Cross-ministerial Strategic Innovation Promotion Program (SIP)

Hitachi

1-3 Enhancement of Security Resistance of the Control System by Early
Detection of Intrusion/Attacks
Operation
monitoringand analysis
technologies

Detects unauthorized operation that is hard to detect in the control system
where availability is considered important.

Features Enhancement of system immunity by monitoring subtle changes in operationI.

Detection of unauthorized operation lurking in normal operation.

Even in the case of an authenticated operation that is hard to notice using existing technology, a subtle change that
occurs in the control system is detected (integrated soundness determination technology).

II. Monitoring suitable for the characteristics of the control system
A subtle change is detected by learning and modeling the characteristics of the control system from the communication
state and then monitoring the operation (operation monitoring technology). A system where availability is considered
importance can be introduced with minimum influence.

Issues in the Current Critical Systems
With a growing number of unknown viruses and intrusions in a more sophisticated way, it is now difficult to prevent
all intrusions by solely using intrusion prevention and attack defense technologies. There are intrusion and attack
risks on the rise in control systems not directly connected to an external network. Therefore, intrusion/attacks
detecting technologies suitable for the control system are needed in case of intrusion.

Technologies for Solving the Issues
Integrated soundness determination technology
Integrated soundness determination
Relevance analysis
Small change

Small change

Small change

Operation monitoring

Operation monitoring

Monitor communication
Status of the information/control network

Monitor communication
Status of the controlnetwork

Communication status

Communication status

Operation monitoring technology
Adapted to the control system
The normal state is learned and modeled according to thecharacteristics of the control system. It is possible to select thecommunication status monitoring/application behavior
monitoring according to the application destination.
InternetMonitor the operationof application

Information/control network

Information/control network

Control network

Control system

Communication
statusmonitoring

Application
behavior
monitoring

Control network

Comprehensive determination of unauthorized operation
using small changes

Communication status monitoring

Application behavior monitoring

Analysis of relevance of small changes reveals
unauthorized operation that may have slipped pastwhen looking at a single change and suppresses
excessive invalid determination.

Monitors the communication
status in real time and detects
small changes throughcomparison with the model.

Captures the activities within thedevice that is not shown in thecommunication status and detects
small changes.

Implementation Status/Schedule
Verification was performed in collaboration with the critical infrastructure company in the end of FY2017, and the technology whose researchand development had been completed ahead of the others was already commercialized in FY2017 (product: Hitachi Anomaly Detector).
Hitachi continues conducting related activities after that and will plan to commercialize products of the results of ongoing researches.
© Hitachi, Ltd. 2020. All Rights Reserved.

Cross-ministerial
Cross-ministerialStrategic
StrategicInnovation
InnovationPromotion
PromotionProgram
Program(SIP)(SIP)

Hitachi

1-3 Enhancement of Security Resistance of the Control System by Early
Detection of Intrusion/Attacks
Commercialization of the technology with its research and development completed ahead of the others- Hitachi Anomaly Detector -SIP cyber preceding R&D technologyAudit shields in depth

System where old and new devices coexistCollectReport
Multiple audit algorisms in depth with operations made white

Maintenancepersonnel

SIP technology incorporated

Analyze1)

DetectLearn

Social infrastructure supporting living
Making use of know-hows on the control system accumulated for years, Hitachi
makes operations white from diversified perspectives.

Real-time detection of unknown threats by algorithms focusing on each operation<Features> (i)(ii) Analysis of business communications and self-learning of normal business communications fromscratch(iii) Availability of the product independent of the device model or OS version connected to the system

Protect safe operationof the system

How to Apply R&D Technologies
Use ofExternal institution information CSIRT (supported organization)

Guideline for each phase
Build (check)

Design

Early response

・JPCERT, NISC,・IPA or others
・Security vendor

Information
sharing

CSIRT of other companies

Policy formulation
Response determination

ReportProtect by organization

Instruct

SOC
Incident monitoring/response

Build (preparation)
Build(introduction)

Incident or other events

Operation

Multi-layered
defense

Detection device(SIP result)
Network

Detection device(SIP result)

Network

Detection device(SIP result)・・・

Protect by system

Control system

Describes key points of how to design/build
security systems, organization structure, operation
design, and other technical aspects.

Control system

・Detection devices are incorporated into the control system in the field
to detect every small change as an incident.
・Incidents are monitored in SOC2) and comprehensive determination ismade for taking early response actions..

Presentation Overview○Experience the display of incidents detected by the detection devices and how to operate the system.
<Image of the control system><Configuration example of detection devices>

Reconnaissance bymalware infection orother system compromiseInformation
network
Datamanagement
serverControlmanagement
server

Maintenance
operation server

Information control network
Collection and analysis server

Information control
networkBusiness interference byblocking communicationor other interferences

Monitoring
serverControl server

Control network
Collection and analysis monitoring server

Controlnetwork
PC in the field

PC in the field

PC in the field
Simulated attack

1) OT: Operational Technology
2) SOC: Security Operation Center(i) Perform simulated attack

Inter-network comprehensive analysis
monitoring server/Comprehensive
soundness determination server

Operation
monitoring
terminal(ii) The simulated attack that has been detected isdisplayed on the operation screen, enabling operationfrom the operator’s viewpoint.

© Hitachi, Ltd. 2020. All Rights Reserved.