Patent Publication Number: US-2022217159-A1

Title: Detection method, detection system, and detection program

Description:
TECHNICAL FIELD 
     The present invention relates to a detection method, a detection system and a detection program. 
     BACKGROUND ART 
     Recently, cases where a network is used for a control system that performs feedback control based on sensor data have been increasing. Along with the increase, the risk of cyber attacks is increasing. Especially, a replay attack that performs tampering with use of past sensor data to pretend that an operation is being normally performed is difficult to detect, and measures are required. 
     Therefore, in order to detect the replay attack, technology called watermark is proposed in which micro white noise is added to a control input to monitor a response of sensor data (see Non-Patent Literature 1). 
     CITATION LIST 
     Non-Patent Literature 
     Non-Patent Literature 1: Yilin Mo, Rohan Chabukswar, Bruno Sinopoli, “Detecting Integrity Attacks on SCADA Systems”, IEEE Transactions on Control System Technology, Volume 22, Issue 4, July 2014, P. 1396-1407 
     SUMMARY OF THE INVENTION 
     Technical Problem 
     According to the conventional technology, however, there is a possibility that parameter identification of a control system by an attacker becomes highly accurately possible. In other words, when white noise is added to a control input, the control input may have variation that is large enough to satisfy identifiability conditions of an algorithm, thereby allowing an attacker to identify parameters with significantly higher accuracy. 
     When parameters of a control system are identified by an attacker, a confidentiality problem that design information about the control system leaks occurs. Further, there is a possibility that the attacker accurately calculates an estimate of sensor data using the identified control system and performs tampering to pretend that an operation is being normally performed, at a higher level than a replay attack, and detection becomes further difficult. 
     The present invention has been made in view of the above description, and an object is to make parameter identification of a control system by an attacker difficult and detect a replay attack. 
     Means for Solving the Problem 
     In order to solve the problem described above and achieve the object, a detection method according to the present invention is a detection method executed in a detection system comprising a sensor and a controller, the detection method including: a state estimation process of the controller calculating, using sensor data indicating a state of a control target outputted from the sensor and a control input to control the state of the control target, an estimate of the state of the control target; and a calculation process of the controller calculating the control input to which colored noise in a predetermined frequency band is added, according to the calculated estimate of the state of the control target. 
     Effects of the Invention 
     According to the present invention, it becomes possible to make parameter identification of a control system by an attacker difficult and detect a replay attack. 
    
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         FIG. 1  is a schematic diagram showing an overview configuration of a detection system according to the present embodiment. 
         FIG. 2  is a diagram for explaining an attack by an attacker. 
         FIG. 3  is a diagram for explaining an attack by an attacker. 
         FIG. 4  is a flowchart showing a detection process procedure by the detection system according to the present embodiment. 
         FIG. 5  is a diagram for explaining an example. 
         FIG. 6  is a diagram for explaining an example. 
         FIG. 7  is a diagram showing an example of a computer to execute a detection program. 
     
    
    
     DESCRIPTION OF EMBODIMENTS 
     An embodiment of the present invention will be described below in detail with reference to drawings. Note that the present invention is not limited by this embodiment. In the drawings, the same portions are shown being given the same reference sign. 
     [Configuration of Detection System] 
       FIG. 1  is a schematic diagram showing an outline configuration of a detection system according to the present embodiment. A detection system  1  is a control system that performs feedback control of a state of a control target  2 , for example, a heat engine or the like according to a current state. As illustrated in  FIG. 1 , the detection system  1  has the control target  2 , a sensor  3 , a controller  4  and an actuator  5 . 
     The sensor  3  is a sensor, such as a temperature sensor, to measure the state of the control target  2 , and outputs sensor data obtained by sensing physical information indicate the state of the control target  2 , to the controller  4  via a network. The sensor  3  is realized, for example, by an MPU (micro processing unit), an FPGA (field programmable gate array) or the like. 
     The controller  4  calculates a control input to control, for example, the actuator  5  for the control target  2 , such as a valve, using the sensor data received from the sensor  3 . In the present embodiment, the controller  4  calculates a control input to which colored noise in a predetermined frequency band is added, according to an estimate of the state of the control target  2  calculated using the sensor data indicating the state of the control target  2 , which has been outputted from the sensor  3 , and the control input to control the state of the control target  2 . 
     Specifically, the controller  4  is realized by a general-purpose computer, for example, a personal computer or the like, and a control unit such as a CPU (central processing unit) executes a processing program stored in a memory. Thereby, the control unit functions as a state estimation unit  4   a , a calculation unit  4   b  and a detection unit  4   c  as shown in  FIG. 1 . Each of or a part of these functional units may be implemented in different hardware. For example, the detection unit  4   c  may be implemented in a device different from the controller  4 . 
     Further, in the controller  4 , a communication control unit not shown, which is realized by an NIC (network interface card), controls communication between the control unit and external devices such as the control target  2  and the sensor  3  via the network. The controller  4  is provided with a storage unit not shown, which is realized by a semiconductor memory device, such as a RAM and a flash memory, or a storage device such as a hard disk and an optical disk. 
     Here, a state x(k) (hereinafter also referred to as x k ) of the control target  2  at discrete time k is indicated with the following expression (1). Here, (k+1) means time one step after K; and w(k) represents modeled noise. 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     [ 
                     
                       Math 
                       . 
                       
                           
                       
                       ⁢ 
                       1 
                     
                     ] 
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     x 
                     ⁡ 
                     
                       ( 
                       
                         k 
                         + 
                         1 
                       
                       ) 
                     
                   
                   = 
                   
                     
                       A 
                       ⁢ 
                       
                         x 
                         ⁡ 
                         
                           ( 
                           k 
                           ) 
                         
                       
                     
                     + 
                     
                       
                         Bu 
                         ⁡ 
                         
                           ( 
                           k 
                           ) 
                         
                       
                       
                         CONTROL 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         INPUT 
                       
                     
                     + 
                     
                       
                         w 
                         ⁡ 
                         
                           ( 
                           k 
                           ) 
                         
                       
                       
                         MODELED 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         NOISE 
                       
                     
                   
                 
               
               
                 
                   ( 
                   1 
                   ) 
                 
               
             
           
         
       
     
     In this case, sensor data y(k) (hereinafter also referred to as y k ) outputted by the sensor  3  is indicated by the following expression (2). Here, v(k) represents environmental noise. 
     
       
         
           
             
               
                 
                   [ 
                   
                     Math 
                     . 
                     
                         
                     
                     ⁢ 
                     2 
                   
                   ] 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     y 
                     ⁡ 
                     
                       ( 
                       k 
                       ) 
                     
                   
                   = 
                   
                     
                       C 
                       ⁢ 
                       
                         x 
                         ⁡ 
                         
                           ( 
                           k 
                           ) 
                         
                       
                     
                     + 
                     
                       
                         v 
                         ⁡ 
                         
                           ( 
                           k 
                           ) 
                         
                       
                       
                         ENVIRONMENTAL 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         NOISE 
                       
                     
                   
                 
               
               
                 
                   ( 
                   2 
                   ) 
                 
               
             
           
         
       
     
     The state estimation unit  4   a  calculates an estimate of the state of the control target  2  using sensor data indicating the state of the control target  2  and a control input to control the state of the control target  2 . Specifically, the state estimation unit  4   a  calculates the estimate of the state of the control target  2  using a Kalman filter as shown by the following expression (3). 
     
       
         
           
             
               
                 
                   [ 
                   
                     Math 
                     . 
                     
                         
                     
                     ⁢ 
                     3 
                   
                   ] 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       x 
                       ^ 
                     
                     ⁡ 
                     
                       ( 
                       
                         k 
                         + 
                         1 
                       
                       ) 
                     
                   
                   = 
                   
                     
                       A 
                       ⁢ 
                       
                         
                           x 
                           ^ 
                         
                         ⁡ 
                         
                           ( 
                           k 
                           ) 
                         
                       
                     
                     + 
                     
                       B 
                       ⁢ 
                       
                         u 
                         ⁡ 
                         
                           ( 
                           k 
                           ) 
                         
                       
                     
                     - 
                     
                       
                         K 
                         ⁡ 
                         
                           ( 
                           
                             
                               C 
                               ⁢ 
                               
                                 
                                   x 
                                   ^ 
                                 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     k 
                                     + 
                                     1 
                                   
                                   ) 
                                 
                               
                             
                             - 
                             
                               y 
                               ⁡ 
                               
                                 ( 
                                 
                                   k 
                                   + 
                                   1 
                                 
                                 ) 
                               
                             
                           
                           ) 
                         
                       
                       
                         KALMAN 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         FILTER 
                       
                     
                   
                 
               
               
                 
                   ( 
                   3 
                   ) 
                 
               
             
           
         
       
     
     The calculation unit  4   b  calculates a control input to which colored noise in a predetermined frequency band is added, according to the calculated estimate of the state of the control target  2 . Specifically, the calculation unit  4   b  calculates a control input to perform optimal control in order to steady variation of the sensor data y(k) that includes the environmental noise v(k), shown in the above expression (2). Further, the calculation unit  4   b  adds colored noise with a frequency co within a predetermined range, to the control input to perform the optimal control indicated by a dotted line in the following expression (4). 
     
       
         
           
             
               
                 
                   [ 
                   
                     Math 
                     . 
                     
                         
                     
                     ⁢ 
                     4 
                   
                   ] 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     u 
                     k 
                   
                   = 
                   
                     
                       
                         L 
                         ⁢ 
                         
                           
                             x 
                             ^ 
                           
                           k 
                         
                       
                       
                         OPTIMAL 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         CONTROL 
                       
                     
                     + 
                     
                       
                         
                           ∑ 
                           
                             n 
                             = 
                             1 
                           
                         
                         ⁢ 
                         
                           
                             α 
                             n 
                           
                           ⁢ 
                           
                             sin 
                             ⁡ 
                             
                               ( 
                               
                                 
                                   2 
                                   ⁢ 
                                   
                                     πω 
                                     n 
                                   
                                   ⁢ 
                                   k 
                                 
                                 + 
                                 
                                   θ 
                                   n 
                                 
                               
                               ) 
                             
                           
                         
                       
                       
                         COLORED 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         NOISE 
                       
                     
                   
                 
               
               
                 
                   ( 
                   4 
                   ) 
                 
               
             
           
         
       
     
     Here,  FIGS. 2 and 3  are diagrams for explaining an attack by an attacker. First, in  FIG. 2 , a replay attack is illustrated. In the example shown in  FIG. 2 , an attacker steals sensor data y k−s  in the past (k-s) and, at the time of attacking, performs a replay attack to tamper the sensor data y k  to y k−s . In this case, the detection unit  4   c  monitors presence/absence of abnormality by monitoring a difference between a value of the sensor data and an estimate of the sensor data calculated from an estimate of a state. Therefore, it is possible for the attacker to perform a replay attack to tamper the sensor data using the same sensor data as past sensor data so that the attack is not noticed by the controller  4 . 
     Then, if the controller  4 , that is, the state estimation unit  4   a  and the calculation unit  4   b  cannot detect the replay attack, it becomes possible for the attacker to make an arbitrary input to cause an illegal operation of the control target  2 , to the actuator  5 . 
     Therefore, in the conventional watermark method, it is possible for the calculation unit  4   b  to detect a replay attack by outputting a control input u k  to which white noise is added, to the actuator  5  as shown by the following expression (5). In other words, by the noise being added, the same sensor data as past sensor data is not actually outputted, and, therefore, it becomes possible to detect a replay attack. Here, the white noise is noise according to normal distribution of mean 0, variance Ξ. 
     
       
         
           
             
               
                 
                   [ 
                   
                     Math 
                     . 
                     
                         
                     
                     ⁢ 
                     5 
                   
                   ] 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     u 
                     k 
                   
                   = 
                   
                     
                       L 
                       ⁢ 
                       
                         
                           x 
                           ^ 
                         
                         k 
                       
                     
                     + 
                     
                       
                         
                           ξ 
                           k 
                         
                         , 
                         
                           
                             ξ 
                             k 
                           
                           ~ 
                           
                             N 
                             ⁡ 
                             
                               ( 
                               
                                 0 
                                 , 
                                 Z 
                               
                               ) 
                             
                           
                         
                       
                       
                         WHITE 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         NOISE 
                       
                     
                   
                 
               
               
                 
                   ( 
                   5 
                   ) 
                 
               
             
           
         
       
     
     In  FIG. 3 , an attack by parameter identification is illustrated. In the example shown in  FIG. 3 , an attacker performs parameter identification of the control system by stealing a combination of the control input u k  and the sensor data y k . 
     For example, the attacker can identify the parameters A, B and C of the control system shown in the above expressions (1) to (3) using the PBSID method known as an algorithm capable of identifying parameters only by input/output data in a feedback control environment. The PBSID method is an algorithm to identify parameters A, B, C, D and K in an innovation form, indicated like the following expression (6). 
       [Math. 6] 
       ξ k+1   =Aξ   k   +BU   k   +Ke   k   ,y   k   =Cξ   k   +Du   K   +e   k   (6)
 
     When the parameters are identified, it becomes possible for the attacker to calculate an estimate y k ′ of the sensor data y k . Therefore, it becomes possible for the attacker to perform tampering of the sensor data y k  at a higher accuracy than a replay attack and make an arbitrary input to cause an illegal operation of the control target  2  to the actuator  5 . 
     Here, when white noise is added to a control input like the above expression (5), the control input has increased variation. Then, since the attacker can collect various combinations of the control input u k  and the sensor data y k , the order of a PE property, which is known as an identifiability index, becomes infinite. The PE property shows that, as the order is larger, more highly accurate identification is possible. 
     In comparison, if colored noise is added to a control input like the above expression (4), the order of the PE property is 2n relative to the number n of sine-wave frequencies ω included in the colored noise. Therefore, it is seen that, by selecting colored noise in a frequency band that influences the control system little, parameter identification of the control system becomes difficult. 
     Returning to the description of  FIG. 1 , the detection unit  4   c  detects an attack using past sensor data. For example, as shown in  FIGS. 2 and 3 , the detection unit  4   c  detects a replay attack by monitoring the difference between the value of the sensor data and the estimate of the sensor data calculated from the estimate of the state. 
     Specifically, as shown by Formula (7) below, the detection unit  4   c  performs a chi-square test of a freedom degree P, with a difference between the estimate of the sensor data and actual sensor data as a random variable. In other words, the detection unit  4   c  determines that there is a replay attack if a value of a statistic g k  indicated by the following expression (7) exceeds a predetermined threshold. 
     
       
         
           
             
               
                 
                   
                       
                   
                   ⁢ 
                   
                     [ 
                     
                       Math 
                       . 
                       
                           
                       
                       ⁢ 
                       7 
                     
                     ] 
                   
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     g 
                     k 
                   
                   = 
                   
                     
                       ∑ 
                       
                         i 
                         = 
                         
                           k 
                           - 
                           p 
                           + 
                           1 
                         
                       
                       k 
                     
                     ⁢ 
                     
                       
                         
                           
                             ( 
                             
                               
                                 y 
                                 i 
                               
                               - 
                               
                                 C 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       A 
                                       ⁢ 
                                       
                                         
                                           x 
                                           ^ 
                                         
                                         k 
                                       
                                     
                                     + 
                                     
                                       B 
                                       ⁢ 
                                       
                                         u 
                                         K 
                                       
                                     
                                   
                                   ) 
                                 
                               
                             
                             ) 
                           
                           T 
                         
                         ⁢ 
                         
                           
                             Cov 
                             ⁡ 
                             
                               ( 
                               x 
                               ) 
                             
                           
                           
                             - 
                             1 
                           
                         
                         ⁢ 
                         
                           ( 
                           
                             
                               y 
                               i 
                             
                             - 
                             
                               C 
                               ⁡ 
                               
                                 ( 
                                 
                                   
                                     A 
                                     ⁢ 
                                     
                                       
                                         x 
                                         ^ 
                                       
                                       k 
                                     
                                   
                                   + 
                                   
                                     B 
                                     ⁢ 
                                     
                                       u 
                                       K 
                                     
                                   
                                 
                                 ) 
                               
                             
                           
                           ) 
                         
                       
                       
                         
                           
                             
                               SQUARE 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               OF 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               DIFFERENCE 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               BETWEEN 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               ESTIMATE 
                             
                           
                         
                         
                           
                             
                               OF 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               SENSOR 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               DATA 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               AND 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               ACTUAL 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               SENSOR 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               DATA 
                             
                           
                         
                       
                     
                   
                 
               
               
                 
                   ( 
                   7 
                   ) 
                 
               
             
           
         
       
     
     Here, if there is not a replay attack, an expected value of the square of the random variable “the difference between the estimate of the sensor data and the actual sensor data” is indicated by the following expression (8). 
     
       
         
           
             
               
                 
                   [ 
                   
                     Math 
                     . 
                     
                         
                     
                     ⁢ 
                     8 
                   
                   ] 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       
                         
                           E 
                           ⁡ 
                           
                             ( 
                             
                               
                                 y 
                                 i 
                               
                               - 
                               
                                 C 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       A 
                                       ⁢ 
                                       
                                         
                                           x 
                                           ^ 
                                         
                                         k 
                                       
                                     
                                     + 
                                     
                                       B 
                                       ⁢ 
                                       
                                         u 
                                         K 
                                       
                                     
                                   
                                   ) 
                                 
                               
                             
                             ) 
                           
                         
                         T 
                       
                       ⁢ 
                       
                         
                           Cov 
                           ⁡ 
                           
                             ( 
                             x 
                             ) 
                           
                         
                         
                           - 
                           1 
                         
                       
                       ⁢ 
                       
                         ( 
                         
                           
                             y 
                             i 
                           
                           - 
                           
                             C 
                             ⁡ 
                             
                               ( 
                               
                                 
                                   A 
                                   ⁢ 
                                   
                                     
                                       x 
                                       ^ 
                                     
                                     k 
                                   
                                 
                                 + 
                                 
                                   B 
                                   ⁢ 
                                   
                                     u 
                                     K 
                                   
                                 
                               
                               ) 
                             
                           
                         
                         ) 
                       
                     
                     
                       
                         
                           
                             EXPECTED 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             VALUE 
                             ⁢ 
                             
                               
                                   
                               
                               ⁢ 
                               
                                   
                               
                             
                             ⁢ 
                             OF 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             DIFFERENCE 
                           
                         
                       
                       
                         
                           
                             BETWEEN 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             ESTIMATE 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             OF 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             SENSOR 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             DATA 
                           
                         
                       
                       
                         
                           
                             
                                 
                             
                             ⁢ 
                             
                               AND 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               ACTUAL 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               SENSOR 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               DATA 
                             
                           
                         
                       
                     
                   
                   = 
                   m 
                 
               
               
                 
                   ( 
                   8 
                   ) 
                 
               
             
           
         
       
     
     On the other hand, if there is a replay attack, the expected value of the square of the random variable “the difference between the estimate of the sensor data and the actual sensor data” is indicated by the following expressions (9) and (10). 
     
       
         
           
             
               
                 
                   [ 
                   
                     Math 
                     . 
                     
                         
                     
                     ⁢ 
                     9 
                   
                   ] 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       
                         
                           E 
                           ⁡ 
                           
                             ( 
                             
                               
                                 y 
                                 i 
                               
                               - 
                               
                                 C 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     
                                       A 
                                       ⁢ 
                                       
                                         
                                           x 
                                           ^ 
                                         
                                         k 
                                       
                                     
                                     + 
                                     
                                       B 
                                       ⁢ 
                                       
                                         u 
                                         K 
                                       
                                     
                                   
                                   ) 
                                 
                               
                             
                             ) 
                           
                         
                         T 
                       
                       ⁢ 
                       
                         
                           Cov 
                           ⁡ 
                           
                             ( 
                             x 
                             ) 
                           
                         
                         
                           - 
                           1 
                         
                       
                       ⁢ 
                       
                         ( 
                         
                           
                             y 
                             i 
                           
                           - 
                           
                             C 
                             ⁡ 
                             
                               ( 
                               
                                 
                                   A 
                                   ⁢ 
                                   
                                     
                                       x 
                                       ^ 
                                     
                                     k 
                                   
                                 
                                 + 
                                 
                                   B 
                                   ⁢ 
                                   
                                     u 
                                     K 
                                   
                                 
                               
                               ) 
                             
                           
                         
                         ) 
                       
                     
                     
                       
                         
                           
                             EXPECTED 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             VALUE 
                             ⁢ 
                             
                               
                                   
                               
                               ⁢ 
                               
                                   
                               
                             
                             ⁢ 
                             OF 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             DIFFERENCE 
                           
                         
                       
                       
                         
                           
                             BETWEEN 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             ESTIMATE 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             OF 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             SENSOR 
                             ⁢ 
                             
                                 
                             
                             ⁢ 
                             DATA 
                           
                         
                       
                       
                         
                           
                             
                                 
                             
                             ⁢ 
                             
                               AND 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               ACTUAL 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               SENSOR 
                               ⁢ 
                               
                                   
                               
                               ⁢ 
                               DATA 
                             
                           
                         
                       
                     
                   
                   = 
                   
                     m 
                     + 
                     M 
                   
                 
               
               
                 
                   ( 
                   9 
                   ) 
                 
               
             
             
               
                 
                   [ 
                   
                     Math 
                     . 
                     
                         
                     
                     ⁢ 
                     10 
                   
                   ] 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       HERE 
                       , 
                       
                         THE 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         FOLLOWING 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         IS 
                         ⁢ 
                         
                             
                         
                         ⁢ 
                         
                           SATISFI 
                           ⁢ 
                           ED 
                         
                         ⁢ 
                         
                           : 
                         
                       
                     
                     ⁢ 
                     
                       
 
                     
                     ⁢ 
                     
                       
                         
                           
                             M 
                             = 
                             
                               
                                 ∑ 
                                 
                                   i 
                                   = 
                                   1 
                                 
                                 n 
                               
                               ⁢ 
                               
                                 
                                   ( 
                                   
                                     
                                       M 
                                       i 
                                       
                                         ( 
                                         1 
                                         ) 
                                       
                                     
                                     ⁢ 
                                     
                                       M 
                                       i 
                                       
                                         ( 
                                         2 
                                         ) 
                                       
                                     
                                     ⁢ 
                                     
                                       exp 
                                       ⁡ 
                                       
                                         ( 
                                         
                                           
                                             j 
                                             ⁢ 
                                             
                                                 
                                             
                                             ⁢ 
                                             2 
                                             ⁢ 
                                             
                                                 
                                             
                                             ⁢ 
                                             π 
                                             ⁢ 
                                             
                                                 
                                             
                                             ⁢ 
                                             
                                               
                                                 ω 
                                                 i 
                                               
                                               ⁡ 
                                               
                                                 ( 
                                                 
                                                   k 
                                                   - 
                                                   1 
                                                 
                                                 ) 
                                               
                                             
                                           
                                           + 
                                           
                                             θ 
                                             i 
                                           
                                         
                                         ) 
                                       
                                     
                                   
                                   ) 
                                 
                                 ⁢ 
                                 
                                   
                                     ( 
                                     · 
                                     ) 
                                   
                                   T 
                                 
                               
                             
                           
                         
                       
                       
                         
                           
                             
                               M 
                               i 
                               
                                 ( 
                                 1 
                                 ) 
                               
                             
                             = 
                             
                               
                                 
                                   C 
                                   ⁡ 
                                   
                                     ( 
                                     
                                       I 
                                       - 
                                       
                                         A 
                                         ⁢ 
                                         
                                           exp 
                                           ⁡ 
                                           
                                             ( 
                                             
                                               
                                                 - 
                                                 j 
                                               
                                               ⁢ 
                                               
                                                   
                                               
                                               ⁢ 
                                               2 
                                               ⁢ 
                                               
                                                   
                                               
                                               ⁢ 
                                               π 
                                               ⁢ 
                                               
                                                   
                                               
                                               ⁢ 
                                               
                                                 ω 
                                                 i 
                                               
                                             
                                             ) 
                                           
                                         
                                       
                                     
                                     ) 
                                   
                                 
                                 
                                   - 
                                   1 
                                 
                               
                               ⁢ 
                               B 
                               ⁢ 
                               
                                 a 
                                 i 
                               
                             
                           
                         
                       
                       
                         
                           
                             
                               M 
                               i 
                               
                                 ( 
                                 2 
                                 ) 
                               
                             
                             = 
                             
                               1 
                               - 
                               
                                 exp 
                                 ⁡ 
                                 
                                   ( 
                                   
                                     j 
                                     ⁢ 
                                     
                                         
                                     
                                     ⁢ 
                                     2 
                                     ⁢ 
                                     
                                         
                                     
                                     ⁢ 
                                     π 
                                     ⁢ 
                                     
                                         
                                     
                                     ⁢ 
                                     
                                       ω 
                                       i 
                                     
                                     ⁢ 
                                     l 
                                   
                                   ) 
                                 
                               
                             
                           
                         
                       
                     
                   
                   } 
                 
               
               
                 
                   ( 
                   10 
                   ) 
                 
               
             
           
         
       
     
     When there is a replay attack, these values are larger by M than when there is not a replay attack. Therefore, if M is sufficiently large, it is possible to detect a replay attack. Therefore, in the detection system  1  of the present embodiment, by the calculation unit  4   b  selecting colored noise in a frequency band where M (1)  is as large as possible, it becomes possible to improve replay attack detection performance. Thus, by the calculation unit  4   b  selecting a frequency band of colored noise using the predetermined index M (1) , it becomes possible to improve the replay attack detection performance. 
     [Detection Process] 
       FIG. 4  is a flowchart showing a detection process procedure by the detection system  1  according to the present embodiment. The flowchart in  FIG. 4  is started, for example, at a timing when a user performs a start instruction operation on the controller  4 . 
     First, the controller  4  receives sensor data obtained by the sensor  3  sensing physical information showing a state of the control target  2  (step S 1 ). In the controller  4 , the state estimation unit  4   a  calculates an estimate of the state of the control target  2  using sensor data yk outputted from the sensor  3  and a control input uk calculated by the calculation unit  4   b  (step S 2 ). 
     The calculation unit  4   b  calculates a control input to perform optimal control according to the estimate of the state (step S 3 ). Further, the calculation unit  4   b  adds colored noise with a frequency co within a predetermined range, to the control input to perform the optimal control (step S 4 ). 
     Then, the calculation unit  4   b  outputs the control input to which the colored noise is added, to the actuator  5 , returns the process to step S 1  and waits for a response of sensor data outputted from the sensor  3 . 
     As described above, in the detection system  1  of the present embodiment, the state estimation unit  4   a  of the controller  4  calculates an estimate of a state of the control target  2  using sensor data indicating the state of the control target  2  outputted from the sensor  3  and a control input to control the state of the control target  2 . Further, the calculation unit  4   b  calculates a control input to which colored noise in a predetermined frequency band is added, according to the calculated estimate of the state of the control target  2 . 
     Thereby, in the detection system  1  of the present embodiment, it becomes possible to easily make parameter identification of the control system by an attacker difficult and detect a replay attack, without changing a system configuration. Therefore, it becomes possible to prevent leakage of confidential information and an attack by higher-level tampering. 
     EXAMPLE 
     In the present example, parameter identification was performed using a control system that performs feedback control. This control system is identified by parameters indicated by the following expression (11). Here, Q and R indicate modeled noise w according to normal distribution and variance of environmental noise v, respectively. 
     
       
         
           
             
               
                 
                   [ 
                   
                     Math 
                     . 
                     
                         
                     
                     ⁢ 
                     11 
                   
                   ] 
                 
               
               
                 
                     
                 
               
             
             
               
                 
                   
                     
                       A 
                       = 
                       
                         ( 
                         
                           
                             
                               
                                 
                                   0 
                                   . 
                                   9 
                                 
                                 ⁢ 
                                 8 
                               
                             
                             
                               2 
                             
                             
                               
                                 
                                   0 
                                   . 
                                   7 
                                 
                                 ⁢ 
                                 4 
                               
                             
                           
                           
                             
                               0 
                             
                             
                               
                                 
                                   - 
                                   
                                     0 
                                     . 
                                     4 
                                   
                                 
                                 ⁢ 
                                 9 
                               
                             
                             
                               1 
                             
                           
                           
                             
                               0 
                             
                             
                               
                                 
                                   - 
                                   
                                     0 
                                     . 
                                     7 
                                   
                                 
                                 ⁢ 
                                 2 
                               
                             
                             
                               
                                 
                                   - 
                                   
                                     0 
                                     . 
                                     4 
                                   
                                 
                                 ⁢ 
                                 9 
                               
                             
                           
                         
                         ) 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       B 
                       = 
                       
                         ( 
                         
                           
                             
                               0 
                             
                           
                           
                             
                               0 
                             
                           
                           
                             
                               0.85 
                             
                           
                         
                         ) 
                       
                     
                     , 
                     
                       
 
                     
                     ⁢ 
                     
                       C 
                       = 
                       
                           
                       
                       ⁢ 
                       
                         ( 
                         
                           
                             
                               0.57 
                             
                             
                               0.72 
                             
                             
                               0.27 
                             
                           
                         
                         ) 
                       
                     
                   
                   ⁢ 
                   
                     
 
                   
                   ⁢ 
                   
                     
                       Q 
                       = 
                       1 
                     
                     , 
                     
                       R 
                       = 
                       I 
                     
                   
                 
               
               
                 
                   ( 
                   11 
                   ) 
                 
               
             
           
         
       
     
     In this control system, parameter identification by an operation of 1000 steps at a time was performed N=100 times, using the conventional watermark method and the control input u k  of the method proposed by the above embodiment. In the conventional watermark method, it was assumed that white noise was added to the control input u k  as indicated by the following expression (12). 
       [Math. 12] 
         u   k   =L{circumflex over (x)}   k +ξ k ,ξ k   ˜N (0,1)  (12)
 
     Further, in the method proposed by the above embodiment, it was assumed that colored noise was added to the control input u k  as indicated by the following expression (13). 
       [Math. 13] 
         u   k   =L{circumflex over (x)}   k +Σ n=1 α n  sin(ω n   k+θ   n ),ω=0.1, 0.11, . . . , 0.2  (13)
 
       FIGS. 5 and 6  are diagrams for explaining the example. In  FIG. 5 , eigenvalues of parameters A and true values are plotted on polar coordinates. It is seen that, according to the conventional watermark method, identification results are close to the true values, and identification is accurately performed as shown in  FIG. 5( a ) . On the other hand, it is seen that, according to the method proposed by the above embodiment, identification results are significantly apart from true values as shown in  FIG. 5( b ) , and identification accuracy is low. Thus, it was confirmed that, according to the detection system  1  of the above embodiment, parameter identification is difficult. 
     Next, in  FIG. 6 , a replay attack detection result in the control system of the method proposed by the above embodiment is illustrated. Here, in  FIG. 6( a ) , the relationship between M (1)  and the frequency co shown by the above expression (10) is illustrated. As shown in  FIG. 6( a ) , it is seen that M (1)  is sufficiently large in a frequency band shown by being surrounded by a thick frame (w=0.1, 011, . . . , 0.2). 
     Further, in  FIG. 6( b ) , time-series change of the statistic g k  (hereinafter written as g) shown by the above expression (7) in the case where the control input u k  to which colored noise in the frequency band where M (1)  is sufficiently large, which is shown in  FIG. 6( a ) , is added as shown by the above expression (13) is illustrated. Here, a replay attack was started at time=100, and change of g was monitored. In this case, since the value of g significantly changes at and after the time=100 and exceeds a predetermined threshold as shown in  FIG. 6( b ) , it can be determined that there is a replay attack at and after the time=100. Thus, it was confirmed that, according to the detection system  1  of the above embodiment, it is possible to detect a replay attack. 
     [Program] 
     It is also possible to create a program in which the processes to be executed by the detection system  1  according to the above embodiment are written in a computer-executable language. As one embodiment, the controller  4  of the detection system  1  can be implemented by causing a detection program to execute the above detection process to be installed into a desired computer as package software or online software. For example, it is possible to, by causing an information processing device to execute the above detection program, cause the information processing device to function as the controller  4 . As the information processing device stated here, a desktop-type or laptop-type personal computer is included. In addition, as the information processing device, a mobile communication terminal such as a smartphone, a mobile phone and a PHS (personal handyphone system) and, furthermore, a slate terminal such as a PDA (personal digital assistant) is included in the category. Further, the functions of the controller  4  may be implemented in a cloud server. 
       FIG. 7  is a diagram showing an example of a computer to execute the detection program. A computer  1000  has, for example, a memory  1010 , a CPU  1020 , a hard disk drive interface  1030 , a disk drive interface  1040 , a serial port interface  1050 , a video adapter  1060  and a network interface  1070 . These units are connected via a bus  1080 . 
     The memory  1010  includes a ROM (read-only memory)  1011  and a RAM  1012 . The ROM  1011  stores, for example a boot program such as BIOS (basic input/output system). The hard disk drive interface  1030  is connected to a hard disk drive  1031 . The disk drive interface  1040  is connected to a disk drive  1041 . For example, a removable storage medium such as a magnetic disk and an optical disk is inserted into the disk drive  1041 . To the serial port interface  1050 , for example, a mouse  1051  and a keyboard  1052  are connected. To the video adapter  1060 , for example, a display  1061  is connected. 
     Here, the hard disk drive  1031  stores, for example, an OS  1091 , an application program  1092 , a program module  1093  and program data  1094 . Each piece of information described in the above embodiment is stored, for example, in the hard disk drive  1031  or the memory  1010 . 
     Further, the detection program is stored in the hard disk drive  1031 , for example, as the program module  1093  in which commands to be executed by the computer  1000  are written. Specifically, the program module  1093  in which each process to be executed by the controller  4 , which has been described in the above embodiment, is written is stored in the hard disk drive  1031 . 
     Further, data used in information processing by the detection program is stored, for example, in the hard disk drive  1031  as the program data  1094 . Then, the CPU  1020  reads the program module  1093  and the program data  1094  stored in the hard disk drive  1031  onto the RAM  1012  as necessary and executes each procedure described above. 
     The program module  1093  and the program data  1094  related to the detection program are not limited to the case of being stored in the hard disk drive  1031  but may be stored, for example, in a removable storage medium and read out by the CPU  1020  via the disk drive  1041  or the like. Or alternatively, the program module  1093  and the program data  1094  related to the detection program may be stored in another computer connected via a network such as a LAN and a WAN (wide area network) and read out by the CPU  1020  via the network interface  1070 . 
     An embodiment to which an invention made by the inventor is applied has been described above. The present invention, however, is not limited by the description and drawings forming a part of disclosure of the present invention by the present embodiment. In other words, all of other embodiments, examples, operation techniques and the like made by those skilled in the art based on the present embodiment are included in the category of the present invention. 
     REFERENCE SIGNS LIST 
     
         
         
           
               1  Detection system 
               2  Control target 
               3  Sensor 
               4  Controller 
               4   a  State estimation unit 
               4   b  Calculation unit 
               4   c  Detection unit 
               5  Actuator