JP7571406B2 - Control system and control method - Google Patents

Description

The present invention relates to a security function in a control system including a control device.

In recent years, factories and other manufacturing sites have been hit by malware and other attacks, making it necessary to implement security measures for control devices such as programmable logic controllers (PLCs). According to the concept of defense in depth, security measures must be implemented not only for interfaces connecting the inside and outside of the factory and the network within the factory, but also for the control devices themselves that make up the production equipment.

WO 2018/181253 (Patent Document 1) discloses a configuration for detecting anomalies in an existing manufacturing system without making significant modifications to the system.

International Publication No. 2018/181253

The configuration disclosed in Patent Document 1 adds a data analysis device to an existing manufacturing system, and does not implement security measures in the control device itself. In addition, the configuration disclosed in Patent Document 1 determines whether there is an abnormality in the manufacturing system, and does not disclose a method for identifying the type of security attack in the event of such an attack.

One of the objectives of the present invention is to provide a configuration that implements security measures for the control device itself and is also capable of identifying the type of security attack in the event of a security attack.

A control device according to an aspect of the present invention includes a process execution unit that executes an input process for acquiring information input from the outside, a control calculation that is executed with reference to the information acquired by the input process, and an output process for outputting information calculated by the control calculation to the outside, and an anomaly detection unit that detects an anomaly that has occurred among a plurality of detection target anomalies. Each of the detection target anomalies is associated with one of the input process, the control calculation, and the output process. The control device includes a database that includes at least one attack pattern that specifies one or more anomalies associated with a specific type of security attack, and an attack identification unit that, when one or more anomalies specified by any of the attack patterns included in the database match one or more anomalies detected by the anomaly detection unit, identifies that the control device is under a security attack of the type associated with the attack pattern.

According to this configuration, by detecting an abnormality that occurs in any of the input processing, control calculation, and output processing, and determining whether or not one or more detected abnormalities match one or more abnormalities defined by a pre-prepared attack pattern, it is possible to identify that a security attack of a type associated with the attack pattern is occurring. This makes it possible to detect that a security attack is occurring, and also to identify the type of security attack occurring.

The processing execution unit may operate according to a corresponding security measure depending on the type of security attack identified by the attack identification unit. With this configuration, appropriate security measures can be implemented depending on the type of security attack identified.

The operation according to the corresponding security measure may include changing the execution content of the control calculation. With this configuration, appropriate security measures can be realized by changing the execution content of the control calculation.

The operation according to the corresponding security measure may include restricting the output by the output process. With this configuration, appropriate security measures can be implemented by restricting the output by the output process.

The attack identification unit may compare one or more anomalies detected within a predetermined time period with one or more anomalies defined by an attack pattern. This configuration makes it possible to detect with higher accuracy whether or not a security attack is occurring.

The control device may further include a notification unit that notifies devices other than the control device of information on the type of security attack identified by the attack identification unit. With this configuration, it is possible to grasp the occurrence status of security attacks in the entire system, and to implement more appropriate security measures.

The control device may further include an attack estimation unit that estimates whether or not a security attack of a type associated with an attack pattern is occurring based on the degree of match between one or more anomalies defined by one of the attack patterns included in the database and one or more anomalies detected by the anomaly detection unit. With this configuration, even if there is no match at all with one or more anomalies defined by the attack pattern, if a certain degree of similarity is recognized, it is possible to determine that a security attack is occurring and to estimate the type of security attack occurring.

The attack estimation unit may compare one or more anomalies detected within a predetermined time period with one or more anomalies defined by an attack pattern. This configuration makes it possible to detect with higher accuracy whether or not a security attack is occurring.

The control device may further include a notification unit that notifies devices other than the control device of information on the type of security attack estimated by the attack estimation unit. With this configuration, it is possible to grasp the occurrence status of security attacks in the entire system, and more appropriate security measures can be implemented.

At least one of the attack pattern and the abnormality to be detected may be determined according to the settings from the support device. With this configuration, the user can freely configure various settings, including the attack pattern and the abnormality to be detected, on the support device.

A control method according to another aspect of the present invention includes the steps of executing an input process for acquiring information input from the outside, a control calculation for executing a control process with reference to the information acquired by the input process, and an output process for outputting information calculated by the control calculation to the outside, and a step of detecting an abnormality that has occurred among a plurality of detection target abnormalities. Each of the detection target abnormalities is associated with any of the input process, the control calculation, and the output process. The control method includes the steps of referring to a database including at least one attack pattern that specifies one or more abnormalities associated with a specific type of security attack, and determining whether the one or more detected abnormalities match one or more abnormalities specified by any of the attack patterns included in the database, and identifying that the type of security attack associated with the attack pattern is occurring.

A control program according to yet another aspect of the present invention causes a computer to execute the steps of: an input process for acquiring information input from the outside; a control calculation for executing a control process by referring to the information acquired by the input process; and an output process for outputting information calculated by the control calculation to the outside; and a step of detecting an abnormality that has occurred among a plurality of detection target abnormalities. Each of the detection target abnormalities is associated with one of the input process, the control calculation, and the output process. The control program causes the computer to execute the steps of referring to a database including at least one attack pattern that specifies one or more abnormalities associated with a specific type of security attack, and determining whether the one or more detected abnormalities match one or more abnormalities specified by any of the attack patterns included in the database, and identifying that the computer is under a security attack of the type associated with the attack pattern.

The present invention makes it possible to implement security measures for the control device itself, and to identify the type of security attack if one occurs.

FIG. 1 is a schematic diagram showing an application example of a control system according to an embodiment of the present invention. FIG. 1 is a schematic diagram showing a configuration example of a control system according to an embodiment of the present invention. 2 is a schematic diagram illustrating an example of a hardware configuration of a control device that constitutes the control system according to the present embodiment. FIG. 5 is a diagram showing an example of the contents of an abnormality detected by an abnormality detection unit of the control device according to the present embodiment. FIG. 4 is a schematic diagram showing a more detailed functional configuration example of an abnormality detection unit of the control device according to the present embodiment. FIG. 13 is a schematic diagram showing a more detailed example of the functional configuration of an attack identification unit of the control device according to the present embodiment. FIG. 4 is a diagram for explaining an example of an attack pattern database of the control device according to the present embodiment; FIG. 4 is a flowchart showing a processing procedure in the control system according to the present embodiment. FIG. 13 is a schematic diagram showing an example of how an attack identification result is used in the control system according to the present embodiment. FIG. 4 is a diagram showing an example of a security countermeasure table in the control system according to the present embodiment. 1 is a schematic diagram showing an example of a network relay device including an attack monitoring unit according to an embodiment of the present invention; FIG. 4 is a diagram showing an example of a security countermeasure table in the control system according to the present embodiment. 13 is a schematic diagram showing a more detailed example of the functional configuration of an attack estimation unit of the control device according to the present embodiment. FIG. 1 is a schematic diagram showing an example of a functional configuration for improving the identification accuracy/estimation accuracy in a control device according to the present embodiment; 1 is a schematic diagram showing a configuration example focusing on notification of an attack identification result in a control system according to an embodiment of the present invention. FIG. FIG. 2 is a schematic diagram showing a configuration example focusing on a support device in the control system according to the present embodiment. A figure showing an example of abnormality detection setting 173 set by a support device in the control system of this embodiment.

The embodiment of the present invention will be described in detail with reference to the drawings. Note that the same or equivalent parts in the drawings will be given the same reference numerals and their description will not be repeated.

<A. Application Examples>
An example of a situation in which the present invention is applied will be described.

Figure 1 is a schematic diagram showing an application example of a control system 1 according to the present embodiment. Figure 1 shows an example of the functional configuration of a control device 100 that constitutes the control system 1 according to the present embodiment.

Referring to FIG. 1, the control device 100 includes a process execution unit 130 as a functional configuration for controlling a control target. The process execution unit 130 includes an input unit 140, a control unit 150, and an output unit 160, and repeatedly executes the processes provided by each unit.

The input unit 140 executes an input process to acquire information input from outside. More specifically, the input unit 140 acquires and processes information input from outside sources such as the field device 300, the display operation terminal 400, the management server 500, and the gateway 600.

The control unit 150 refers to the information acquired by the input unit 140 and executes a control calculation defined by a user program or the like. The control unit 150 uses the control calculation to calculate or generate information to be output to the outside.

The output unit 160 executes an output process to output information calculated by the control calculation to the outside. More specifically, the output unit 160 outputs information calculated or generated by the control unit 150 to the outside, such as the field device 300, the display operation terminal 400, the management server 500, and the gateway 600.

In this way, the processing execution unit 130 executes an input process to acquire information input from the outside, a control calculation to be executed by referring to the information acquired by the input process, and an output process to output information calculated by the control calculation to the outside.

The control device 100 includes a functional configuration (input unit 140, control unit 150, output unit 160) for controlling the control target, as well as an attack monitoring unit 170 for providing security functions. The attack monitoring unit 170 detects anomalies caused by security attacks on the control device 100, and identifies the type of security attack that caused the detected anomaly. In the following description, a security attack may simply be referred to as an "attack."

More specifically, the attack monitoring unit 170 includes an anomaly detection unit 172 and an attack identification unit 176.

The abnormality detection unit 172 detects an abnormality that has occurred among multiple detection target abnormalities. More specifically, the abnormality detection unit 172 determines whether or not an abnormality has occurred in the control device 100 based on information obtained from at least one of the input unit 140, the control unit 150, and the output unit 160. Here, each of the detection target abnormalities is associated with either the input process executed by the input unit 140, the control calculation executed by the control unit 150, or the output process executed by the output unit 160.

When the anomaly detection unit 172 detects an anomaly, it records the anomaly data 174 as information indicating the content of the detected anomaly.

The attack identification unit 176 refers to the attack pattern database 178 and determines whether or not an attack is occurring based on the anomaly data 174 recorded by the anomaly detection unit 172, and identifies the type of attack that is occurring.

The attack pattern database 178 includes at least one attack pattern that defines one or more anomalies associated with a particular type of security attack.

When the attack identification unit 176 determines that an attack is occurring, it outputs an attack identification result 180 including information on the type of attack that has been identified. More specifically, when one or more anomalies defined by any of the attack patterns included in the attack pattern database 178 match one or more anomalies detected by the anomaly detection unit 172, the attack identification unit 176 determines that a security attack of the type associated with that attack pattern is occurring.

The attack identification results 180 may be used by the control device 100 to vary its behavior depending on the identified attack, or may be analyzed after the fact to determine necessary security measures.

As shown in FIG. 1, the control device 100 according to this embodiment can detect attacks on the control device 100 and identify the type of attack detected by combining and referring to information in the input unit 140, the control unit 150, and the output unit 160.

<B. Hardware Configuration Example>
First, an example of a hardware configuration of a control system 1 according to the present embodiment will be described.

(b1: System configuration example)
2 is a schematic diagram showing a configuration example of a control system 1 according to the present embodiment. Referring to FIG. 2, the control system 1 includes a control device 100, a support device 200, a display operation terminal 400, a management server 500, and a gateway 600.

In the configuration example shown in FIG. 2, the control device 100 is connected to a network. More specifically, the control device 100 is connected to a display operation terminal 400 and a management server 500 via a higher-level network 10. The higher-level network 10 is connected to the Internet via a gateway 600. In addition, the control device 100 is connected to one or more field devices 300 via one or more field networks 20.

(b2: control device 100)
Fig. 3 is a schematic diagram showing an example of a hardware configuration of a control device 100 constituting the control system 1 according to the present embodiment. Referring to Fig. 3, the control device 100 is an example of a computer, and includes, as main components, a processor 102 such as a CPU (Central Processing Unit) or a GPU (Graphical Processing Unit), a chipset 104, a main memory device 106, a secondary memory device 108, a USB (Universal Serial Bus) controller 112, a memory card interface 114, network controllers 116 and 118, and an internal bus controller 122.

The processor 102 reads various programs stored in the secondary storage device 108, expands them in the main storage device 106, and executes them to realize various processes described below in addition to the control functions originally provided by the control device 100. The chipset 104 mediates the exchange of data between the processor 102 and each component.

The secondary storage device 108 stores various programs such as user programs in addition to a system program 110, which corresponds to a control program.

The USB controller 112 is responsible for exchanging data with the support device 200 via the USB connection.

The memory card interface 114 allows the memory card 115 to be attached and detached, and makes it possible to write data such as the system program 110 and various settings to the memory card 115, or to read data such as the system program 110 and various settings from the memory card 115.

Each of the network controllers 116 and 118 is responsible for exchanging data with any device via the network. For example, the network controller 116 is responsible for communication via the upper network 10, and the network controller 118 is responsible for communication via the field network 20. The network controllers 116 and 118 may employ industrial network protocols such as EtherCAT (registered trademark), EtherNet/IP (registered trademark), DeviceNet (registered trademark), and CompoNet (registered trademark).

The internal bus controller 122 is responsible for exchanging data with one or more functional units (local devices) (not shown). The internal bus may use a manufacturer-specific communication protocol, or a communication protocol that is the same as or conforms to any industrial network protocol.

Although FIG. 3 shows an example of a configuration in which the processor 102 executes a program to provide the necessary functions, some or all of these provided functions may be implemented using a dedicated hardware circuit (e.g., an ASIC (Application Specific Integrated Circuit) or an FPGA (Field-Programmable Gate Array)). Alternatively, the main part of the control device 100 may be realized using hardware that follows a general-purpose architecture (e.g., an industrial PC based on a general-purpose PC). In this case, virtualization technology may be used to run multiple OSs (operating systems) with different uses in parallel, and necessary applications may be executed on each OS.

(b3: support device 200)
The support device 200 provides functions necessary for the development and maintenance of user programs executed by the control device 100. The support device 200 further provides functions for supporting the setting of security functions implemented in the control device 100, as will be described later.

As an example, the support device 200 is realized using hardware that conforms to a general-purpose architecture (e.g., a general-purpose personal computer).

(b4: field device 300)
The field device 300 has the function of acquiring information from the controlled object (field) and providing it to the control device 100, and/or the function of providing a command value (output value) calculated by a control calculation executed by the control device 100 to the controlled object.

The field device 300 may include, for example, a remote I/O terminal, a servo driver/motor, a robot, etc. Furthermore, the field device 300 may include any device such as a sensor, a temperature adjustment unit, a pulse counter unit, a motion controller unit, etc.

Remote I/O terminals may include, for example, digital input (DI) units, digital output (DO) units, analog output (AI) units, analog output (AO) units, pulse-catch input units, and composite units that combine multiple types.

(b5: display operation terminal 400)
The display operation terminal 400 presents to the user various information calculated by the control calculations executed by the control device 100, and outputs corresponding commands to the control device 100 in response to user operations.

(b6: management server 500)
The management server 500 holds information necessary for production management and the like, and provides the necessary information to the control device 100 at predetermined intervals or for each event. The management server 500 also stores any information transmitted from the control device 100, and responds with requested information in response to a search query or the like.

(b7: Gateway 600)
The gateway 600 implements security measures for communications between the upper network 10 and the Internet. The gateway 600 may have a known configuration.

<C. Functional configuration example>
Next, an example of a functional configuration of the control system 1 according to the present embodiment will be described.

(c1: Abnormality detection unit)
4 is a diagram showing an example of the contents of an abnormality detected by abnormality detection unit 172 of control device 100 according to this embodiment. Referring to FIG. 4, abnormality detection unit 172 can detect an input abnormality that may occur in input unit 140, a control abnormality that may occur in control unit 150, and an output abnormality that may occur in output unit 160.

The input abnormality may include, for example, a communication abnormality such as a protocol abnormality, a file abnormality such as a file abnormality, and an I/O abnormality such as an abnormality related to an input/output signal.

The control abnormality may include, for example, a system control abnormality consisting of an abnormality related to the control calculation executed by the control unit 150, and a hardware resource abnormality consisting of an abnormality related to the hardware resources used in the control calculation executed by the control unit 150.

Output abnormalities may include communication abnormalities, such as abnormalities related to data transmission, and I/O abnormalities, such as abnormalities related to input/output signals.

When the control device 100 cannot properly control the controlled object, it is considered that one of the abnormalities shown in FIG. 4 has occurred in the input unit 140, the control unit 150, or the output unit 160.

Note that the abnormality shown in FIG. 4 is an example, and any classification or type of abnormality may occur in the input unit 140, the control unit 150, and the output unit 160.

Figure 5 is a schematic diagram showing a more detailed functional configuration example of the abnormality detection unit 172 of the control device 100 according to this embodiment. With reference to Figure 5, the abnormality detection unit 172 includes an abnormality recording unit 1730 for recording the generated abnormality data 174.

The abnormality recording unit 1730 includes an input abnormality detection unit 1720 as a functional configuration for detecting input abnormalities, a control abnormality detection unit 1724 as a functional configuration for detecting control abnormalities, and an output abnormality detection unit 1727 as a functional configuration for detecting output abnormalities. The abnormality recording unit 1730 receives detection signals from the input abnormality detection unit 1720, the control abnormality detection unit 1724, and the output abnormality detection unit 1727.

The input abnormality detection unit 1720 receives detection signals from a communication abnormality detection unit 1721 that detects communication abnormalities, a file abnormality detection unit 1722 that detects file abnormalities, and an I/O abnormality detection unit 1723 that detects I/O abnormalities.

The control abnormality detection unit 1724 receives detection signals from a system control abnormality detection unit 1725 that detects system control abnormalities and a hardware resource abnormality detection unit 1726 that detects hardware resource abnormalities.

The output abnormality detection unit 1727 receives detection signals from a communication abnormality detection unit 1728 that detects communication abnormalities and an I/O abnormality detection unit 1729 that detects I/O abnormalities.

In the abnormality detection unit 172 of the control device 100, when the communication abnormality detection unit 1721, the file abnormality detection unit 1722, the I/O abnormality detection unit 1723, the system control abnormality detection unit 1725, the hardware resource abnormality detection unit 1726, the communication abnormality detection unit 1728, and the I/O abnormality detection unit 1729 detect the occurrence of an abnormality for which they are responsible, they output a detection signal to identify the detected abnormality. The detection signals output from each detection unit are aggregated and finally recorded as occurred abnormality data 174.

In the example shown in FIG. 5, the communication anomaly detection unit 1721, the system control anomaly detection unit 1725, and the I/O anomaly detection unit 1729 each detect an anomaly. For ease of explanation, the anomalies detected by each are described as "anomaly A," "anomaly D," and "anomaly Z."

The generated anomaly data 174 may be configured in a table format that associates the occurrence or nonoccurrence of each type of anomaly (anomaly item) detected by each detection unit. In the example shown in FIG. 5, the generated anomaly data 174 records "○" in the occurrence items corresponding to "Abnormality A," "Abnormality D," and "Abnormality Z," and records "-" in the other items.

The occurring anomaly data 174 may be configured in a list format that stores only the contents of the detected anomaly (anomaly item). In the example shown in FIG. 5, a list including three entries, "Abnormality A," "Abnormality D," and "Abnormality Z," may be output as the occurring anomaly data 174.

The abnormality data 174 may be generated or updated at a predetermined interval (e.g., at each control cycle), or may be generated or updated only when any of the detection units detects the occurrence of an abnormality.

(c2: Attack Identification Unit)
6 is a schematic diagram showing a more detailed functional configuration example of the attack identification unit 176 of the control device 100 according to the present embodiment. With reference to Fig. 6, the attack identification unit 176 refers to an attack pattern database 178, and determines whether or not an attack is occurring based on the occurred anomaly data 174 recorded by the anomaly detection unit 172, and identifies the type of attack occurring.

More specifically, the attack identification unit 176 includes an attack pattern acquisition unit 1760 and a comparison unit 1762.

The attack pattern acquisition unit 1760 retrieves the attack patterns registered in the attack pattern database 178 one by one and supplies them to the comparison unit 1762. The attack pattern database 178 defines the type of attack (attack pattern) received by a combination of one or more anomaly contents (anomaly items). In other words, the detected attack (attack pattern) is defined in association with one or more combinations of anomalies detected by any of the input unit 140, the control unit 150, and the output unit 160.

The comparison unit 1762 compares the attack pattern provided by the attack pattern acquisition unit 1760 with the occurring anomaly data 174 to determine whether the occurring anomaly data 174 matches any of the attack patterns. If the occurring anomaly data 174 matches any of the attack patterns, the comparison unit 1762 determines that the system is under attack of the type indicated by the matching attack pattern.

For example, in the example shown in FIG. 6, the abnormality data 174 matches "attack pattern 3," so it can be determined that the type of attack indicated by "attack pattern 3" has occurred.

Figure 7 is a diagram for explaining an example of the attack pattern database 178 of the control device 100 according to this embodiment. With reference to Figure 7, the attack pattern database 178 specifies combinations of anomalies corresponding to attacks such as spoofing attacks, DoS attacks, and DDoS attacks.

More specifically, a spoofing attack occurs when the receipt of an unauthorized command (a communication anomaly caused by an input abnormality) and a timing anomaly in a specific process (a system control anomaly caused by a control abnormality) are detected simultaneously.

A DoS attack occurs when excessive traffic (communication abnormality due to input abnormality) and excessive CPU load (hardware resource abnormality due to control abnormality) are detected simultaneously.

A DDoS attack occurs when a source anomaly (communication anomaly due to input anomaly), excessive traffic (communication anomaly due to input anomaly), and excessive CPU load (hardware resource anomaly due to control anomaly) are detected simultaneously.

Note that the combinations of anomalies for each attack pattern shown in FIG. 7 are just examples, and any attack pattern not shown may be defined, and any combination of anomalies may be associated with each attack pattern. Also, for the attack patterns shown in FIG. 7, other combinations of anomalies may be used.

D. Processing Procedure
Next, a process procedure in the control system 1 according to the present embodiment will be described.

Figure 8 is a flowchart showing the processing procedure in the control system 1 according to this embodiment. Typically, each step shown in Figure 8 may be realized by the processor 102 of the control device 100 reading the system program 110 stored in the secondary storage device 108, extracting it into the main storage device 106, and executing it.

Referring to FIG. 8, the control device 100 determines whether a control period has arrived (step S2). If a control period has arrived (YES in step S2), the control device 100 executes input processing including obtaining information about the control target via a local device and/or a field device (step S4). Next, the control device 100 executes a control calculation using the obtained information about the control device (step S6). Furthermore, the control device 100 executes output processing including outputting the calculation results output by the execution of the control calculation to the control target via a local device and/or a field device (step S8).

As shown in steps S2 to S8, the control device 100 executes an input process to acquire information input from the outside, a control calculation that is executed by referring to the information acquired by the input process, and an output process that outputs information calculated by the control calculation to the outside.

Next, the control device 100 determines whether the abnormality detection period has arrived (step S10). If the abnormality detection period has not arrived (NO in step S10), the process from step S2 onward is repeated.

If the abnormality detection period has arrived (YES in step S10), the control device 100 determines whether an abnormality has occurred in any of the input processing (input unit 140), control calculation (control unit 150), and output processing (output unit 160) (step S12).

If an abnormality occurs in any of the input processing (input unit 140), the control calculation (control unit 150), and the output processing (output unit 160) (YES in step S12), the control device 100 detects the abnormality that has occurred (step S14) and records it as the abnormality data 174 (step S16). That is, the control device 100 executes a process to detect the abnormality that has occurred among the multiple abnormalities to be detected.

If no abnormality occurs in any of the input process (input unit 140), control calculation (control unit 150), and output process (output unit 160) (NO in step S12), the processes from step S2 onwards are repeated.

The control device 100 refers to the attack pattern database 178 to acquire one attack pattern (step S18), and determines whether the acquired attack pattern matches the recorded occurring anomaly data 174 (step S20). That is, the control device 100 refers to the attack pattern database 178, which includes at least one attack pattern that specifies one or more anomalies associated with a specific type of security attack, and determines whether the detected one or more anomalies match one or more anomalies specified by any of the attack patterns included in the attack pattern database 178.

If the acquired attack pattern matches the recorded anomaly data 174 (YES in step S20), the control device 100 outputs an attack identification result 180 including information on the type of attack indicated by the acquired attack pattern (step S22). In other words, the control device 100 identifies that the device is under a security attack of the type associated with the matching attack pattern. Then, the processing from step S2 onwards is repeated.

If the acquired attack pattern does not match the recorded occurrence anomaly data 174 (NO in step S20), the control device 100 judges whether acquisition of all attack patterns contained in the attack pattern database 178 has been completed (step S24). If acquisition of all attack patterns contained in the attack pattern database 178 has not been completed (NO in step S24), the processing from step S18 onwards is repeated.

If acquisition of all attack patterns contained in the attack pattern database 178 has been completed (YES in step S24), the control device 100 determines that it is not under attack (step S26) and repeats the processing from step S2 onwards.

Note that while FIG. 8 shows a processing example in which the control period and the abnormality detection period are set independently, they may be set to a common period. For example, the control period may be set in the range of about 1 msec to several hundred msec, and the abnormality detection period may be set in the range of about several msec to several seconds.

<E. Examples of use of attack identification results>
Next, a usage example of the output attack identification result 180 will be described.

Fig. 9 is a schematic diagram showing an example of the use of the attack identification result 180 in the control system 1 according to this embodiment. Referring to Fig. 9, when the attack monitoring unit 170 of the control device 100 detects an attack, it notifies the control unit 150 that it is under attack or has been attacked. In addition, the attack monitoring unit 170 of the control device 100 may notify the control unit 150 of the type of attack that has been identified.

The control unit 150 may change the behavior of the control calculation in response to a notification from the attack monitoring unit 170. More specifically, the control unit 150 may implement security measures in response to the contents of the attack identification result 180. When the control unit 150 implements security measures, the control unit 150 may be configured to be able to refer to the security measures table 152.

Fig. 10 is a diagram showing an example of the security countermeasures table 152 in the control system 1 according to the present embodiment. Referring to Fig. 10, the security countermeasures table 152 specifies the correspondence between the attack patterns detected by the attack monitoring unit 170 and the security countermeasures implemented for each attack pattern.

The processing execution unit 130 operates according to the corresponding security countermeasure according to the type of security attack identified by the attack identification unit 176. More specifically, when the control unit 150 of the processing execution unit 130 receives a notification of the attack identification result 180 from the attack monitoring unit 170, it refers to the security countermeasure table 152 and determines the security countermeasure corresponding to the attack pattern included in the notification. Then, the control unit 150 operates according to the determined security countermeasure. At this time, the operation according to the security countermeasure includes changing the execution content of the control calculation.

For ease of explanation, FIG. 10 describes the security measures in natural language, but considering the implementation of the control device 100, information specifying which function blocks from among pre-prepared function blocks are used for the corresponding security measures may be included. Alternatively, partial programs or instruction codes for implementing the security measures to be implemented may be included.

Note that the security measures for each attack pattern shown in FIG. 10 are just examples, and any attack pattern not shown may be defined, and any security measures may be associated with each attack pattern.

<F. Network relay device>
In the above description, the attack monitoring unit 170 is implemented in the control device 100 for controlling a control target. However, the attack monitoring unit 170 may be implemented in a device other than the control device 100.

Fig. 11 is a schematic diagram showing an example of a network relay device 100A including an attack monitoring unit 170 according to this embodiment. Referring to Fig. 11, for example, the network relay device 100A is disposed between a management server 500 and a control device 100. All data transmitted and received between the control device 100 via the upper network 10 passes through the network relay device 100A.

The network relay device 100A is equipped with an attack monitoring unit 170. By adopting such a configuration, the network relay device 100A can detect anomalies caused by security attacks on the control device 100 based on data received by the control device 100 and data transmitted by the control device 100, and can identify the type of security attack that caused the detected anomaly. The network relay device 100A then reduces or eliminates the threat by, for example, blocking the attack on the control device 100.

In the network relay device 100A, the process execution unit 130 also operates in accordance with the corresponding security measures depending on the type of security attack identified by the attack identification unit 176.

In the configuration example shown in FIG. 11, the attack identification result 180 including information on the type of attack identified is notified to the output unit 160 of the network relay device 100A. The output unit 160 may change the behavior of the output process of the network relay device 100A depending on the notification from the attack monitoring unit 170. More specifically, the output unit 160 may implement security measures depending on the contents of the attack identification result 180. When the output unit 160 implements security measures, the output unit 160 may be configured to be able to refer to a security measures table 162.

Fig. 12 is a diagram showing an example of a security countermeasure table 162 in the control system 1 according to the present embodiment. Referring to Fig. 12, the security countermeasure table 162 specifies the correspondence between the attack patterns detected by the attack monitoring unit 170 and the security countermeasures implemented for each attack pattern.

The security countermeasures table 162 specifies the behavior of the output unit 160 of the network relay device 100A for blocking attacks. In accordance with the specifications of the security countermeasures table 162, the output unit 160 of the network relay device 100A adjusts whether or not to block and the extent of the blockage. In this way, the operation according to the security countermeasures includes restricting the output by the output process.

For ease of explanation, FIG. 12 describes the security measures in natural language, but considering the implementation of the network relay device 100A, information specifying which of the pre-prepared function blocks is to be used for the corresponding security measure may also be included. Alternatively, partial programs or instruction codes for implementing the security measures to be implemented may also be included.

Note that the security measures for each attack pattern shown in FIG. 12 are just examples, and any attack pattern not shown may be defined, and any security measures may be associated with each attack pattern.

<G. Attack Estimation Function>
In the above description, a configuration is exemplified in which the condition for determining that an attack has occurred is the match between the occurring anomaly data 174 and any of the attack patterns, but a function (attack estimation unit 190) that can estimate the presence or absence of an attack even if there is no perfect match may be implemented. In other words, even if the occurring anomaly data 174 does not match any of the attack patterns, if a certain degree of similarity is recognized, it may be estimated that there is a high possibility that an attack has occurred.

Fig. 13 is a schematic diagram showing a more detailed functional configuration example of the attack estimation unit 190 of the control device 100 according to this embodiment. Referring to Fig. 13, the attack estimation unit 190, like the attack identification unit 176 described above, refers to the attack pattern database 178 and determines whether or not an attack is occurring based on the occurring anomaly data 174 recorded by the anomaly detection unit 172. When the attack estimation unit 190 determines that an attack is occurring, it may identify the type of attack that is occurring.

In other words, the attack estimation unit 190 estimates whether or not a security attack of the type associated with an attack pattern has occurred based on the degree of match between one or more anomalies defined by any of the attack patterns included in the attack pattern database 178 and one or more anomalies detected by the anomaly detection unit 172.

More specifically, the attack estimation unit 190 includes a coincidence calculation unit 192 and a coincidence evaluation unit 194. The coincidence calculation unit 192 calculates the degree of coincidence, which indicates the degree of coincidence with the occurring anomaly data 174, for each attack pattern registered in the attack pattern database 178. The coincidence calculation unit 192 outputs an attack pattern coincidence 196 which indicates the degree of coincidence calculated for each attack pattern.

The matching degree calculation unit 192 may, for example, normalize the degree of matching between the occurring anomaly data 174 and the attack pattern to a value between 0 and 1 and then calculate the degree of matching.

The matching evaluation unit 194 evaluates the matching degree 196 for each attack pattern calculated by the matching calculation unit 192 to determine whether or not an attack is occurring.

As an example of an evaluation method, if any of the degrees of match included in the attack pattern match 196 is equal to or greater than a predetermined similarity determination threshold 198, it may be determined that the user is under attack of the type indicated by the attack pattern corresponding to the degree of match equal to or greater than the similarity determination threshold 198. In the example shown in FIG. 13, the similarity determination threshold 198 is set to "0.5", and "attack pattern 1", which indicates "0.7", which is equal to or greater than the similarity determination threshold 198, is selected as the valid one. In other words, it can be estimated that the user is under attack of the type indicated by "attack pattern 1".

As another example of the evaluation method, the attack pattern showing the highest degree of similarity among the degrees of similarity included in the attack pattern matching degree 196 may be selected, and it may be determined that the user is under attack of the type indicated by the selected attack pattern. In the example shown in FIG. 13, "attack pattern 1" showing the highest degree of similarity of "0.7" is selected. In other words, it can be estimated that the user is under attack of the type indicated by "attack pattern 1".

The judgment condition is not limited to the similarity judgment threshold 198 or the maximum similarity as described above, and any condition can be used. Judgment conditions such as the first and second similarity values being apart by a predetermined threshold or more, or all similarity values other than the first being less than a predetermined threshold, may be used.

By adopting the attack estimation function described above, even if the occurring anomaly data 174 does not completely match the attack pattern, if there is a high probability that an attack is occurring, it can be determined that an attack is occurring.

This type of attack estimation function is also useful, for example, for detecting variants or variations of known security attacks.

<H. Improving identification accuracy/estimation accuracy>
The one or more anomalies (occurring anomaly data 174) referred to in the identification process and/or estimation process by the attack identification unit 176 and/or the attack estimation unit 190 are limited to those detected within a predetermined time period. By doing so, it is possible to improve the identification accuracy and/or estimation accuracy.

Fig. 14 is a schematic diagram showing an example of a functional configuration for improving the identification accuracy/estimation accuracy in the control device 100 according to this embodiment. With reference to Fig. 14, the attack monitoring unit 170 includes a timer 182 in addition to an anomaly detection unit 172, an attack identification unit 176, and an attack estimation unit 190. Note that the attack estimation unit 190 does not necessarily have to be implemented.

The timer 182 starts counting when the anomaly detection unit 172 detects an anomaly. When a predetermined time has elapsed since the start of the counting, the timer 182 notifies the attack identification unit 176 and the attack estimation unit 190 of the passage of that time.

When the attack identification unit 176 receives a notification from the timer 182, it references the anomaly data 174 recorded at that time to determine whether or not an attack is occurring and to identify the type of attack that is occurring.

Similarly, when the attack estimation unit 190 receives a notification from the timer 182, it references the anomaly data 174 recorded at that timing to estimate whether or not an attack is occurring and estimates the type of attack that is occurring.

The logical sum of anomalies detected from the start of timer 182 counting until a predetermined time has elapsed may be recorded as occurred anomaly data 174. In other words, anomalies that occur at any timing within the time until a notification is issued from timer 182 may be aggregated as one occurred anomaly data 174. In this case, attack identification unit 176 and/or attack estimation unit 190 will compare one or more anomalies detected within the predetermined time with one or more anomalies defined by the attack pattern.

The predetermined time detected by the timer 182 may be determined according to the control period of the control device 100, the hardware specifications of the control device 100, the transmission speed of the network, the characteristics of the attack to be detected, etc.

As described above, by limiting the time to detect anomalies used to identify and/or estimate an attack, it is possible to eliminate anomaly information that becomes noise, thereby improving the accuracy of identifying and/or estimating an attack.

In addition, as described above, by using all the anomalies detected over a predetermined period of time after any anomaly is detected to identify and/or estimate an attack, it is possible to identify and/or estimate even attacks that cannot be detected by a combination of one or more anomalies detected at a certain timing (one shot).

<I. Notification of attack identification results to outside the control device>
In the above explanation, a configuration has been exemplified in which the attack identification result 180 output from the attack identification unit 176 is used inside the control device 100, but the attack identification result 180 may also be notified to an outside of the control device 100.

FIG. 15 is a schematic diagram showing a configuration example focusing on notification of an attack identification result 180 in a control system 1 according to this embodiment. Referring to FIG. 15, the control system 1 includes, for example, a control device 100 and a network relay device 100A.

Each of the control device 100 and the network relay device 100A includes an attack identification unit 176 and a notification unit 184.

When the attack identification unit 176 determines that an attack is occurring, it outputs an attack identification result 180 that includes information on the type of attack that has been identified. When the attack identification result 180 is output from the attack identification unit 176, the notification unit 184 notifies the management server 500 and/or management server 500A of the attack identification result 180.

Similarly, when the attack identification result 180 is output from the attack estimation unit 190, the notification unit 184 may notify the management server 500 and/or management server 500A of the attack identification result 180.

In this way, the control device 100 may be implemented with a notification unit 184 that notifies devices other than the control device 100 of information on the type of security attack identified by the attack identification unit 176 and/or information on the type of security attack estimated by the attack estimation unit 190.

The management server 500 may be placed, for example, in a factory that includes a control target controlled by the control system 1. The management server 500 may aggregate the attack identification results 180 to grasp the status of attacks that have occurred in the factory that includes the control target, and may determine security measures to be taken in the target factory.

The management server 500A may be located, for example, outside a factory that includes a control target controlled by the control system 1. The management server 500A may be operated, for example, by an entity other than the operator of the factory (for example, a management company with higher expertise that is outsourced). By aggregating the attack identification results 180 in the management server 500A, it is also possible to perform a more in-depth analysis of security measures.

The method of notifying the management server 500 and/or management server 500A of the attack identification result 180 may be to use a normal network or a dedicated line (e.g., a public wireless line such as 5G or 4G). By using a normal network, the attack identification result 180 can be notified easily and at low cost. Furthermore, by using a dedicated line, the attack identification result 180 can be notified even in a situation where communication is not possible due to a DoS attack or a DDoS attack.

Alternatively, the notification unit 184 can store the attack identification result 180 as a file and retrieve the file afterwards, making it possible to retrieve and analyze the attack identification result 180 even in a situation where communication is not possible.

As described above, by notifying the control device 100 and the network relay device 100A of the attack identification result 180 to the outside of the device, it is possible to detect attacks over a wider area and to more efficiently identify the type of attack and decide on security measures.

<J. Support Device 200>
The contents of the control calculations executed by the control device 100 constituting the control system 1 according to this embodiment are determined by a user using the support device 200 to program, set, and so on.

Figure 16 is a schematic diagram showing an example configuration focusing on the support device 200 in the control system 1 according to the present embodiment. Referring to Figure 16, a user operates the support device 200 to generate data for defining the control calculations in the control device 100, such as task settings 202, network configuration 204, and user program 206. These data are transferred from the support device 200 to the control device 100.

The task settings 202 and the user program 206, for example, define the contents of the control calculations executed by the control unit 150 of the control device 100. The network configuration 204, for example, defines the contents of the input processing executed by the input unit 140 and the output processing executed by the output unit 160.

The support device 200 can also arbitrarily set the behavior of the attack monitoring unit 170 and/or the attack estimation unit 190 implemented in the control device 100 in response to user operation. For example, the user operates the support device 200 to generate an attack monitoring unit setting 208. The attack monitoring unit setting 208 includes anomaly detection setting 173, which is a rule for the anomaly detection unit 172 and/or the attack estimation unit 190 of the control device 100 to detect anomalies, and at least a portion of the contents of the attack pattern database 178 referenced by the attack identification unit 176 and/or the attack estimation unit 190 of the control device 100.

FIG. 17 is a diagram showing an example of an abnormality detection setting 173 set by the support device 200 in the control system 1 according to the present embodiment. Referring to FIG. 17, the setting items of the abnormality detection setting 173 may include an abnormality detection target, an abnormality detection range, and an abnormality detection condition.

The abnormality detection target specifies the target for detecting the occurrence of an abnormality, and can specify, for example, hardware such as a communication port, or software settings such as a packet transmission protocol. For example, "Communication Port 1" can be set to "Enabled" or "Disabled" as an abnormality detection target. When "Communication Port 1" is set to "Enabled," it becomes a target for abnormality detection, and when "Communication Port 1" is set to "Disabled," it is excluded from the abnormality detection target.

The abnormality detection range specifies the range in which the occurrence of an abnormality is detected. For example, when multiple types of unauthorized commands are expected, only specific unauthorized commands may be specified as the target for abnormality detection. For example, "All Commands" may be set to detect all unauthorized commands as the target for abnormality detection, or "Command A only" may be set to detect only a specific unauthorized command A as the target for abnormality detection.

The abnormality detection conditions specify the conditions for determining the occurrence of an abnormality, and include, for example, a threshold value for detecting "excessive traffic." For example, the threshold value for detecting "excessive traffic" may be set to "80%" or "50%." Alternatively, the threshold value may be set arbitrarily.

The user operates the support device 200 to set the contents as shown in FIG. 17, thereby generating anomaly detection settings 173. The anomaly detection settings 173 are transferred to the control device 100 and reflected in the anomaly detection unit 172. In this way, the anomaly detection unit 172 determines the anomaly to be detected according to the anomaly detection settings 173 provided by the support device 200.

The contents of the anomaly detection settings 173 may be set to initial values in advance in correspondence with the contents of the anomaly referenced in the attack pattern database 178 implemented in the control device 100.

In addition, if certain anomalies are excluded from detection targets in the anomaly detection settings 173, consistency with the contents of the attack pattern database 178 cannot be maintained. Therefore, the support device 200 also updates the contents of the attack pattern database 178 of the control device 100 according to the contents of the anomaly detection settings 173.

For example, if any anomaly associated with an attack pattern included in the attack pattern database 178 is excluded from detection, the following processing may be performed:

(1) Anomalies set as not subject to detection are judged as "not matching" (2) Anomalies set as not subject to detection are judged as "always matching" or "don't care" When process (1) is adopted, attack patterns that have anomalies set as not subject to detection as a condition will not be identified. Also, when process (2) is adopted, if anomalies associated with an attack pattern match anomalies excluding anomalies set as not subject to detection, the anomaly will be identified as an attack pattern.

The user may operate the support device 200 to set which of the above-mentioned processes to select.

In this way, the user can freely change the attack patterns and anomalies to be detected, and enable/disable them, contained in the attack pattern database 178, according to the settings from the support device 200, by operating the support device 200. That is, the anomalies to be detected may be determined according to the anomaly detection settings 173 provided by the support device 200. In addition, it may be possible to set or change the attack pattern database 178 from the support device 200.

<K. Notes>
The present embodiment as described above includes the following technical idea.
[Configuration 1]
A processing execution unit (130) that executes an input process (140) for acquiring information input from the outside, a control calculation (150) that is executed by referring to the information acquired by the input process, and an output process (160) that outputs information calculated by the control calculation to the outside;
an abnormality detection unit (172) that detects an abnormality that has occurred among a plurality of abnormalities of detection targets, each of the abnormalities of the detection targets being associated with any one of the input processing, the control calculation, and the output processing;
a database (178) including at least one attack pattern defining one or more anomalies associated with a particular type of security attack;
and an attack identification unit (176) that, when one or more anomalies defined by any of the attack patterns included in the database match one or more anomalies detected by the anomaly detection unit, identifies that the control device is undergoing a security attack of the type associated with the attack pattern.
[Configuration 2]
2. The control device according to configuration 1, wherein the process execution unit operates in accordance with a corresponding security measure depending on a type of security attack identified by the attack identification unit.
[Configuration 3]
3. The control device according to configuration 2, wherein the operation according to the corresponding security countermeasure includes changing the execution content of the control calculation.
[Configuration 4]
3. The control device according to configuration 2, wherein the operation in response to the corresponding security countermeasure includes restricting output by the output process.
[Configuration 5]
The control device according to any one of configurations 1 to 4, wherein the attack identification unit compares one or more anomalies detected within a predetermined time period with one or more anomalies defined by an attack pattern.
[Configuration 6]
The control device according to any one of configurations 1 to 5, further comprising a notification unit (184) that notifies a device other than the control device of information on a type of security attack identified by the attack identification unit.
[Configuration 7]
The control device according to any one of configurations 1 to 4, further comprising an attack estimation unit (190) that estimates whether or not the control device is subjected to a security attack of a type associated with an attack pattern based on a degree of match between one or more anomalies defined by any one of the attack patterns included in the database and one or more anomalies detected by the anomaly detection unit.
[Configuration 8]
8. The control device of configuration 7, wherein the attack estimation unit compares one or more anomalies detected within a predetermined time period with one or more anomalies defined by an attack pattern.
[Configuration 9]
The control device according to configuration 7 or 8, further comprising a notification unit (184) that notifies a device other than the control device of information on a type of security attack estimated by the attack estimation unit.
[Configuration 10]
The control device according to any one of configurations 1 to 9, wherein at least one of the attack pattern and the abnormality to be detected is determined according to settings from a support device (200).
[Configuration 11]
Steps (S2 to S8) of executing an input process for acquiring information input from an outside source, a control calculation executed by referring to the information acquired by the input process, and an output process for outputting information calculated by the control calculation to an outside source;
and detecting an abnormality that has occurred among a plurality of abnormalities to be detected (S14, S16), each of the abnormalities to be detected being associated with any of the input process, the control calculation, and the output process;
A step of referring to a database including at least one attack pattern that defines one or more anomalies associated with a specific type of security attack, and determining whether or not the one or more anomalies defined by any of the attack patterns included in the database match the one or more detected anomalies (S18, S20);
and a step (S22) of identifying that a security attack of a type associated with the attack pattern has occurred.
[Configuration 12]
A control program (110) for causing a computer (100) to:
Steps (S2 to S8) of executing an input process for acquiring information input from an outside source, a control calculation executed by referring to the information acquired by the input process, and an output process for outputting information calculated by the control calculation to an outside source;
and detecting an abnormality that has occurred among a plurality of abnormalities to be detected (S14, S16), each of the abnormalities to be detected being associated with any one of the input process, the control calculation, and the output process;
A step of referring to a database including at least one attack pattern that defines one or more anomalies associated with a specific type of security attack, and determining whether or not the one or more anomalies defined by any of the attack patterns included in the database match the one or more detected anomalies (S18, S20);
and a step (S22) of identifying that the computer is under a security attack of a type associated with the attack pattern.

L. Advantages
The control device according to the present embodiment detects an abnormality occurring in any of the input process, the control calculation, and the output process, and determines whether or not the detected abnormality or abnormalities match one or more abnormalities defined by a pre-prepared attack pattern, thereby identifying that a security attack of a type associated with the attack pattern has occurred. This makes it possible to detect that a security attack has occurred, and also to identify the type of the security attack. As a result, it is possible to implement appropriate security measures according to the type of security attack.

The embodiments disclosed herein should be considered to be illustrative and not restrictive in all respects. The scope of the present invention is indicated by the claims, not by the above description, and is intended to include all modifications within the meaning and scope of the claims.

1 Control system, 10 Upper network, 20 Field network, 100 Control device, 100A Network relay device, 102 Processor, 104 Chip set, 106 Main memory device, 108 Secondary memory device, 110 System program, 112 USB controller, 114 Memory card interface, 115 Memory card, 116, 118 Network controller, 122 Internal bus controller, 130 Processing execution unit, 140 Input unit, 150 Control unit, 152, 162 Security countermeasures table, 160 Output unit, 170 Attack monitoring unit, 172 Anomaly detection unit, 173 Anomaly detection setting, 174 Occurring anomaly data, 176 Attack identification unit, 178 Attack pattern database, 180 Attack identification result, 182 Timer, 184 Notification unit, 190 Attack estimation unit, 192 Matching degree calculation unit, 194 Matching degree evaluation unit, 196 Degree of match for each attack pattern, 198 threshold value, 200 support device, 202 task setting, 204 network configuration, 206 user program, 208 attack monitoring unit setting, 300 field device, 400 display operation terminal, 500, 500A management server, 600 gateway, 1720 input anomaly detection unit, 1721, 1728 communication anomaly detection unit, 1722 file anomaly detection unit, 1723, 1729 I/O anomaly detection unit, 1724 control anomaly detection unit, 1725 system control anomaly detection unit, 1726 hardware resource anomaly detection unit, 1727 output anomaly detection unit, 1730 anomaly recording unit, 1760 attack pattern acquisition unit, 1762 comparison unit.

Claims (12)

1. A control system comprising:
A control device;
A support device connectable to the control device,
the support device generates a task setting, a network configuration, a user program, and an attack monitoring unit setting in response to a user operation , the attack monitoring unit setting including an anomaly detection setting which is a rule for detecting anomalies, and an attack pattern database;
The control device includes:
a processing execution unit that executes an input process for acquiring information input from an outside, a control calculation that is executed by referring to the information acquired by the input process, and an output process that outputs information calculated by the control calculation to an outside;
an abnormality detection unit that detects an abnormality that has occurred among a plurality of abnormalities of detection targets, each of the abnormalities of the detection targets being associated with any one of the input process, the control calculation, and the output process;
a database including at least one attack pattern defining one or more anomalies associated with a particular type of security attack;
an attack identification unit that, when one or more anomalies defined by any one of the attack patterns included in the database match one or more anomalies detected by the anomaly detection unit, identifies that the device is under a security attack of a type associated with the attack pattern;
The support device transfers data to the control device, whereby the content of the control calculation is defined by the task setting and the user program, and the content of the input processing and the output processing is defined by the network configuration;
The anomaly detection unit determines the anomaly to be detected by referring to the anomaly detection setting included in the attack monitoring unit setting from the support device;
A control system , wherein the contents of the database are set or changed by the attack pattern database included in the attack monitoring unit setting from the support device . The control system according to claim 1, wherein the processing execution unit operates in accordance with a corresponding security measure depending on the type of security attack identified by the attack identification unit. The control system of claim 2, wherein the operation according to the corresponding security measure includes changing the execution content of the control calculation. The control system of claim 2, wherein the action taken in response to the corresponding security measure includes limiting the output from the output process. The control system according to any one of claims 1 to 4, wherein the attack identification unit compares one or more anomalies detected within a predetermined time period with one or more anomalies defined by an attack pattern. The control system according to any one of claims 1 to 5, further comprising a notification unit that notifies a device other than the control device of information on the type of security attack identified by the attack identification unit. The control system according to any one of claims 1 to 4, further comprising an attack estimation unit that estimates whether or not a security attack of a type associated with an attack pattern has been made based on the degree of agreement between one or more anomalies defined by any one of the attack patterns included in the database and one or more anomalies detected by the anomaly detection unit. The control system of claim 7, wherein the attack estimation unit compares one or more anomalies detected within a predetermined time period with one or more anomalies defined by an attack pattern. The control system according to claim 7 or 8, further comprising a notification unit that notifies a device other than the control device of information on the type of security attack estimated by the attack estimation unit. The attack monitoring unit setting includes:
A setting for defining the detection target;
A setting for defining a range for detecting the occurrence of an anomaly;
The control system according to any one of claims 1 to 9, further comprising: settings for defining conditions for determining whether an abnormality has occurred. A control method executed in a control system including a control device and a support device connectable to the control device,
the support device includes a step of generating a task setting, a network configuration, a user program, and an attack monitoring unit setting in response to a user operation, the attack monitoring unit setting including an anomaly detection setting which is a rule for detecting anomalies, and an attack pattern database ;
the support device transferring data to the control device ;
the control device includes a step of executing an input process for acquiring information input from an outside, a control calculation for executing by referring to the information acquired by the input process, and an output process for outputting information calculated by the control calculation to an outside , the content of the control calculation being defined by the task setting and the user program, and the content of the input process and the output process being defined by the network configuration ;
the control device refers to the anomaly detection setting included in the attack monitoring unit setting from the support device to determine an anomaly to be detected, and detects an anomaly that has occurred among the plurality of anomalies to be detected, each of the anomalies to be detected being associated with any one of the input process, the control operation, and the output process;
The control device refers to a database including at least one attack pattern that defines one or more anomalies associated with a specific type of security attack, and determines whether or not the one or more anomalies defined by any of the attack patterns included in the database match the one or more anomalies detected;
and determining by the control device that the control device is subject to a security attack of a type associated with the attack pattern ;
A control method , wherein the contents of the database are set or changed by the attack pattern database included in the attack monitoring unit setting from the support device . The attack monitoring unit setting includes:
A setting for defining the detection target;
A setting for defining a range for detecting the occurrence of an anomaly;
The control method according to claim 11 , further comprising: setting for defining a condition for determining that an abnormality has occurred.

Images