JP6507075B2 - Illegal communication detection device, illegal communication detection system, and method of detecting illegal communication - Google Patents

Description

  The present invention relates to an unauthorized communication detection device, an unauthorized communication detection system, and a method for detecting unauthorized communication.

  Social infrastructure such as electric power, railways, water supply and gas, and control systems used in automobiles operate devices such as valves and actuators based on sensor information to maintain preset pressure and temperature. Required In order to realize the operation, the embedded device such as the control device included in the control system periodically confirms the state of the device by acquiring information from the sensor, and the control device or server etc. It is necessary to notify the status and to control as needed. For this reason, it is usual that the control system periodically performs a large amount of communication and performs processing based on the communication data.

  The control system used to be dedicated OS or proprietary protocol, and was installed in isolated area in the area that can not be accessed from the external network such as the Internet, so it is considered to be unrelated to cyber attack such as computer virus and DoS attack. It has However, in order to reduce costs, cases where a general-purpose OS or general-purpose protocol is used for a control system and cases where a control system and an information system are connected for improving processing efficiency are increasing. Therefore, the control system is more likely to be cyber attacked.

  Furthermore, in recent years, computer viruses targeting a control system have been discovered, and a control system is also required to have a technology for detecting infection such as malware and unauthorized access from the outside as in an information system.

  DESCRIPTION OF RELATED ART As background art of this technical field, there exists Unexamined-Japanese-Patent No. 2006-115007 (patent document 1). In this publication, “signature rule division means for dividing a signature rule to be referred to in order to detect that the communication between the monitoring target network and the external network is an illegal communication is divided into a plurality of blocks; Each of the plurality of intrusion detection processing devices has detection processing execution means for executing processing for detecting the signature rule of the corresponding block, with each of the signature rules corresponding to each of the plurality of intrusion detection processing devices. This is an intrusion detection and processing apparatus characterized by the above.

JP, 2006-115007, A

  There are restrictions on the embedded device resources (eg, processing performance, storage capacity, bandwidth, etc.) included in the control system. It is difficult for low resource detection devices to verify a large number of communication packets sent and received within the control system to detect unauthorized communication. Further, in the technology described in Patent Document 1, a plurality of detection devices are installed in a control system in order to improve detection performance. However, in the control system, equipment required for control work needs to be installed in a limited space called a control panel, and it is necessary to install a plurality of detection devices as in the technology described in Patent Document 1 Have difficulty. Therefore, according to one aspect of the present invention, a detecting device with limited resources and installation space is used to detect unauthorized communication regarding important work in a control system at high speed and with high accuracy.

  In order to solve the above-mentioned subject, one mode of the present invention adopts the following composition. A detection device for detecting unauthorized communication between a first control device and a second control device, comprising: a processor and a storage device, wherein the processor controls the first control device to execute the second control device. Monitoring a plurality of control commands for controlling the operation of the second control device, and responses to the plurality of control commands that the second control device transmits to the first control device; A response time indicating a difference between a reception time of each of a plurality of control commands and a reception time of a response corresponding to each of the plurality of control commands is calculated, and the plurality of control commands are calculated based on each of the calculated response times. Are classified into a control command group including one or more control commands, and one or more control commands selected from the control command group based on each of the calculated response times. Each of the task groups is determined to be an important task, and for each of the important tasks, a filter policy indicating the correspondence between the important task and the header information of the control command selected from the control command belonging to the important task is generated. Acquiring a detection policy indicating correspondence between the important work and the data pattern of the payload, storing the filter policy and the detection policy in the storage device, and performing a first control command from the first control device If there is a filter policy that includes the first header information of the first control command, the first detection policy including the important business indicated by the filter policy is obtained, and the payload of the first control command is Based on the comparison result with the data pattern indicated by the first detection policy, it is determined whether or not the first control command is an invalid command. And, when the first control command is determined to be invalid command, and generates an alert including information of the first control command, detecting device.

  According to one aspect of the present invention, a detection device with limited resources and installation space is used to quickly and accurately detect unauthorized communication regarding important work in a control system.

FIG. 2 is a block diagram showing an example of a configuration of an unauthorized communication detection system for a control system in the first embodiment. It is a block diagram showing the example of hardware constitutions of each device contained in the unauthorized communication detection system for control systems. FIG. 8 is a sequence diagram showing an example of reference data generation processing in the first embodiment. 7 is a configuration example of a communication packet stored in the communication packet storage unit in the first embodiment. 5 is a configuration example of reference data in Embodiment 1. FIG. 8 is a sequence diagram showing an example of classification data generation processing in the first embodiment. 5 is a flowchart illustrating an example of filter policy generation processing according to the first embodiment. 7 is a configuration example of task classification data in the first embodiment. 5 is a configuration example of a filter policy in the first embodiment. FIG. 7 is a sequence diagram illustrating an example of a process of collecting and updating filter policies stored in the detection device according to the first embodiment. FIG. 8 is a sequence diagram illustrating an example of a collection process and an update process of a detection policy stored in the detection device according to the first embodiment. 7 is a configuration example of a detection policy in the first embodiment. FIG. 7 is a sequence diagram showing an example of a process of verifying the legitimacy of a packet transmitted and received between control devices in the first embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. It should be noted that the present embodiment is merely an example for realizing the present invention, and does not limit the technical scope of the present invention.

  The present embodiment describes an unauthorized communication detection system for a control system. The detection device included in the unauthorized communication detection system for the control system collects control commands transmitted and received between the control devices. The detection device classifies the collected control commands into one or more control command groups based on the response time and transmission / reception size of each control command. The detection apparatus identifies, based on the response time of each control command and the transmission / reception size, a control command group of an important task having a large influence on the system from one or more control command groups. The detection device generates a filter policy that narrows down to only the area changed for each communication packet in the communication packet group.

  In the detection processing, when the received control command is a control command of an important task in the detection process, the detection device refers to the payload of the control command to determine whether the received control command is an unauthorized communication. If the detection device determines that the received control command is an incorrect communication, it generates an alert including information on the reception control command.

  FIG. 1 shows a configuration example of an unauthorized communication detection system for a control system of the present embodiment. The unauthorized communication detection system 100 for a control system of the present embodiment includes, for example, a plurality of control devices 10-1 to 10-n, a network device 20, a detection device 30, a management device 40, and a network 50. Hereinafter, the control devices 10-1 to 10-n will be referred to as the control device 10 when not particularly distinguished. Similarly, regarding each part included in each of the control devices 10-1 to 10-n, the hyphen and the following are omitted and described unless otherwise specified.

  Although FIG. 1 shows an example in which two control devices 10 are included in the control system-directed unauthorized communication detection system 100, the number of control devices 10 included in the control system-directed unauthorized communication detection system 100 is not limited.

  The control device 10 includes a control processing unit 101 that is a program that performs control processing, and a communication unit 102 that is realized by a communication device described later and that communicates with the network 50, the network device 20, and the like.

  The network device 20 is a program for copying a communication packet input to the network device 20. The packet copying unit 201 is a program for copying a communication packet. The first communication unit 202 for communicating with the network 50 203 and a third communication unit 204 that communicates with the control device 10-n. The network device 20 may include four or more communication units. Each communication unit is realized by, for example, a communication device described later.

  The detection device 30 includes a communication unit 301 and a communication packet acquisition unit 302, an operation classification unit 303, an important work determination unit 304, a difference extraction unit 305, a filter policy generation unit 306, a filtering processing unit 307, and a detection unit which are programs. An alert generation unit 309 includes an operation mode management unit 318, a reference data generation unit 319, a classification data generation unit 320, a filter policy update unit 321, and a detection policy update unit 322.

  The detection device 30 is an area for storing data. The communication packet storage unit 310, the reference data storage unit 311, the classification data storage unit 312, the determination threshold storage unit 313, the task classification data storage unit 314, and the filter. A policy storage unit 315, a detection policy storage unit 316, and an alert storage unit 317 are included.

  The communication unit 301 is realized by a communication device described later, and communicates with the network device 20. The communication packet acquisition unit 302 acquires information of the communication packet input to the communication unit 301. The task classification unit 303 classifies the communication packet acquired by the communication packet acquisition unit 302 for each task. The classification data generation unit 320 generates classification data indicating an index for classifying the communication packet by the task classification unit 303.

  The important work determination unit 304 determines the important work that affects the operation of the control device 10 from the work classified by the work classification unit 303. The reference data generation unit 319 generates reference data indicating a reference for determining the important work by the important work determination unit 304.

  The difference extraction unit 305 extracts a difference area of data in the packet of the important task. Details of the difference area will be described later. The filter policy generation unit 306 generates a filter policy that specifies a packet of an important job. The filtering processing unit 307 filters the input packet in accordance with the filter policy generated by the filter policy generation unit 306. The detection unit 308 verifies the legitimacy of the packet or data that has passed the filter according to a detection policy described later.

  The alert generation unit 309 generates an alert when the detection unit 308 detects the presence of an invalid packet or data. The operation mode management unit 318 manages the operation mode of the detection device 30. The detection device 30 can execute the processing defined in the setting operation mode. A specific example of the operation mode will be described later. The detection device 30 operates according to the operation mode managed by the operation mode management unit 318, so that, for example, the operation of the detection device 30 not intended by the user can be prevented, and thus the execution of unauthorized processing can be prevented. .

  The filter policy update unit 321 updates the filter policy in accordance with the instruction from the management device 40. The detection policy update unit 322 updates the detection policy according to the instruction from the management device 40.

  The communication packet storage unit 310 stores the communication packet acquired by the communication packet acquisition unit 302. The reference data storage unit 311 stores the reference data generated by the reference data generation unit 319. The classification data storage unit 312 stores classification data generated by the classification data generation unit 320. The determination threshold storage unit 313 stores a threshold used when the task classification unit 303 classifies tasks. The task classification data storage unit 314 stores task classification data indicating task information to which the communication packet belongs.

  The filter policy storage unit 315 stores the filter policy generated by the filter policy generation unit 306. The detection policy storage unit 316 stores a detection policy that is used when the detection unit 308 detects the presence of an invalid packet or data. The alert storage unit 317 stores the alert generated by the alert generation unit 309.

  The management device 40 includes a communication unit 406 and a reference packet generation unit, a filter policy generation unit 402, a detection policy generation unit 403, a filter policy collection unit 404, and a detection policy collection unit 405, which are programs. Further, the management device 40 includes a filter policy storage unit 407 and a detection policy storage unit 408, which are areas for storing data, respectively.

  The communication unit 406 is realized by, for example, a communication device described later, and communicates with the network 50. The reference packet generation unit 401 generates a reference packet used when the reference data generation unit 319 generates reference data. The filter policy generation unit 402 generates a filter policy stored in the filter policy storage unit 315 and the filter policy storage unit 407. The detection policy generation unit 403 generates a detection policy stored in the detection policy storage unit 316 and the detection policy storage unit 408.

  The filter policy collection unit 404 collects the filter policies stored in the filter policy storage unit 315. The detection policy collection unit 405 collects the detection policy stored in the detection policy storage unit 316. The filter policy storage unit 407 stores the filter policy generated by the filter policy generation unit 402 or collected by the filter policy collection unit 404. The detection policy storage unit 408 stores the detection policy generated by the detection policy generation unit 403 or collected by the detection policy collection unit 405.

  FIG. 2 illustrates an exemplary hardware configuration of the control devices 10-1 to 10-n, the network device 20, the detection device 30, and the management device 40. The control devices 10-1 to 10-n, the network device 20, the detection device 30, and the management device 40 are, for example, a communication device 11, an input / output device 12, and an auxiliary storage device connected by an internal communication line 16 such as a bus. 13 is configured on a computer 17 including a CPU 14 and a memory 15.

  The CPU 14 includes a processor and / or logic circuit that operates in accordance with a program stored in the memory 15. The memory 15 includes a ROM, which is a non-volatile storage element, and a RAM, which is a volatile storage element. The ROM stores an immutable program (for example, BIOS). The RAM is a high-speed and volatile storage element such as a dynamic random access memory (DRAM), and temporarily stores a program executed by the CPU 14 and data used when the program is executed.

  The auxiliary storage device 13 is, for example, a large-capacity and non-volatile storage device such as a magnetic storage device (HDD) or a flash memory (SSD), and stores a program executed by the CPU 14 and data used when executing the program. . That is, the program is read from the auxiliary storage device 13, loaded into the memory 15, and executed by the CPU 14.

  The computer 17 may have an input / output interface. The input / output interface is an interface to which the input / output device 12 is connected, which receives an input from the operator, and which outputs the execution result of the program in a form that can be viewed by the operator. The input / output device 12 includes, for example, input devices such as a keyboard and a mouse, and output devices such as a display device and a printer.

  The communication device 11 is a network interface device that controls communication with another device according to a predetermined protocol. The communication device 11 also includes, for example, a serial interface such as USB. The computer 17 may include a plurality of communication devices 11. For example, each communication unit included in the network device 20 may be realized by different communication devices 11.

  The program executed by the CPU 14 may be provided to the computer 17 via, for example, removable media (CD-ROM, flash memory, etc.) or a network, and may be stored in the non-volatile auxiliary storage device 13 which is a non-temporary storage medium. Good. Therefore, the computer 17 may have an interface for reading data from removable media.

  The control devices 10-1 to 10-n, the network device 20, the detection device 30, and the management device 40 are physically on one computer 17 or on a plurality of logically or physically configured computers 17. The computer system may be operated on separate threads on the same computer 17, or may be operated on virtual computers built on a plurality of physical computer resources.

  The program is executed by the CPU 14 to perform predetermined processing while using a storage device and a communication port. Therefore, in the present embodiment and the other embodiments, the description with the program as the subject may be the description with the CPU 14 as the subject. Alternatively, the process executed by the program is a process performed by the computer 17 and the computer system on which the program operates.

  The CPU 14 operates as a functional unit (means) that realizes a predetermined function by operating according to a program. For example, the CPU 14 operates in accordance with the communication packet acquisition unit 302 to function as a communication packet acquisition unit (communication packet acquisition unit), and operates in accordance with the operation classification unit 303 to function as a operation classification unit (operation classification unit). The same is true for other programs. Furthermore, the CPU 14 also operates as a functional unit (means) that implements each of a plurality of processes executed by each program. The computer 17 and the computer system are devices and systems including these functional units (means).

  FIG. 3 shows an example of the reference data generation process. First, the operation mode management unit 318 sets the operation mode to the initial mode, for example, in accordance with an instruction from the user via the input / output device 12 (S501). The initial mode is a mode for executing generation processing of reference data. If the operation mode management unit 318 can not set the operation mode to the initial mode, or if processing after step S502 described later is to be executed without being set to the initial mode, the unauthorized communication detection system 100 for the control system performs the subsequent processing. You may cancel

  Next, the reference packet generation unit 401 generates a reference packet (S502). For example, the reference packet generation unit 401 receives, from the operation mode management unit 318, a notification that a reference packet generation instruction has been received from the user via the input / output device 12, or that the operation mode has been changed to the initial mode. Start generation of reference packet triggered by

  Next, the communication unit 406 transmits the reference packet generated by the reference packet generation unit 401 to the control device 10-n (S503). Here, the reference packet is a packet indicating a reference for determining whether the task indicated by the control command is an important task. For example, packets transmitted / received at the network level such as Ping (that is, packets which do not carry out processing in a layer higher than the network layer) and user applications only refer to application data and do not write or perform internal processing. A packet is an example of a reference packet. Further, the reference packet generation unit 401 may transmit a plurality of reference packets having different characteristics (for example, the data amount of the packet, the control processing indicated by the packet, and the like).

  Next, the packet duplication unit 201 of the network device 20 duplicates the reference packet received from the management device 40 (S504). Next, the second communication unit 203 transmits the reference packet copied by the packet copying unit 201 to the detection device 30 (S505), and the third communication unit 204 controls the reference packet copied by the packet copying unit 201 as the control device 10-n. (S506).

  Next, the communication packet acquisition unit 302 acquires the reception time at which the communication unit 301 receives the copied reference packet from the network device 20 from, for example, the OS of the detection device 30 (S508). Next, the communication packet acquisition unit 302 acquires the size of the reference packet received by the communication unit 301 (S509). Next, the communication packet acquisition unit 302 stores the communication packet indicating the information of the received reference packet in the communication packet storage unit 310 (S510).

  Here, a configuration example of the communication packet stored in the communication packet storage unit 310 will be described. FIG. 4 shows a configuration example of a communication packet stored in the communication packet storage unit 310. The communication packet 1101 has, for example, a reception time 1102 indicating a time when the detection device 30 receives a reference packet corresponding to the communication packet, a size 1103 of a reference packet corresponding to the communication packet, and a reference corresponding to the communication packet And packet data 1104 indicating binary data of the packet. The order of components of the communication packet 1101 is not limited to the example of FIG.

  It returns to the explanation of FIG. On the other hand, the control processing unit 101-n processes the reference packet received from the network device 20 (S507). Next, the control processing unit 101-n generates a response indicating the processing result of the reference packet, and the communication unit 102-n transmits the response generated by the control processing unit 101-n to the management device 40 (S511).

  Next, the packet replication unit 201 of the network device 20 replicates the received response (S512). Next, the second communication unit 203 transmits the response copied by the packet copying unit 201 to the detection device 30 (S513), and the third communication unit 204 transmits the response copied by the packet copying unit 201 to the management device 40 ( S514).

  Next, the communication packet acquisition unit 302 acquires the reception time at which the communication unit 301 received the copied response from the network device 20, for example, from the OS of the detection device 30 (S515). Next, the communication packet acquisition unit 302 acquires the size of the copied response received by the communication unit 301 (S516). Next, the communication packet acquisition unit 302 stores the communication packet indicating the information of the received response in the communication packet storage unit 310 (S517). The configuration of the communication packet indicating the information of the response is the same as the configuration of the communication packet illustrated in FIG.

  Next, the reference data generation unit 319 generates reference data using the information of the communication packet of the reference packet stored in step S510 and the information of the communication packet of the response stored in step S517 (see below). S518).

  Here, a configuration example of reference data will be described. FIG. 5 shows a configuration example of reference data. The reference data 1201 includes, for example, a command reception time 1202 indicating the time when the detection device 30 receives the reference packet, a response reception time 1203 indicating the time when the detection device 30 receives a response to the reference command, and a command reception time 1202 Response time 1204 indicating the difference between the time and the response reception time 1203, the size 1205 of the reference packet, the size 1206 of the response packet, the transmission / reception size 1207 indicating the sum of the size of the command packet and the size of the response packet, and the reference packet And packet data 1208 indicating binary data. The order of the components of the reference data 1201 is not limited to the example shown in FIG.

  It returns to the explanation of FIG. Next, the reference data generation unit 319 stores the generated reference data in the reference data storage unit 311 (S519). In the example of FIG. 3, the processing in which the detection device 30 generates reference data is illustrated, but a device other than the detection device 30 may generate reference data. Further, the reference data generated regardless of the process of FIG. 3 may be directly stored in the reference data storage unit 311 in advance.

  FIG. 6 shows an example of classification data generation processing based on a communication packet of control work performed at the time of trial operation etc. between the control device 10-1 and the control device 10-n. First, the operation mode management unit 318 sets the operation mode to the collection mode in accordance with, for example, an instruction from the user via the input / output device 12 (S601). The collection mode is a mode for collecting communication packets of control work and generating classification data. Here, if the operation mode management unit 318 can not set the operation mode to the collection mode, or if processing after step S602 to be described later is to be executed without being set to the collection mode, the unauthorized communication detection system 100 for a control system. May cancel the subsequent processing.

  Next, the control processing unit 101-1 generates a control command (S602). The control command is, for example, a command for performing control of the operation of the control device 10, acquisition of the state of the control device 10, and the like. The control processing unit 101-1 triggers, for example, that an instruction from the user via the input / output device 12 has been received, or that a notification that the operation mode has changed to the collection mode has been received from the operation mode management unit 318. Start generation of control command as Next, the communication unit 102-1 transmits the control command generated by the control processing unit 101-1 to the control device 10-n (S603).

  Next, the packet copying unit 201 of the network device 20 copies the control command received by the third communication unit 204 from the control device 10-1 (S604). Next, the second communication unit 203 transmits the control command copied by the packet copying unit 201 to the detection device 30 (S 605), and the third communication unit 204 controls the control command copied by the packet copying unit 201. (S606).

  Next, the communication packet acquisition unit 302 acquires the reception time at which the communication unit 301 receives the copied control command from the network device 20, for example, from the OS of the detection device 30 (S608). Next, the communication packet acquisition unit 302 acquires the size of the received control command (S609). Next, the communication packet acquisition unit 302 stores the communication packet indicating the information of the received control command in the communication packet storage unit 310 (S610). The configuration of the communication packet indicating the information of the control command is the same as the configuration of the communication packet illustrated in FIG.

  On the other hand, the control processing unit 101-n performs the control task indicated by the control command received from the network device 20 (S607). Next, the control processing unit 101-n generates a response indicating the processing result of the control task, and the communication unit 102-n transmits the response generated by the control processing unit 101-n to the control device 10-1 (S611). .

  Next, the packet copying unit 201 of the network device 20 copies the response received by the third communication unit 204 (S612). Next, the second communication unit 203 transmits the response copied by the packet copying unit 201 to the detecting device 30 (S613), and the first communication unit 202 transmits the response copied by the packet copying unit 201 to the control device 10-1. (S614).

  Next, the communication packet acquisition unit 302 acquires the reception time at which the communication unit 301 receives the copied response from the network device 20 from, for example, the OS of the detection device 30 (S615). Next, the communication packet acquisition unit 302 acquires the transmission / reception size of the packet of the response received by the communication unit 301 (S616). Next, the communication packet acquisition unit 302 stores the communication packet indicating the information of the received response in the communication packet storage unit 310 (S617). The configuration of the communication packet indicating the information of the response is the same as the configuration of the communication packet illustrated in FIG.

  Next, the classification data generation unit 320 generates classification data using the information of the communication packet of the control command stored in S610 and the information of the communication packet of the response stored in S617 (S618) . The configuration of classification data is the same as the configuration of reference data shown in FIG. Specifically, the configuration of classification data is described by replacing the “reference packet” in the description of the configuration of the reference data in FIG. 5 with a “control command”.

  Next, the classification data generation unit 320 stores the generated classification data in the classification data storage unit 312 (S619). The process of FIG. 6 shows a process in which one classification data is generated for one control command. In the present embodiment, the processes of steps S602 to S619 are performed for each of a plurality of commands to be subjected to task classification.

  FIG. 7 shows an example of filter policy generation processing executed after reference data and classification data are generated. First, in accordance with, for example, an instruction from the user via the input / output device 12, the filter policy generation process starts (S701).

  Specifically, for example, when the operation mode management unit 318 sets the operation mode to the filter policy generation mode in accordance with the instruction, the filter policy generation process is started. The filter policy generation mode is a mode for generating a filter policy. Here, when the operation mode management unit 318 can not set the operation mode to the filter policy generation mode, or the processing after step S702 described later is to be executed without being set to the filter policy generation mode, the detection device 30 The subsequent processing may be canceled.

  Next, the task classification unit 303 acquires classification data stored in the classification data storage unit 312 (S702). Next, the task classification unit 303 indicates, for each of the acquired classification data, the importance of the control task indicated by the control command corresponding to the classification data, based on the response time and transmission / reception size of the classification data. A classification index is calculated (S703).

  The value obtained by dividing the response time of the classification data by the transmission / reception size is an example of the classification index of the classification data. The response time of the classification data is an example of a classification index of the classification data. Further, a value obtained by substituting the response time of the classification data and the transmission / reception size into a predetermined function which is an increase function of the response time and a reduction function of the transmission / reception size is an example of the classification index of the classification data.

  Next, the task classification unit 303 compares each of the generated classification indicators with the determination threshold stored in the determination threshold storage unit 313, and indicates information for identifying the task for each classification data. Assign an ID.

  The task classification unit 303 assigns a task ID to each classification data, for example, as follows. The task classification unit 303, for example, sorts the calculated classification indices in ascending order. The task classification unit 303 assigns the first task ID to the classification data corresponding to the classification index included in the section including the smallest classification index and whose length is the determination threshold. Furthermore, the task classification unit 303 is a section that includes the minimum classification index of classification data to which no business ID is assigned, and does not include the classification index of classification data to which a business ID is already assigned, and has a length A second task ID is assigned to the classification data corresponding to the contained classification index in the section where the judgment threshold is the judgment threshold. The task classification unit 303 can assign task IDs to all classification data by repeating the same processing. The task classification unit 303 can specify the classification data belonging to the same task at high speed and with high accuracy by the above-described processing.

  The task classification unit 303 generates task classification data corresponding to each of the classification data, and stores the generated task classification data in the task classification data storage unit 314 (S704). Here, a configuration example of task classification data will be described.

  FIG. 8 shows an example of the configuration of task classification data stored in the task classification data storage unit 314. The task classification data 1301 includes a task ID 1302 of classification data corresponding to the task classification data, a classification index 1303 of classification data corresponding to the task classification data, and packet data of classification data corresponding to the task classification data. And packet data 1304 indicating. The task classification data may not include the classification index 1303. Further, the order of the components of the task classification data 1301 is not limited to the above.

  It returns to the explanation of FIG. Next, the important work determination unit 304 determines the work ID of the important work from the work ID of the generated work classification data using the classification index of the reference data stored in the reference data storage unit 311, and makes a decision. The job ID thus stored is stored in the filter policy storage unit 315 (S705).

  The important work determining unit 304 determines the work ID of the important work, for example, as follows. For example, for each task ID, the important task determining unit 304 selects one classification index from the task classification data having the task ID. At this time, it is preferable that the important work determination unit 304 select the minimum classification index from the work classification data corresponding to the work ID. The important work determination unit 304 compares the classification index of the reference data with each of the selected classification indices, and determines a work ID having a classification index larger than the classification index of the reference data as the work ID of the important work.

  The classification index of the reference data is determined based on the response time of the reference packet. Therefore, for example, when the reference packet is a packet transmitted / received at the network level, the important task determining unit 304 executes the above-described processing to classify the command corresponding to the control command for executing processing at a level higher than the network level. Data can be classified as important tasks.

  Also, for example, in the case where the reference packet is a packet in which the user application only refers to the data of the application and does not write or perform internal processing, the important work determining unit 304 executes the above-described processing to execute the application. It is possible to increase the possibility that the classification data corresponding to the control command that executes the processing other than the data reference of is classified as the important work.

  In addition, the important work determining unit 304 may compare a predetermined threshold with each of the selected classification indicators, and determine a work ID having a classification index larger than the predetermined threshold as a work ID of the important work.

  Hereinafter, an example of processing in which a filter policy is created for each task ID of important tasks will be described. The filter policy generation unit 306 acquires, from the filter policy storage unit 315, the task ID of one important task for which the filter policy has not been created, and classifies packet data 1304 of all task classification data corresponding to the acquired task ID into task categories. It is acquired from the data storage unit 314 (S706).

  Next, the difference extraction unit 305 compares each of the payloads in the acquired packet data, and specifies a difference area indicating an area in which data differs in the payload (S 707). Specifically, for example, the difference extraction unit 305 compares each bit of each acquired payload, and determines an area including bits other than bits having the same value in all the payloads as a difference area. By extracting the difference area by the difference extraction unit 305, it is possible to reduce the area to be referred to by the detection unit 308 for abnormality detection while suppressing a decrease in detection accuracy in the abnormality detection process of step S1010 described later. Thus, the throughput can be reduced. In S707, the difference extraction unit 305 may set all bits of the payload as a difference area.

  Here, for example, when each bit bit in the packet data acquired by the difference extraction unit 305 is compared, the number of bits having the same value in all packet data is equal to or less than a predetermined ratio of the total number of bits in the payload. If it is determined that there is an area, an area consisting of bits having the same value in all packet data may be specified instead of the difference area.

  Next, the filter policy generation unit 306 generates a filter policy based on the task ID and packet data 1304 acquired in step S706 and the difference area determined by the difference extraction unit 305, and filters the generated filter policy. It is stored in the policy storage unit 315 (S 708).

  Here, a configuration example of the filter policy will be described. FIG. 9 shows a configuration example of the filter policy stored in the filter policy storage unit 315. The filter policy 1401 includes, for example, the task ID 1402 acquired in step S706, header information specified from packet data 1304 of task classification data of the corresponding task ID, and a detection area 1408 indicating the extracted difference area.

  The header information of the filter policy 1401 includes, for example, the transmission source 1403 of the communication packet, the transmission destination 1404 of the communication packet, the protocol 1405 of the communication packet, the transmission destination port number 1406 of the communication packet, and other features of the communication packet. And option 1407 shown.

  Note that, for example, when a plurality of types of transmission destinations are included in the packet data acquired in step S706, the filter policy generation unit 306 generates, for example, the transmission destination with the largest number of appearances or all transmission destinations in step S708. Are included in the filter policy 1401 corresponding to the task ID acquired in step S706. The same applies to header information other than the transmission destination. The filter policy 1401 may be directly input from the user via the input / output device 12. Further, the order of the components of the filter policy 1401 is not limited to the above.

  It returns to the explanation of FIG. Next, the filter policy generation unit 306 verifies whether or not the business policy ID of the important business for which the filter policy is not generated exists in the filter policy storage unit 315 (S709). If the filter policy generation unit 306 determines that there is a business ID of an important business for which a filter policy has not been generated (S709: Yes), the process returns to step S706 to generate a filter policy for the ungenerated business ID. . On the other hand, when the filter policy generation unit 306 determines that the filter policy is generated for the task IDs of all the important tasks (S709: No), the processing is ended (S710).

  FIG. 10 shows an example of the process of collecting and updating the filter policy stored in the detection device 30. First, the operation mode management unit 318 sets the operation mode to the maintenance mode, for example, in accordance with the user's instruction via the input / output device 12 (S801). The maintenance mode is a mode for carrying out policy collection processing, update processing, and the like. Here, if the operation mode management unit 318 can not set the operation mode to the maintenance mode, or if the processing after step S802 described later is to be executed without being set to the maintenance mode, the unauthorized communication detection system 100 for a control system. May cancel the subsequent processing.

  Next, the filter policy collection unit 404 generates a filter policy collection command (S802). The filter policy collection unit 404 is triggered, for example, by having received from the operation mode management unit 318 an instruction from the user via the input / output device 12 or a notification that the operation mode has been changed to the maintenance mode. Start generation of filter policy collection command.

  Next, the communication unit 406 transmits the filter policy collection command generated by the filter policy collection unit 404 to the detection device 30 (S803), and the second communication unit 203 detects the filter policy collection command received by the first communication unit 202. It transmits to the apparatus 30 (S804).

  Next, the filter policy update unit 321 acquires the filter policy stored in the filter policy storage unit 315 according to the filter policy collection command received by the communication unit 301 (S805). Next, the communication unit 301 transmits the filter policy acquired by the filter policy update unit 321 to the management device 40 (S806), and the first communication unit 202 transmits the filter policy received by the second communication unit 203 to the management device 40. (S807).

  If no filter policy is stored in the filter policy storage unit 315, the filter policy update unit 321 may generate a response indicating that there is no filter policy instead of acquiring the filter policy in step S805. At this time, in S 806 and S 807, the response is transmitted instead of the filter policy.

  Next, the filter policy collection unit 404 outputs the filter policy received by the communication unit 406 to the input / output device 12. Next, the filter policy generation unit 402 updates the filter policy according to an instruction from the user via the input / output device 12 (S808). When the communication unit 406 receives a response indicating that the filter policy does not exist, the filter policy generation unit 402 may newly generate the filter policy according to an instruction from the user via the input / output device 12 .

  Next, the communication unit 406 transmits the new filter policy updated by the filter policy generation unit 402 to the detection device 30 (S809), and the second communication unit 203 detects the new filter policy received by the first communication unit 202. (S810). Next, the filter policy update unit 321 updates the filter policy by storing the new filter policy received by the communication unit 301 in the filter policy storage unit 315 (S811).

  Next, the filter policy update unit 321 generates a response indicating the update result. The communication unit 301 transmits the response to the management device 40 (S812), and the first communication unit 202 transmits the response received by the second communication unit 203 to the management device 40 (S813).

  Next, the filter policy generation unit 402 refers to the update result indicated by the response received by the communication unit 406, and determines whether the update processing by the filter policy update unit 321 has succeeded (S814). If the filter policy generation unit 402 determines that the update process has succeeded (S814: Yes), the filter policy storage unit 407 stores the filter policy updated in S808 (S815).

  On the other hand, when the filter policy collection unit 404 determines that the update processing has failed (S814: No), the process returns to S809, and transmits the new filter policy again. Note that, for example, when a predetermined time has elapsed from the first determination process in step S814, or when the determination process in step S814 is performed a predetermined number of times, the filter policy generation unit 402 may end the process.

  Next, the operation mode management unit 318 sets the operation mode to the operation mode, for example, according to an instruction from the user via the input / output device 12 (S816). The operation mode is a mode in which the packet received by the detection device 30 is filtered based on the filter policy and the detection policy. Also, for example, when the filter policy update in S811 is successful, the operation mode management unit 318 may automatically set the operation mode to the operation mode. By the process shown in FIG. 10, the user of the management apparatus 40 can easily confirm the filter policy, and further, can flexibly change the filter policy.

  FIG. 11 shows an example of collection processing and update processing of detection policies stored in the detection device 30. First, the operation mode management unit 318 sets the operation mode to the maintenance mode, for example, in accordance with the user's instruction via the input / output device 12 (S901). Here, if the operation mode management unit 318 can not set the operation mode to the maintenance mode, or if the processing after step S902 described later is to be executed without being set to the maintenance mode, the unauthorized communication detection system 100 for a control system. May cancel the subsequent processing.

  Next, the detection policy collection unit 405 generates a detection policy collection command (S902). The detection policy collection unit 405 is triggered, for example, by receiving from the operation mode management unit 318 a notification from the operation mode management unit 318 that an instruction from the user via the input / output device 12 has been received or that the operation mode has changed to the maintenance mode. Start generation of detection policy collection command.

  Next, the communication unit 406 transmits the detection policy collection command generated by the detection policy collection unit 405 to the detection device 30 (S903), and the second communication unit 203 collects the detection policy received by the first communication unit 202. The command is transmitted to the detection device 30 (S904).

  Next, the detection policy update unit 322 acquires the detection policy stored in the detection policy storage unit 316 according to the detection policy collection command received from the network device 20 (S905). Next, the communication unit 301 transmits the detection policy acquired by the detection policy update unit 322 to the management device 40 (S906), and the first communication unit 202 transmits the detection policy received by the second communication unit 203 to the management device 40. Send (S907).

  When the detection policy is not stored in the detection policy storage unit 316, the detection policy update unit 322 may generate a response indicating that the detection policy does not exist, instead of acquiring the detection policy in step 905. At this time, in S 906 and S 907, the response is transmitted instead of the detection policy.

  Next, the detection policy collection unit 405 outputs the detection policy received by the communication unit 406 to the input / output device 12. Next, the detection policy generation unit 403 updates the received detection policy in accordance with an instruction from the user via the input / output device 12 (S908). If the communication unit 406 receives a response indicating that the detection policy does not exist, the detection policy generation unit 403 may newly generate the detection policy in accordance with an instruction from the user via the input / output device 12. . Next, the communication unit 406 transmits the new detection policy updated by the detection policy generation unit 403 to the detection device 30 (S909), and the second communication unit 203 detects the new detection policy received by the first communication unit 202. Send to 30 (S910).

  Next, the detection policy update unit 322 updates the detection policy by storing the new detection policy received by the communication unit 301 from the network device 20 in the detection policy storage unit 316 (S911). Next, the filter policy update unit 321 generates a response indicating the update result. The communication unit 301 transmits the response to the management device 40 (S912), and the first communication unit 202 transmits the response received by the second communication unit 203 to the management device 40 (S913).

  Next, the detection policy generation unit 403 refers to the update result indicated by the response received by the communication unit 406, and determines whether the update processing by the detection policy update unit 322 has succeeded (S914). If the detection policy generation unit 403 determines that the update process has succeeded (S 914; YES), the detection policy generation unit 403 stores the detection policy generated in S 904 in the detection policy storage unit 408. On the other hand, when the detection policy generation unit 403 determines that the update processing has failed (S914: No), the processing returns to S909, and transmits the new detection policy again.

  Note that, for example, when a predetermined time has elapsed from the initial determination process in step S914, or when the determination process in step S914 has been performed a predetermined number of times, the detection policy generation unit 403 may end the process. Next, the operation mode management unit 318 sets the operation mode to the operation mode, for example, according to an instruction from the user via the input / output device 12 (S916). Also, for example, when the filter policy update in S811 is successful, the operation mode management unit 318 may automatically set the operation mode to the operation mode. By the process shown in FIG. 11, the user of the management apparatus 40 can easily check the detection policy, and can change the detection policy flexibly.

  FIG. 12 shows a configuration example of a detection policy stored in the detection policy storage unit 316. The detection policy 1501 includes a task ID 1502, a detection area 1503, the number of patterns 1504 indicating the number of patterns of data included in the detection area, and a valid data pattern 1505 indicating the pattern of data included in the detection area. The order of the components of the detection policy 1501 is not limited to the above.

  The task ID 1502 is, for example, a task ID of an important task. That is, the detection policy storage unit 316 includes a detection policy corresponding to each business ID of the filter policy stored in the filter policy storage unit 315. The detection area 1503 indicates, for example, a detection area 1408 of the filter policy having the same task ID 1402 as the task ID 1502.

  FIG. 13 illustrates an example of the process of verifying the legitimacy of a packet transmitted and received between the control device 10-1 and the control device 10-n by the detection device 30. First, the operation mode management unit 318 sets the operation mode to the operation mode, for example, in accordance with a user instruction via the input / output device 12 (S1001). For example, the process of step S816 or step S916 may be replaced with step S1001.

  Here, if the operation mode management unit 318 can not set the operation mode to the operation mode, or if the processing after step S1002 is to be executed without being set to the operation mode, the unauthorized communication detection system 100 for the control system You may cancel the processing of.

  Next, the control processing unit 101-1 generates a control command (S1002). Next, the communication unit 102-1 transmits the control command generated by the control processing unit 101-1 to the control device 10-n (S1003). Next, the packet duplication unit 201 duplicates the control command received from the control device 10-1 (S1004). Next, the second communication unit 203 transmits the control command copied by the packet copying unit 201 to the detection device 30 (S1005), and the first communication unit 202 controls the control command copied by the packet copying unit 201. Send to n (S1006).

  The control processing unit 101-n executes the control task according to the control command received from the network device 20 (S1007). The filtering processing unit 307 performs packet filtering on the control command received by the communication unit 301 from the network device 20 using the filter policy stored in the filter policy storage unit 315 (S1008).

  Specifically, for example, when the filter policy having header information that matches the header information of the received control command exists in the filter policy storage unit 315, the filtering processing unit 307 filters the control command in the packet to be filtered. Determine that there is. In addition, when the filter policy having header information that matches the header information of the received control command does not exist in the filter policy storage unit 315, the filtering processing unit 307 determines that the control command is a packet not to be filtered. .

  When the filtering processing unit 307 determines that the control command is a packet not to be filtered (S1008: No), the detection process is ended (S1009). On the other hand, when the filtering processing unit 307 determines that the control command is a packet to be filtered (S1008: Yes), the detection unit 308 uses the detection policy stored in the detection policy storage unit 316 to perform detection processing. Perform (S1010).

  Specifically, the detection unit 308 acquires the task ID of the filter policy whose header information matches in S1008, and acquires the detection policy having the acquired task ID from the detection policy storage unit 316. The detection unit 308 acquires the detection area 1503 of the acquired detection policy, and checks data in the detection area of the payload of the received control command. If the data in the detection area matches the data indicated by the valid data pattern 1505 of the acquired detection policy, the detection unit 308 determines that there is no abnormality. If the data in the detection area does not match the data indicated by the valid data pattern 1505 of the acquired detection policy, the detection unit 308 determines that there is an abnormality.

  If the detection unit 308 determines that there is no abnormality, that is, the control command is not an incorrect command (S1010: No), the detection process is ended (S1011). On the other hand, when the detection unit 308 determines that there is an abnormality, that is, the control command is an incorrect command (S1010: Yes), the alert generation unit 309 generates an alert (S1012). The alert generation unit 309 includes, for example, the time when the control command is received, the task ID corresponding to the control command, data of the detection area of the control command, and the like in the alert.

  Next, the alert generation unit 309 stores the generated alert in the alert storage unit 317 (S1013). Here, the communication unit 301 may transmit the alert generated by the alert generation unit 309 to the management device 40, and the first communication unit 202 may transmit the alert received by the second communication unit 203 to the management device 40 or the like. Also, the input / output device 12 of the detection device 30 and / or the input / output device of the management device 40 may output an alert.

  As described above, the unauthorized communication detection system 100 for a control system according to the present embodiment determines whether the control command belongs to the important work using the filter policy, and uses the detection policy for the control command corresponding to the important work. Perform the filtering. The unauthorized communication detection system 100 for a control system can perform efficient unauthorized communication detection processing with a small amount of processing. Specifically, by using the low-resource detection device 30 alone, it is possible to detect unauthorized communication relating to important work in the control system at high speed and with high accuracy.

  For example, the network device 20 and / or the management device 40 may be included in the detection device 30 of the present embodiment, and the control device 10, the detection device 30, and the management device 40 include a communication function with the network. Alternatively, these devices may communicate with the network via another device.

  The present invention is not limited to the embodiments described above, but includes various modifications. For example, the embodiments described above are described in detail in order to explain the present invention in an easy-to-understand manner, and are not necessarily limited to those having all the configurations described. In addition, part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. In addition, with respect to a part of the configuration of each embodiment, it is possible to add, delete, and replace other configurations.

  Further, each of the configurations, functions, processing units, processing means, etc. described above may be realized by hardware, for example, by designing part or all of them with an integrated circuit. Further, each configuration, function, etc. described above may be realized by software by the processor interpreting and executing a program that realizes each function. Information such as a program, a table, and a file for realizing each function can be placed in a memory, a hard disk, a recording device such as an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

  Further, control lines and information lines indicate what is considered to be necessary for the description, and not all control lines and information lines in the product are necessarily shown. In practice, almost all configurations may be considered to be mutually connected.

10-1 to 10-n Control device, 14 CPU, 15 memory, 30 detection device, 303 job classification unit, 40 management device, 304 important work determination unit, 305 difference extraction unit, 306 filter policy generation unit, 307 filtering processing unit 308 detection unit 309 alert generation unit 311 reference data storage unit 312 classification data storage unit 313 determination threshold storage unit 314 task classification data storage unit 315 filter policy storage unit 316 detection policy storage unit 318 Reference data generation unit, 319 classification data generation unit, 321 filter policy update unit, 322 detection policy update unit, 401 reference packet generation unit, 404 filter policy collection unit, 405 detection policy collection unit,

Claims (12)

A detection device for detecting unauthorized communication between a first control device and a second control device, the detection device comprising:
Including a processor and a storage device,
The processor is
A plurality of control commands for controlling the operation of the second control device, which the first control device transmits to the second control device, and a plurality of controls, which the second control device transmits to the first control device Monitor the response to each command,
Calculating a response time indicating a difference between the reception time of each of the plurality of control commands and the reception time of the response corresponding to each of the plurality of control commands,
The plurality of control commands are classified into a control command group including one or more control commands based on each of the calculated response times,
Each of one or more control command groups selected from the control command group is determined as an important task based on each of the calculated response times,
Generating a filter policy indicating, for each of the important tasks, the correspondence between the important tasks and the header information of the control command selected from the control commands belonging to the important tasks;
Obtain a detection policy that indicates the correspondence between the important task and the payload data pattern,
Storing the filter policy and the detection policy in the storage device;
Receiving a first control command from the first controller;
If there is a filter policy that includes first header information of the first control command:
Acquire a first detection policy including the important task indicated by the filter policy;
Based on the comparison result of the payload of the first control command and the data pattern indicated by the first detection policy, it is determined whether the first control command is an invalid command or not.
A detection device that generates an alert including information of the first control command when it is determined that the first control command is an invalid command. The detection device according to claim 1, wherein
The processor compares the value of each bit of the payload of the control command belonging to the important work with respect to each of the important work, and specifies a difference area indicating at least one bit having a different value between the payloads;
The detection policy indicates the correspondence between the important work and the data pattern of the difference area,
The processor is
If there is a filter policy that includes first header information of the first control command:
The first control command is an invalid command based on the comparison result of the data of the difference area indicated by the first detection policy of the first control command and the data pattern of the difference area indicated by the first detection policy. Detection device that determines if there is. The detection device according to claim 1, wherein
The processor is
Calculate a classification index based on each of the response times,
Generate a plurality of sections having a predetermined length and not overlapping each other,
A detection device which includes control commands corresponding to classification indexes included in the same section in the same control command group. The detection device according to claim 1, wherein
The processor is
Calculating a transmission / reception size indicating a sum of each of the plurality of control commands and the size of the response corresponding to each of the plurality of control commands;
The plurality of control commands are classified into a control command group including one or more control commands based on each of the calculated response times and each of the calculated transmission / reception sizes,
A detection device which determines one or more control command groups selected from the control command group based on each of the calculated response times, each of the calculated transmission / reception sizes, and the like as an important task. The detection device according to claim 1, wherein
The processor is
A classification index is calculated based on each of the response times,
A detection device which determines a control command group including a control command corresponding to a classification index larger than a first threshold as important work. The detection device according to claim 5, wherein
The processor is
A reference packet, which is a packet at the network level for controlling the operation of the second control device, or a packet for which writing and internal processing are not performed at the application level, transmitted to the second control device by a management device that manages the detection device Monitoring a response to the reference packet that the second control device transmits to the management device;
A first response time indicating a difference between the reception time of each of the plurality of control commands and the reception time of the response corresponding to each of the plurality of control commands is calculated,
The detection apparatus which determines the classification index based on said 1st response time to said 1st threshold. The detection device according to claim 1, wherein
Connected to the input device,
The detection device, wherein the processor acquires the detection policy by user input via the input device. The detection device according to claim 1, wherein
The processor is
Receiving an indication indicating an operating mode defining the process that the processor can execute;
Execute a process defined by an operation mode indicated by the received instruction;
The operation mode includes a first operation mode for calculating the response time, a second operation mode for generating the filter policy, a third operation mode for acquiring the detection policy, and a command in which the first control command is incorrect. And a fourth operation mode to determine whether it is or not. A detection system that includes a first control device, a second control device, and a detection device that detects unauthorized communication between the first control device and the second control device,
The detection device
A plurality of control commands for controlling the operation of the second control device, which the first control device transmits to the second control device, and a plurality of controls, which the second control device transmits to the first control device Monitor the response to each command,
Calculating a response time indicating a difference between the reception time of each of the plurality of control commands and the reception time of the response corresponding to each of the plurality of control commands,
The plurality of control commands are classified into a control command group including one or more control commands based on each of the calculated response times,
Each of one or more control command groups selected from the control command group is determined as an important task based on each of the calculated response times,
Generating a filter policy indicating, for each of the important tasks, the correspondence between the important tasks and the header information of the control command selected from the control commands belonging to the important tasks;
Obtain a detection policy that indicates the correspondence between the important task and the payload data pattern,
Receiving a first control command from the first controller;
If there is a filter policy that includes first header information of the first control command:
Acquire a first detection policy including the important task indicated by the filter policy;
Based on the comparison result of the payload of the first control command and the data pattern indicated by the first detection policy, it is determined whether the first control command is an invalid command or not.
A detection system that generates an alert including information of the first control command when it is determined that the first control command is an invalid command. The detection system according to claim 9,
Further including an output device and a management device that manages the detection device;
The management device is
Sending an instruction to collect at least one of a filter policy and a detection policy to the detection device;
Receiving the at least one held by the detection device from the detection device;
A detection system which outputs the received at least one to the output device. The detection system according to claim 9,
Further including an input device and a management device that manages the detection device,
The management device is
At least one of a filter policy and a detection policy is acquired by user input via the input device,
Transmitting the acquired at least one to the detection device;
The detection system, wherein the detection device holds at least one received from the management device. A detection method detects unauthorized communication between a first control device and a second control device.
The method is
The detection device
A plurality of control commands for controlling the operation of the second control device, which the first control device transmits to the second control device, and a plurality of controls, which the second control device transmits to the first control device Monitor the response to each command,
Calculating a response time indicating a difference between the reception time of each of the plurality of control commands and the reception time of the response corresponding to each of the plurality of control commands,
The plurality of control commands are classified into a control command group including one or more control commands based on each of the calculated response times,
Each of one or more control command groups selected from the control command group is determined as an important task based on each of the calculated response times,
Generating a filter policy indicating, for each of the important tasks, the correspondence between the important tasks and the header information of the control command selected from the control commands belonging to the important tasks;
Obtain a detection policy that indicates the correspondence between the important task and the payload data pattern,
Receiving a first control command from the first controller;
If there is a filter policy that includes first header information of the first control command:
Acquire a first detection policy including the important task indicated by the filter policy;
Based on the comparison result of the payload of the first control command and the data pattern indicated by the first detection policy, it is determined whether the first control command is an invalid command or not.
A method of generating an alert including information of the first control command if it is determined that the first control command is an incorrect command.