Patent ID: 9075410
Filing Date: 2015-07-07
Classification: G05B,G06F,H04L

Abstract:
1. An abnormality detection system for detecting an abnormality in a network, comprising: a plurality of control systems each connected to the network and operating in a corresponding protected area; a monitoring section provided in each control system of the plurality of control systems, the monitoring section being for inspecting data exchanged between the control system and a counter control system to be monitored and for transmitting an abnormality notification when the counter control system is suspected to have an abnormality; and a management section for adding up abnormality notifications transmitted from respective monitoring sections of the plurality of control systems so as to evaluate the reputation of the counter control system suspected to have an abnormality, and for causing a protected area for operating the counter control system suspected to have an abnormality to restrict outbound traffic from a virtual actuator inside of the protected area to an actual actuator outside the protected area by a hypervisor blocking a connection from the virtual actuator to the actual actuator and to pass inbound traffic from an actual sensor outside the protected area to a virtual sensor inside of the protected area by the hypervisor maintaining a connection from the actual sensor to the virtual sensor, when an indication is identified that the counter control system is abnormal according to criteria from a result of the evaluation, wherein the management section causes the protected area for operating the counter control system suspected to have an abnormality to connect a dummy control device in the protected area, instead of an actual control device, to the counter control system operating in the protected area.