Patent Number: 
Section: claims

1. A computer-implemented method comprising:receiving, by a processor, measurement data from each of a plurality of measurement targets in a system comprising a plurality of industrial control systems;computing, by the processor, a plurality of sets of anomaly values based on the measurement data and a computation algorithm according to a plurality of classifications corresponding to a plurality of properties of each measurement target;computing, by the processor, an anomaly pattern using the plurality of sets of anomaly values computed based on the measurement data and the computation algorithm according to the plurality of classifications corresponding to the plurality of properties of each measurement target;determining, by the processor, a situation of the system based on the anomaly pattern, wherein a determination of the situation of the system is made by comparing the anomaly pattern with previously stored anomaly; andimplementing a countermeasure action based at least in part on the situation of the system,wherein the computation algorithm is selected from a plurality of computation algorithms based on a type of the measurement data. 2. The method according to claim 1, wherein at least one of the classifications is a hierarchical classification. 3. The method according to claim 1, wherein determining further comprises:determining the situation of the system by comparing predetermined patterns of the sets of anomaly values corresponding to each situation of the system with the computed sets of anomaly values. 4. The method according to claim 1, wherein determining further comprises:determining the situation of the system by comparing predetermined patterns of the sets of anomaly values corresponding to each situation of the system with simplified forms of the computed sets of anomaly values. 5. The method according to claim 1, wherein determining further comprises:comparing predetermined patterns of the sets of anomaly values corresponding to each situation of the system with simplified forms of the computed sets of anomaly values and determining a situation corresponding to patterns with highest degrees of similarity as the situation of the system. 6. The method according to claim 1, wherein determining further comprises:determining the situation of the system based on changes over time in the sets of anomaly values. 7. The method according to claim 1, wherein the plurality of properties is at least one of: a function, a network configuration, a type, or an installation location of each measurement target, a management organization of the installation location, or a security level of the installation location. 8. The method according to claim 1, wherein computing further comprises:computing a first set of anomaly values based on the measurement data and the computation algorithm according to a first classification corresponding to a first property of each measurement target, and computing a second set of anomaly values based on the measurement data and the computation algorithm according to a second classification corresponding to a second property of each measurement target;and wherein determining further comprises:determining the situation of the system based on the first set of anomaly values, the second set of anomaly values, and a predetermined determination algorithm. 9. The method according to claim 8, wherein computing further comprises:computing a set of network anomaly values based on the measurement data and the computation algorithm according to a network hierarchical structure corresponding to a network configuration of the measurement targets, and computing a set of location anomaly values based on the measurement data and the computation algorithm according to a location hierarchical structure corresponding to installation locations of the measurement targets;and wherein determining further comprises:determining the situation of the system based on the set of network anomaly values, the set of location anomaly values, and a predetermined determination algorithm. 10. The method according to claim 8, wherein computing further comprises:computing a third set of anomaly values based on the measurement data and the computation algorithm according to a third classification corresponding to a third property of each measurement target;and wherein determining further comprises:determining the situation of the system based on the first set of anomaly values, the second set of anomaly values, the third set of anomaly values, and a predetermined determination algorithm. 11. The method according to claim 10, wherein computing further comprises:computing a set of type anomaly values based on the measurement data the computation algorithm according to a hierarchical structure corresponding to types of the measurement targets, computing a set of location anomaly values based on the measurement data and the computation algorithm according to a hierarchical structure corresponding to installation locations of the measurement targets, and computing a set of security anomaly values based on the measurement data and the computation algorithm according to a structure corresponding to security levels of the installation locations of the measurement targets;and wherein determining further comprises:determining the situation of the system based on the set of type anomaly values, the set of location anomaly values, the set of security anomaly values, and a predetermined determination algorithm. 12. The method according to claim 1, further comprising:displaying a determination result of the situation of the system to a user. 13. The method according to claim 1, further comprising:displaying the sets of anomaly values and a determination result of the situation of the system to a user. 14. The method according to claim 1, wherein the plurality of industrial control systems each comprise different device types or are located in different geographic locations. 15. The method according to claim 1, wherein the type of the measurement data is one of numerical data and event data. 16. The method according to claim 15, wherein, when the type of the measurement data is numerical data, the plurality of computation algorithms is selected from the group consisting of a Hotelling's T2 algorithm, a one-class support vector machine (SVM) algorithm, and a local outliner factor algorithm. 17. The method according to claim 15, wherein, when the type of the measurement data is event data, the plurality of computation algorithms is selected from the group consisting of an infrequent pattern mining algorithm, a Naive Bayes algorithm, and a hidden Markov algorithm. 18. A computer program product comprising a non-transitory storage medium readable by a processing circuit and storage instructions for execution by the processing circuit for performing a method comprising:receiving measurement data from each of a plurality of measurement targets in a system comprising a plurality of industrial control systems;computing a plurality of sets of anomaly values based on the measurement data and a computation algorithm according to a plurality of classifications corresponding to a plurality of properties of each measurement target;computing an anomaly pattern using the plurality of sets of anomaly values computed based on the measurement data and the computation algorithm according to the plurality of classifications corresponding to the plurality of properties of each measurement target; anddetermining a situation of the system based on the anomaly pattern, wherein a determination of the situation of the system is made by comparing the anomaly pattern with previously stored anomaly patterns; andimplementing a countermeasure action based at least in part on the situation of the system,wherein the computation algorithm is selected from a plurality of computation algorithms based on a type of the measurement data. 19. A system, the system comprising:a processor in communication with one or more types of memory, the processor configured to:facilitate an input unit to receive measurement data from each of a plurality of measurement targets in the system comprising a plurality of industrial control systems;facilitate a computation unit tocompute a plurality of sets of anomaly values based on the measurement data and a computation algorithm according to a plurality of classifications corresponding to a plurality of properties of each measurement target;compute an anomaly pattern using the plurality of sets of anomaly values computed based on the measurement data and the computation algorithm according to the plurality of classifications corresponding to the plurality of properties of each measurement target;facilitate a determination unit to determine the situation of the system based on the anomaly pattern, wherein a determination of the situation of the system is made by comparing the anomaly pattern with previously stored anomaly patterns; andimplement a countermeasure action based at least in part on the situation of the system,wherein the computation algorithm is selected from a plurality of computation algorithms based on a type of the measurement data. 20. The system of claim 19, wherein the processor is further configured to:facilitate a storage unit to store the computation algorithm and the determination algorithm. 21. The system of claim 20, whereinthe storage unit stores sets of anomaly values and situations of the system, each situation being associated with corresponding sets of anomaly values; andthe determination unit determines the situation of the system by comparing the computed sets of anomaly values with the stored sets of anomaly values. 22. The system of claim 20, whereinthe storage unit stores simplified patterns of sets of anomaly values and situations of the system, each situation being associated with corresponding simplified patterns; andthe determination unit determines the situation of the system by comparing the computed sets of anomaly values with the stored patterns. 23. The system of claim 19, wherein the processor is further configured to:facilitate an output unit to display a determination result of the situation of the system to a user.