Patent ID: 9354625
Filing Date: 2016-05-31
CPC Classification: G05B,G06F,H04L

Claim Text:
1. An abnormality detection method for detecting an abnormality in a network in which a plurality of control systems operate in respective protected areas, the abnormality detection method comprising: receiving, from one or more control systems in the plurality of control systems, an abnormality notification for a counter control system to be monitored by the plurality of control systems; adding up abnormality notifications so as to evaluate the reputation of the counter control system suspected to have an abnormality, the reputation being made by at least two control systems in the plurality of control systems for monitoring the counter control system, and judging whether the counter control system suspected to have an abnormality is abnormal or not according to criteria; causing a protected area for operating the counter control system suspected to have an abnormality to restrict outbound traffic from a virtual actuator inside of the protected area to an actual actuator outside the protected area by a hypervisor blocking a connection from the virtual actuator to the actual actuator and to pass inbound traffic from an actual sensor outside the protected area to a virtual sensor inside of the protected area by the hypervisor maintaining a connection from the actual sensor to the virtual sensor, when an indication is identified that the control system is abnormal according to the criteria from a result of the evaluation; and causing the protected area for operating the counter control system suspected to have an abnormality to connect a dummy control device in the protected area, instead of an actual control device, to the counter control system operating in the protected area.