JP2019205125A - Abnormal factor determination device, control system, and abnormal factor determination method - Google Patents

Abstract

To provide an abnormal factor determination device capable of quickly and accurately dealing with a system abnormality.SOLUTION: An abnormal factor determination device according to an embodiment is provided in a control system including a control device that controls equipment by using network data transmitted via a network. The abnormal factor determination device includes a storage unit that stores control state data including a control state indicating an operation state of the control device, and an analysis unit that determines whether the cause of the abnormality occurring in the control system is an attack through the network or a device failure on the basis of the control state data stored in the storage unit when the network data is analyzed.SELECTED DRAWING: Figure 1

Description

  Embodiments described herein relate generally to an abnormality factor determination device, a control system, and an abnormality factor determination method.

  In recent years, control devices (control systems) in fields such as FA (Factory Automation) require security measures to prepare for cyber attacks such as computer viruses and unauthorized access due to the adoption of general-purpose technology, standard technology, and connection to open networks. It has become.

  As one of the security measures, there is an intrusion detection system (IDS: Intrusion Detection System) that monitors a system network and detects an intrusion into the network. This detects system abnormalities caused by cyber attacks, such as unauthorized access from outside the system and malware infection inside the system, and is widely used mainly in IT (Information Technology) systems.

JP 2012-169731 A

  When the control system detects an abnormality, the action to be taken differs depending on whether the abnormality is caused by an attack or a failure. For example, if it is due to an attack, only the attack source is blocked, and if it is due to a failure, priority is given to safety.

  However, since the conventional apparatus is based on the premise that only one of the two types of abnormality is detected, the cause of the abnormality cannot be specified. Therefore, when an abnormality occurs in the control system, it is expected that a long time will be required to deal with the abnormality. In addition, if the cause of the abnormality cannot be determined correctly, the measures to be taken may be inappropriate, and the situation may be worsened.

  An embodiment of the present invention aims to provide an abnormality factor determination device, a control system, and an abnormality factor determination method capable of quickly and accurately dealing with an abnormality in a system.

  According to one embodiment, the abnormality factor determination device is provided in a control system including a control device that controls equipment using network data transmitted via a network. The abnormality factor determination device includes a storage unit that stores control state data including a control state indicating an operation state of the control device, and a control unit configured to perform control based on the control state data stored in the storage unit when analyzing the network data. And an analysis unit that determines whether the cause of the abnormality that has occurred in the system is an attack through a network or a device failure.

  According to the present embodiment, it is possible to quickly and accurately cope with a system abnormality.

It is a block diagram which shows the structure of the control system which concerns on 1st Embodiment. It is a figure which shows an example of control state data. It is the flowchart which showed the processing flow of abnormality factor determination of 1st Embodiment. It is a block diagram which shows the structure of the control system which concerns on 2nd Embodiment. It is the flowchart which showed the processing flow of abnormality factor determination of 2nd Embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. This embodiment does not limit the present invention.

(First embodiment)
FIG. 1 is a block diagram illustrating a configuration of a control system according to the first embodiment. A control system 1 shown in FIG. 1 includes a control device 11, an HMI (Human Machine Interface) 12, a network switch 13, and an abnormality factor determination device 14. The control system 1 may be provided with a plurality of control devices 11 and HMIs 12, or may be configured such that these are directly connected without using the network switch 13.

  The control device 11 controls equipment installed in a plant, FA, or the like using network data transmitted via a network. The control device 11 includes a controller 111, a sensor 112, and an actuator 113. The controller 111 is composed of, for example, a PLC (Programmable Logic Controller). The sensor 112 senses the state or environment of the control target device. The actuator 113 operates based on the control of the controller 111. The configuration of the control device 11 is not limited to the configuration illustrated in FIG. 1, and may be configured to perform remote control such as state monitoring and setting change from a user terminal such as the HMI 12 in addition to autonomous operation. .

  Further, the control device 11 performs an operation according to a control state designed in advance. The control device 11 has, for example, six control states of “stopped”, “starting up”, “waiting for execution”, “running”, “testing”, and “programming”. Here, “programming” includes operations such as writing and downloading of a control program. Note that the control state is not limited to the above six types. Different control states may be defined for each control device 11. In the present embodiment, the controller 111 grasps the current control state of the control device 11.

  The control device 11 transmits the control state, in-execution processing, and next execution scheduled processing as control state information to the outside of the control device 11, and the abnormality factor determination device 14 receives the control state information. When the control device 11 has a function of transmitting a processing result to the host device for each periodic process of itself, the control state information can be transmitted using the communication function. Here, the host device is a device positioned higher in the network than the control device 11, and corresponds to, for example, the HMI 12 and the abnormality factor determination device 14.

  The control device 11 can also include control state information in the periodic communication processing to the host device, or can transmit at a timing different from this communication processing. In the latter case, flexible control state information can be transmitted regardless of the timing of periodic processing.

  Further, the control state information may not be always transmitted from the control device 11 but may be transmitted only in a specific mode. For example, when the control system 1 has a test mode and an operation mode, the control device 11 is notified of whether the HMI 12 is in the test mode or the operation mode. In this case, the control device 11 transmits control state information in the test mode. For example, when the abnormality factor determination device 14 uses machine learning, the control device 11 has a learning mode and a determination mode. In this case, the abnormality factor determination device 14 notifies the control device 11 whether the learning mode or the determination mode is set. At this time, the control state information is transmitted in the learning mode. As described above, by limiting the exposure of the control state indicating the operation state of the control device 11, leakage of internal information of the control device 11 due to network eavesdropping can be reduced.

  The HMI 12 monitors the state of each control device 11 via the network switch 13. The network switch 13 connects each control device 11 to the network. In this embodiment, this network is Ethernet (registered trademark), but may be a network of another standard. Further, the network switch 13 has a mirror port, and an abnormality factor determination device 14 is connected to the mirror port. Thereby, the abnormality factor determination device 14 can acquire all network data transmitted through the control system 1 via the network switch 13.

  The abnormality factor determination device 14 may have any configuration as long as the network data can be analyzed and abnormality detection and abnormality factor determination processing can be performed. For example, as illustrated in FIG. 1, the communication unit 141, the analysis unit 142, A storage unit 143 and a display unit 144 are provided. The display unit 144 may be externally attached to the abnormality factor determination device 14 or may be a function for remote display using the HMI 12 or the like. The constituent elements of the abnormality factor determination device 14 may be hardware or may be realized as software.

  The communication unit 141 communicates with each component in the control system 1. The analysis unit 142 analyzes the network data received by the communication unit 141, and performs abnormality detection and abnormality factor determination based on the analysis result. The storage unit 143 stores control state data including control state information extracted from the network data by the analysis unit 142. This control state data is used for abnormality detection and factor analysis by the analysis unit 142. The storage unit 143 may be a storage device such as an HDD (Hard Disk Drive) or a semiconductor memory such as a DRAM (Dynamic Randam Access Memory).

  FIG. 2 is a diagram illustrating an example of control state data. The control state data 200 shown in FIG. 2 is data including the control state of each control device 11. The control state data 200 indicates, for each control device 11, ID (Identification), IP (Internet Protocol) address, past control state, current control state, and processing information to be executed next. The control state data 200 stores the previous control state and the previous control state as past control states.

  Hereinafter, with reference to FIG. 3, the abnormality factor determination method by the abnormality factor determination device 14 according to the first embodiment will be described. FIG. 3 is a flowchart showing a process flow of abnormality factor determination.

  In the abnormality factor determination device 14, first, the communication unit 141 receives network data (step S11). Subsequently, the analysis unit 142 performs an analysis process on the network data received by the communication unit 141 (step S12). In step S2, the analysis unit 142 extracts control state information from, for example, network data. Subsequently, the analysis unit 142 updates the control state data 200 stored in the storage unit 143 based on the extracted control state information (step S13).

  Next, the analysis unit 142 performs abnormality detection and factor determination on the received network data in consideration of the current control state, using the updated control state data 200 (step S14). In step S14, the analysis unit 142 performs the following determination, for example.

  According to the control state data 200 shown in FIG. 2, since the control state of the control device 11 identified by ID2 is “stopped”, communication starting from this control device 11 should not occur. However, when the transmission source of the received network data is the IP address of the control device 11, the analysis unit 142 determines that the unauthorized terminal is impersonating the control device 11. Further, the control device 11 identified by ID1 is “active”. Therefore, for example, when communication that requests rewriting of the program to the control device 11 is detected, the analysis unit 142 determines that the operation is an unauthorized operation.

  Note that the determination process of the analysis unit 142 may be realized by creating a determination rule in advance based on the specifications of the control system 1 or by revising the determination rule using a method such as machine learning. Also good. Moreover, the determination process of the analysis part 142 is not limited to the method mentioned above. For example, the analysis unit 142 detects an abnormality by analyzing a matching with an abnormal pattern or a deviation degree from a normal state with respect to network data, and when an abnormality is detected, whether the cause is an attack or a failure. May be determined.

  If the determination result by the analysis unit 142 is abnormal (step S15), the display unit 144 displays the determination result and alerts the user (step S16). The display contents may include the terminal information and the countermeasures that are the cause of determination together with the determination result.

  When a specific abnormality factor can be determined in step S15, the control system 1 may automatically execute a countermeasure according to the factor. For example, when the cause of the abnormality is an attack from an unauthorized terminal, the network switch 13 blocks communication from the unauthorized terminal based on an instruction from the analysis unit 142, Execute processing such as ignoring communication from.

  If the abnormality factor is a failure, the network switch 13 executes a process of switching the connection of the control device 11 to a redundant standby system based on an instruction from the analysis unit 142. For example, when the control device B shown in FIG. 1 is provided as a redundancy of the control device A, the network switch 13 disconnects the connection of the control device A to the network when the control device A fails. Connect only B to the network.

  As described above, the network switch 13 executes a measure relating to connection to the network according to the analysis result of the analysis unit 142, so that a countermeasure corresponding to the abnormality factor is automatically executed.

  According to the present embodiment described above, abnormality detection and factor determination are performed by providing the abnormality factor determination device 14 in the control system 1, and a determination result indicating whether the factor is due to an attack or a failure can be output. . Therefore, since the user can grasp the cause of the abnormality and the failure location, it is possible to automate countermeasures based on the abnormality factor determination result. Further, since the abnormality factor determination device 14 uses the control state information of each control device 11, it is possible to detect an abnormality and determine the factor with high accuracy.

(Second Embodiment)
Hereinafter, the second embodiment will be described focusing on differences from the first embodiment. FIG. 4 is a block diagram illustrating a configuration of a control system according to the second embodiment. The control system 2 shown in FIG. 4 is different from the first embodiment in that in addition to the components of the control system 1, the control system 2 includes an aggregation server 15 that controls each control device 11.

  The aggregation server 15 is connected to the control device 11 via the network switch 13. However, the aggregation server 15 may be directly connected to the control device 11. The aggregation server 15 performs monitoring and control of the control device 11 such as, for example, rewriting parameters of the control device 11, giving a control instruction, and receiving processing results periodically transmitted from each control device 11. In addition, the aggregation server 15 has a function of relaying communication from the HMI 12 disposed at a remote location as a site-side gateway of the control system 2. In the present embodiment, the abnormality factor determination device 14 may be included in the aggregation server 15.

  Since the aggregation server 15 knows the operation state of each control device 11, it holds the control state of each control device 11. The aggregation server 15 transmits this control state either spontaneously or based on a request from the abnormality factor determination device 14. The abnormality factor determination device 14 receives the control state from the aggregation server 15 and performs abnormality detection and factor determination as in the first embodiment.

  Further, the aggregation server 15 has a CPU (Central Processing Unit) processing capability higher than that of the control device 11, and can incorporate general information security functions such as device authentication and secure communication. Therefore, it is also possible to prevent leakage of state information and data by encrypting the communication path between the aggregation server 15 and the abnormality factor determination device 14. In the case where the aggregation server 15 includes the abnormality factor determination device 14, it is possible to realize the countermeasure against eavesdropping on the communication path.

  Hereinafter, with reference to FIG. 5, the abnormality factor determination method by the abnormality factor determination device 14 according to the second embodiment will be described. FIG. 5 is a flowchart showing a processing flow of the abnormality factor determination method. As shown in FIG. 5, the abnormality factor determination device 14 executes the update process of the control state data 200 and the abnormality detection and factor determination process independently and asynchronously.

  First, the update process of the control state data 200 will be described. Here, a case where the aggregation server 15 spontaneously transmits the control state of each control device 11 will be described. In this case, the abnormality factor determination device 14 is in a state of waiting for reception of the control state (step S21). Thereafter, when the communication unit 141 receives the control state from the aggregation server 15 (step S22), the analysis unit 142 updates the control state data 200 stored in the storage unit 143 (step S23). Thereafter, the process returns to step S21, and the abnormality factor determination device 14 returns to a state of waiting for reception of the control state.

  Next, abnormality detection and factor determination processing will be described. When the communication unit 141 receives network data while the operations in steps S21 to S23 are repeated (step S24), the analysis unit 142 reads the control state data 200 from the storage unit 143 (step S25). Subsequently, the analysis unit 142 performs abnormality detection and factor determination on the received network data based on the current control state read in step S25 (step S26). If the determination result by the analysis unit 142 is abnormal (step S27), the display unit 144 displays the determination result and alerts the user (step S28).

  According to the present embodiment described above, the abnormality detection and factor determination processing using the control state information grasped by the aggregation server 15 can be realized. Therefore, it becomes possible to reduce the bandwidth for each control device 11 to transmit the control state information.

  Although several embodiments and modifications have been described above, these embodiments are presented only as examples and are not intended to limit the scope of the invention. The novel system described herein can be implemented in various other forms. Various omissions, substitutions, and changes can be made to the system configuration described in the present specification without departing from the gist of the invention. The appended claims and their equivalents are intended to include such forms and modifications as are within the scope and spirit of the invention.

DESCRIPTION OF SYMBOLS 11 Control apparatus, 13 Network switch, 14 Abnormal factor determination apparatus, 15 Aggregation server, 142 Analysis part, 143 Storage part, 144 Display part

Claims (6)

An abnormality factor determination device provided in a control system including a control device that controls equipment using network data transmitted via a network,
A storage unit for storing control state data including a control state indicating an operation state of the control device;
When analyzing the network data, based on the control state data stored in the storage unit, the cause of the abnormality that occurred in the control system is an attack through the network, or the failure of the device An analysis unit for determining whether or not
An abnormality factor determination device comprising: A control system comprising: a control device that controls equipment using network data transmitted via a network; a network switch that connects the control device to the network; and an abnormality factor determination device that is connected to the network switch. Because
The abnormality factor determination device includes:
A storage unit for storing control state data including a control state indicating an operation state of the control device;
When analyzing the network data, based on the control state data stored in the storage unit, the cause of the abnormality that occurred in the control system is an attack through the network, or the failure of the device And an analysis unit for determining whether the control system is a control system.   The control system according to claim 2, wherein the network switch executes a measure relating to connection to the network according to an analysis result of the analysis unit.   The control system according to claim 2 or 3, wherein the control device constantly transmits the control state to the abnormality factor determination device.   The control system according to claim 2, further comprising an aggregation server that transmits the control state acquired from the control device to the abnormality factor determination device. An abnormality factor determination method for a control system including a control device that controls equipment using network data transmitted over a network,
Storing control state data including a control state indicating an operation state of the control device;
When analyzing the network data, based on the stored control state data, whether the cause of the abnormality occurring in the control system is an attack through the network or a failure of the device Abnormal factor determination method to determine.

Images