JP6743553B2 - Abnormality detection system and abnormality detection method - Google Patents

Description

The present invention relates to an abnormality detection system and an abnormality detection method.

Conventionally, in a plant having a control system or the like, a method for detecting an abnormality in the control system or the like is known.

This is because an abnormality detection device is installed between a control server (HMI (Human-Machine Interface) or the like) and a control device (PLC (Programmable Logic Controller), controller, or the like) that configures the control system. Is a method of detecting. Specifically, the control server and control equipment, network equipment (router, gateway, etc.) on the line connecting the control server and control equipment are equipped with an abnormality detection function, or the abnormality detection equipment is directly connected to the same line. For example, the abnormality is detected by analyzing the state of the server or the device, the data on the network, or the like.

For example, first, the abnormality detection device that detects an abnormality in the control system has a security gateway. Then, the security gateway monitors traffic such as sensor data, sensor signals, operation commands for actuators, and control signals for actuators transmitted in the control network. Next, the security gateway generates event information in a predetermined format as a result of the monitoring, and passes the event information to the analysis engine. Subsequently, the analysis engine analyzes the event information and detects an abnormality that has occurred in the control network (for example, Patent Document 1).

JP, 2012-168686, A

However, in the conventional method, for example, the process of maintenance and maintenance work of the control server, the control device, the network device, etc. equipped with the abnormality detection device, infection of computer viruses via the network, and exploitation of vulnerabilities, etc. It is possible to disable the function of the abnormality detection device, and even if the data is falsified, the abnormality may not be detected in some cases.

One aspect of the present invention is made in view of such a problem, and an object thereof is to detect an abnormality of a plant or an apparatus used in the plant.

In order to solve the above-mentioned problems and achieve the object, in an embodiment of the present invention, an operation system having at least a field device for measuring a physical quantity or a device state, a virtual system connected to the field device, and An abnormality detection system including an operation system and a collation system connected to the virtual system,
Unlike the above-mentioned method of detecting an abnormality between the control server and the control device,
From the field device, an input unit for inputting an input signal indicating a measurement result by the field device,
A virtual system having a data generation unit for generating first data indicating a processing result equivalent to that of the operation system based on the input signal;
An acquisition unit for acquiring the first data from the virtual system and the second data indicating the processing result of the processing based on the input signal from the operation system;
And a detector that detects the abnormality of the operation system or a plant using the operation system by comparing the first data and the second data.

According to the present invention, it is possible to detect an abnormality in a plant or an apparatus used in the plant.

It is a system diagram which shows an example of the whole structure of the abnormality detection system in one Embodiment of this invention. It is a block diagram which shows an example of the hardware constitutions of the information processing apparatus used for implement|achieving the collation system which the abnormality detection system in one embodiment of this invention has. It is a sequence diagram which shows an example of the whole process by the abnormality detection system in one Embodiment of this invention. It is a sequence diagram which shows an example of the whole process by the abnormality detection system in one Embodiment of 2nd Embodiment of this invention. It is a system diagram which shows an example of the whole structure of the abnormality detection system in one Embodiment of 2nd Embodiment of this invention. It is a flowchart which shows an example of the collation by the abnormality detection system in one Embodiment of 2nd Embodiment of this invention. It is a timing chart which shows an example of the serial number used in the collation by the abnormality detection system in one embodiment of the present invention. It is a functional block diagram which shows an example of a functional structure of the abnormality detection system in one Embodiment of this invention.

Embodiments of the present invention will be described in the following order.

1. Overall configuration example of anomaly detection system 2. 2. Example of hardware configuration of each system included in the abnormality detection system Overall processing example by anomaly detection system 4. Example of functional configuration of anomaly detection system

(First embodiment)
≪ 1. Overall configuration example of anomaly detection system ≫
FIG. 1 is a system diagram showing an example of the overall configuration of an abnormality detection system according to an embodiment of the present invention. As illustrated, the abnormality detection system 10 includes an operation system 1, a virtual system 2, and a matching system 3.

In a plant such as a factory, the operation system 1 measures various physical quantities or states of devices used in the plant. Specifically, the physical quantity is, for example, temperature, pressure, speed, rotation speed of the motor, electric energy or size. In this way, the physical quantity is a mechanical or electrical value measured by the field device 1FM such as a sensor. In addition, the status of the device indicates various states such as whether or not the target device is in operation, whether or not the device is in failure, and whether or not the power of the device is on or off. It is a parameter to show.

Next, in the operation system 1, the measurement result by the field device 1FM becomes a signal (hereinafter referred to as “input signal SIP”) and is input to the input module 1IM. Then, the input module 1IM performs A/D (analog-digital) conversion or the like on the input signal SIP. Next, the input module 1IM generates, by A/D conversion, a value in a data format that can be processed by the controller 1CR, a so-called digital value. That is, the input module 1IM converts the input signal SIP into a format that the controller 1CR or the like can process. A digital value may be transmitted from the field device 1FM.

Then, the controller 1CR performs processing based on the digital value. What kind of processing is performed by the controller 1CR varies depending on preset setting conditions, the type of the controller 1CR, the type of the input signal SIP, and the like.

For example, assume that the field device 1FM is a device that measures temperature. Then, the field device 1FM outputs a voltage value (the unit system is V (volt) or the like) indicating the measurement result to the input module 1IM in response to the input signal SIP. Next, the input module 1IM generates a digital value (the unit system is dimensionless) by A/D conversion. Subsequently, the controller 1CR performs a process of converting a digital value into a value (hereinafter referred to as “industrial value”) in a format that humans can understand, such as temperature (the unit system is °C (degrees)). To do. Further, the industrial value is not limited to temperature and may be other types.

The controller 1CR may perform processing such as controlling other devices based on the input signal SIP.

Then, the data indicating the processing result by the operation system 1 (hereinafter referred to as “second data D2”) is transmitted to the HMI terminal 1HM. When transmitted to the HMI terminal 1HM, for example, the second data D2 is stored in the database DB in the HMI terminal 1HM. Then, the HMI terminal 1HM displays the management parameter, that is, the second data D2, on the user UR who is the manager of the plant or the like.

Further, the operation system 1 may include a supervisory control computer such as SCADA (Supervision Control and Data Acquisition), DCS (Distributed Control System), PLC, or a combination thereof. Further, the operation system 1 may include a plurality of controllers 1CR, input modules 1IM and the like.

A general-purpose OS (Operating System) such as Windows (registered trademark) or Linux (registered trademark) may be used for each device included in the operation system 1, or a general-purpose network such as Ethernet (registered trademark) may be used as the network. is there. Therefore, a so-called cyber attack may be performed on the operation system 1.

Specifically, as shown in the drawing, a cyber attack (hereinafter referred to as “first cyber”) that aims at input or output of each device included in the operation system 1, that is, a signal and data transmitted and received on a network to which each device is connected. Attack AT1”) may be performed against the operation system 1. In the illustrated example, in the first cyber attack AT1, signals transmitted and received between the respective devices are targets of the cyber attack, and the first cyber attack AT1 falsifies the data or illegally acquires the data.

Further, as shown in the drawing, a cyber attack (hereinafter, referred to as “second cyber attack AT2”) aiming at data stored in each device of the operation system 1 may be performed on the operation system 1. In the illustrated example, the second cyber attack AT2 firstly illegally invades the operation system 1 and targets the data stored in the database DB to falsify the data or illegally acquire the data. It is an attack.

In addition, a cyber attack targeting the program DP installed in each device of the operation system 1 (hereinafter referred to as “third cyber attack AT3”) may be performed on the operation system 1. In the illustrated example, for example, it is assumed that the program DP for displaying the second data D2 on the user UR is installed in the HMI terminal 1HM in advance.

More specifically, the HMI terminal 1HM displays the second data D2 on the user UR in a time series or by processing the data in a format such as a table by using the program DP to display a graph. That is, the program DP displays a numerical value, a state, or the like for the user UR to monitor the plant or the equipment used by the plant based on the data. When the third cyber attack AT3 is performed on the program DP that performs such processing, for example, the numerical value displayed by the program DP is changed, the message indicating "abnormal" is changed, and the user UR sets the plant You may not be able to detect abnormalities.

As described above, there are cases where cyber attacks such as the first cyber attack AT1, the second cyber attack AT2, and the third cyber attack AT3 are made to the operation system 1, and an abnormality occurs in the plant or the equipment included in the plant. Therefore, the abnormality detection system 10 detects the abnormality of the plant or the equipment included in the plant by the virtual system 2 and the verification system 3.

As illustrated, the virtual system 2 inputs the input signal SIP from the field device 1FM. That is, the virtual system 2 performs processing based on the measurement result of the field device 1FM, like the controller 1CR and the like, instead of the test signal and the like. The input signal SIP is transmitted from the field device 1FM to the virtual system 2 separately from the operation system 1. That is, the field device 1FM transmits the input signal SIP showing the same content to the operation system 1 and the virtual system 2 twice.

Further, the route for transmitting the input signal SIP from the field device 1FM to the operation system 1 and the route for transmitting the input signal SIP from the field device 1FM to the virtual system 2 may be separate. Specifically, the cable connecting the field device 1FM and the operation system 1 and the cable connecting the field device 1FM and the virtual system 2 are different cables or the like.

The virtual system 2 performs processing that is equivalent to the processing result of the controller 1CR or the like. That is, as described above, in the operation system 1, when the temperature is first measured, the digital value is generated, and the digital value is converted into the industrial value indicating the temperature, the virtual system 2 similarly inputs The signal SIP is converted to generate a digital value, and the digital value is A/D converted to generate an industrial value indicating temperature.

Therefore, since the virtual system 2 performs the same processing as the operation system 1, the data indicating the processing result of the virtual system 2 (hereinafter referred to as “first data D1”) is the data indicating the same result as the second data D2. Becomes

Therefore, the collation system 3 acquires the first data D1 and the second data D2 from the operation system 1 and the virtual system 2, and collates the first data D1 and the second data D2. Then, based on the result of the collation, the user UR is notified of the abnormality detection result and the like.

Each system included in the abnormality detection system is, for example, a system having the following hardware configuration.

≪ 2. Example of hardware configuration of each system of the abnormality detection system ≫
The virtual system 2 is, for example, an electronic circuit or the like. That is, the virtual system 2 is realized by, for example, an ASIC (Application Specific Integrated Circuit) or an FPGA (Field-Programmable Gate Array). The virtual system 2 may be realized by an information processing device or the like that operates based on firmware or the like. As described above, it is desirable that the virtual system 2 is realized by an information processing device capable of high-speed processing such as an electronic circuit. However, depending on the processing speed of the operation system 1, information such as a PC (Personal Computer) or a server may be used. It may be realized by the processing device. On the other hand, the collation system is realized by, for example, the following information processing device and the like.

FIG. 2 is a block diagram showing an example of the hardware configuration of the information processing apparatus used to realize the collation system included in the abnormality detection system according to the embodiment of the present invention. As illustrated, the collation system 3 includes a CPU (Central Processing Unit) HW1, a storage device HW2, a network I/F (interface) HW3, an input I/FHW4, and an output I/FHW5. That is, the matching system 3 is an information processing device such as a PC, a server, or a workstation.

The CPU HW1 is a control device that controls an arithmetic device that performs arithmetic operations and data processing for realizing processing and hardware.

The storage device HW2 is a main storage device such as a so-called memory. Further, the storage device HW2 stores programs, set values, data, and the like. The storage device HW2 may further include an auxiliary storage device and the like.

The network I/FHW 3 is an interface that inputs and outputs data and the like via the network. For example, the network I/FHW3 is a connector, a cable, a driver, or the like.

The input I/FHW 4 is an interface that is operated by a user and inputs data from an external device. For example, the input I/FHW 4 is an input device such as a keyboard, a mouse, or a combination thereof. Further, the input I/FHW 4 is a connector, a driver or the like for connecting an input device and an external device.

The output I/FHW 5 is an interface for displaying to a user and outputting data to an external device. For example, the output I/FHW 5 is an output device such as a display. Further, the output I/FHW 5 is a connector, a driver or the like for connecting the output device and the external device.

The hardware configuration is not limited to the illustrated configuration. For example, the collation system 3 may have a hardware configuration that further internally or externally includes a computing device, a control device, or a storage device.

The virtual system 2 and the matching system 3 are realized by one or more information processing devices. That is, the virtual system 2 and the collation system 3 may be realized by a plurality of information processing devices, and may be configured to perform processing in a redundant, distributed or parallel manner.

≪ 3. Overall processing example by anomaly detection system ≫
FIG. 3 is a sequence diagram showing an example of overall processing by the abnormality detection system according to the embodiment of the present invention.

<<Measurement Example>> (Step S101)
In step S101, the operation system 1 measures with a field device. And the operation system 1 produces|generates the input signal which shows a measurement result.

<<Example of input of input signal>> (step S102)
In step S102, the operation system 1 inputs an input signal to the controller using an input module or the like. On the other hand, the operation system 1 transmits an input signal indicating the same measurement result to the virtual system 2 and inputs the input signal to the virtual system 2.

<<Processing example by controller etc.>> (step S103)
In step S103, the operation system 1 performs processing based on the input signal by the controller or the like. Then, in step S103, the operation system 1 transmits the second data indicating the processing result to the matching system 3.

<<Example of Processing Equivalent to Operation System 1>> (Step S104)
In step S104, the virtual system 2 performs a process equivalent to that of the operation system 1 by the controller or the like. Then, in step S104, the virtual system 2 transmits the first data indicating the processing result to the matching system 3.

That is, step S103 and step S104 are equivalent processes. As shown in the figure, both step S103 and step S104 are processed based on the same input signal input in step S102.

<<Example of Acquisition of First Data and Second Data>> (Step S105)
In step S105, the matching system 3 acquires the first data and the second data. That is, in the illustrated overall process, the verification system 3 receives the second data transmitted in step S103 and the first data transmitted in step S104, and acquires the respective data.

<<Example of Abnormality Detection>> (Step S106)
In step S106, the collation system 3 collates the first data and the second data to detect an abnormality. Specifically, the matching system 3 determines whether the first data and the second data are the same. As described above, step S103 and step S104 are equivalent processes and are performed by inputting the same input signal. Therefore, when the operation system 1 is not subjected to a cyber attack or the like, the second data has not been falsified, so the first data and the second data are the same. Therefore, if the first data and the second data are the same, the collation system 3 determines that the collation result indicates that there is no abnormality, that is, the operation system 1 and the device used by the operation system 1 are in the “normal” state. judge.

On the other hand, when the operation system 1 is subjected to some kind of cyber attack and any program, data, or signal on the operation system 1 is tampered with, the first data as a processing result may also be changed by tampering. Therefore, when the operation system 1 receives a cyber attack or the like, the second data becomes data showing a different result from the first data due to falsification by the cyber attack or the like. Therefore, if there is tampering or the like, the first data and the second data are different data. Therefore, if the first data and the second data are not the same, the collation system 3 is in an abnormal state, that is, the operation system 1 or a device used by the operation system 1 such as a field device is in an “abnormal” state. Judge that there is. In this way, the verification system 3 detects an abnormality in the operation system 1 or the equipment used by the operation system 1.

<< Notification Example >> (Step S107)
In step S107, the verification system 3 notifies the user UR of the abnormality. For example, in step S107, the collation system 3 transmits an email or the like to the information processing device operated by the user UR when the abnormality of the operation system 1 or the device used by the operation system 1 is detected in step S106, A Patlight (registered trademark) or the like is turned on, or an alarm device such as a buzzer is operated to notify the user UR that an abnormality has been detected. In this way, when notified, the user UR can know that an abnormality has occurred in the operation system 1 or a device used by the operation system 1.
(Second embodiment)
In the second embodiment, for example, the abnormality detection system 10 has the same overall configuration and hardware configuration as in the first embodiment. The second embodiment differs from the first embodiment in overall processing. In the second embodiment, for example, the abnormality detection system 10 performs the following overall processing.

FIG. 4 is a sequence diagram showing an example of overall processing by the abnormality detection system according to the second embodiment of the present invention. Compared with FIG. 3, FIG. 4 is different in that step S201 and step S202 are added. Hereinafter, the different points will be mainly described and the duplicated description will be omitted.

Steps S201 and S202 perform the same process as step S104 separately from step S104. That is, steps S201 and S202 perform the same processing as step S103 on the same input signal as step S103.

For example, as shown in the figure, step S201, step S202 and step S104 are processed in parallel. In the illustrated example, step S201, step S202, and step S104 are processed in parallel, but step S201, step S202, and step S104 may be processed in parallel instead of in parallel. Then, the data indicating the respective processing results of step S201 and step S202 are transmitted to the matching system 3 as in step S104.

That is, the virtual system 2 redundantly performs the same process as step S104. The number of redundancy is not limited to three as shown in the figure. That is, in the virtual system 2, the same process as in step S104 may be performed in plural. Hereinafter, the number of processes similar to step S104 will be referred to as “the number of processes N”. Specifically, as shown in FIG. 3, when there is no redundancy, the number of processes N=1 is set. On the other hand, in the case shown in FIG. 4, the number of processes N=3.

Further, the number of the first data transmitted to the matching system 3 changes depending on the number of processes. If the number of processes is N, the first data and the second data are as follows.

FIG. 5 is a system diagram showing an example of the overall configuration of an abnormality detection system according to an embodiment of the second embodiment of the present invention. As illustrated, the second data D2 is transmitted from the operation system 1 to the collation system 3. On the other hand, N pieces of first data are transmitted from the virtual system 2 to the matching system 3. In the illustrated example, as the first data, the eleventh data D11, the twelfth data D12,..., The first N data D1N are transmitted.

Then, when the collation system 3 acquires the second data and the plurality of first data (step S105 shown in FIG. 4), the collation system 3 performs the collation based on the second data and the plurality of first data. For example, the collation system 3 collates as follows.

FIG. 6 is a flowchart showing an example of collation by the abnormality detection system according to the embodiment of the second embodiment of the present invention. That is, in step S106 shown in FIG. 4, the collation system 3 performs the illustrated process.

<<Example of determination whether the first data is the same>> (Step S301)
In step S301, the matching system determines whether the first data is the same. As shown in FIG. 5, when the “processing number N” is 2 or more, the first data is plural. Therefore, the matching system determines whether the data is the same.

Specifically, in the example shown in FIG. 5, the matching system determines whether the eleventh data D11 and the twelfth data D12 are the same. Further, as shown in FIG. 5, when there are many first data, the collation system may further determine using another combination of the first data.

Since each first data has the same input signal and the same processing result, if there is no abnormality, that is, if the virtual system is in the “normal” state, each first data will be the same data. On the other hand, when the virtual system receives a cyber attack, the first data and the like may be falsified. In this way, when the data is falsified in the virtual system, each first data becomes different data. Therefore, in step S301, the matching system determines whether the first data is the same, and determines the state of the virtual system.

Next, when the matching system determines that the first data are the same (YES in step S301), the matching system proceeds to step S303. On the other hand, when the collation system determines that the first data is not the same (NO in step S301), the collation system proceeds to step S302.

<<Example of detection of abnormality in virtual system>> (step S302)
In step S302, the verification system detects an abnormality in the virtual system. That is, in step S302, the verification system determines that the virtual system is under a cyber attack. In the subsequent step S107 (see FIG. 4), it may be notified that the virtual system is abnormal or the like.

<<Example of determination as to whether first data and second data are the same>> (step S303)
In step S303, the matching system determines whether the first data and the second data are the same. Next, if the collation system determines that the first data and the second data are the same (YES in step S303), the collation system ends the process. That is, in this case, the collation system determines that there is no abnormality. On the other hand, when the collation system determines that the first data and the second data are not the same (NO in step S303), the collation system proceeds to step S304.

<<Example of Abnormality Detection in Operation System>> (Step S304)
In step S304, the verification system detects an abnormality in the virtual system. For example, step S303 and step S304 are the same processes as step S106 (see FIG. 3) of the first embodiment.

As described above, when the first data is redundantly generated, the abnormality detection system can detect the abnormality of the virtual system.

(Modification)
The collation is not limited to the process of determining only whether or not the data is the same as in the first and second embodiments. For example, in the collation, each data may be accumulated for a predetermined time, and it may be determined whether or not the tendency in time series of each data is the same. For example, if one data shows a value that increases with the passage of time, while the other data shows a value that decreases with the passage of time, the collation system is , May be detected as abnormal.

Further, the collation may be a process of comparing statistical data. For example, the collation system first accumulates each data for a predetermined time. Then, the matching system calculates the average value of each data. Next, the matching system determines whether or not the average values of the respective data match. In this way, statistical data such as average values are compared, and if the statistical data are different, the collation system may detect an abnormality.

When the statistical data or the tendency is used for the matching, the matching system uses, for example, the real-time processing to determine whether the first data and the second data are the same, while the statistical data or the tendency is used. The processing may be batch processing.

Further, in the collation, the same is not limited to the case where the values indicated by the respective data are completely the same. The error and the like may be different between the processing by the operation system and the processing by the simulation by the virtual system. Therefore, an allowable value or the like may be set for the same determination in order to ignore a difference due to an error or the like. The allowable value is set in advance.

Further, in the collation, specific data such as a serial number that can identify each data to be collated may be added to the first data and the second data. The specific data may be a so-called time stamp or the like. The processing speed may differ between the operation system and the virtual system. Therefore, even if input signals are input to the operation system and the virtual system at the same timing, the respective data indicating the processing result are not always output at the same timing. Therefore, the collation system may not know which data should be collated with which data. Therefore, if a serial number or the like is added to the input signal as described below, for example, the matching system can specify the combination of data to be matched.

FIG. 7 is a timing chart showing an example of serial numbers used in collation by the abnormality detection system according to the embodiment of the present invention. For example, as shown in the figure, when the input signal SIP is input, the virtual system generates the first data based on the input signal SIP and transmits the first data to the matching system, so that the virtual system generates the first data. A first data signal SD1 indicating data is transmitted. Further, since the operation system generates the second data based on the input signal SIP and transmits the second data to the collation system, the virtual system transmits the second data signal SD2 indicating the second data.

Specifically, in this example, the operation system performs processing based on the data of "IN1" indicated by the input signal SIP to generate the data of "OT21" that is the second data, and similarly, "IN1". The virtual system generates the data “OT11” that is the first data indicating the processing result equivalent to that of the operation system based on the data “”.

As shown in the drawing, even when the operation system and the virtual system perform equivalent processing, the timing of data transmission to the collation system may differ depending on the processing speed of each system or the network environment. In the illustrated example, if each system is in a “normal” state, the same “OT21” data is transmitted to the matching system and “OT11” data is transmitted to the matching system. This is an example of the case where the time TE is deviated. As described above, if there is a deviation in the time TE or the like, the collation system may not know which first data should be collated with the second data.

Therefore, as shown in the figure, a signal indicating the serial number SNM is added and transmitted at the same timing as each data. In this way, even if the time TE is deviated, the collation system can determine that the first data and the second data of the same serial number SNM should be collated. Specifically, when the first data having the serial number SNM of “1” and the second data are collated, “OT21” and “OT11” are collated by the collation system even if the time TE is deviated. Matched. In this way, the virtual system and the operation system may add specific data indicating the serial number SNM or the like and transmit each data to the matching system.

≪ 4. Functional configuration example of anomaly detection system ≫
FIG. 8 is a functional block diagram showing an example of the functional configuration of the abnormality detection system in the embodiment of the present invention. As illustrated, for example, in the abnormality detection system 10, the virtual system 2 includes an input unit FN1 and a data generation unit FN2. Moreover, in the abnormality detection system 10 of the illustrated example, the operation system 1 includes a processing unit FN3. Then, in the abnormality detection system 10 of the illustrated example, the collation system 3 includes an acquisition unit FN4, a detection unit FN5, and a notification unit FN6.

The input unit FN1 inputs the input signal SIP indicating the measurement result of the field device 1FM from the field device 1FM included in the operation system 1. The input unit FN1 is realized by, for example, an interface included in an electronic circuit or the like.

The data generation unit FN2 performs processing equivalent to the processing unit FN3 included in the operation system 1 based on the input signal SIP, and then generates the first data D1 indicating the processing result by the operation system 1. The data generation unit FN2 is realized by, for example, an arithmetic device included in an electronic circuit.

The processing unit FN3 performs various processes based on the input signal SIP to generate the second data D2. The processing unit FN3 is realized by, for example, the controller 1CR (see FIG. 1) or the like.

The acquisition unit FN4 acquires, from the virtual system 2, the first data D1 generated by the data generation unit FN2 and the second data D2 generated by the processing unit FN3 from the operation system. The acquisition unit FN4 is realized by, for example, the network I/FHW3 (see FIG. 2) or the input I/FHW4 (see FIG. 2).

The detection unit FN5 collates the first data D1 and the second data D2 acquired by the acquisition unit FN4 to detect an abnormality in the operation system 1 or a plant using the operation system 1. The detection unit FN5 is realized by, for example, the CPUHW1 (see FIG. 2) and the like.

When the detection unit FN5 detects an abnormality, the notification unit FN6 notifies the user UR or the like of the abnormality. The notification unit FN6 is realized by, for example, the network I/FHW3 (see FIG. 2) or the output I/FHW5 (see FIG. 2).

When the virtual system 2 is present, the abnormality detection system 10 can generate the first data D1 indicating the processing result equivalent to that of the operation system 1. Specifically, the virtual system 2 can input the same input signal SIP as that used by the operation system 1 from the field device 1FM by the input unit FN1.

Then, in the virtual system 2, the data generation unit FN2 can perform processing equivalent to that of the processing unit FN3. Therefore, when the operation system 1 is in the “normal” state, the virtual system 2 can generate the second data D2 generated by the processing unit FN3 and the first data D1 indicating the same processing result. Therefore, when the collation system 3 collates the first data D1 and the second data D2, the abnormality detection system 10 can detect the abnormality of the operation system 1 or a plant using the operation system 1.

Specifically, the collation system 3 first acquires the first data D1 and the second data D2 by the acquisition unit FN4. Next, the collation system 3 collates the first data D1 and the second data D2 with the detection unit FN5. For example, when the first data D1 and the second data D2 are different, the collation system 3 determines that the operation system 1 or the plant using the operation system 1 is an “abnormal” data that has been tampered with by a cyber attack. The state can be detected.

As a comparative example, measures against cyber attacks include, for example, setting up a firewall or introducing antivirus software. In this way, there is a method to prevent unauthorized access from the outside of each system, insertion of computer virus, generation of so-called backdoor for unauthorized intrusion, and deprivation of system administrator authority. is there. In particular, if a general-purpose OS or a general-purpose network is used, a security attack may be used to carry out a cyber attack. In this way, when a cyber attack is made, data is tampered with and installed programs are changed.

For example, even if the data has been tampered with, if the user monitors it, it may be possible for the user to detect an abnormal change in the value or the like and discover a cyber attack or the like. On the other hand, if the viewer software program used by the user is tampered with, the program indicating that the program has been tampered with will display different data. In some cases, it may be possible to find out that a cyber attack has been taken.

On the other hand, when each data is collated as in the present embodiment, the abnormality detection system 10 can detect an abnormality even if the viewer software program used for monitoring is tampered with.

It is desirable that the virtual system and the operation system are implemented by different devices. That is, it is desirable that the virtual system and the operation system are physically separate devices. If a virtual system and an operation system are realized by the same device, for example, if the device has a security vulnerability that is highly susceptible to cyber attacks, both systems may be tampered with. Becomes higher. On the other hand, if the virtual system and the operation system are physically different devices, they have different configurations, so that it is possible to reduce the possibility that both of them will be tampered immediately.

Note that all or part of each processing according to the embodiment of the present invention is realized by a program for causing a computer described in a low-level language, a high-level language, or a combination thereof to execute the abnormality detection method. Good. That is, the program is a computer program for causing a computer such as an information processing device to execute all or part of each processing.

Further, the program can be stored in a computer-readable recording medium and distributed. The recording medium may be a flash memory, a flexible disc, an optical disc such as a CD-ROM or a Blu-ray disc, an SD (registered trademark) card, an auxiliary storage device or an MO. Furthermore, the program can be distributed through a telecommunication line.

Furthermore, all or part of each processing according to an embodiment of the present invention is performed by an information processing system having one or more information processing devices, and all or part of processing is performed in parallel, distributed, redundant, or a combination thereof. May be done.

Further, each processing according to the embodiment of the present invention is not limited to the illustrated order. For example, part or all of each processing may be processed in a different order, parallel, distributed, or omitted.

Although the preferred embodiments of the present invention have been described above in detail, the present invention is not limited to the above-described embodiments, and various modifications or changes can be made within the scope of the gist of the present invention described in the claims. It is possible.

10 Abnormality detection system 1 Operation system 2 Virtual system 3 Collation system FN1 Input unit FN2 Data generation unit FN3 Processing unit FN4 Acquisition unit FN5 Detection unit FN6 Notification unit D1 First data D2 Second data SIP input signal 1FM Field device

Claims (10)

An operation detection system including at least a field device for measuring a physical quantity or a device state, a virtual system connected to the field device, and an abnormality detection system including a collation system connected to the operation system and the virtual system,
From the field device, an input unit for inputting an input signal indicating a measurement result by the field device,
A virtual system having a data generation unit that generates first data indicating a processing result equivalent to that of the operation system based on the input signal;
An acquisition unit for acquiring the first data from the virtual system and the second data indicating the processing result of the processing based on the input signal from the operation system;
An abnormality detection system comprising: a collation system having a detection unit configured to collate the first data and the second data to detect an abnormality of the operation system or a plant using the operation system. The abnormality detection system according to claim 1, wherein the data generation unit generates a plurality of the first data. The abnormality detection system according to claim 2, wherein the detection unit compares a plurality of pieces of the first data to detect an abnormality in the virtual system. The detection unit detects an abnormality in at least the operation system or a plant using the operation system by collating at least the first data and the second data based on whether or not the first data is the same. The abnormality detection system according to any one of 3 above. 5. The detection unit further detects the abnormality of the operation system or a plant using the operation system by further collating based on each tendency of the first data and the second data, statistical data, or a combination thereof. Anomaly detection system described in. The abnormality detection system according to claim 1, further comprising a notification unit that notifies the abnormality when the detection unit detects the abnormality. 7. The virtual system and the operation system attach specific data capable of specifying data to be collated in collation to the first data and the second data, and transmit the first data and the second data. Abnormality detection system described. The abnormality detection system according to any one of claims 1 to 7, which is realized by a device different from the virtual system and the operation system. Anomaly detection performed by an anomaly detection system including an operation system having at least a field device for measuring a physical quantity or a device state, a virtual system connected to the field device, and a collation system connected to the operation system and the virtual system Method,
An input procedure in which the virtual system inputs an input signal indicating a measurement result by the field device from the field device;
A data generation procedure in which the virtual system generates first data indicating a processing result equivalent to that of the operation system, based on the input signal;
An acquisition procedure in which the verification system acquires the first data from the virtual system and second data indicating a processing result of processing based on the input signal from the operation system;
An abnormality detection method, wherein the collation system collates the first data and the second data to detect an abnormality of the operation system or a plant using the operation system. The abnormality detection method according to claim 9, wherein in the detection procedure, a plurality of pieces of the first data are collated to detect an abnormality of the virtual system.

Images