JP7822305B2 - Analysis system and analysis method - Google Patents

Description

The present invention relates to a technology for generating information to recreate a system using a digital twin.

In recent years, there has been a growing integration of OT (Operational Technology) systems with IT in order to achieve automated control and increased efficiency. OT systems place great importance on safety, continuity, and real-time performance.

With the convergence of OT and IT, the security of OT systems has become an issue. Applying security measures to OT systems can potentially affect safety, continuity, and real-time performance. Therefore, it is necessary to analyze the scope and content of the impact of security measures and consider security measures that do not affect safety, continuity, and real-time performance.

Simulation technology that uses digital twins to recreate OT systems in cyberspace and analyze the scope and content of the impact of security measures is attracting attention.

OT systems can be divided into multiple control processes that control different objects, such as control processes related to communications and control processes related to the control performed by the OT system. Control performed by the OT system is the control that the OT system originally performs, such as the control of plants, buildings, and infrastructure facilities.

To achieve a simulation, each control process must be modeled. For example, models of multiple control processes must be generated, such as control processes related to communication that represent the connectivity and network configuration of data communications between devices via a communications network, and control processes related to control performed by the OT system, such as controlling the behavior of control devices involved in the process. Setting up models manually places a heavy burden on the user, which is an issue. Therefore, a method is known for automatically generating models using process mining technology that uses logs.

For example, Patent Document 1 discloses a device that "acquires the application log of an application program AP, extracts log data relating to a series of work processes from the acquired application log as blocks, extracts patterns from the blocks in which multiple pieces of related log data are arranged in chronological order, extracts patterns from the extracted patterns that share certain log data, and generates a business processing flow based on the certain log data."

Japanese Patent Application Laid-Open No. 2017-227944

Conventional technology can be used to generate control process models. However, in the case of systems that are controlled based on multiple control processes, such as OT systems, conventional technology cannot grasp the relationships between the control process models. Therefore, in order to reproduce and simulate an OT system using a digital twin, it is necessary to separately set the relationships between the control process models.

The present invention aims to provide technology for understanding the relationships between models of multiple control processes in systems that are controlled based on multiple control processes, such as OT systems.

A representative example of the invention disclosed in this application is as follows: An analysis system for generating information for reproducing a system using a digital twin, wherein the system is controlled based on a plurality of control processes having different control targets, the analysis system includes a computer having a processor, a storage device connected to the processor, and a network interface connected to the processor, and manages models of each of the plurality of control processes, the models of the control processes being composed of components that represent processes included in the control processes, the analysis system acquires an event log for each of the plurality of control processes, and executes an analysis process that analyzes the relationship between the components of the model of a first control process and the components of the model of a second control process, the event log for the control process includes parameters for identifying the components, and the analysis process executes an analysis process that analyzes the relationship between the components of the model of the first control process and the components of the model of the second control process, The method includes a first process of selecting a target component from the components of the model; a second process of acquiring the event log of the first control process related to the target component as a target log; a third process of comparing, for each of the event logs of the second control process, parameters included in the target log with parameters included in the event log of the second control process, and calculating an index representing the relevance with the target log; a fourth process of identifying the event log of the second control process related to the target component based on the index; a fifth process of identifying, as related components, the components of the model of the second control process related to the identified event log of the second control process; and a sixth process of recording the target component and the related components in association with each other.

This invention makes it possible to understand the relationships between models of multiple control processes for controlling a system. Issues, configurations, and advantages other than those described above will become clear from the description of the following examples.

FIG. 1 is a diagram illustrating an example of the configuration of an analysis apparatus according to a first embodiment. FIG. 1 is a diagram illustrating an example of a control system according to a first embodiment. FIG. 4 is a diagram illustrating an example of event log information managed by the analysis apparatus according to the first embodiment. FIG. 4 is a diagram illustrating an example of event log information managed by the analysis apparatus according to the first embodiment. FIG. 10 is a diagram illustrating an example of determination rule information according to the first embodiment. FIG. 2 is a diagram illustrating an example of a model of a control process according to the first embodiment. FIG. 2 is a diagram illustrating an example of a model of a control process according to the first embodiment. 1 is a flowchart illustrating an example of an analysis process executed by the analysis apparatus according to the first embodiment. 1 is a flowchart illustrating an example of an analysis process executed by the analysis apparatus according to the first embodiment. FIG. 10 is a diagram showing an example of a weight matrix used in the analysis process of the first embodiment. FIG. 4 is a diagram illustrating an example of analysis result information generated by the analysis device of the first embodiment. FIG. 10 is a diagram illustrating an example of a screen presented by the analysis device of the first embodiment. FIG. 10 is a diagram illustrating an example of a screen presented by the analysis device of the first embodiment. FIG. 10 is a diagram illustrating an example of a screen presented by the analysis device of the first embodiment.

The following describes an embodiment of the present invention with reference to the accompanying drawings. However, the present invention should not be construed as being limited to the description of the embodiment shown below. Those skilled in the art will readily understand that the specific configuration can be modified without departing from the spirit or intent of the present invention.

In the configuration of the invention described below, identical or similar components or functions are designated by the same reference numerals, and duplicate explanations will be omitted.

The terms "first," "second," "third," etc. used in this specification are used to identify components and do not necessarily limit the number or order.

The position, size, shape, and range of each component shown in the drawings may not represent the actual position, size, shape, and range, etc., in order to facilitate understanding of the invention. Therefore, the present invention is not limited to the position, size, shape, and range, etc., disclosed in the drawings, etc.

Figure 1 shows an example of the configuration of the analysis device of Example 1.

The analysis device 100 analyzes the relationships between models of control processes in a control system that is controlled based on multiple control processes. The analysis device 100 has a processor 110, a main memory device 111, a secondary memory device 112, and a network interface 113. The analysis device 100 may also have input devices such as a keyboard, mouse, and touch panel, as well as an output device such as a display.

The processor 110 is a computing device that controls the entire analysis device 100 and executes programs stored in the main memory device 111. By executing processing in accordance with the programs, the processor 110 operates as a functional unit (module) that realizes a specific function. In the following explanation, when processing is described using a functional unit as the subject, this indicates that the processor 110 is executing a program that realizes that functional unit.

The main memory device 111 is a storage device that stores programs executed by the processor 110 and information executed by the programs, and is, for example, a volatile or non-volatile memory. The main memory device 111 is also used as a work area.

The secondary storage device 112 is a storage device that permanently stores information, such as an HDD (Hard Disk Drive) or SSD (Solid State Drive). The programs and information stored in the main storage device 111 may be stored in the secondary storage device 112. In this case, the processor 110 reads the programs and information from the secondary storage device 112 and loads them into the main storage device 111.

The network interface 113 communicates with external devices via a network.

The main memory device 111 stores programs that implement the log acquisition unit 120 and analysis unit 121, and also holds judgment rule information 122.

Determination rule information 122 is information for managing rules for determining the relationship between the event logs (event logs) of each of the two control processes.

The log acquisition unit 120 acquires the event logs of each of the multiple control processes. The event logs may be acquired directly from the control system, or from an external system different from the control system. The event logs may also be input by the user.

The analysis unit 121 analyzes the relationships between control process models based on the event logs and judgment rule information 122 for each of the multiple control processes.

The functional units of the analysis device 100 may be configured such that multiple functional units are combined into a single functional unit, or a single functional unit may be divided into multiple functional units for each function. The functions of the analysis device 100 may also be realized using multiple computers.

Figure 2 is a diagram illustrating an example of a control system according to the first embodiment. Figure 2 shows the configuration of an OT system. The OT system is controlled based on, for example, a control process related to communication and a control process related to control performed by the OT system. Numbers represent packets.

The analysis device 100 manages the acquired event logs of each control process as event log information. Figures 3 and 4 show examples of event log information managed by the analysis device 100 of Example 1.

Figure 3 shows event log information 300, which manages event logs for communication-related control processes. Event log information 300 stores records including ID 301, transmission start time 302, transmission end time 303, protocol 304, source MAC 305, destination MAC 306, source IP 307, destination IP 308, source port 309, and destination port 310. One record corresponds to one event log. Note that the fields included in a record are not limited to those described above.

ID 301 is a field that stores the ID of the event log. The event of the communication-related control process is the transmission of a packet. Transmission start time 302 and transmission end time 303 are fields that store the packet transmission start time and transmission end time. Protocol 304 is a field that stores the communication protocol.

Source MAC 305, Source IP 307, and Source Port 309 are fields that store the MAC address, IP address, and port number of the communication device that is the source of the packet. Destination MAC 306, Destination IP 308, and Destination Port 310 are fields that store the MAC address, IP address, and port number of the communication device that is the destination of the packet.

Figure 4 shows event log information 400, which manages event logs for control processes related to control performed by the OT system. Event log information 400 stores records including ID 401, processing start time 402, processing end time 403, device name 404, MAC address 405, IP address 406, and sensor information 407. One record corresponds to one event log. Note that the fields included in a record are not limited to those described above.

ID 401 is a field that stores the ID of the event log. Control process events related to control performed by the OT system are specific OT controls. Processing start time 402 and processing end time 403 are fields that store the start and end times of the control.

Device name 404, MAC address 405, and IP address 406 are fields that store the name, MAC address, and IP address of the device to be controlled. Sensor information 407 is a field that stores measurement information from the sensor that monitors the device to be controlled.

Figure 5 shows an example of the judgment rule information 122 in Example 1.

The judgment rule information 122 stores a judgment table 500 for each pair of control processes. The judgment table 500 stores records including a parameter (1) 501, a parameter (2) 502, a judgment rule 503, and a weight 504. One record exists for each parameter pair.

Parameter (1) 501 is a field that stores the identification information of a parameter included in the event log of a control process that forms a pair. Parameter (2) 502 is a field that stores the identification information of a parameter included in the event log of another control process that forms a pair. In FIG. 5, parameter (1) 501 stores the "transmission start time" included in the event log of a control process related to communication, and parameter (2) 502 stores the "processing start time" included in the event log of a control process related to control performed by the OT system.

Determination rule 503 is a field that stores the rule for determining whether two parameters corresponding to parameter (1) 501 and parameter (2) 502 are similar. Determination rule 503 stores, for example, a conditional expression. Weight 504 is a field that stores the weight that is set when two parameters are similar.

The analysis device 100 generates a model of a control process by performing process mining using the event log. The model of a control process is composed of components that represent the processes included in the control process. Figures 6 and 7 show an example of a model of a control process in Example 1.

Figure 6 shows model information 600 for managing models of control processes related to communication. Models of control processes related to communication are models in which communication flows are components.

Model information 600 stores records including ID 601, device name 602, connected device name 603, connected device name 604, source MAC 605, source IP 606, and payload 607. One record corresponds to one flow (component). Note that the fields included in the record are not limited to those described above.

ID 601 is a field that stores the flow ID. Device Name 602 is a field that stores the name of the communication source device. Connected Device Name 603 is a field that stores the name of the communication destination device. Connected Device Name 604 is a field that stores the name of the device that is the target of control implemented by the OT system through communication. Source MAC 605 and Source IP 606 are fields that store the MAC address and IP address of the communication source device. Payload 607 is a field that stores the information to be transmitted.

Figure 7 shows model information 700 for managing a model of the control process related to the control performed by the OT system. The model of the control process related to the control performed by the OT system is a model in which control is a component.

Model information 700 stores records including an ID 701, a control name 702, and a control device name 703. One record corresponds to one control (component). Note that the fields included in a record are not limited to those described above.

ID 701 is a field that stores the control ID. Control name 702 is a field that stores the name of the control. Control device name 703 is a field that stores the name of the device that is the target of control.

Note that the information defining the components of a control process model includes parameters contained in the control process's event log.

In addition, the user may generate the model information 600, 700 and set it in the analysis device 100.

Figures 8A and 8B are flowcharts illustrating an example of analysis processing performed by the analysis device 100 of Example 1. Figure 9 is a diagram illustrating an example of a weighting matrix used in the analysis processing of Example 1. Figure 10 is a diagram illustrating an example of analysis result information generated by the analysis device 100 of Example 1.

When the analysis device 100 receives an execution instruction specifying two control processes, it starts the analysis process. The analysis device 100 assigns the two control processes to control process 1 and control process 2. For example, the assignment is based on importance in the control system. The user may specify the assignment of the control processes in advance.

When analyzing the control process of an OT system, the control process related to the control performed by the OT system is referred to as control process 1, and the control process related to communication is referred to as control process 2.

The analysis device 100 starts loop processing of the components of the model of control process 1 (step S101). The analysis device 100 selects one component from the components of the model of control process 1.

The analysis device 100 identifies event logs related to the selected component from the event logs of control process 1 (step S102).

Based on the event log identified in step S102, the analysis device 100 extracts event logs to be compared from the event log of control process 2 (step S103). For example, event logs with execution times within a predetermined range are extracted. Note that step S103 may be omitted.

The analysis device 100 starts loop processing of the event log of control process 1 (step S104). The analysis device 100 selects one event log (first event log) from the event logs identified in step S102.

The analysis device 100 initializes the weight matrix 900 (step S105). Specifically, the analysis device 100 generates a weight matrix 900 in which the parameters of the event log of control process 1 are the column components and the parameters of the event log of control process 2 are the row components. The analysis device 100 sets all components of the weight matrix 900 to 0.

The analysis device 100 starts loop processing of the event log of control process 2 (step S106). The analysis device 100 selects one event log (second event log) from the event logs extracted in step S103.

The analysis device 100 starts loop processing of the parameters in the event log (first event log) of control process 1 (step S107). The analysis device 100 selects one parameter (first parameter) from the parameters in the first event log.

The analysis device 100 starts loop processing of the parameters in the event log (second event log) of control process 2 (step S108). The analysis device 100 selects one parameter (second parameter) from the parameters in the event log of control process 2.

The analysis device 100 references the judgment rule information 122, acquires the judgment rule for the first parameter and the second parameter, and calculates weights based on the judgment rule (step S109). If the judgment rule is met, the analysis device 100 overwrites the value of weight 504 on the elements of the weight matrix 900 corresponding to the first parameter and the second parameter. If the judgment rule is not met, the analysis device 100 overwrites 0 on the elements of the weight matrix 900 corresponding to the first parameter and the second parameter. Note that if there is no judgment rule corresponding to the parameter combination, the analysis device 100 calculates a weight of 0.

The analysis device 100 determines whether processing has been completed for all parameters in the second event log (step S110).

If processing has not been completed for all parameters in the second event log, the analysis device 100 returns to step S108 and selects new second parameters.

When processing has been completed for all parameters in the second event log, the analysis device 100 determines whether processing has been completed for all parameters in the first event log (step S111).

If processing has not been completed for all parameters in the first event log, the analysis device 100 returns to step S107 and selects a new first parameter.

When processing has been completed for all parameters of the first event log, the analysis device 100 calculates a relevance score that represents the relevance between the first event log and the second event log based on the weight matrix 900 (step S112). For example, the analysis device 100 calculates the sum or maximum value of the weights of each component of the weight matrix 900 as the relevance score. The analysis device 100 stores data that associates the ID of the first event log, the ID of the second event log, the relevance score, and the weight matrix 900 in a work area.

The analysis device 100 determines whether processing has been completed for all event logs extracted in step S103 (step S113).

If processing has not been completed for all event logs extracted in step S103, the analysis device 100 returns to step S106 and selects a new second event log.

When processing has been completed for all event logs extracted in step S103, the analysis device 100 determines whether processing has been completed for all event logs identified in step S102 (step S114).

If processing has not been completed for all event logs identified in step S102, the analysis device 100 returns to step S104 and selects a new first event log.

When processing has been completed for all event logs identified in step S102, the analysis device 100 identifies the event log of control process 2 that is associated with the component selected in step S101 (step S115).

For example, the analysis device 100 identifies a predetermined number of event logs of control processes 2 in descending order of relevance score. Furthermore, the analysis device 100 identifies event logs of control processes 2 whose relevance scores are greater than a threshold.

The analysis device 100 references the model information of the control process 2 based on the event log identified in step S115 and identifies the model components of the control process 2 that are associated with the event log (step S116). This identifies the model components of the second control process that are associated with the model components of the first control process.

The analysis device 100 updates the analysis result information 1000 (step S117). The analysis result information 1000 stores records including component (1) 1001 and component (2) 1002. There is one entry for each component in the model of control process 1. The analysis device 100 adds a record to the analysis result information 1000 and sets the ID of the component in the model of control process 1 selected in step S101 to component (1) of the added record. The analysis device 100 also sets the ID of the component in the model of control process 2 identified in step S116 to component (2) 1002 of the added record. Two or more IDs may be set for component (2) 1002.

The analysis device 100 determines whether processing has been completed for all components of the model of control process 1 (step S118).

If processing has not been completed for all components in the model of control process 1, the analysis device 100 returns to step S101 and selects a new component.

When processing has been completed for all components of the model of control process 1, the analysis device 100 terminates the analysis process.

Figures 11, 12, and 13 are diagrams showing examples of screens presented by the analysis device 100 of Example 1.

Screen 1100 in Figure 11 is used to set parameters for the control protocol event log.

The user operates button 1101 to add a control protocol setting field. The user operates button 1102 to add an event log parameter setting field. The user operates button 1103 to set the control protocol event log parameter information in the analysis device 100. The analysis device 100 determines the format of the event log information based on the control protocol event log parameter information.

Screen 1200 in Figure 12 is the screen used to set judgment rules.

The user sets the name of the control protocol in input field 1201 and the parameters in input field 1202. The user sets the name of the control protocol in input field 1203 and the parameters in input field 1204. The user sets the judgment rule in input field 1205 and the weighting value in input field 1206. The user operates button 1207 to set the judgment rule in the analysis device 100. The analysis device 100 sets the received judgment rule in the judgment table 500 corresponding to the combination of control processes set in input field 1201 and input field 1203.

Screen 1300 in Figure 13 is a screen that displays the analysis results. Screen 1300 displays analysis result information 1000. When the user selects a record in the analysis result information 1000 and operates button 1301, the weight matrix 900 is displayed.

The analysis device 100 of Example 1 can generate information indicating the component relationships between control process models using information on the control process event log and the control process model. Based on this information, the component relationships between control process models can be understood.

The present invention is not limited to the above-described embodiments, but includes various modifications. Furthermore, for example, the above-described embodiments provide detailed descriptions of the configurations in order to clearly explain the present invention, and the present invention is not necessarily limited to those that include all of the described configurations. Furthermore, it is possible to add, delete, or replace part of the configuration of each embodiment with another configuration.

Furthermore, the above-described configurations, functions, processing units, processing means, etc. may be implemented in part or in whole in hardware, for example, by designing them as integrated circuits. The present invention can also be realized by software program code that implements the functions of the embodiments. In this case, a storage medium on which the program code is recorded is provided to a computer, and a processor in the computer reads the program code stored on the storage medium. In this case, the program code read from the storage medium itself implements the functions of the above-described embodiments, and the program code itself and the storage medium on which it is stored constitute the present invention. Examples of storage media for providing such program code include flexible disks, CD-ROMs, DVD-ROMs, hard disks, SSDs (Solid State Drives), optical disks, magneto-optical disks, CD-Rs, magnetic tape, non-volatile memory cards, and ROMs.

Furthermore, the program code that realizes the functions described in this embodiment can be implemented in a wide range of programming or scripting languages, such as assembler, C/C++, Perl, Shell, PHP, Python, and Java (registered trademark).

Furthermore, the software program code that realizes the functions of the embodiments may be distributed via a network and stored on a storage means such as a computer's hard disk or memory, or on a storage medium such as a CD-RW or CD-R, and the processor of the computer may read and execute the program code stored on the storage means or storage medium.

In the above examples, the control lines and information lines shown are those deemed necessary for explanation, and not all control lines or information lines in the product are necessarily shown. All components may be interconnected.

100 Analysis device 110 Processor 111 Main memory device 112 Sub-memory device 113 Network interface 120 Log acquisition unit 121 Analysis unit 122 Determination rule information 300 Event log information 400 Event log information 500 Determination table 600, 700 Model information 900 Weight matrix 1000 Analysis result information 1100, 1200, 1300 Screen

Claims (6)

An analysis system that generates information for reproducing a system using a digital twin,
the system is controlled based on a plurality of control processes with different control targets;
The analysis system comprises:
a computer having a processor, a storage device connected to the processor, and a network interface connected to the processor;
managing a model of each of the plurality of control processes;
the model of the control process is composed of components that represent processes included in the control process;
The analysis system comprises:
acquiring a log of events for each of the plurality of control processes;
performing an analysis process for analyzing the association between the components of the model of a first control process and the components of the model of a second control process;
the log of events of the control process includes a parameter identifying the component;
The analysis process includes:
a first process for selecting a target component from the components of the model of the first controlled process;
a second process of acquiring a log of the event of the first control process related to the target component as a target log;
a third process of comparing, for each of the event logs of the second control process, a parameter included in the target log with a parameter included in the event log of the second control process, and calculating an index representing a relevance with the target log;
a fourth process for identifying a log of the event of the second control process associated with the target component based on the indicator;
a fifth process of identifying the component of the model of the second controlled process that is associated with the log of the event of the identified second controlled process as a related component;
and a sixth process of recording the target component and the related component in association with each other. 10. The analysis system of claim 1,
The system comprises:
It is an operational technology system,
Controlled based on a control process relating to communication and a control process relating to control implemented by the operational technology system;
the first control process is a control process related to control performed by the operational technology system;
The analysis system is characterized in that the second control process is a control process related to the communication. 10. The analysis system of claim 1,
retaining judgment information that stores data relating combinations of parameters to be compared, judgment rules, and weights;
In the third process, a weight of each of the event logs of the second control process is calculated as the index;
In the fourth process, the event log of the second control process associated with the target component is identified based on the sum of the weights of each of the event logs of the second control process. An analytical method for generating information for reproducing a system using a digital twin, the method being performed by an analytical system, the method comprising:
the system is controlled based on a plurality of control processes with different control targets;
The analysis system comprises:
a computer having a processor, a storage device connected to the processor, and a network interface connected to the processor;
managing a model of each of the plurality of control processes;
the model of the control process is composed of components that represent processes included in the control process;
The analysis method includes:
a first step in which the computer acquires an event log of each of the plurality of control processes;
a second step of executing, by the computer, an analysis process for analyzing a relationship between the components of the model of the first control process and the components of the model of the second control process;
the log of events of the control process includes a parameter identifying the component;
The second step includes:
a third step in which the computer selects a target component from the components of the model of the first control process;
a fourth step in which the computer acquires, as a target log, a log of the event of the first control process related to the target component;
a fifth step in which the computer compares, for each of the event logs of the second control process, a parameter included in the target log with a parameter included in the event log of the second control process, and calculates an index representing a relevance with the target log;
a sixth step of the computer identifying, based on the indicator, a log of the events of the second control process associated with the target component;
a seventh step in which the computer identifies, as relevant components, the components of the model of the second controlled process that are associated with the event log of the identified second controlled process;
an eighth step in which the computer associates and records the target component and the related component. The analysis method according to claim 4,
The system comprises:
It is an operational technology system,
Controlled based on a control process relating to communication and a control process relating to control implemented by the operational technology system;
the first control process is a control process related to control performed by the operational technology system;
The analysis method is characterized in that the second control process is a control process related to the communication. The analysis method according to claim 4,
the analysis system holds judgment information that stores data associating combinations of parameters to be compared, judgment rules, and weights;
the fifth step includes a step of calculating, by the computer, a weight of each of the logs of the events of the second control process as the index;
The sixth step is an analysis method characterized in that it includes a step in which the computer identifies the event log of the second control process associated with the target component based on the total value of the indicators of each of the event logs of the second control process.