JP2019080211A - Countermeasure planning system and monitoring device for control system - Google Patents

Abstract

To provide measures taking into consideration an impact on a task that is being performed in a control system.SOLUTION: A countermeasure planning system for a control system is provided with a network device that receives and relays packets communicated between a plurality of control devices, collects and transmits a communication log of received packets, detects an irregularity of the received packets, and transmits an alert, and a monitoring device that includes a task extraction unit that extracts a task pattern including information on a communication path from the communication log transmitted by the network device, a countermeasure pattern storage unit in which a countermeasure pattern including information on equipment related to the countermeasure is stored, a task impact estimation unit that extracts an affected task on the basis of information on a communication path included in the task pattern and information on equipment included in the countermeasure pattern, and includes the affected task in the countermeasure pattern, a countermeasure planning unit that extracts a countermeasure candidate on the basis of an alert sent by the network device and the countermeasure pattern, and an input/output unit that outputs the countermeasure candidate including the affected task.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a countermeasure planning system and a monitoring device for a control system.

  Control systems used in social infrastructure such as electric power, railways, water supply, and gas and in automobiles are required to operate devices such as valves and actuators based on sensor information and maintain preset pressure and temperature. Ru.

  In order to realize this operation, in a built-in device such as a controller, periodically acquire information from the sensor, check the status, notify other controllers, servers, etc., and perform control as necessary. Is required. For this reason, periodic communication occurs in the control system, and processing is usually performed based on the communication data.

  On the other hand, the control system has so far used a dedicated operating system (OS) or a dedicated protocol, and is installed in an isolated state in an area inaccessible from an external network such as the Internet. It has been considered as irrelevant from cyber attacks such as of service attack.

  However, cases of using a general-purpose OS or a general-purpose protocol for cost reduction are increasing, and connection with an information system is also in progress for improving efficiency. Also, in recent years, computer viruses targeting the control system have been discovered, and the control system also needs a technology to detect and deal with security incidents such as infection with malware and unauthorized access from the outside as in the information system. It has become.

  With respect to such problems, there is known a technology in which the content of measures is determined in advance for each type of security incident, and the measures are extracted and executed based on the type occurring at the time of detection of the security incident (for example, patent documents 1).

JP 2012-226680 A

  If the technique known by patent document 1 grade | etc., Is used, it will become possible to select and apply a predetermined countermeasure. However, in the control system, the contents of the task to be executed change depending on the control application, and the communication path of the network also changes. For this reason, regardless of the work being performed, if the predetermined measures are selected and applied, the selected measures may not be suitable for the work being performed, which may greatly affect the work.

  The present invention has been made in view of the above circumstances, and an object thereof is to provide a countermeasure in consideration of the influence on operations performed in a control system.

  A representative countermeasure planning system according to the present invention is a countermeasure planning system for a control system, which receives and relays packets communicated between a plurality of control devices, and collects communication logs of the received packets. A network device that transmits an alert, detects an irregularity of a received packet, and sends an alert, and a task extraction unit that extracts a task pattern including information of a communication path from the communication log transmitted by the network device; The affected task is extracted based on the countermeasure pattern storage unit in which the countermeasure pattern including the device information is stored, the communication path information included in the task pattern and the device information included in the countermeasure pattern, and the affected task is included in the countermeasure pattern Extract action candidates based on the business impact estimation unit, the alert sent from the network device, and the action pattern And measures planning unit and an input-output unit for outputting a countermeasure candidate including the impact work, characterized by comprising a monitoring device, comprising a.

  According to the present invention, it is possible to provide measures taking into consideration the influence on the task being executed in the control system.

It is a figure which shows the example of a structure of a countermeasure drafting system. It is a figure which shows the example of a structure of a control apparatus, an unauthorized connection prevention apparatus, and a monitoring apparatus. It is a figure which shows the example of a structure of a network apparatus. It is a figure which shows the example of the processing flow which collects a communication log at the time of trial operation. It is a figure which shows the example of the processing flow which extracts a work pattern. It is a figure which shows the example of the processing flow which estimates work influence. It is a figure which shows the example of the processing flow regarding the countermeasure at the time of operation | use. It is a figure which shows the example of a work related information input screen. It is a figure which shows the example of a countermeasure selection screen. It is a figure which shows the example of a countermeasure selection result screen. It is a figure which shows the example of the information of an alert. It is a figure which shows the example of the information of a communication log. It is a figure which shows the example of the information of a work pattern. It is a figure which shows the example of the information of a countermeasure pattern.

  One embodiment of the present invention will be described below. Note that the present invention is not limited to the embodiment described below.

  FIG. 1 is a diagram showing an example of the configuration of a countermeasure planning system. This countermeasure planning system is for a control system, and as illustrated in FIG. 1, the control devices 10-1 to 10-n (where n is an integer of 2 or more, and n is 3 or more, the control devices 10-2 to 10). -(N-1) is not shown), the network device 20, the unauthorized connection prevention device 30, the monitoring device 40, and the network 50.

  Here, a plurality of networks 50 may exist, and a plurality of network devices 20 and a plurality of unauthorized connection prevention devices 30 may exist for each network 50. The unauthorized connection prevention device 30 may not exist. The network device 20 and the unauthorized connection prevention device 30 may be one device.

  Each of the control devices 10-1 to 10-n communicates with each of the control processing units 101-1 to 101-n that performs control processing, and with the network 50, the network device 20, and the like. and each of n.

  The network device 20 includes a filtering unit 201 that filters communication packets input to the network device 20, an alert generation unit 202 that generates an alert when the filtering unit 201 detects an unauthorized communication, and the network device 20. Communication log collection unit 203 for collecting logs related to communication packets, and a policy update unit 204 for updating the filtering policy referred to by the filtering unit 201.

  The network device 20 further includes a mode management unit 205 that manages the operation mode of the network device 20, a first communication unit 206 that communicates with the network 50, and a filtering policy storage unit that stores the filtering policy referred to by the filtering unit 201. 207, a communication log storage unit 208 for storing the communication log collected by the communication log collection unit 203, and a second communication unit 209 for communicating with the control device 10-n. The network device 20 may have three or more communication units.

  The unauthorized connection prevention device 30 detects an unauthorized device connected on the network 50, and an alert generation unit 302 which generates an alert when the unauthorized connection is detected by the unauthorized connection detection unit 301. A list updating unit 303 for updating the legal device list to be referred to by the unauthorized connection detection unit 301, a communication unit 304 for communicating with the network 50, and a legal device list for storing the legitimate device list to be referred to by the unauthorized connection detection unit 301. And a storage unit 305.

  Further, the unauthorized connection prevention device 30 may perform processing for disconnecting the device detected as an unauthorized connection from the network 50. When the network 50 is actually configured by a network switch or the like, the disconnection process may be a process for shutting down the port of the network switch, and the unauthorized connection prevention device 30 responds to a command from the monitoring device 40. A network switch or the like may be controlled.

  The monitoring device 40 includes an alert collection unit 401 that collects alerts generated by the network device 20 and the unauthorized connection prevention device 30, a cause analysis unit 402 that analyzes the cause using the collected alert, and an analysis result of the cause analysis unit 402. Based on the above, a countermeasure planning unit 403 for planning a countermeasure, a communication log collection unit 404 for collecting communication logs collected by the network device 20, and patterns of tasks being executed in the control system using the collected communication logs And a task extraction unit 405 to be extracted.

  In addition, the monitoring device 40 has a communication unit 406 that communicates with the network 50, a work influence estimation unit 407 that estimates the influence on the work performed in the control system of measures taken by the measure planning unit 403, and an alert. It includes an alert storage unit 408 that stores the alert collected by the collection unit 401, and a communication log storage unit 409 that stores the communication log collected by the communication log collection unit 404.

  Furthermore, the monitoring device 40 stores a task pattern storage unit 410 that stores the task pattern extracted by the task extraction unit 405 and a countermeasure pattern storage unit 411 that stores a list of measures to be referred to when the countermeasure planning unit 403 formulates a countermeasure. When the task extracting unit 405 extracts a task, the task information is input, and the countermeasure planning unit 403 outputs the result of planning the countermeasure, and the mode management unit that manages the operation mode of the monitoring apparatus 40. Including 413.

  FIG. 2 is a diagram illustrating an example of the hardware configuration of the control devices 10-1 to 10-n, the unauthorized connection prevention device 30, and the monitoring device 40. The control devices 10-1 to 10-n, the unauthorized connection prevention device 30, and the monitoring device 40 may have the same hardware configuration, and the communication device 11, the input / output device 12, the storage device 13, and the CPU 14 , And the memory 15 are connected by an internal communication line 16 such as a bus.

  The communication device 11 is included in the communication units 102-1 to 102-n, the communication unit 304, or the communication unit 406 illustrated in FIG. The input / output device 12 is included in the input / output unit 412 illustrated in FIG. The storage device 13 includes the valid device list storage unit 305, the alert storage unit 408, the communication log storage unit 409, the task pattern storage unit 410, or the countermeasure pattern storage unit 411 illustrated in FIG.

  The CPU 14 is a processor, reads out and executes a program stored in the memory 15, reads and writes data from and to the memory 15 or the storage device 13, processes data, and controls the communication device 11 and the input / output device 12. Do. Thus, the CPU 14 may be each part in the control devices 10-1 to 10-n, the unauthorized connection prevention device 30, or the monitoring device 40 illustrated in FIG. Therefore, the description in which each part is a subject may be replaced with the description in which the CPU 14 is a subject.

  The memory 15 stores programs or data. The program or data stored in the memory 15 may be copied to and from the storage device 13. The control devices 10-1 to 10-n, the unauthorized connection prevention device 30, or the monitoring device 40 may include circuits not illustrated in FIG. 2 or may not include a part of the configuration illustrated in FIG. good.

  FIG. 3 is a diagram showing an example of the hardware configuration of the network device 20. As shown in FIG. In the network device 20, the first communication device 21-1, the second communication device 21-2, the input / output device 22, the storage device 23, the CPU 24, and the memory 25 are internal communication lines 26 such as a bus. It is connected and configured.

  The description of the input / output device 22 to the memory 25 is the same as that of the input / output device 12 to the memory 15 described with reference to FIG. The first communication device 21-1 is included in the first communication unit 206, and the second communication device 21-2 is included in the second communication unit 209. The network device 20 may have three or more communication devices.

  Below, the processing flow in the countermeasure system for control systems is explained. In the processing flow described below, programs stored in the storage devices 13 and 23 of the control devices 10-1 to 10-n, the network device 20, the unauthorized connection prevention device 30, and the monitoring device 40 are stored in the memories 15 and 25. It is loaded and executed by the CPUs 14 and 24 so as to be executed by the respective processing units embodied on the devices constituting the countermeasure planning system for the control system.

  For this reason, the description which makes each apparatus a subject may be replaced with the description which makes CPU14 and 24 a subject. Also, each program to be loaded and executed may be stored in advance in the storage device 13 or 23, or is necessary for execution via another storage medium or communication medium (network or carrier wave propagating through the network). It may be introduced at any time.

  FIG. 4 is a diagram showing an example of a processing flow executed at the time of trial operation of the control system, etc., in the countermeasure system for control system. At the time of trial operation of the control system, the operation modes of the network device 20 and the monitoring device 40 are set to the initial mode, and at the time of operation of the control system, these operation modes are set to the operation mode.

  Therefore, first, the network device 20 sets the operation mode of the network device 20 to the initial mode (step S401). Here, if the operation mode can not be set to the initial mode, or if the subsequent processing is to be executed without being set to the initial mode, the subsequent processing may be canceled.

  Also, the monitoring device 40 sets the operation mode of the monitoring device 40 to the initial mode (step S402). Here, if the operation mode can not be set to the initial mode, or if the subsequent processing is to be executed without being set to the initial mode, the subsequent processing may be canceled. Steps S401 and S402 may be executed using a signal received via the network 50 as a trigger or may be executed by a user operation.

  Next, the control device 10-1 generates a control command (step S403), and transmits the generated control command to the control device 10-n. Here, since the network device 20 exists between the control device 10-1 and the control device 10-n, the network device 20 receives the control command.

  The network device 20 stores the communication log regarding the control command received from the control device 10-1 (step S404), and transmits the received control command to the control device 10-n. The configuration of the communication log will be described later with reference to FIG.

  When the control device 10-n receives a control command from the network device 20, the control device 10-n executes control work as a control system according to the received control command (step S405), and sends a response indicating the executed result to the control device 10-1. Directly send.

  The network device 20 stores a communication log related to the received response (step S406), and transmits the received response to the control device 10-1. Then, it is determined whether or not the trial operation has ended (step S407). The determination of the end of the trial operation may be made by determining that the end signal or instruction is given to the network device 20, or the number of communication packets to be transmitted and received is determined in advance, and the number of packets passes It may be determined whether it has been done.

  As a result, when it is determined that the test operation has not ended, the network device 20 waits for the next control command (step S408). On the other hand, when it is determined that the test operation has ended, the network device 20 acquires the communication log group stored in the communication log storage unit 208 (step S409).

  Then, the network device 20 transmits the acquired communication log group to the monitoring device 40, and sets the operation mode of the network device 20 to the operation mode (step S410). On the other hand, when the communication log group is received from the network device 20, the monitoring device 40 stores the received communication log group in the communication log storage unit 409 (step S411).

  The monitoring device 40 extracts the work pattern using the communication log stored in the communication log storage unit 409 (step S412), estimates the business influence (step S413), and sets the operation mode of the monitoring device 40 to the operation mode. (Step S414). The task pattern extraction process and the task influence estimation process will be described later with reference to FIGS.

  FIG. 5 is a diagram showing an example of a processing flow for extracting a task pattern from the communication log collected at the time of trial operation executed by the monitoring device 40. This processing flow corresponds to the processing of step S412 shown in FIG. 4 and may be executed by the task extraction unit 405 in the monitoring device 40.

  First, the monitoring apparatus 40 starts work pattern extraction processing (step S501), and acquires a communication log from the communication log storage unit 409 (S502). Here, the communication log to be acquired may be the communication log of the detected data amount by detecting the data amount of the communication log stored in the communication log storage unit 208, or the communication of the predetermined data amount It may be a log.

  Next, the monitoring device 40 performs communication path analysis using the information on the transmission source and the transmission destination included in the acquired communication log (step S503). The communication path analysis is an analysis for specifying one communication path divided into a plurality of communications, and extracts a communication log in which a transmission destination of a communication log and a transmission source of a communication log thereafter coincide with each other, It repeats repeating extraction of a communication log in which the transmission destination of the communication log extracted by the coincidence of the transmission source and the transmission source of the communication log after that coincide.

  For example, for communication log A in which the transmission source is the control device 10-a and the transmission destination is the control device 10-b, the communication in which the transmission source is the control device 10-b and the transmission destination is the control device 10-c When the log B is extracted and the communication log C in which the transmission source is the control device 10-c and the transmission destination is the control device 10-d is extracted from the extracted communication log B, the control device 10- The communication paths from “a” to “control device 10-d” are analyzed, and communication log A, communication log B, and communication log C are a series of communication logs.

  The monitoring device 40 uses the date and time information of the communication log to evaluate the interval of the series of communication logs extracted in step S503 (step S504). For this purpose, among the series of communication logs, the difference between the reception date and time of any two communication logs whose communication is continuous between the transmission destination and the transmission source is calculated. That is, the difference between the reception date of communication log A and the reception date of communication log B is calculated, and the difference between the reception date of communication log B and the reception date of communication log C is calculated.

  The monitoring device 40 extracts the task pattern from the difference between the calculated reception date and time of the communication log (step S505). For extraction of business patterns, for example, a communication log having a difference of two reception dates within a series of communication logs within a predetermined time, such as within one second, is regarded as a communication log related to the same business, and more than a predetermined time The communication log relating to the same business is regarded as the business pattern, considering that the communication log is the communication log relating to different business.

  If it is determined in step S503 that there are a plurality of business patterns in which the communication path analyzed is completely the same communication path, the monitoring apparatus 40 extracts an execution cycle between the business patterns. The execution cycle may be a cycle of the first reception date and time of the communication log related to each work pattern.

  The monitoring device 40 determines whether any task pattern is already stored in the task pattern storage unit 410 (step S506). As a result, if it is determined that the file is not stored, the subsequent step S509 is performed.

  If it is determined in step S506 that the data is stored, the monitoring apparatus 40 acquires the task pattern from the task pattern storage unit 410 (S507), and extracts the difference between the acquired task pattern and the task pattern extracted in step S505. (S508).

  The task pattern extracted in step S505 may include a task pattern already stored in the task pattern storage unit 410. Therefore, the task pattern of the difference extracted in step S508 is a new task pattern which has not been found so far. It is. The work pattern in this case will be described later with reference to FIG.

  In step S509, the monitoring apparatus 40 receives input of related information such as the name of the task and the importance of the task for the task pattern extracted in step S505 or the differential task pattern extracted in step S508, and for each extracted task An ID is allocated and stored in the task pattern storage unit 410 together with communication path information such as a transmission source, a transmission destination, and a relay path, and cycle information.

  An example of the input screen of the task related information will be described later with reference to FIG. For example, it is preferable that the degree of importance of the business is increased as the business continuation is requested, by accepting an input of high, middle, low, or ten levels. Then, the monitoring device 40 ends the process (step S510).

  In addition to the process of using the communication log at the time of trial operation, the work pattern may be directly set by the user for extraction of the work pattern, or may be extracted from information described in a document such as a system design document. Although it is good, it is not limited to these processes.

  In addition, the process flow illustrated in FIG. 5 may be executed not only at the time of trial operation but also at a predetermined constant interval, or when a new job is added, the addition or the like is detected by some process. May be executed.

  FIG. 6 is a diagram showing an example of a processing flow for estimating the influence on the work of the measure implemented after the work pattern extraction by the monitoring device 40. This processing flow corresponds to the processing of step S413 shown in FIG. 4 and may be executed by the task influence estimation unit 407 in the monitoring device 40.

  First, the monitoring apparatus 40 starts task influence estimation processing (step S601), acquires a countermeasure pattern from the countermeasure pattern storage unit 411 (step S602), and acquires a task pattern stored in the task pattern storage unit 410. (Step S603). The countermeasure pattern here will be described later with reference to FIG.

  Next, the monitoring apparatus 40 estimates the operations affected by using the countermeasure pattern acquired in step S602 and the operation pattern acquired in step S603 (S604). Affected task estimation matches the countermeasure contents such as network disconnection and device disconnection specified for each countermeasure pattern with the communication route of each task pattern, and the operations that are affected when each countermeasure pattern is executed and their effects Extract the contents (stop and partial stop). Here, as the judgment of stop or partial stop, for example, it is conceivable to stop the case in which all communication in each work pattern is stopped, and to partially stop the case in which a part of communication is stopped. It is not something to be done.

  The monitoring device 40 calculates the degree of influence from the extracted affected task and the contents of the influence (step S605). The degree of impact calculation, for example, quantifies the degree of importance of the affected operations (3 for high, 2 for medium, 1 for low), and quantifies the contents of the impact (for stop) 1) In the case of partial stop, digitize with 0.5 and calculate by multiplication.

  In addition, if multiple tasks are affected when one measure is executed, the impact degree is calculated for each task, and the largest impact degree among the calculated may be the final impact degree, or Although the sum of a plurality of influence degrees may be the final influence degree, it is not limited to these processes.

  The monitoring apparatus 40 stores the affected task, the contents of the impact, and the degree of impact in each countermeasure pattern of the countermeasure pattern storage unit 411 that is each countermeasure pattern extracted when there is the task affected in step S604. Step S606). And the monitoring apparatus 40 complete | finishes a process (step S607).

  FIG. 7 is a diagram showing an example of a processing flow executed at the time of operation of the control system in the control system-oriented countermeasure planning system. Since it is at the time of operation of the control system, communication is performed among a plurality of control devices in the control devices 10-1 to 10-n, but this communication itself is the communication for what kind of control. Since there is nothing to do with the following description, illustration and description will be omitted.

  In the operation of the control system, the network device 20 uses the filtering policy stored in the filtering policy storage unit 207 to detect the occurrence of a security incident such as the occurrence of unauthorized communication, and generates an alert (step S701). ), Sends the generated alert to the monitoring device 40.

  In addition, the unauthorized connection prevention device 30 also detects the occurrence of a security incident such as an unauthorized device connection using an authorized device list stored in the authorized device list storage unit 305 in the operation of the control system, and generates an alert. The generated alert is transmitted to the monitoring apparatus 40 (step S702).

  Thus, when the alert is transmitted to the monitoring device 40, the monitoring device 40 receives the alert, and stores the received alert in the alert storage unit 408 (S703). The alert here will be described later with reference to FIG. Next, the monitoring device 40 uses the stored alert to identify the device or network that caused the security incident (step S704). That is, the cause analysis unit 402 analyzes the cause.

  The monitoring apparatus 40 extracts applicable countermeasure candidates from the countermeasure pattern storage unit 411 based on the cause contents indicating the type of the apparatus or the network which is identified in step S704 and the type of the incident (step S705). That is, the countermeasure planning unit 403 devises a countermeasure. The monitoring device 40 outputs the extracted countermeasure candidate (step S706).

  An example of the output to the screen of the countermeasure candidate will be described later with reference to FIG. The contents of this output may include information on the history or results of measures selected in the past. By including such information, it helps the user to select measures in the next step.

  The monitoring apparatus receives an input for selecting a measure by the user from among the outputted measure candidates (step S 707). An example of the countermeasure selection result screen will be described later with reference to FIG. Although FIG. 10 shows an example in which a single measure is selected, the present invention is not limited to a single measure, and a plurality of measures may be selected. Further, information on the selection may be recorded as a history of measures.

  Then, the monitoring device 40 executes the selected countermeasure (step S708). For this purpose, the monitoring device 40 sends a countermeasure command to the target device. FIG. 7 shows an example in which the monitoring device 40 transmits to the network device 20. The above steps S <b> 705 to S <b> 708 may be performed by the countermeasure drafting unit 403.

  In the example shown in FIG. 7, a screen is displayed for a user such as a monitoring person who outputs a measure candidate, and after visualizing the influence on work, a flow is shown in which the measure is selected by the user. However, if the degree of influence of the countermeasure is low, etc., the case may be determined and step S706 may be skipped without displaying the screen, and the monitoring apparatus 40 may select a measure with a low degree of influence in step S707. .

  The network device 20 that receives the countermeasure command transmitted from the monitoring device 40 updates the filtering policy stored in the filtering policy storage unit 207 based on the received countermeasure command (step S 708).

  FIG. 8 is a diagram showing an example of a task related information input screen output by the monitoring device 40. As shown in FIG. The task related information input screen 801 is a screen displayed in step S 509 shown in FIG. 5 and may be displayed by the input / output unit 412 and is composed of a system configuration 802 and a task list 803.

  The task list 803 is composed of the task ID 804, the communication path 805, the cycle 806, the task name 807, and the importance 808, and is displayed as a table. The task ID 804 displays the ID assigned to each task in step S509, the communication path 805 displays the communication path analyzed in step S503, and the cycle 806 displays the cycle extracted in step S505. .

  Further, the input column 809 of the task name 807 and the importance 808 is for prompting the user to input, and the content of the input information is as described with reference to FIG. A keyboard (not shown) may be used for input to the input column 809, or the input column 809 is a high, middle, low or numeric pull-down menu, and may be selected from the pull-down menu. .

  The system configuration 802 displays the configuration of the control system, and the communication path of each business corresponding to the information of the business ID 804 and the communication path 805. When the user confirms this display, it is possible to reduce an input error in the input column 809 of the business name 807 and the importance 808.

  Note that the content displayed on the job related information input screen 801 is not limited to the example shown in FIG. 8 and may include the content of the example shown in FIG. It is not limited to the eight examples.

  In steps S503 to S505, extraction of the business may be leaked, so business ID 804, communication path 805, and cycle 806 can also be input on business related information input screen 801, and new business information (business ID 804, communication path 805). , The cycle 806, the task name 807, and the importance 808) may be added to the task list 803.

  FIG. 9 is a diagram showing an example of the countermeasure selection screen output by the monitoring device 40. As shown in FIG. The countermeasure selection screen 901 is a screen on which candidates to be selected in step S 706 shown in FIG. 7 are displayed. The countermeasure selection screen 901 may be displayed by the input / output unit 412, and includes a system configuration 902 and a countermeasure candidate list 903.

  The system configuration 902 displays the configuration of the control system. In addition, the countermeasure candidate list 903 includes a countermeasure ID 904, an affected operation name 905, a communication route 906, an importance degree 907, an influence content 908, an influence degree 909, and a selection frequency 910, and is displayed as a table. .

  The countermeasure ID 904 is an ID of the countermeasure candidate extracted in step S 705, and is information stored in the countermeasure pattern storage unit 411. The affected task name 905, the communication path 906, and the importance 907 are obtained in the information of the countermeasure pattern storage unit 411. The affected task ID corresponding to the ID of the countermeasure ID 904 is obtained. It is information obtained from 410.

  The influence content 908, the influence degree 909, and the selection frequency 910 are information corresponding to the ID of the countermeasure ID 904 in the information of the countermeasure pattern storage unit 411. The content displayed on the countermeasure selection screen 901 is not limited to the example shown in FIG. 9, but may include the content of the example shown in FIG. 9, and the display position and order are also shown in FIG. It is not limited to the example.

  FIG. 10 is a diagram showing an example of the countermeasure selection result screen output by the monitoring device 40. As shown in FIG. The countermeasure selection result screen 1001 is a screen displayed in step S 707 shown in FIG. 7 and may be displayed by the input / output unit 412 and is composed of a task influence display 1002 and a countermeasure candidate list 1003.

  The countermeasure candidate list 1003 includes a countermeasure ID 1004, an affected task name 1005, a communication route 1006, an importance degree 1007, an influence content 1008, an influence degree 1009, and a selection count 1010, and is displayed as a table. The contents are the same as the countermeasure candidate list 903.

  The selected countermeasure 1011 in the countermeasure candidate list 1003 is a countermeasure selected by the user's cursor operation or the like, and the display included in the selected countermeasure 1011 may be changed in display color, for example.

  In the example of FIG. 10, “001” of the countermeasure ID 1004 is selected, and the selected countermeasure is the communication of “control device A” and “control device B” of the communication path 1006, “control device A” and “control device C”. The communication of “1” and the communication of “control device A” and “control device D” are measures for “stop” of the influence content 1008.

  The task influence display 1002 is the same as the system configuration 802 shown in FIG. 8, but corresponds to the measure “001” of the measure ID 1004 in order to display the influence of the selected measure in an easily understandable manner to the user. In communication of the communication path 1006, a cross mark indicating "stop" of the influence content 1008 is displayed.

  The contents displayed on the countermeasure selection result screen 1001 are not limited to the example shown in FIG. 10, and may be any contents as long as the contents of the example shown in FIG. 10 are included. It is not limited to the example of.

  FIG. 11 is a diagram illustrating an example of alert information stored in the alert storage unit 408 of the monitoring apparatus 40. The alert generated and transmitted by the network device 20 and the unauthorized connection prevention device 30 described with reference to FIG. 7 may include the same information as the alert shown in FIG.

  The alert includes an alert generation date and time 1101, an alert item 1102 indicating the type of the alert, and alert related information 1103 output in association with the alert item. The alert related information 1103 may include the type of security incident or information of a device or network that has caused the security incident.

  Note that the information included in the alert is not limited to the example of FIG. 11, and may be any information as long as the information of the example shown in FIG. 11 is included, and the order of the information is also limited to the example of FIG. is not.

  FIG. 12 is a diagram showing an example of communication log information stored in the communication log storage unit 208 of the network device 20 and the communication log storage unit 409 of the monitoring device 40. The communication log group transmitted by the network device 20 described with reference to FIG. 4 may include the same information as the communication log shown in FIG. 12.

  The communication log includes a reception date 1201 when the network device 20 receives the communication packet, and a header 1202 of the received communication packet. The header 1202 includes a transmission source 1203, a transmission destination 1204, a protocol 1205, and a port 1206.

  In the case where the communication packet communication path is a path for transmitting from the control device 10-a to the control device 10-b and transmitting from the control device 10-b to the control device 10-c, the communication transmitted (received) first The transmission source 1203 of the packet is the control device 10-a, the transmission destination 1204 is the control device 10-b, and the transmission source 1203 of the communication packet transmitted (received) next is the control device 10-b, and the transmission destination 1204 is the control device It becomes 10-c.

  The port 1206 is a destination port but may be a source port. Note that the information included in the communication log is not limited to the example of FIG. 12, but may be any information as long as the information of the example shown in FIG. 12 is included, and the order of the information is also limited to the example of FIG. It is not a thing.

  FIG. 13 is a diagram showing an example of the information of the task pattern stored in the task pattern storage unit 410 of the monitoring device 40. As shown in FIG. The job pattern is composed of a job ID 1301, a transmission source 1302, a transmission destination 1303, a relay route 1304, a cycle 1305, a job name 1306, and an importance 1307. These pieces of information are set in step S509 shown in FIG.

  The task ID 1301 is an ID assigned to each task. In the case where the communication packet communication path is transmitted from the control device 10-a to the control device 10-b and from the control device 10-b to the control device 10-c, the transmission source 1302 is the control device 10-a. The transmission destination 1303 is the control device 10-c, and the relay route 1304 is the control device 10-b.

  If the communication route of the communication packet includes more control devices, information on control devices included in the relay route 1304 is increased. A cycle 1305 is an execution cycle between work patterns extracted in step S505. The task name 1306 and the importance 1307 are information input to the input field 809 shown in FIG.

  The information included in the work pattern is not limited to the example shown in FIG. 13, but may include information of the example shown in FIG. 13, and the order of the information is also limited to the example shown in FIG. It is not a thing.

  FIG. 14 is a diagram showing an example of information of the countermeasure pattern stored in the countermeasure pattern storage unit 411 of the monitoring device 40. As shown in FIG. The countermeasure pattern includes a cause content 1401, a countermeasure ID 1402, a countermeasure device 1403, a countermeasure content 1404, an influence business ID 1405, an influence content 1406, an influence degree 1407, and a history 1408. Among these, it is preferable that settings other than the impact job ID 1405, the impact content 1406, the impact degree 1407, and the history 1408 be set in advance.

  The cause content 1401 is information of the type of security incident or the device or network that has caused the security incident, and is preferably information that can be compared with the information of the alert. The countermeasure ID 1402 is an ID for identifying a countermeasure. The countermeasure device 1403 is information that identifies the device that is to take measures against the cause content 1401.

  The countermeasure content 1404 is information on a command or setting change value transmitted to the device identified by the countermeasure device 1403. It is preferable that the information includes information such as communication or equipment interrupted by the countermeasure and equipment which is stopped by the countermeasure.

  The affected task ID 1405 is an ID for identifying the task affected when the measure of the ID of the measure ID 1403 is executed. The influence content 1406 is information on the influence that the task of each task ID of the impact task ID 1405 is stopped or partially stopped.

  The degree of influence 1407 is a value calculated in step S605 shown in FIG. 6, and is a value calculated based on the degree of importance of the operation affected and the contents of the influence. The history 1408 is information for counting the number of times selected in step S 707 shown in FIG. 7 for each ID of the countermeasure ID 1402.

  Therefore, the number of times included in the history 1408 may be incremented by 1 each time it is selected in step S 707, or may be reset to 0 according to the input via the input / output unit 412. . The history 1408 may include, in addition to the number of times selected, other information on past measures regarding the combination of the task ID and the measure ID.

  The influence job ID 1405 may be estimated in step S604 shown in FIG. In this case, the influence content 1406 may be estimated according to the countermeasure device 1403 and the countermeasure content 1404. On the other hand, the influence job ID 1405 and the influence content 1406 may be set in advance. In this case, step S604 may be skipped.

  Further, the information included in the countermeasure pattern is not limited to the example of FIG. 14, and it is sufficient if the information of the example shown in FIG. 14 is included, and the order of the information is also limited to the example of FIG. It is not a thing.

  As described above, the countermeasure planning system for control system can extract the communication path from the actual communication based on the communication log, and can extract the task pattern. Then, for the extracted work pattern, the input of the importance of the work can be received and included in the information of the work pattern. Thereby, it is possible to calculate the degree of influence of the countermeasure between the countermeasure pattern set in advance and the extracted work pattern.

  In addition, when a security incident is detected, countermeasure candidates can be provided along with the degree of impact. This makes it possible to select measures taking into consideration the impact on operations. This influence can also be visualized along with the business communication path.

  The present invention is not limited to the above embodiments, and various modifications can be made within the scope of the invention. For example, when a detection device other than a network device or an unauthorized connection prevention device is connected, or when the function of the network device or an unauthorized connection prevention device is included in the monitoring device, or a control device, a monitoring device, or a network device And the case where the device for preventing unauthorized connection does not include a communication function with the network, but communicates with the network via another device. Also in the case of these embodiments, there is no need for essential changes in the processing performed in the entire system.

20: Network device, 30: Incorrect connection prevention device, 40: Monitoring device, 402: Cause analysis unit, 403: Countermeasure planning unit, 405: Business extraction unit, 407: Business impact estimation unit, 50: Network

Claims (15)

A countermeasure planning system for a control system,
A network device that receives and relays a packet communicated between a plurality of control devices, collects and transmits a communication log of the received packet, detects an irregularity of the received packet, and transmits an alert, and the network device A task extraction unit that extracts a task pattern including information on a communication route from the communication log transmitted by the server, a countermeasure pattern storage unit that stores a countermeasure pattern including information on a device related to a countermeasure, and a communication route included in the task pattern The affected business is extracted based on the information of the device and the information of the device included in the countermeasure pattern, and the business impact estimation unit including the affected business in the countermeasure pattern, and the countermeasure candidate extracted based on the alert transmitted by the network device It has a monitoring device that includes a countermeasure planning unit and an input / output unit that outputs countermeasure candidates including affected operations. And a countermeasure planning system characterized by The countermeasure planning system according to claim 1, wherein
The network device is
Communication logs including information on transmission source and transmission destination and the date and time received by the network device are collected and transmitted,
The task extraction unit
In the communication log transmitted by the network device, when the transmission destination included in the first communication log matches the transmission source included in the second communication log, the transmission source of the first communication log and transmission The destination of the first and second communication logs is analyzed as a communication path, and the difference between the reception date and time included in the first communication log and the reception date and time included in the second communication log is within a preset time If it is, a business task planning system including information of the analyzed communication path is extracted. The countermeasure planning system according to claim 2, wherein
The task extraction unit
A countermeasure planning system characterized by extracting a cycle of reception date and time related to a plurality of business patterns in which analyzed communication paths coincide. The countermeasure planning system according to claim 3, wherein
The task extraction unit
Output the analyzed communication path and the extracted cycle, control the input / output unit to input the task name and the importance, analyze the communication path, the extracted cycle, the input task name, and The countermeasure planning system characterized by including the inputted importance in the work pattern. The countermeasure planning system according to claim 4, wherein
The task impact estimation unit
The countermeasure planning system characterized in that the influence degree of the extracted influence work is calculated using the inputted importance degree, and the influence degree is included in the countermeasure pattern. The countermeasure planning system according to claim 5, wherein
The countermeasure pattern storage unit
The countermeasure pattern further including the cause content is stored,
The measure planning unit
The input / output unit is configured to extract the countermeasure pattern corresponding to the cause content from the countermeasure pattern storage unit and output the degree of influence included in the extracted countermeasure pattern, the information included in the alert transmitted by the network device And controlling the input / output unit to output the communication path, the task name, and the degree of importance included in the task pattern of the affected task included in the extracted countermeasure pattern. The countermeasure planning system according to claim 6, wherein
The countermeasure pattern storage unit
A countermeasure pattern is stored, which further includes the information of the device to be countered and the content of the counter,
The measure planning unit
The input / output unit is controlled to receive an input for selecting a countermeasure pattern according to the output of a plurality of countermeasure patterns, and the content of the countermeasure is transmitted according to the information of the device to be countermeasure contained in the selected countermeasure pattern A countermeasure planning system characterized in that it is controlled to The countermeasure planning system according to claim 7, wherein
The countermeasure pattern storage unit
The countermeasure pattern including the history is stored.
The measure planning unit
The input / output unit is configured to extract the countermeasure pattern corresponding to the cause content from the countermeasure pattern storage unit and to output the history included in the extracted countermeasure pattern, as the information included in the alert transmitted by the network device corresponds to the cause content A countermeasure planning system characterized by controlling and updating a history included in a selected countermeasure pattern. The countermeasure planning system according to claim 8, wherein
The network device is
Filter relaying packets based on the filtering policy,
The countermeasure pattern storage unit
A countermeasure pattern is stored that includes information on the network device as a device to be countermeasured, and includes a filtering policy as a countermeasure content,
The countermeasure planning system is characterized in that the countermeasure planning unit performs control to transmit a filtering policy to the network device according to the information of the network device included in the selected countermeasure pattern. The countermeasure planning system according to claim 5, wherein
The countermeasure pattern storage unit
Stores a countermeasure pattern that further includes the cause content, the device to be countered, and the content of the countermeasure.
The measure planning unit
Information included in the alert transmitted by the network device is extracted from the countermeasure pattern storage unit according to the degree of influence included in the countermeasure pattern storage unit, and the countermeasure pattern corresponding to the cause content is extracted. A countermeasure planning system characterized in that control is performed to transmit the content of the countermeasure to the device to be countermeasured. A monitoring device for the control system,
A task extraction unit that extracts a task pattern including information on a communication path from the received communication log;
A countermeasure pattern storage unit in which a countermeasure pattern including information on equipment related to the countermeasure is stored;
A task impact estimation unit that extracts affected tasks based on information on communication paths included in the task pattern and information on devices included in the countermeasure pattern, and includes affected tasks in the countermeasure pattern;
A countermeasure planning unit that extracts countermeasure candidates based on the received alert and the countermeasure pattern;
A monitoring apparatus comprising: an input / output unit that outputs countermeasure candidates including affected operations. The monitoring device according to claim 11, wherein
The task extraction unit
When a communication log including information on a transmission source and a transmission destination and date and time is received and the transmission destination included in the first communication log matches the transmission source included in the second communication log among the received communication logs The transmission source and the transmission destination of the first communication log and the transmission destination of the second communication log are analyzed as a communication path, and the date and time included in the first communication log and the second communication log are included. A monitoring apparatus characterized by extracting a work pattern including information of an analyzed communication path when a difference between date and time is within a preset time. 13. The monitoring device according to claim 12, wherein
The task extraction unit
A monitoring apparatus characterized by extracting a cycle of date and time related to a plurality of business patterns in which analyzed communication paths coincide. 14. The monitoring device according to claim 13, wherein
The task extraction unit
Output the analyzed communication path and the extracted cycle, control the input / output unit to input the task name and the importance, analyze the communication path, the extracted cycle, the input task name, and The monitoring apparatus characterized by including the input importance in a work pattern. 15. The monitoring device according to claim 14, wherein
The task impact estimation unit
A monitoring apparatus characterized by calculating the degree of influence using the input degree of importance, and including the degree of influence in a countermeasure pattern, using the degree of influence of the extracted influence business.

Images