ATTACK DETECTION APPARATUS, ATTACK DETECTION METHOD, AND NON-TRANSITORY COMPUTER READABLE MEDIUM

An attack detection apparatus (100) includes an attack detection unit (120), a pattern determination unit (130), and a final determination unit (140). The attack detection unit (120) executes for each of a plurality of pieces of communication data as subject data, an attack detection process to determine whether or not the subject data complies with one of rules included in an authorization list that includes a plurality of rules to each of which a unique identifier has been assigned. The pattern determination unit (130) execute a pattern determination process to determine whether or not an identifier corresponding to a rule with which the subject data complies conforms to an appearance pattern of identifiers derived from a model, using the model for determining whether the appearance pattern of the identifiers corresponding to rules each of which is complied with each of the plurality of pieces of communication data is normal or not. When the pattern determination process is executed, the final determination unit (140) determines whether the subject data is normal or not, using a determination result by the attack detection process and a determination result by the pattern determination process.

TECHNICAL FIELD

The present disclosure relates to an attack detection apparatus, an attack detection method, and an attack detection program.

BACKGROUND ART

In recent years, the threat of cyber-attacks against industrial control systems has increased due to the opening up, networking, or the like of the industrial control systems. One of the countermeasures against a cyber-attack that enters through a network is an attack detection system that detects an attack activity by monitoring network communication. In particular, in the industrial control systems, attack detection methods that utilizes the fact that network communication is fixed include a method of creating an authorization list that includes a destination Internet Protocol (IP) address, a port number, or the like of a normal communication packet and detecting a communication packet that does not comply with the created authorization list as an attack, and a method of defining a characteristic of a further general normal communication packet and detecting a communication packet that deviates from the defined characteristic.

On the other hand, there is a cyber-attack that is performed by combining normal communication packets, and in the cyber-attack, the methods described above are bypassed and a cyber-attack is launched. Methods of detecting such a further advanced cyber-attack include a method of updating the authorization list depending on the state of a system, a method of making the authorization list to include a characteristic that spans a plurality of communication packets, such as an appearance order, an appearance frequency, or the like of the packets, a method of performing attack determination on a communication packet determined to be normal using the authorization list, using an additional another criterion, and the like.

Patent Literature 1 discloses a technique to determine communication in two stages. Here, in the first stage, attack detection using an authorization list is performed and communication that does not comply with a rule included in the authorization list is determined to be an attack. In the second stage, it is determined whether the communication is an attack or not according to the abnormality of the communication that complies with a rule included in the authorization list.

CITATION LIST

Patent Literature

Patent Literature 1: pamphlet of WO 2019/240020 A1

SUMMARY OF INVENTION

Technical Problem

According to the technology disclosed in Patent Literature 1, when one piece of communication data is to be determined using a feature corresponding to a plurality of elements relating to the one piece of communication data, the problem is that a processing load is relatively high due to the need to calculate the feature using the plurality of elements.

The present disclosure aims in a method of performing attack determination using an additional another criterion on a communication packet determined to be normal using an authorization list, not to calculate a feature using a plurality of elements when one piece of communication data is to be determined using the feature corresponding to the plurality of elements relating to the one piece of communication data.

Solution to Problem

An attack detection apparatus according to the present disclosure includes:an attack detection unit to execute for each of a plurality of pieces communication data as subject data, an attack detection process to determine whether or not the subject data complies with one of rules included in an authorization list that includes a plurality of rules to each of which a unique identifier has been assigned;a pattern determination unit, when the subject data complies with one of the rules included in the authorization list, to execute a pattern determination process to determine whether or not an identifier corresponding to a rule with which the subject data complies conforms to an appearance pattern of identifiers derived from a model, using the model for determining whether the appearance pattern of the identifiers corresponding to rules each of which is complied with each of the plurality of pieces of communication data is normal or not; anda final determination unit, when the pattern determination process is executed, to determine whether the subject data is normal or not, using a determination result by the attack detection process and a determination result by the pattern determination process.

Advantageous Effects of Invention

According to the present disclosure, when subject data complies with one of rules included in an authorization list, an identifier corresponding a rule with which the subject data complies conforms to an appearance pattern of identifiers derived from a model. Here, the model is for determining whether the appearance pattern of the identifiers corresponding to rules each of which is complied with each of a plurality of pieces of communication data is normal or not. Accordingly, according to the present embodiment, in a method of performing attack determination using an additional another criterion on a communication packet determined to be normal using the authorization list, a feature is not calculated using a plurality of elements when one piece of communication data is to be determined using the feature corresponding to the plurality of elements relating to the one piece of communication data.

DESCRIPTION OF EMBODIMENTS

In the description and drawings of embodiments, the same elements and corresponding elements are denoted by the same reference sign. The description of elements denoted by the same reference sign will be suitably omitted or simplified. Arrows in the drawings mainly indicate flows of data or flows of processing. Further, “unit” may be suitably interpreted as “circuit”, “step”, “procedure”, “process”, or “circuitry”.

The present embodiment will be described in detail below with reference to the drawings.

*** Description of Configuration ***

FIG.1is a block diagram illustrating a functional configuration example of an attack detection apparatus100. The attack detection apparatus100includes a communication data acquisition unit110, an attack detection unit120, a pattern determination unit130, a final determination unit140, and a determination result output unit150, as illustrated inFIG.1. The attack detection unit120is also referred to as an authorization list type attack detection unit. The pattern determination unit130is also referred to as a rule number pattern determination unit.

The communication data acquisition unit110acquires communication data202.

The communication data202is communication data to be detected and is communication data to be input into the attack detection unit120.

The attack detection unit120determines whether or not the communication data202is data authorized by an authorization list122. The attack detection unit120executes for each of a plurality of pieces of communication data202as subject data, an attack detection process to determine whether or not the subject data complies with one of rules included in the authorization list122.

The authorization list122is a white list in which a characteristic of communication to be authorized is defined as a rule, and is data indicating an identifier of each rule and a list enumerating the characteristic of communication authorized by each rule. A specific example of the identifier of the rule is a rule number. The authorization list122usually includes a plurality of rules. A unique identifier has been assigned to each rule.

The pattern determination unit130determines communication data202determined to be data authorized by the authorization list122, based on a rule number206corresponding to the communication data202. When the subject data complies with one of the rules included in the authorization list122, the pattern determination unit130executes a pattern determination process to determine using a model relating to an appearance pattern of an identifier, whether or not an identifier corresponding to a rule with which the subject data complies conforms to the appearance pattern of the identifier derived from the model. The model is for determining whether or not the appearance pattern of the identifier corresponding to the rule with which each of the plurality of pieces of communication data202complies is normal or not. When the identifier corresponding to the subject data conforms to the appearance pattern of the identifier derived from the model, an identifier to be estimated from the appearance pattern as the identifier corresponding to the subject data is consistent with an identifier corresponding to the actual subject data, or a characteristic indicated in the appearance pattern is not inconsistent with a characteristic indicated in an appearance pattern of an identifier corresponding to each of all pieces of communication data202that have been received at a time when the subject data is received, as a specific example. The pattern determination unit130may learn the model relating to the appearance pattern of the identifier, using the plurality of pieces of communication data202determined to be normal and the appearance pattern of the identifier corresponding to each of the plurality of pieces of communication data202determined to be normal.

The rule number206is an identifier for each rule, and is used to check which rule included in the authorization list122the communication data202complies with when the communication data202is determined to be authorized communication.

The final determination unit140decides a final determination result by integrating a determination result205and a determination result303. When the pattern determination process is executed, the final determination unit140determines whether the subject data is normal or not, using a determination result through the attack detection process and a determination result through the pattern determination process. When the subject data is normal, the subject data is not data relating to an attack, as a specific example. When the subject data has been determined in the attack detection process not to comply with any of the rules included in the authorization list122, the final determination unit140determines that the subject data is not normal. When the subject data has been determined in the attack detection process to comply with one of the rules included in the authorization list122, the final determination unit140determines that the subject data is normal in a case where the identifier corresponding to the rule with which the subject data complies has been determined not to be consistent with the appearance pattern derived from the model in the pattern determination process.

The determination result205is data that indicates a result of determination by the attack detection unit120, and is data that represents whether the communication data202is authorized communication or not.

The determination result303is data that indicates a result of determination by the pattern determination unit130.

The determination result output unit150outputs the final determination result.

(a) ofFIG.2is a block diagram illustrating a functional configuration example of the attack detection unit120. The attack detection unit120includes a collation unit121and the authorization list122, as illustrated in (2) ofFIG.2.

The collation unit121determines whether communication according to the communication data202is authorized communication or not, by collating the communication data202with the authorization list122. The collation unit121outputs the determination result205and the rule number206.

(b) ofFIG.2illustrates a specific example of the authorization list122.

As illustrated in the present example, in the authorization list122according to the present embodiment, a rule number which is an identifier is assigned to each rule without duplication, and it is assumed that there is a one-to-one correspondence between the rule number and the rule. Further, it is assumed that the identifier is represented by an integer or a value that has a one-to-one correspondence with an integer. That is, it is assumed that the identifier can be treated as an integer in a computer.

On the other hand, a characteristic of communication is usually expressed in a format that combines a plurality of items whose types differ from each other, for the purpose of achieving relatively high accuracy in attack detection. In the present example, the characteristic of the communication consists of 7 items: a protocol; a transmission source Internet Protocol (IP) address; a transmission source port; a destination IP address; a destination port; a data length; and a payload. In such a manner, in the authorization list122according to the present embodiment, one identifier is assigned to one characteristic of communication which consists of a plurality of items. In terms of processing efficiency in a computer, it is obvious that it is more efficient to process one identifier than to process one characteristic of communication that is made up of a plurality of items whose types differ from each other, as a combination.

FIG.3is a block diagram illustrating a functional configuration example of the pattern determination unit130. The pattern determination unit130includes a model learning unit131, a model storage unit132, a determination unit133, and a model acquisition unit134, as illustrated inFIG.3.

The determination unit133determines whether the rule number206is normal or not, and outputs a determined result as the determination result303. In determining whether the rule number206is normal or not, the determination unit133collates the rule number with a rule number model. The rule number model is a modeled appearance pattern of a normal rule number.

The model learning unit131learns the rule number model, using a rule302corresponding to the normal communication data202as input.

The model acquisition unit134acquires the rule number model by external input.

The model storage unit132stores the rule number model learned by the model learning unit131or the rule number model externally acquired by the model acquisition unit134.

(a) ofFIG.4is a block diagram illustrating a functional configuration example of the final determination unit140. The final determination unit140includes a determination integration unit141as illustrated inFIG.4.

In the present embodiment, two types of determination results which are the determination result205by the attack detection unit120and the determination result303by the pattern determination unit130are obtained for the communication data202. The determination integration unit141decides a final determination result by integrating these two types of determination results, and outputs the decided determination result.

(b) ofFIG.4illustrates a specific example of processing of the determination integration unit141. The determination integration unit141adopts a method of calculating the logical sum of two pieces of input, as an integration method of the determination results, as a specific example. That is, when certain communication data202has been determined to be an attack by at least one of the attack detection unit120and the pattern determination unit130, the certain communication data202is finally determined to be an attack. Thus, if certain communication data202has been determined to be an attack by the attack detection unit120, the certain communication data202is determined to be an attack by the final determination unit140. Further, even if certain communication data202has been determined to be normal by the attack detection unit120, the certain communication data202is determined to be an attack by the final determination unit140if the certain communication data202has been determined to be an attack by the pattern determination unit130. Determining that the communication data202is an attack includes determining that communication corresponding to the communication data202is an attack.

A pattern of rule numbers will be described with reference toFIG.5. When normal packets are input one after another to the attack detection unit120, rule numbers each of which corresponds to each packet are output one after another from the attack detection unit120. The rule number corresponding to each packet is a rule number indicating a rule with which each packet complies.

(a) ofFIG.5represents a state in which, when a packet sequence501is input, a rule number sequence502that consists of rule numbers each of which corresponds to each packet of the input packet sequence501is output from the attack detection unit120. Here, the packet sequence501is assumed to consist of normal packets.

(b) ofFIG.5illustrates a specific example of a numerical sequence503. The numerical sequence503is an example of the rule number sequence502corresponding to the normal packet sequence501. (b) ofFIG.5represents a state in which, when normal packets are input to the attack detection unit120in the order of reception of the normal packets, the rule number corresponding to each of the input packets is output in the order of 0, 1, 0, 2, 1, 3, 4, 1, 5, . . . . Further, a graph504is a graph in which each element of the rule number sequence502is plotted with the time on the horizontal axis and the rule number on the vertical axis. The horizontal axis indicates the time at which a packet corresponding to each element of the rule number sequence502is received. Here, the regularity of the rule number sequence502appears as a geometric pattern in the graph504. In such a manner, in the present embodiment, by assigning a rule number to each rule included in the authorization list122, and associating each rule with each number, the regularity of rules corresponding to normal packets is obvious as the regularity of rule numbers.

FIG.6illustrates another specific example of a pattern of rule numbers.FIG.6is a histogram that represents the number of pieces of communication data202each of which corresponds to each rule number of the authorization list122at a time when a total of 100 pieces of normal communication data202is given. From this histogram, it can be seen that the majority (about 40 percent) of the normal communication data202corresponds to the rule number 1, the small portion (about 4 percent) of the normal communication data202corresponds to the rule number 8, and the like.

The model learning unit131learns a pattern of rule numbers such as above. A technique used by the model learning unit131for learning is arbitrary. However, it is known that a technique called Long Short Term Memory (LSTM) is suitable for time series data such as the graph504, as a specific example. Further, a histogram as illustrated inFIG.6can be generated by counting the number of pieces of communication data202each of which corresponds to each rule number.

Then, as described above, calculating a feature of a rule number expressed by one integer is more efficient in computer processing than calculating a feature of communication that consists of a plurality of items whose types differ from each other. Therefore, a learning cost can be reduced by learning a pattern of rule numbers.

FIG.7illustrates an operational example of the determination unit133. Here, it is assumed that 0, 1, 0, 2, 1, 3, 4, 1, 5, . . . as the order of rule numbers corresponding to normal communication data202is learned as a rule number model. The determination unit133predicts a rule number to be corresponded to normal communication data202to be received next, using the rule number model, and determines whether the rule number corresponding to the communication data202actually received during attack detection is correct or not, based on the predicted rule number.

Here, it is assumed that the rule numbers corresponding to the communication data202received during the attack detection are 0, 1, 0, 2, 1, 2 in the order in which the communication data202has been received. At this time, “2” which is the rule number corresponding to communication data202received last is not “3” which is the rule number to be corresponded to the communication data202. Therefore, the determination unit133determines that the communication data202is an attack. In the present example, it is determined to be an attack when the rule numbers are not exactly consistent. However, it does not need to be determined to be an attack even if the rule numbers are not exactly consistent. The rule number model may be a model indicating a statistical property or a probabilistic property of a pattern of rule numbers, and the determination unit133may determine to be an attack when the statistical property or the probabilistic property indicated in the model is inconsistent with the pattern of the rule numbers, as a specific example.

FIG.8illustrates a hardware configuration example of the attack detection apparatus100, and an example of a computer that implements the attack detection apparatus100. The present example illustrates a configuration in which a processor902, a main storage device903, an auxiliary storage device904, an input interface906, a display interface907, and a network interface908are connected to a data bus905, as seen in a general computer. The attack detection apparatus100may consist of a plurality of computers.

The processor902is an Integrated Circuit (IC) that performs arithmetic processing, and controls hardware included in the computer. A specific example of the processor902is a Central Processing Unit (CPU), a Digital Signal Processor (DSP), or a Graphics Processing Unit (GPU).

A plurality of processors may be included as an alternative to the processor902. The plurality of processors shares the role of the processor902.

The main storage device903is typically a volatile memory device, and is, as a specific example, a Random Access Memory (RAM). The main storage device903is also referred to as a main memory. Data stored in the main storage device903is saved in the auxiliary storage device904as necessary.

The auxiliary storage device904is typically a non-volatile storage device, and is, as a specific example, a Read Only Memory (ROM), a Hard Disk Drive (HDD), or a flash memory. Data stored in the auxiliary storage device904is loaded into the main storage device903as necessary.

The input interface906is a port to which an input device is connected, and is, as a specific example, a Universal Serial Bus (USB) terminal. Specific examples of the input device are a keyboard and a mouse.

The display interface907is a port to which a display device is connected, and is, as a specific example, a High-Definition Multimedia Interface (HDMI, registered trademark) terminal. A specific example of the display device is a display.

The network interface908is a receiver and a transmitter. A specific example of the network interface908is a communication chip or a Network Interface Card (NIC).

Processing of the attack detection unit120, the pattern determination unit130, and the like is implemented as the attack detection program which is a software program, and the attack detection program is usually held in the auxiliary storage device904. The attack detection program is read by the processor902into the faster main storage device903, and executed.

The attack detection program may be recorded on a computer readable non-volatile recording medium. A specific example of the non-volatile recording medium is an optical disc or a flash memory. The attack detection program may be provided as a program product.

Data used when the attack detection program is executed, data and the like obtained by executing the attack detection program are stored in a storage device as appropriate. Each unit of the attack detection apparatus100uses the storage device as appropriate. The storage device consists of at least one of the main storage device903, the auxiliary storage device904, a register in the processor902, and a cache memory in the processor902, as a specific example. Data and information may have the same meaning. The storage device may be independent of the computer.

When attack detection is performed in real time, the communication data202to be acquired by the communication data acquisition unit110is acquired from the network interface908. On the other hand, when the attack detection is performed on the communication data202that has been acquired in the past, it is also conceivable to acquire the communication data202held in the auxiliary storage device904. A result of the attack detection may be virtually displayed by the display interface907or may be notified to a remote operator via the network interface908. Further, the input interface906may be used for the purpose of a setting of the attack detection apparatus100or the like. Editing the authorization list122and the rule number model, or the like is conceivable as a specific example of the setting of the attack detection apparatus100.

When the attack detection apparatus100is implemented in a form such as a router as a specific example, the attack detection apparatus100may not have the input interface906, the display interface907, and the like. Further, it is also conceivable that a part or all of the attack detection process may be implemented as hardware rather than software. In this case, it is conceivable that the attack detection apparatus100is an apparatus that includes a logic circuit such as a Field Programmable Gate Array (FPGA).

*** Description of Operation ***

An operational procedure of the attack detection apparatus100is equivalent to an attack detection method. Further, a program that implements operation of the attack detection apparatus100is equivalent to an attack detection program.

FIG.9is a flowchart illustrating an example of the overall operation of the attack detection apparatus100. The operation of the attack detection apparatus100will be described with reference toFIG.9.

The communication data acquisition unit110acquires the communication data202subject to attack detection.

The collation unit121collates the acquired communication data202with the authorization list122.

When the acquired communication data202complies with one of the rules included in the authorization list122, the attack detection apparatus100proceeds to step S806. In other cases, the attack detection apparatus100proceeds to step S804.

The collation unit121determines that the acquired communication data202is an attack.

The determination integration unit141performs final determination by integrating the determination result by the collation unit121and the determination result by the determination unit133. When there is no determination result by the determination unit133, the determination integration unit141performs the final determination without using the determination result by the determination unit133.

The determination integration unit141outputs data indicating a result of performing the final determination.

Step S806consists of steps S807to S812. After the process of step S806is completed by the determination unit133, the attack detection apparatus100proceeds to step S805.

The determination unit133acquires the rule number corresponding to the acquired communication data202.

The determination unit133reads the rule number model from the model storage unit132, and determines whether or not the acquired rule number conforms to the read rule number model.

The model learning unit131updates the rule number model by learning the rule number acquired in step S807in parallel with the process of step S808.

In step S808, when the acquired rule number has been determined not to conform to the read rule number model, the determination unit133proceeds to S811. In other cases, the determination unit133proceeds to step S812.

The determination unit133determines that the acquired communication data202is an attack.

The determination unit133determines that the acquired communication data202is not an attack.

Description of Effects of Embodiment 1

As described above, according to the present embodiment, by assigning a unique identifier to each of rules included in the authorization list122, a feature of the communication data202which is usually represented by a plurality of items whose types differ from each other, is represented by a single identifier, and the represented identifier is subject to learning. Therefore, a cost of learning a sequence or a statistical characteristic of normal communication, and the like can be reduced.

Further, according to the present embodiment, in authorization list type attack detection, a process of extracting the feature to be learned is implemented by a process of acquiring an identifier corresponding to a rule with which the communication data202complies. Therefore, according to the present embodiment, a cost of extracting the feature necessary for learning can be reduced.

Accordingly, according to the present embodiment, attack detection with relatively high accuracy can be realized with a relatively small amount of calculational resources, in attack detection that combines authorization list type attack detection and attack detection by learning.

Other Configurations

FIG.10illustrates a hardware configuration example of the attack detection apparatus100according to the present modification.

The attack detection apparatus100includes a processing circuit909in place of the processor902, the processor902and the main storage device903, the processor902and the auxiliary storage device904, or the processor902, the main storage device903, and the auxiliary storage device904.

The processing circuit909is hardware that implements at least a part of each unit included in the attack detection apparatus100.

The processing circuit909may be dedicated hardware, or may be a processor that executes a program stored in the main storage device903.

When the processing circuit909is the dedicated hardware, a specific example of the processing circuit909is a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), or a combination thereof.

The attack detection apparatus100may include a plurality of processing circuits as an alternative to the processing circuit909. The plurality of processing circuits share the rile of the processing circuit909.

In the attack detection apparatus100, some functions may be implemented by the dedicated hardware, and the remaining functions may be implemented by software or firmware.

The processing circuit909is implemented by, as a specific example, hardware, software, firmware, or a combination of thereof.

The processor902, the main storage device903, the auxiliary storage device904, and the processing circuit909are collectively referred to as “processing circuitry”. That is, the functions of the individual functional components of the attack detection apparatus100are implemented by the processing circuitry.

The attack detection apparatus100according to other embodiments may also have the same configuration as that of the present modification.

In the following, differences from the embodiment described above will be mainly described with references with the drawings.

*** Description of Configuration ***

In Embodiment 1, by learning a pattern of identifiers corresponding to the normal communication data202, a pattern of the normal communication data202is learned relatively efficiently. However, according to Embodiment 1, it is not obvious how to select an appropriate learning technique at a time when each of various possible patterns of the normal communication data202is given. Here, when information relating to a specification of a subject system is available, the meaning of each rule, a possible pattern of an identifier, and the like can be known in advance from the information. Therefore, in this case, it is possible to select a learning technique suitable for each pattern of rule numbers, to generate a rule number model directly without using a learning technique, or the like. The present embodiment aims to use the information relating the specification of the subject system.

FIG.11is a block diagram illustrating a functional configuration example of the pattern determination unit130according to the present embodiment. The pattern determination unit130further includes a learning technique selection unit135and pattern classification information136, as illustrated inFIG.11. The pattern determination unit130selects a method of learning a model relating to an appearance pattern of identifiers, depending on a classification of the appearance pattern of the identifiers corresponding to each of the plurality of pieces of the communication data202determined to be normal.

The pattern classification information136is information to be generated based on specification information137, and is information indicating the pattern classification.

The specification information137is information that can be obtained in advance, and is information indicating the specification or the like of the subject system.

The learning technique selection unit135selects a learning technique suitable for a pattern of rule numbers, using the pattern classification information136.

The model learning unit131learning a rule number model, using the learning technique selected by the learning technique selection unit135.

The rule number model can be created in advance based on the specification information137. When the rule number model has been created in advance, the model acquisition unit134may acquire the created rule number model.

FIG.12illustrates a specific example of the pattern classification information136. The meaning of each of pattern classifications will be described with reference toFIG.13.

FIG.13illustrates specific examples of the pattern classifications.FIG.13illustrates each pattern with cyclic transmission21, a command/response22, a limited number23, transient transmission24, data regularity25, and rare communication26, as a specific example of the pattern classification. Further,FIG.13illustrates a specific example of each pattern.

In a control system, a distinction is sometimes made between two types of communication by referring to communication that occurs periodically as cyclic transmission and communication that occurs arbitrarily as transient transmission, as a specific example.

The cyclic transmission21illustrates that the communication data202corresponding to a rule number 3 appears at one-minute intervals. A learning technique suitable for periodic data or time-series data is selected for such a pattern of communication, as a specific example. Here, the pattern illustrated in the graph504ofFIG.5can also be considered as cyclic transmission. A plurality of rule numbers as a whole illustrate a periodic pattern in the graph504. Therefore, when using the graph504as learning data, the model learning unit131may learn a pattern for the whole of the plurality of rule numbers. On the other hand, in this case, the model learning unit131may learn the individual rule numbers separately by treating them as a superposition of a plurality of rule numbers each of which has periodicity.

Unlike the cyclic transmission, the rule numbers and time intervals that appear are usually irregular in the transient transmission, as illustrated in the transient transmission24. Therefore, when the communication is the transient transmission, there is a high possibility that the same learning technique as a learning technique used when the communication is the cyclic transmission is not suitable.

In the transient transmission24, the communication data202is assumed to be generated by manual operation, and it is conceivable to learn a state in which appearance intervals of rule numbers are not constant and the appearance intervals vary widely, as a specific example.

The command/response22represents a pattern of rule numbers corresponding to command/response type communication. In the command/response type communication, when a Read command is transmitted from a control apparatus to a device, a value of a sensor is transmitted from the device to the control apparatus, as a response to the Read command, as a specific example.

The command/response22represents a simple command/response in which the communication data202corresponding to a rule number 1 and the communication data202corresponding to a rule number 2 make one round trip.

More generally, when the communication data202appears as a communication protocol according to a predetermined rule, a technique of learning the rule as a state transition diagram may be selected. Further, a case where the communication protocol is defined in advance as the state transition diagram is also conceivable as the specification information137. In this case, the model acquisition unit134may acquire the defined state transition diagram.

The limited number23represents a pattern in which there is a limit on the number of times that communication corresponding to a rule number 4 is authorized in a certain period. Operation in which communication of a password authentication request is only authorized up to three times within one hour, that is, operation in which the password authentication is not executed for a certain period of time if the password authentication fails three times within one hour, is implemented in the limited number23. Although such a limited number relating to the password authentication needs to be originally implemented as an authentication system, the limited number is illustrated here as a specific example.

The data regularity25represents communication in which a rule number200transmits temperature data. The data regularity25represents that a temperature indicated in the temperature data fluctuates significantly from 0 to 90 to 50. Here, the significant fluctuation in the temperature acquired by the same sensor in a short period of time is not normal behavior. Therefore, when a value indicated in the communication data202fluctuates significantly, the determination unit133can determine that the communication data202is an attack. In such a case, the learning technique selection unit135can select a technique of leaning a model relating to a system being monitored and controlled using the communication data202, as a specific example, a model relating to a temperature change. In the data regularity25, when a value relating to communication does not change unnaturally at all, the communication may be determined to be an attack.

The rare communication26represents communication in which communication data202corresponding to a rule number1000is rarely received. Learning of a statistical model as illustrated inFIG.6is conceivable for such communication. This may be used to determine the correctness of an appearance frequency of a rule number that appears rarely, and to determine rare communication data202as an attack in order to urge caution against receiving the rare communication data202even if the rare communication data202corresponds to normal communication.

Although each pattern has been described as being independent, a combination of several patterns is also possible. While certain communication is based on the pattern of the command/response, it is sufficiently conceivable that regularity appears in the communication data202to be exchanged in the certain communication, as a specific example.

The pattern classifications described above are only examples. In such a manner, there are various patterns possible for normal communication data202in a subject system. A model with high accuracy can be learned when the communication data202that complies with the various patterns is learned by different techniques each of which is suitable for each pattern, rather than the communication data202being learned collectively by a single learning technique. A case where two pieces of learning data are generated without mixing two types of communication data202is more reasonable than a case where learning data is generated by mixing communication data202of the cyclic transmission and communication data202of the transient transmission, which have completely different characteristics, as a specific example. A point of the present embodiment is to generate the pattern classification information136in advance based on the specification information137for the purpose of learning a model with higher accuracy, and to be able to select an appropriate learning technique for each rule number based on the generated pattern classification information136.

Description of Effects of Embodiment 2

As described above, when the specification information137of a subject system is available in advance, the pattern classification information136can be generated by classifying in advance communication patterns that may occur in the subject system. Thus, the learning technique selection unit135that selects a learning technique using the pattern classification information136is provided in the present embodiment. This makes it possible to select the appropriate learning technique depending on a communication pattern corresponding to packets. Therefore, accuracy of attack detection through learning can be increased.

Further, according to the present embodiment, learning techniques can be separated for each pattern of packets. Therefore, in implementation of a computer, it is easy to execute processing relatively efficiently, by assigning a process corresponding to each pattern to a separate thread, a CPU, or the like.

In the following, differences from the embodiments described above will be mainly described with reference to the drawings.

*** Description of Configuration ***

In Embodiments 1 and 2, it is assumed that rules each of which defines a characteristic of the communication data202that is considered to be normal are listed sequentially and that a unique identifier is assigned to each rule, as a data structure of the authorization list122. However, there is no particular order in which the rules are listed. Therefore, a method of checking the rules sequentially from the top of the rules is conceivable as a method of searching for a rule corresponding to the communication data202to be detected. Since the processing time in this method increases in proportion to the number of rules. this method is not suitable in such a case where the number of rules included in the authorization list122is large. Thus, it is conceivable to use a hash table, as the data structure and a search method of the authorization list122that is not affected by the number of rules. In the present embodiment, the hash table is used in the authorization list122.

FIG.14is a diagram for explaining an example of a collation method of the authorization list122, using the hash table.

When the attack detection unit120according to the present embodiment collates subject data with each rule included in the authorization list122, the attack detection unit120collates a hash value corresponding to the subject data with a value corresponding to each rule included in the authorization list122.

A hash function31is designed to output a value equal to or greater than 1 and less than or equal to N (N is a positive integer) by calculation on an input value, and is also designed to perform the calculation at high speed.

Further, a hash table34is designed to be accessible, using a subscript equal to or greater than 1 and less than or equal to N. In particular, at a position accessed using a hash value33corresponding to authorized communication data202, as the subscript, a rule corresponding to the communication data202is stored.

InFIG.14, when communication data202is given, 1 is calculated as the hash value33by the hash function31, and the subscript to be accessed is found to be 1. Here, a rule35is stored in the hash table34, as a rule corresponding to a subscript 1. Therefore, the communication data202is found to be communication authorized by the authorization list122.

On the other hand, when the hash value33corresponding to communication data202is 2, there is no data corresponding to a subscript 2 in the hash table34. Therefore, in this case, the communication data202is found to be unauthorized communication. On the premise that the calculation of the hash function31is performed at high speed, a collation process using the hash table34can be performed at high speed.

However, in search for data using the hash table34, it is necessary to consider the possibility that the hash values33are consistent with each other for inputs that differ from each other. Here, in the hash table34illustrated inFIG.14, there are two pieces of rules36which are rules corresponding to a subscript 3. This means that the hash values33corresponding to the communication data202corresponding to each of these two pieces of the rules36are consistent with each other.

Further,FIG.15illustrates another specific example where the hash values33for inputs that differ from each other are consistent with each other. In the present example, both of the hash value33of the authorized communication data202and the hash value33of the unauthorized communication data202are 1, and are consistent with each other. Here, although the unauthorized communication data202needs to be determined to be an attack, simply checking for the presence of a rule corresponding to the subscript 1 in the hash table34results in the communication data202being erroneously determined to be authorized communication.

Accordingly, when communication data202collates with the authorization list122, it is necessary to first check to see if there is a rule in the hash table34with the hash value33corresponding to the communication data202, as the subscript, and then to check to see if the checked rule actually corresponds to the communication data202. As a result, by collating a rule43corresponding to the subscript 1 with the unauthorized communication data202, and checking that they do not conform with each other, the collation unit121can finally determine that the communication data202is an attack, for example.

In the hash table34described above, since a subscript used to access each rule is not unique, the subscript cannot be learned as a rule number. Thus, data stored in the hash table34includes unique rule numbers in addition to rules.

In the hash table34illustrated inFIG.16, a rule51and a rule number52corresponding to the rule51are stored for the subscript 1, as a specific example. Further, a rule53and a rule number54corresponding to the rule53are stored for the subscript 3. There are two pieces of rules each of which corresponds to the subscript 3, and a unique rule number is assigned to each rule. Although a decision method of a rule number varies, an integer with a subscript K in the tens digit and used to access the hash table34is assigned as a rule number, in the example illustrated inFIG.16. As a result, if there are 10 or less rules whose corresponding subscripts conform with each other, a unique rule number can be assigned to each rule.

FIG.17illustrates a specific example of packets generated in response to temperature data. In the present example, the temperature data is represented in the payload portion. When application data or the like is represented in the payload portion as in the present example, the payload portion changes depending on the application data or the like. However, the communication data202except for the payload portion is often unchanged. When a rule that authorizes such communication data202is stored in the hash table34, the efficiency is reduced because the data in the hash table34is huge if the rule is prepared for each possible value of the communication data202. Thus, when the payload portion represents the application data or the like, and the communication data202that does not change except for the payload portion is handled, the portion other than the payload portion is set as a rule. a unique rule number is assigned to each rule, and the hash table34manages each rule to which the unique rule number has been assigned. Further, the validity of a value in the payload portion is verified by a different method from the method using the hash table34. The different method is the same as the method illustrated in the data regularity25ofFIG.13.

Description of Effects of Embodiment 3

As described above, according to the present embodiment, even when the hash table34is used as a data structure and a search method of the authorization list122, a unique rule number is assigned to each rule. Further, according to the present embodiment, a rule on a portion other than a payload portion is generated for such communication data202in which application data or the like is represented in the payload portion. Therefore, the same learning as the learning described in Embodiments 1 and 2 can be applied to the present embodiment.

Other Embodiments

Each of the above described embodiments can be freely combined, or any component of each of the embodiments can be modified. Alternatively, any component can be omitted in each of the embodiments.

Alternatively, the embodiments are not limited to those presented in Embodiments 1 to 3, and various modifications can be made as needed. The procedures described using the flowcharts or the like may be suitably modified.

REFERENCE SIGNS LIST