WO2019225232A1

WO2019225232A1 - Monitoring device, monitoring system, and monitoring method

Info

Publication number: WO2019225232A1
Application number: PCT/JP2019/016416
Authority: WO
Inventors: 熊谷　洋子; 宏樹内山; 訓大久保
Original assignee: 株式会社日立製作所
Priority date: 2018-05-23
Filing date: 2019-04-17
Publication date: 2019-11-28
Also published as: JP7134708B2; JP2019204259A

Abstract

The purpose of the present invention is to detect an incident of a monitoring subject apparatus without collecting a log relating to an operation performed in the monitoring subject apparatus. A detection data collection unit 401 collects cyber detection data generated in an unauthorized communication prevention device 20 or an unauthorized connection prevention device 30 and physical detection data generated in a video analysis device 60. An integration analysis unit 402 uses the collected cyber detection data and the physical detection data to analyze a cause and plan recommendation measures. A measure execution unit 403 requests the unauthorized communication prevention device 20 or the unauthorized connection prevention device 30 to perform apparatus and network disconnection on the basis of a result of the analysis by the integration analysis unit 402.

Description

Monitoring device, monitoring system, and monitoring method

The present invention relates to a monitoring device, a monitoring system, and a monitoring method using physical security.

In recent years, cyber attacks have been increasing against social infrastructures such as electric power, railways, water and gas, and control systems used in automobiles. Security such as malware infection and unauthorized access from outside. Response to incidents is required. For this reason, countermeasures such as detection of a cyber attack, defense, and separation of an infected device when it is detected are implemented by introducing a security device for responding to a security incident in the control system.

 When dealing with security incidents, it is important to detect them early and take appropriate primary measures before the impact reaches a wide area. Since cyber attacks usually go through the steps of intrusion, search, expansion, and purpose execution, it is important to detect events in the intrusion phase, which is an early stage, in order to realize early detection. Events in the intrusion phase include unauthorized login to devices, connection of unauthorized devices such as USB tokens, network connection of unauthorized terminals, etc. In order to detect these, security software installed on devices and terminals, It is conceivable to detect by collecting and checking these logs by utilizing the function of OS (Operating System).

However, since the control system requires real-time processing higher than the information system, installation of software for devices and terminals and change of log output settings may affect existing operations. Log collection also increases the network load, which may affect existing business. For these reasons, it is often difficult for the control system to collect logs from each device or terminal.

For this reason, it is necessary to detect security incidents other than equipment and terminal logs, and it is conceivable to use physical security devices such as entry / exit management and surveillance cameras. In Patent Literature 1, the terminal device is infected with malware by detecting the contradiction that the user's terminal device behaves suspiciously in a situation where the user cannot operate using the entry / exit situation. A monitoring device for detecting this is described.

Japanese Patent Laying-Open No. 2015-55960

In the technology disclosed in Patent Document 1, malware infection can be detected by using both information of entry / exit acquired from the entry / exit management system and network information transmitted / received by the terminal device. That is, it is possible to detect malware infection without collecting log information of terminal devices.

However, in the control system, since a specific user is not assigned to a specific device, the technique of Patent Document 1 cannot be used as it is. Moreover, although the technique of patent document 1 can detect the behavior after malware infection, it is difficult to detect at the stage (intrusion phase) until the infection. For this reason, in an environment where a large number of operators handle the device, it is necessary to detect cyber attacks at an early stage (in the intrusion phase) without collecting device and terminal logs.

The present invention has been made in view of the above circumstances, and an object thereof is to detect an incident of a monitoring target device without collecting a log related to an operation performed on the monitoring target device.

In order to achieve the above object, a monitoring apparatus according to a first aspect detects an incident of the monitoring target device based on an analysis result of communication information transmitted from the monitoring target device and image information obtained by photographing the monitoring target device. Detect.

According to the present invention, it is possible to detect an incident of a monitoring target device without collecting a log regarding an operation performed on the monitoring target device.

FIG. 1 is a block diagram showing a functional configuration of the monitoring system according to the first embodiment. FIG. 2 is a block diagram showing a hardware configuration of the monitoring apparatus of FIG. FIG. 3 is a block diagram showing a hardware configuration of the unauthorized communication preventing apparatus of FIG. FIG. 4 is a diagram showing a processing flow of extracting physical detection data in the monitoring system of FIG. FIG. 5 is a diagram illustrating a configuration example of monitoring information generated by the monitoring camera of FIG. FIG. 6 is a diagram showing detection rules used for extracting the physical detection data of FIG. FIG. 7 is a diagram showing a processing flow for detecting and handling a security incident in the monitoring system of FIG. FIG. 8 is a diagram illustrating a configuration example of cyber detection data generated by each of the unauthorized communication prevention device and the unauthorized connection prevention device of FIG. 1 and physical detection data generated by the video analysis device. FIG. 9 is a flowchart showing processing of the integrated analysis unit of the monitoring apparatus of FIG. FIG. 10 is a diagram showing a display example of the incident status confirmation screen of the monitoring apparatus of FIG. FIG. 11 is a diagram illustrating a processing flow of extracting physical detection data in the monitoring system according to the second embodiment. FIG. 12 is a diagram illustrating a processing flow of security incident detection and response in the monitoring system according to the second embodiment.

Embodiments will be described with reference to the drawings. The embodiments described below do not limit the invention according to the claims, and all the elements and combinations described in the embodiments are essential for the solution of the invention. Not necessarily.

FIG. 1 is a block diagram illustrating a functional configuration of the monitoring system according to the first embodiment.
In FIG. 1, the monitoring system includes control devices 10 ₁ to 10 _n (n is a positive integer), unauthorized communication preventing device 20, unauthorized connection preventing device 30, monitoring device 40, monitoring camera 50, and video analysis. Device 60. A control unit 10 _1, the unauthorized communication preventing device 20, and unauthorized access preventing apparatus 30, the monitoring device 40, a monitoring camera 50, the image analyzer 60 is connected through a network 70. The control device 10 _n is connected to the unauthorized communication prevention device 20.

Here, a plurality of unauthorized communication prevention devices 20 and unauthorized connection prevention devices 30 may exist for each network. A plurality of monitoring cameras 50 and video analysis devices 60 may exist. The monitoring camera 50 may be provided for each monitoring target device. The monitoring target device is a device or a terminal that is a detection target of a security incident.

Each of the control devices 10 ₁ to 10 _n controls the control system while communicating between the control devices 10 ₁ to 10 _n in a control system used in social infrastructure such as electric power, railway, water supply, gas, and automobiles. Each of the control devices 10 ₁ to 10 _n includes control processing units 101 ₁ to 101 _n that perform control processing, and communication units 102 ₁ to 102 _n that communicate with the network 70, the unauthorized communication prevention device 20, and the like.

The unauthorized communication prevention device 20 detects an attack based on communication information transmitted from the monitored device. Attacks can include steps of intrusion, search, expansion, and purpose execution. The unauthorized communication preventing apparatus 20 includes a filtering unit 201 that filters communication packets input to the unauthorized communication preventing apparatus 20, and detection data generation that generates cyber detection data (alert) when the filtering unit 201 detects unauthorized communication. Unit 202, policy updating unit 203 that updates a filtering policy referred to by filtering unit 201, first communication unit 204 that communicates with network 70, and filtering policy storage unit 205 that stores a filtering policy referred to by filtering unit 201. And a second communication unit 206 that communicates with the control device 10 _n . The filtering policy can define communication contents to be filtered. The cyber detection data is a result of detecting an attack based on communication information transmitted from the monitored device. The unauthorized communication preventing apparatus 20 may have three or more communication units.

The unauthorized connection prevention device 30 detects unauthorized connection of the monitored device and generates cyber detection data based on the unauthorized connection detection result. The unauthorized connection prevention device 30 generates an unauthorized connection detection unit 301 that detects that an unauthorized device is connected to the network 70, and generates cyber detection data (alert) when the unauthorized connection detection unit 301 detects an unauthorized connection. A detection data generation unit 302 that performs communication, a list update unit 303 that updates a valid device list that is referred to by the unauthorized communication detection unit 301, a communication unit 304 that communicates with the network 70, and a valid device list that is referred to by the unauthorized connection detection unit 301. And a legitimate device list storage unit 305 for storing. For example, a MAC address permitted to connect to the network 70 can be registered in the legitimate device list.

The monitoring camera 50 generates a monitoring image of the monitoring target device. The monitoring location of the monitoring target device by the monitoring camera 50 can be, for example, an input / output interface portion such as a display screen, a connector and a port of the monitoring target device. The monitoring camera 50 includes a photographing unit 501 that performs photographing processing of a monitoring target, and a communication unit 502 that communicates with the network 70.

The video analysis device 60 analyzes image information obtained by photographing the monitoring target device. At this time, the video analysis device 60 can generate physical detection data based on the image information of the monitoring target device. The physical detection data is a result of detecting an attack based on the image information of the monitoring target device. The video analysis device 60 is collected by the video collection unit 601 that collects video data captured by the monitoring camera 50, the detection data generation unit 602 that detects unauthorized connection or manipulation from the collected video data, and the video collection unit 601. A video storage unit 603 that stores video data, a detection rule storage unit 604 that stores a detection rule referred to by the detection detection data generation unit 602, and a communication unit 605 that communicates with the monitoring camera 50 and the monitoring device 40 are provided.

The monitoring device 40 detects an incident of the monitoring target device based on the communication information transmitted from the monitoring target device and the analysis result of the image information obtained by photographing the monitoring target device. At this time, the monitoring device 40 can monitor the incident of the monitoring target device based on the cyber detection data that is the first detection data and the physical detection data that is the second detection data. Here, the monitoring device 40 may collect cyber detection data and physical detection data from the outside, or may generate physical detection data based on image information obtained by photographing the monitoring target device. For example, the monitoring device 40 receives the action information for the interface of the monitoring target device generated based on the image information, and based on the detection rule related to the action information, as a result of detecting an unauthorized connection or an unauthorized operation for the interface, Detection data may be generated. This action information is information related to the operation of the interface of the monitoring target device.

The monitoring device 40 includes a detection data collection unit 401 that collects the cyber detection data generated by the unauthorized communication prevention device 20 or the unauthorized connection prevention device 30, the physical detection data generated by the video analysis device 60, and the collected cyber detection data. The integrated analysis unit 402 detects the incident of the monitored device using the physical detection data, analyzes the cause of the incident and formulates a recommended measure, and based on the analysis result of the integrated analysis unit 402, the unauthorized communication prevention device 20 and the unauthorized Stores the countermeasure execution unit 403 that makes a request for disconnecting the device or the network from the connection prevention device 30, the communication unit 404 that communicates with the network 70, and the cyber detection data and physical detection data collected by the detection data collection unit 401. The recommended measures are planned by the detection data storage unit 405 and the integrated analysis unit 402. A countermeasure pattern storage unit 406 that stores a list of countermeasures to be referred to, an analysis result storage unit 407 that stores recommended countermeasures for incidents output as a result of analysis by the integrated analysis unit 402, and an importance level of the incident, and an integrated analysis unit 402 And an input / output unit 408 for inputting a result of the user's determination as to whether or not to implement a recommended measure. The importance may be a priority for implementing the recommended measure.

Here, the monitoring device 40 monitors the incident of the monitoring target device based on the cyber detection data and the physical detection data, thereby collecting the log of the operation performed on the monitoring target device without collecting the log of the monitoring target device. Security incidents can be detected. Further, in the existing control system provided with the control devices 10 ₁ to 10 _n , the unauthorized communication preventing device 20, the unauthorized connection preventing device 30, and the monitoring are performed without affecting the existing work performed in the control system. The apparatus 40, the monitoring camera 50, and the video analysis apparatus 60 can be introduced. For this reason, it is possible to detect security incidents early in control systems used in social infrastructure such as electric power, railways, water and gas, and automobiles, and to take appropriate primary measures before they reach a wide range. The security of these control systems can be improved. The security incident is an incident related to the security of the monitored device such as infection by malware or the like and unauthorized access from the outside.

FIG. 2 is a block diagram showing a hardware configuration of the monitoring apparatus of FIG.
In FIG. 2, the monitoring device 40 includes a communication device 11, an input / output device 12, a storage device 13, a CPU 14, and a memory 15. The communication device 11, the input / output device 12, the storage device 13, the CPU 14, and the memory 15 are connected via an internal communication line 16 such as a bus.

The CPU 14 is hardware that controls operation of the entire monitoring device 40. The memory 15 can be composed of, for example, a semiconductor memory such as SRAM or DRAM. The memory 15 can store a program being executed by the CPU 14, or can be provided with a work area for the CPU 14 to execute the program.

The storage device 13 is a storage device having a large storage capacity, for example, a hard disk device or an SSD (Solid State Drive). The storage device 13 can hold execution files of various programs and data used for executing the programs. The storage device 13 can store a monitoring program 13A. The monitoring program 13A may be software that can be installed in the monitoring device 40, or may be incorporated in the monitoring device 40 as firmware. The monitoring program 13A may be introduced when necessary via another storage medium or communication medium (a network or a carrier wave propagating through the network).

The communication device 11 is hardware having a function of controlling communication with the outside. The communication device 11 is connected to the network 70. The network 70 may be a WAN (Wide Area Network) such as the Internet, a LAN (Local Area Network) such as WiFi, or a mixture of WAN and LAN.

The input / output device 12 is a user interface that receives operations from the user and provides the user with various information such as processing progress and processing results. The input / output device 12 is, for example, a keyboard, a mouse, a touch panel, a card reader, a voice input device, a screen display device (liquid crystal monitor, organic EL display, graphic card, etc.), a voice output device (speaker, etc.), a printing device, and the like. .

The CPU 14 reads the monitoring program 13A into the memory 15 and executes the monitoring program 13A, thereby detecting an incident on the monitored device based on the cyber detection data and the physical detection data, planning a countermeasure for the incident, and the incident It is possible to calculate the importance of

At this time, the monitoring program 13A can realize the functions of the detection data collection unit 401, the integrated analysis unit 402, and the countermeasure execution unit 403 in FIG. Note that the execution of the monitoring program 13A may be shared by a plurality of processors and computers. Alternatively, the CPU 14 may instruct the cloud computer or the like to execute all or part of the monitoring program 13A via the network 70 and receive the execution result.

Note that the control devices 10 ₁ to 10 _n , the unauthorized connection prevention device 30, the monitoring device 40, the monitoring camera 50, and the video analysis device 60 in FIG. 1 can also include hardware similar to that in FIG. However, the CPUs of the control devices 10 ₁ to 10 _n can realize the control processing of the control system by executing the control program. The CPU of the unauthorized connection prevention device 30 can detect unauthorized connection of the monitored device by executing the unauthorized connection prevention program, and can generate cyber detection data based on the unauthorized connection detection result. The CPU of the monitoring camera 50 can generate a monitoring image of the monitoring target device by executing a shooting program. The CPU of the video analysis device 60 can analyze image information obtained by photographing the monitoring target device by executing a video analysis program.

FIG. 3 is a block diagram showing a hardware configuration of the unauthorized communication preventing apparatus of FIG.
3, improper communication prevention device 20 includes a first communication device 21 _1, the second communication device _212, a storage device 22, an output device 23, a CPU 24, a memory 25. A first communication device 21 _1, the second communication device _212, a storage device 22, an output device 23, a CPU 24, a memory 25 is connected via an internal communication line 26 such as a bus. The storage device 22 can store an unauthorized communication prevention program 22A. The first communication device 21 ₁ is connected to the network 70, the second communication device 21 ₂ is connected to the control device 10 _n. The unauthorized communication prevention device 20 may have three or more communication devices.

When the CPU 14 reads the unauthorized communication prevention program 22A into the memory 15 and executes the unauthorized communication prevention program 22A, an attack can be detected based on the communication information transmitted from the monitored device.

At this time, the unauthorized communication prevention program 22A can realize the functions of the filtering unit 201, the detection data generation unit 202, and the policy update unit 203 of FIG. The execution of the unauthorized communication prevention program 22A may be shared by a plurality of processors and computers. Alternatively, the CPU 24 may instruct the cloud computer or the like to execute all or part of the unauthorized communication prevention program 22A via the network 70 and receive the execution result.

Hereinafter, a processing flow in the attack detection system for the control system of the present embodiment will be described. In the processing flow described below, a program stored in each storage device of the control devices 10 ₁ to 10 _n , the unauthorized communication prevention device 20, the unauthorized connection prevention device 30, the monitoring device 40, the monitoring camera 50, and the video analysis device 60 is stored in the memory. And executed by each CPU, and executed by each processing unit embodied on an apparatus constituting the attack detection system for the control system.

FIG. 4 is a diagram showing a processing flow of extracting physical detection data in the monitoring system of FIG.
In FIG. 4, the monitoring camera 50 monitors (photographs) the interface portion of the control devices 10 ₁ to 10 _n that are the devices to be monitored (S401). Examples of the interface include a connector portion for various devices such as USB of each device, a LAN connector portion for network connection, a monitor screen for displaying operation results, and the like.

Next, the monitoring camera 50 generates monitoring information A901 including an image obtained by photographing the monitoring target device and sends it to the video analysis device 60 (S402).

FIG. 5 is a diagram illustrating a configuration example of monitoring information generated by the monitoring camera of FIG.
In FIG. 5, monitoring information A901 includes date and time A902 taken by the monitoring camera 50, position information A903 of the shooting target, and video information A904.

Next, in FIG. 4, when receiving the monitoring information A901 from the monitoring camera 50, the video analysis device 60 analyzes the video of the monitoring target device and extracts action information for the interface (S403).

Then, the video analysis device 60 determines whether or not the action information extracted from the monitoring information A901 matches the detection rule held in the detection rule storage unit 604 (S404). If the action information matches the detection rule (YES in S404), physical detection data A1011 is generated based on the action information and transmitted to the monitoring device 40 (S405). When the physical detection data A1011 is transmitted from the video analysis device 60, the monitoring device 40 receives the physical detection data A1011 (S406). On the other hand, when the action information does not match the detection rule (NO in S404), the video analysis device 60 executes the next video analysis process.

FIG. 6 is a diagram showing detection rules used for extracting the physical detection data of FIG.
In FIG. 6, the video analysis device 60 refers to the detection rule in S404 of FIG. The detection rules include two types of rules, a black list 501 and a white list 511. A black list 501 describes a list of actions that are not permitted, and a white list 511 describes a list of actions that are permitted. The black list 501 includes a major classification 502, a minor classification 503, terminal information 504, and a determination rule 505. The white list 511 includes a major classification 512, a minor classification 513, terminal information 514, and a determination rule 515.

The

major classifications

502 and 512 can describe whether the action to the monitoring target device is connection or operation. The

small classifications

503 and 513 can describe the connection destination to the monitoring target device and the error contents of the monitoring target device. The

terminal information

504 and 514 can describe a part (position information) where the action is executed.

The determination rule 505 can describe specific contents of actions that are not permitted. For example, as an example of unauthorized connection of an interface of a monitoring target device, a case where a USB memory is inserted into a USB connector can be cited. As an example of the unauthorized operation of the interface of the monitoring target device, there can be mentioned a case where the authentication error screen at the time of login is displayed three times in succession.

The determination rule 515 can describe specific contents of permitted actions. For example, as an example where the interface of the monitoring target device is not unauthorized connection, a case where a device with an approved seal is inserted can be cited.

FIG. 7 is a diagram showing a processing flow for detecting and handling a security incident in the monitoring system of FIG.
In FIG. 7, when the video analysis apparatus 60 detects an abnormality according to the flow shown in FIG. 4 (S601), it transmits physical detection data A1011 to the monitoring apparatus 40 (S602).

When detecting an abnormality based on communication information transmitted from the control devices 10 ₁ to 10 _n that are monitoring target devices (S603), the unauthorized connection prevention device 30 uses the detected abnormality content as cyber detection data A1012 and an audit device. 40 (S604). At this time, the unauthorized connection preventing apparatus 30 receives the MAC address transmitted from the control devices 10 ₁ to 10 _n that are the devices to be monitored. If the MAC address received from the control device 10 ₁ to 10 _n or the like as the monitoring target device does not match the MAC address permitted to connect to the network 70, the unauthorized connection of the monitoring target device is recognized. it can.

If the unauthorized communication prevention device 20 detects an abnormality based on the communication information transmitted from the control devices 10 ₁ to 10 _n that are the devices to be monitored (S605), the detected content of the abnormality is the cyber detection data A1013 as an audit device. It transmits to 40 (S606). At this time, the unauthorized communication preventing apparatus 20 receives the communication information transmitted from the control devices 10 ₁ to 10 _n that are monitoring target devices. If the communication information received from the control devices 10 ₁ to 10 _n that are the monitoring target devices matches the filtering policy, the unauthorized operation of the monitoring target device can be recognized.

FIG. 8 is a diagram illustrating a configuration example of cyber detection data generated by each of the unauthorized communication prevention device and the unauthorized connection prevention device of FIG. 1 and physical detection data generated by the video analysis device.
In FIG. 8, the detection data A1001 includes an alert occurrence date and time A1002, an alert item A1003, and alert related information A1004. The alert item A1003 can describe the type of the detection data A1001. The type of the detection data A1001 can indicate, for example, whether the detection data A1001 is physical detection data or cyber detection data. The alert-related information A1004 can describe the location and content of unauthorized connection or unauthorized operation.

In FIG. 7, when the monitoring device 40 receives any of the physical detection data A1011 and the cyber detection data A1012, A1013, the information is integratedly analyzed (S607). Then, the monitoring device 40 presents the importance of the attack detected as a result of analyzing the information, a recommended countermeasure method, and the like to the monitor (S608).

The monitoring person determines whether or not to execute the recommended countermeasure based on the presentation content presented from the monitoring device 40 (S609). When the monitor inputs that the recommended countermeasure is to be executed, the monitoring device 40 sends a countermeasure command to a device (the unauthorized communication prevention device 20 or the unauthorized connection prevention device 30) that implements the recommended countermeasure (S610). The device that has received the countermeasure command executes measures such as device disconnection or network shutdown. For example, when the unauthorized connection preventing device 30 receives a handling command from the monitoring device 40, the monitoring target device is disconnected (S611).

FIG. 9 is a flowchart showing processing of the integrated analysis unit of the monitoring apparatus of FIG.
In FIG. 9, when the integrated analysis unit 402 starts the integrated analysis process (S701), the detection data is acquired from the detection data storage unit 405 (S702), and whether the detection data relates to an attempted attack or whether the detected attack relates to an attempted attack. Is determined (S703).

An attempted attack is defined as a process in which an attacker attempted to intrude or attack the control system but was not realized by the security function of each device. For example, information related to authentication failure at the time of login to each terminal, information (alert) indicating that the communication content is not delivered to the transmission target by the unauthorized communication prevention device 20 being determined as unauthorized communication, and unauthorized connection prevention Information (alert) or the like indicating that the device 30 is determined to be an unauthorized terminal and has not been connected to the network is detected data regarding the attempted attack.

Also, an attempted attack is defined as a process when an attacker performs an intrusion or attack on the control system and succeeds. For example, information indicating that an unauthorized USB token is connected to the device, information indicating that an unauthorized command has been executed (without an error), and the like are detection data related to the attempted attack.

If the detection data to be analyzed is “achieved” (“achieved” in S703), there is already an intrusion or infection, and there is a high risk that the impact will be expanded. For this reason, the measure for storing the device related to the detected data is selected from the measure pattern storage unit 406 as a recommended measure (S704). For example, a recommended measure is a measure for disconnecting a device related to the detected data from the network 70 or blocking communication related to the device related to the detected data.

Next, it is determined whether the detection data to be analyzed is a type of physical detection data or cyber detection data (S705). If the detection data is physical detection data (“physical” in S705), this means that there is an unauthorized person at the site of the control system, and even if the attack can be prevented by a security device or function, it is immediately attacked by another method. There is a risk of being made. Therefore, the importance level of the incident is set to “high” (S706).

If the detection data to be analyzed is cyber detection data (“Cyber” in S705), there is a high possibility that an attack has been made remotely, and if the attack can be prevented by a security device or security function, another means can be used. It can be assumed that it takes a certain amount of time to attack. Therefore, the importance level of the incident is set to “medium” (S707).

On the other hand, when the detection data of the analysis target is “Attempted” (“Attempted” in S703), it indicates that an attack has occurred but has not been invaded or infected. Therefore, a measure for strengthening monitoring is selected from the measure pattern storage unit 406 as a recommended measure for the device related to the detected data (S708). For example, a recommended measure is to collect not only the detection data collected from each device but also a more detailed log, and check whether a log related to cyber attacks is output on the screen of the device in the field. To do.

Next, it is determined whether the detection data to be analyzed is a type of physical detection data or cyber detection data (S709). If the detection data is physical detection data (“physical” in S709), this means that there is an unauthorized person at the site of the control system, and even if the current situation is an attempted attack, an attack is immediately made by another method. There is a risk. Therefore, the importance level of the incident is set to “medium” (S710).

If the detection data to be analyzed is cyber detection data (“Cyber” in S709), there is a high possibility that an attack has been made remotely, and if the attack can be prevented by a security device or security function, use another means. It can be assumed that it takes a certain amount of time to attack. For this reason, the importance level of the incident is set to “low” (S711).

Next, the recommended countermeasure information acquired in S704 or S708 and the importance information determined in S706, S707, S710, and S711 are stored in the analysis result storage unit 407 (S509), and the integrated analysis process is terminated (S510). ).

FIG. 10 is a diagram showing a display example of the incident status confirmation screen of the monitoring apparatus of FIG.
In FIG. 10, the incident status confirmation screen A801 includes a system configuration screen A802, an incident analysis result screen A803, and a physical detection data detail screen A804. The system configuration screen A802 shows the configuration of the control system to be monitored. The control devices A to D on the system configuration screen A802 are the control devices 10 ₁ to 10 _n in FIG. Here, when the monitoring device 40 detects an incident with respect to the control devices A and B, the monitoring devices A and B can be highlighted. The incident analysis result screen A803 is recommended as an incident IDA805 for identifying an incident, an importance A806 indicating the importance of the incident indicated by the incident IDA805, and a primary action for minimizing the impact of the incident. A recommended measure A807 indicating a measure to be infected, an infection location A808 indicating a location where infection is suspected in the incident, a detail A809 indicating detailed information on the infection location, and reference information A810 indicating further detailed information are displayed.

The physical detection data details A804 displays an image that is the basis of the physical detection data as reference information A810 when the physical detection data is included. When the link in the item of reference information A810 is clicked, this image is acquired by making an inquiry to the video analysis device 60 based on the date and position information.

Note that the display content of the incident status confirmation screen A801 is not limited to the above, and it is sufficient that at least the above elements are included. Further, the display order of the components on the incident status confirmation screen A801 is not limited to the above.

In the first embodiment described above, a method has been described in which the video analysis device 60 extracts action information for the interface from the monitoring information A901, generates physical detection data A1011 based on the action information, and transmits the physical detection data A1011 to the monitoring device 40. . On the other hand, the video analysis device 60 may transmit the action information extracted from the monitoring information A901 to the monitoring device 40, and the monitoring device 40 may generate the physical detection data A1011 based on the action information.

FIG. 11 is a diagram illustrating a processing flow of extracting physical detection data in the monitoring system according to the second embodiment. The monitoring device 40 can be provided with a detection rule storage unit that stores the detection rule referred to in S1106. This detection rule can be configured similarly to the content of FIG.
In FIG. 11, the monitoring camera 50 monitors (photographs) interface portions such as the control devices 10 ₁ to 10 _n that are devices to be monitored (S1101). Next, the monitoring camera 50 generates monitoring information A901 including an image obtained by photographing the monitoring target device, and sends the monitoring information A901 to the video analysis device 60 (S1102).

Next, when receiving the monitoring information A901 from the monitoring camera 50, the video analysis device 60 analyzes the video of the monitoring target device and extracts action information for the interface (S1103). Then, the video analysis device 60 transmits the action information to the monitoring device 40 (S1104).

Next, when receiving the action information for the interface (S1105), the monitoring device 40 determines whether or not the action information extracted from the monitoring information A901 matches the detection rule held in the detection rule storage unit (S1106). ). If the action information matches the detection rule (YES in S1106), physical detection data A1011 is generated based on the action information (S1107). On the other hand, when the action information does not match the detection rule (NO in S1107), the monitoring device 40 executes the next action information analysis process.

Here, by executing the action information analysis processing on the monitoring device 40 side, it is not necessary to execute the action information analysis processing on the video analysis device 60 side, and the load on the video analysis device 60 can be reduced.

FIG. 12 is a diagram illustrating a processing flow of security incident detection and response in the monitoring system according to the second embodiment.
In FIG. 12, when detecting the action information for the interface (S1201), the video analysis device 60 transmits the action information to the monitoring device 40 (S1202). When the monitoring device 40 detects abnormality by matching the action information with the detection rule, it generates physical detection data (S1203). The subsequent processing contents of S1204 to S1212 are the same as S603 to S611 of FIG.

As described above, according to the above-described embodiment, in a control system in which a large number of operators handle the control devices 10 ₁ to 10 _n , the devices and terminals are collected without collecting the logs of the devices and terminals. Can be detected early in the intrusion phase.

In addition, this invention is not limited to said embodiment, A various deformation | transformation is possible within the range of the summary. For example, when action information and physical detection data are generated by a physical security device other than the monitoring camera 50, when a detection device other than the unauthorized communication prevention device 20 or the unauthorized connection prevention device 30 is connected, Includes the functions of the unauthorized communication prevention device 20 and the unauthorized connection prevention device 30, or the control devices 10 ₁ to 10 _n , the monitoring device 40, the unauthorized communication prevention device 20 and the unauthorized connection prevention device 30 are connected to the network 70. For example, the communication function is not included, and communication with the network 70 is performed via another device. Even in the case of the present embodiment, there is no essential change in the processing performed in the entire system.

10 ₁ ~ 10 n _... controller, 11 ... communication device, 12 ... output device, 13 ... storage device, 14 ... CPU, 15 ... memory, 16 ... internal signal line, ₁₀₁ 1 ~ 101 n _... control unit, 102 ₁ to 102 _n ... communication unit, 20 ... unauthorized communication prevention device, 21 ₁ ... first communication device, 21 ₂ ... second communication device, 22 ... storage device, 22 ... storage device, 23 ... input / output device, 24 ... CPU , 25 ... Memory, 26 ... Internal signal line, 201 ... Filtering unit, 202 ... Detection data generation unit, 203 ... Communication log collection unit, 204 ... Policy update unit, 205 ... Mode management unit, 206 ... First communication unit, 207 ... Filtering policy storage unit, 208 ... Communication log storage unit, 209 ... Second communication unit, 30 ... Unauthorized connection prevention device, 301 ... Unauthorized connection detection unit, 302 ... Detection data generation unit, 303 ... List update New section, 304 ... communication section, 305 ... legal device list storage section, 40 ... monitoring device, 401 ... detection data collection section, 402 ... integrated analysis section, 403 ... measure execution section, 404 ... communication section, 405 ... detection data storage 406 ... Measurement pattern storage unit 407 ... Analysis result storage unit 408 ... Input / output unit 50 ... Monitoring camera 501 ... Shooting unit 502 ... Communication unit 60 ... Video analysis device 601 ... Video collection unit 602 ... Detection data generation unit, 603 ... Video storage unit, 604 ... Detection rule storage unit, 605 ... Communication unit, 70 ... Network

Claims

A monitoring device that detects an incident of the monitoring target device based on an analysis result of communication information transmitted from the monitoring target device and image information obtained by photographing the monitoring target device.
Claims for monitoring incidents of the monitoring target device based on first detection data that is a result of detecting an attack based on the communication information and second detection data that is a result of detecting an attack based on the image information Item 2. The monitoring device according to Item 1.
A detection data collecting unit for collecting the first detection data and the second detection data;
The monitoring apparatus according to claim 2, further comprising: an integrated analysis unit that detects an incident of the monitoring target device based on the first detection data and the second detection data.
The second detection data as a result of receiving action information for the interface of the monitoring target device generated based on the image information and detecting an unauthorized connection or an unauthorized operation to the interface based on a detection rule related to the action information. The monitoring apparatus according to claim 2, which generates
The monitoring apparatus according to claim 1, wherein the monitoring apparatus executes planning of countermeasures for the incident of the monitored device and calculation of the importance of the incident based on the detection result of the incident of the monitored device.
Whether the detection data to be analyzed indicates an attempted attack that is a process that has been attempted but not realized, or indicates an attempted attack that is a process when the attack is attempted and succeeded The monitoring apparatus according to claim 2, wherein a recommended measure is switched according to a result of the determination.
The monitoring apparatus according to claim 2, wherein whether the detection data to be analyzed is the second detection data or the first detection data is determined, and the importance of the incident is determined according to the determination result. .
As the incident analysis result, an image that is the basis of the importance of the incident, recommended countermeasures, and the second detection data is displayed on a screen together with a configuration diagram of a system including the monitoring target device, and a countermeasure for the incident is selected. The monitoring device according to claim 5, which is enabled.
The detection rule includes at least one of a black list that is a list of actions that are not allowed and a white list that is a list of actions that are allowed.
5. The monitoring according to claim 4, wherein when the action information corresponds to an action registered in the black list or does not correspond to an action registered in the white list, an unauthorized connection or an unauthorized operation to the interface is detected. apparatus
An unauthorized communication prevention device that detects an attack based on communication information transmitted from a monitored device;
A video analysis device for analyzing image information obtained by photographing the monitored device;
Monitoring for monitoring incidents of the monitoring target device based on first detection data that is a result of detecting an attack based on the communication information and second detection data that is a result of detecting an attack based on the image information And a monitoring system.
The monitoring system according to claim 10, further comprising an unauthorized connection prevention device that detects an unauthorized connection of the monitoring target device and generates the first detection data based on a detection result of the unauthorized connection.
The monitoring system according to claim 10, wherein the monitoring device collects the first detection data from the unauthorized communication preventing device and collects the second detection data from the video analysis device.
The monitoring device receives, from the video analysis device, action information for the interface of the monitoring target device generated based on the image information, and based on a detection rule related to the action information, an unauthorized connection or an unauthorized operation to the interface The monitoring system according to claim 10, wherein the second detection data that is a result of detecting the detection is generated.
A CPU for executing a monitoring program;
The CPU executes the monitoring program, based on first detection data that is a result of detecting an attack based on communication information transmitted from the monitoring target device, and image information obtained by capturing the monitoring target device. A monitoring method for monitoring an incident of the monitoring target device based on second detection data that is a result of detecting an attack.
The CPU executes the monitoring program to execute countermeasure planning for the incident of the monitored device and calculation of the importance of the incident based on the detection result of the incident of the monitored device. 14. The monitoring method according to 14.