determination unit 206: Communication unit 207: Input / output unit 208: Incident information storage unit 209: Attack pattern storage unit 210: Device list storage unit 211: Collection Item storage unit, 212: abnormality determination criterion storage unit, 30: incident detection device, 301: communication unit, 302: incident detection unit, 303: incident information storage unit, 0: Network, 50: Log collection server, 501: Communication unit, 502: Log collection unit, 503: Log extraction unit, 504: Integrated log storage unit, A301: Collection command, A302: Log, A501: Abnormal device information output screen A502: System configuration, A503: Abnormal device list, A504: High abnormality degree device, A505: Low abnormality degree device, A506: Incident ID, A507: Date and time, A508: Device, A509: Abnormality degree, A510: Reason for determination, A511 : Display area, A512: Display area, A601: Log, A602: Log generation date, A603: Log category, A604: Log content, A701: Collection command, A702: Collection target device address, A703: Log category, A704: Start collection Date / time, A705: Collection end date / time, A706: Collection condition, A801 : Incident information, A802: incident ID, A803: date and time of occurrence, A804: generating device, A805: content of attack, A806: occurrence status, A901: attack pattern, A902: attack pattern ID, A903: attack pattern information, A904 _{1 to} A904 _n: attack _order, A905 1 _{~A905 n:} area _ID, A906 1 _{~A906 n:} offensive content, A1001: device list, A1002: area ID, A1003: equipment ID, A1004: IP address, A1101: collection item, A1102: Attack pattern ID, A1103: Log category, A1104: Collection condition, A1201: Abnormal judgment criterion, A1202: Abnormal ID, A1203: Attack pattern ID, A1204: Log category, A1205: Abnormality, A1206: Number of logs, A1207 The frequency of the log, A1208: log of _timing, A1401 1 _{~A1401 n: log,} A1402 1 _{~A1402 n:} response, A1501: collection command, A1502: log

Claims (12)

A plurality of control devices connected to the network for collecting and managing logs related to the control target;
An incident detection device that detects incidents occurring in the network and generates incident information;
A monitoring device that monitors the network and transmits / receives information to / from each of the plurality of control devices and the incident detection device,
The monitoring device
When the incident information is received from the incident detection device, a selection unit that selects a collection target device and a collection item regarding the log based on the received incident information;
A command for a specific control device to be the collection target device selected by the selection unit, the collection command including the collection item selected by the selection unit is transmitted to the specific control device via the network, A log collection unit for collecting a specified log according to the collection command from the specific control device via the network;
Each of the control devices
When receiving the collection command from the monitoring device, including a log management unit that transmits the specified log according to the received collection command to the monitoring device via the network,
The monitoring device
An abnormality determination unit that determines whether or not there is an abnormality in the specified log by comparing at least the specified log and the abnormality determination criterion collected by the log collection unit;
An incident detection system, further comprising: an output unit that outputs information based on a determination result of the abnormality determination unit. The incident detection system according to claim 1,
The selection unit includes:
When information indicating whether or not an attack has succeeded is added to the received incident information as information indicating an incident status, the device belonging to the collection target device is changed based on the information on whether or not the attack has been successful. , A featured incident detection system. The incident detection system according to claim 2,
The monitoring device
An attack pattern storage unit in which an attack pattern including an attack sequence, an attacked area, and an attack content is recorded in chronological order;
The selection unit includes:
When information indicating the success of the attack is added to the received incident information, an area where the incident is expected to be affected in the future is predicted based on the attack pattern, and the predicted area An incident detection system characterized by selecting a device belonging to a device belonging to the collection target device. The incident detection system according to claim 2,
The selection unit includes:
When information indicating failure of the attack is added to the received incident information, devices around the device in which the incident has occurred or devices belonging to the network in which the incident has occurred belong to the collection target device Incident detection system characterized by selection as equipment. The incident detection system according to any one of claims 1 to 4,
The output unit is
When outputting information based on the determination result of the abnormality determination unit, device information for identifying a device determined to be abnormal by the abnormality determination unit, and information on the degree of abnormality indicating the degree of abnormality determined to be abnormal by the abnormality determination unit; An incident detection system characterized in that information on a determination reason indicating a determination reason determined as abnormal by the abnormality determination unit and information on a log related to the determination reason are output together. The incident detection system according to any one of claims 1 to 5,
A log collection server that transmits and receives information to and from the monitoring device and collects the logs from the plurality of control devices;
The log collecting unit
Sending the collection command to the log collection server via the network instead of the specific control device;
The log collection server
When the collection command is received, the designated log according to the received collection command is extracted from the logs collected from the plurality of control devices, and the extracted designated log is extracted via the network. Sent to the monitoring device,
The log collecting unit
Further, when the designated log is collected from the log collection server via the network, the collected designated log is output to the abnormality determination unit.
Incident detection system characterized by that. A plurality of control devices connected to the network for collecting and managing logs related to the control target;
An incident detection device that detects incidents occurring in the network and generates incident information;
A monitoring device that monitors the network and transmits / receives information to / from each of the plurality of control devices and the incident detection device, and an incident detection method in a system comprising:
When the monitoring device receives the incident information from the incident detection device, a selection step of selecting a collection target device and a collection item related to the log based on the received incident information;
The monitoring device is a command for the specific control device to be the collection target device selected in the selection step, and the collection command including the collection item selected in the selection step is sent to the specific control via the network. A log collecting step for transmitting to a device and collecting a specified log according to the collection command from the specific control device via the network;
When each control device receives the collection command from the monitoring device, a log management step of transmitting the designated log according to the received collection command to the monitoring device via the network;
The monitoring device compares at least the specified log by the collection at the log collection step with an abnormality determination standard, and determines whether there is an abnormality in the specified log;
An incident detection method comprising: an output step in which the monitoring device outputs information based on a determination result in the abnormality determination step. The incident detection method according to claim 7,
In the selection step,
When information indicating whether or not an attack has succeeded is added to the received incident information as information indicating an incident status, the device belonging to the collection target device is changed based on the information on whether or not the attack has been successful. , A featured incident detection method. The incident detection method according to claim 8,
The monitoring device further comprises an attack pattern storage step for recording an attack pattern including an attack order, an attacked area and an attack content in time series,
In the selection step,
When information indicating the success of the attack is added to the received incident information, it is assumed that the incident will be influenced in the future based on the attack pattern recorded in the attack pattern storing step. An incident detection method characterized by predicting a region and selecting a device belonging to the predicted region as a device belonging to the collection target device. The incident detection method according to claim 8,
In the selection step,
When information indicating failure of the attack is added to the received incident information, devices around the device in which the incident has occurred or devices belonging to the network in which the incident has occurred belong to the collection target device Incident detection method characterized by selecting as a device. It is the incident detection method of any one of Claims 7-10,
In the output step,
When outputting information based on the determination result in the abnormality determination step, device information for specifying the device determined to be abnormal in the abnormality determination step, and information on the degree of abnormality indicating the degree of abnormality determined to be abnormal in the abnormality determination step An incident detection method characterized in that information on a determination reason indicating a determination reason determined to be abnormal in the abnormality determination step and information on a log related to the determination reason are output together. It is the incident detection method of any one of Claims 7-11,
When further comprising a log collection server that performs transmission and reception of information with the monitoring device and collects the log from the plurality of control devices,
When the log collection server receives the collection command, it extracts the designated log according to the received collection command from the logs collected from the plurality of control devices, and extracts the designated log that has been extracted. A transmission step of transmitting to the monitoring device via the network;
In the log collecting step,
The monitoring device transmits the collection command to the log collection server via the network instead of the specific control device, and further collects the specified log from the log collection server via the network. And
In the abnormality determination step,
Comparing the specified log collected from the log collection server in the log collecting step with the abnormality determination criteria to determine whether there is an abnormality in the specified log;
Incident detection method characterized by this.

Images