WO2012157471A1 - 複数の制御システムの異常を検知する異常検知システム - Google Patents
複数の制御システムの異常を検知する異常検知システム Download PDFInfo
- Publication number
- WO2012157471A1 WO2012157471A1 PCT/JP2012/061770 JP2012061770W WO2012157471A1 WO 2012157471 A1 WO2012157471 A1 WO 2012157471A1 JP 2012061770 W JP2012061770 W JP 2012061770W WO 2012157471 A1 WO2012157471 A1 WO 2012157471A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- analysis device
- analysis
- event
- abnormality
- unit
- Prior art date
Links
Images
Classifications
-
- G—PHYSICS
- G05—CONTROLLING; REGULATING
- G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
- G05B23/00—Testing or monitoring of control systems or parts thereof
- G05B23/02—Electric testing or monitoring
-
- G—PHYSICS
- G05—CONTROLLING; REGULATING
- G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
- G05B23/00—Testing or monitoring of control systems or parts thereof
- G05B23/02—Electric testing or monitoring
- G05B23/0205—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults
- G05B23/0218—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults characterised by the fault detection method dealing with either existing or incipient faults
- G05B23/0221—Preprocessing measurements, e.g. data collection rate adjustment; Standardization of measurements; Time series or signal analysis, e.g. frequency analysis or wavelets; Trustworthiness of measurements; Indexes therefor; Measurements using easily measured parameters to estimate parameters difficult to measure; Virtual sensor creation; De-noising; Sensor fusion; Unconventional preprocessing inherently present in specific fault detection methods like PCA-based methods
-
- G—PHYSICS
- G05—CONTROLLING; REGULATING
- G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
- G05B19/00—Programme-control systems
- G05B19/02—Programme-control systems electric
- G05B19/04—Programme control other than numerical control, i.e. in sequence controllers or logic controllers
- G05B19/05—Programmable logic controllers, e.g. simulating logic interconnections of signals according to ladder diagrams or function charts
- G05B19/058—Safety, monitoring
-
- G—PHYSICS
- G05—CONTROLLING; REGULATING
- G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
- G05B23/00—Testing or monitoring of control systems or parts thereof
- G05B23/02—Electric testing or monitoring
- G05B23/0205—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults
- G05B23/0218—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults characterised by the fault detection method dealing with either existing or incipient faults
- G05B23/0224—Process history based detection method, e.g. whereby history implies the availability of large amounts of data
- G05B23/024—Quantitative history assessment, e.g. mathematical relationships between available data; Functions therefor; Principal component analysis [PCA]; Partial least square [PLS]; Statistical classifiers, e.g. Bayesian networks, linear regression or correlation analysis; Neural networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
-
- G—PHYSICS
- G05—CONTROLLING; REGULATING
- G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
- G05B2219/00—Program-control systems
- G05B2219/10—Plc systems
- G05B2219/14—Plc safety
- G05B2219/14036—Detection of fault in processor
Definitions
- ICS An industrial control system (ICS) that manages and controls industrial systems and infrastructure systems is known (see, for example, Non-Patent Document 1).
- ICS industrial control system
- many industrial control systems are not connected to an external network and operate with a specific protocol.
- industrial control systems are connected by a general protocol such as the Internet protocol, and more and more systems are connected to an external network. For this reason, it has become possible for a plurality of industrial control systems to cooperate with each other.
- Non-Patent Document 1 “SCADA”, [online], Wikipedia, [searched on March 30, 2011], Internet ⁇ URL: http://en.wikipedia.org/wiki/SCADA> Patent Document 1 Japanese Translation of PCT International Publication No. 2007-506353
- each industrial control system constantly monitors whether there are any abnormalities in the internal equipment. However, until now, multiple industrial control systems have not monitored abnormalities in cooperation.
- an abnormality detection system for detecting an abnormality in a plurality of control systems corresponding to each of the plurality of control systems.
- a plurality of analysis devices that acquire events occurring in the control system and analyze the presence or absence of an abnormality are provided, and a first analysis device among the plurality of analysis devices receives the events generated in the corresponding control system. It is determined whether or not the second analysis device should be notified to the second analysis device, and the second analysis device analyzes the event notified from the first analysis device and the analysis other than the first analysis device.
- an abnormality detection system, method, and program for determining an abnormality on the condition that there is a correlation with an event notified from an apparatus.
- FIG. 1 shows a configuration of a computing system 10 according to the present embodiment.
- the configurations of the first analysis device 30-1 and the second analysis device 30-2 according to the present embodiment are shown.
- a processing flow of the first analysis device 30-1 and the second analysis device 30-2 according to the present embodiment is shown.
- An example of an event acquired by the first analysis device 30-1 and an example of an event transmitted by the first analysis device 30-1 are shown.
- An example of the table for concealing additional information is shown.
- 2 shows an exemplary hardware configuration of a computer 1900 according to the present embodiment.
- FIG. 1 shows a configuration of a computing system 10 according to the present embodiment.
- the computing system 10 according to the present embodiment includes a plurality of control systems 20, a plurality of analysis devices 30, and a network 40.
- Each of the plurality of control systems 20 is a system in which a plurality of computers and a plurality of devices are connected.
- Each of the plurality of control systems 20 is, for example, an industrial control system (ICS) that manages and controls each object such as an industrial system and an infrastructure (traffic and energy) system.
- the control system 20 includes a plurality of devices, a PLC (Programmable Logic Controller) that controls the devices, a server, and the like.
- Each of the plurality of control systems 20 is, for example, a system that manages various devices (for example, electricity, gas, water, air conditioning, security system, etc.) connected to a network in one building.
- Each of the plurality of control systems 20 may be a partial system in one large control system.
- each of the plurality of control systems 20 may be a partial management system (for example, a building management system, a factory management system, a water management system, and an electrical management system) that constitutes a system that manages the entire city. Good.
- control system 20 may be a system that manages various devices (for example, a telephone and a copy machine) connected to a network in an office or home as an example.
- the control system 20 may be a system that manages a plurality of computers connected to a network in a company or the like, or may be a system that manages a large number of servers connected to a network such as a data center. Good.
- Each of the plurality of analysis devices 30 is provided corresponding to each of the plurality of control systems 20.
- Each of the plurality of analysis devices 30 may be provided corresponding to one control system 20 or may be provided corresponding to two or more control systems 20.
- Each of the plurality of analysis devices 30 acquires an event that occurs in the corresponding control system 20 and analyzes the presence / absence of an abnormality in the corresponding control system 20.
- an event refers to an event that occurs in the corresponding control system 20 and can be detected by, for example, a sensor or a computer.
- the event may be a physical quantity (power, temperature, humidity, mass, volume, flow rate, etc.) detected by a sensor provided for a device or the like in the control system 20.
- the event may be a measurement value (for example, a data rate, a data transmission / reception response, an error rate) of data input / output to / from the information processing apparatus in the control system 20.
- the event is a state of each device in the control system 20 (for example, whether or not it is movable and an operation mode), or a state of a resource constituting the information processing device in the control system 20 (for example, a memory Data occupancy, processor usage, etc.).
- Each of the plurality of analysis devices 30 acquires an event that occurs in the corresponding control system 20, and determines whether or not a predetermined event has been acquired. Each of the plurality of analysis devices 30 determines that the corresponding control system 20 is abnormal when a predetermined event is acquired. And each of the some analysis apparatus 30 performs the coping process according to abnormality, when it determines with the corresponding control system 20 having abnormality.
- the network 40 connects the plurality of control systems 20 and the plurality of analysis devices 30 to each other to enable data transmission / reception.
- the network 40 transmits data using a general-purpose protocol such as the Internet.
- FIG. 2 shows a configuration of the first analysis device 30-1 and the second analysis device 30-2 according to the present embodiment.
- the plurality of analysis devices 30 function as an abnormality detection system that detects an abnormality in the plurality of control systems 20 by cooperating with each other.
- the first analysis device 30-1 among the plurality of analysis devices 30 notifies the event acquired from the corresponding control system 20 to the second analysis device 30-2 among the plurality of analysis devices 30. To do. Then, the second analysis device 30-2 determines whether or not there is a correlation between events notified from the first analysis device 30-1 and other analysis devices 30 other than the first analysis device 30-1. Is detected, and it is determined as abnormal on the condition that there is a correlation.
- At least one of the plurality of analysis devices 30 provided in the computing system 10 functions as the second analysis device 30-2. Further, the analysis device 30 other than the second analysis device 30-2 among the plurality of control systems 20 functions as the first analysis device 30-1.
- the first analysis device 30-1 includes at least an analysis unit 50 that acquires an event that occurs in the corresponding control system 20 and analyzes whether there is an abnormality.
- the second analysis device 30-2 includes at least an analysis control unit 70 that analyzes the presence / absence of abnormality in any of the plurality of control systems 20.
- the second analysis device 30-2 may further include an analysis unit 50.
- the analysis unit 50 includes an acquisition unit 52, a determination unit 54, a standardization unit 56, a concealment unit 58, an event transmission unit 60, an abnormality reception unit 62, and a monitoring unit 64.
- the analysis control unit 70 includes an event reception unit 72, a correlation detection unit 74, and an abnormal transmission unit 76.
- the acquisition unit 52 acquires an event that occurs in the corresponding control system 20.
- the acquisition unit 52 acquires, as an event, physical quantities (power, temperature, humidity, mass, volume, flow rate, and the like) detected by physical sensors provided at each location in the control system 20.
- the acquisition unit 52 acquires, as an event, a measurement value (for example, a data rate, a data transmission / reception response, an error rate) of data input / output to / from the information processing apparatus in the control system 20.
- the acquisition unit 52 acquires the state of each device in the control system 20 or the state of resources (for example, a memory and a processor) configuring the information processing device in the control system 20 as an event.
- the determination unit 54 determines whether or not the corresponding control system 20 is abnormal based on the acquired event. For example, the determination unit 54 determines whether or not the value of the acquired event is a predetermined value.
- the determination unit 54 determines that the corresponding control system 20 is abnormal when the physical quantity detected by the sensor becomes a value outside a predetermined normal range. Further, as an example, when the measurement value of data input / output to / from the information processing apparatus in the control system 20 becomes a value outside a predetermined normal range, the determination unit 54 determines that the corresponding control system 20 is abnormal. It is determined that For example, the determination unit 54 responds when the state of each device in the control system 20 or the state of the resources configuring the information processing device in the control system 20 is in a predetermined state. It is determined that the control system 20 is abnormal.
- the determination unit 54 determines that the corresponding control system 20 is abnormal
- the determination unit 54 notifies the monitoring unit 64 of the abnormality.
- the monitoring unit 64 executes processing to be performed when an abnormality occurs in response to receiving a notification from the determination unit 54 that the abnormality has occurred.
- the monitoring unit 64 reports the abnormality to the administrator of the control system 20 corresponding to the abnormality.
- the monitoring part 64 increases the monitoring frequency of the corresponding control system 20 as an example. In this case, for example, the monitoring unit 64 increases the event acquisition frequency with respect to the acquisition unit 52.
- the monitoring part 64 stops an abnormal apparatus as an example, or stops a power supply.
- the determination unit 54 determines whether or not an event that has occurred in the corresponding control system 20 should be notified to the second analysis device 30-2. Determine.
- the determination unit 54 when the value of the acquired event is a value that is not determined to be abnormal and the difference from the threshold value that determines that it is abnormal is within a predetermined range, It is determined that the event should be notified to the second analysis device 30-2.
- the determination unit 54 may determine that an event for which it is determined that the corresponding control system 20 is abnormal should be notified to the second analysis device 30-2.
- the determination unit 54 has a predetermined normal range (a range determined to be normal) in which a physical quantity detected by a sensor or a measured value of data input to and output from the information processing device in the control system 20 is determined. If the difference from the threshold value determined to be abnormal is within a predetermined value or less, it is determined that the event should be notified to the second analysis device 30-2. Further, as an example, the determination unit 54 is a state in which the state of each device in the control system 20 or the state of the resources constituting the information processing device in the control system 20 is determined to be normal and is set in advance. When the predetermined state is reached, it is determined that the event should be notified to the second analysis device 30-2.
- a predetermined normal range a range determined to be normal in which a physical quantity detected by a sensor or a measured value of data input to and output from the information processing device in the control system 20 is determined. If the difference from the threshold value determined to be abnormal is within a predetermined value or less, it is determined that the event should be notified to the
- the standardization unit 56 standardizes the data format of the event that occurred in the corresponding control system 20 that is determined to be notified to the second analysis device 30-2 by the determination unit 54. More specifically, the standardization unit 56 converts the data format of the event determined to be notified to the second analysis device 30-2 into the data format in the second analysis device 30-2, and standardizes the event. To do. For example, the standardization unit 56 may convert the data format of an event that has occurred in the corresponding control system 20 into a standard data format in the plurality of control systems 20 to standardize the event. Accordingly, the standardization unit 56 can convert the event notified to the second analysis device 30-2 into a data format that can be read by the second analysis device 30-2.
- the concealment unit 58 conceals part of the data representing the content of the event that occurred in the corresponding control system 20, which is determined by the determination unit 54 to be notified to the second analysis device 30-2. As an example, the concealment unit 58 conceals data of the part of the event that is not desired to be known to the other analysis devices 30. As an example, the concealing unit 58 conceals data representing contents (for example, sensor mounting position and sensor performance) that are not desired to be known by the administrator of another control system 20 in order to ensure security.
- the event transmission unit 60 generates an event generated in the corresponding control system 20 that is standardized by the standardization unit 56 and part of data is concealed by the concealment unit 58, and is sent to the analysis control unit of the second analysis device 30-2 70 is notified.
- the analysis unit 50 provided in the first analysis device 30-1 converts the event into a message and notifies the analysis control unit 70 of the second analysis device 30-2 via the network 40.
- the analysis unit 50 provided in the second analysis device 30-2 may notify the event to the analysis control unit 70 via the network 40, or notifies the analysis control unit 70 of the event without passing through the network 40. May be.
- the event reception unit 72 of the analysis control unit 70 receives an event notified from each of the plurality of analysis devices 30. More specifically, the event reception unit 72 receives the event notified from the analysis unit 50 of the first analysis device 30-1 and the event notified from the analysis unit 50 of the second analysis device 30-2. Receive.
- the correlation detection unit 74 of the analysis control unit 70 compares events notified from the plurality of analysis devices 30 and detects whether or not the correlation is equal to or greater than a predetermined correlation value. For example, the correlation detection unit 74 determines that any of the plurality of analysis devices 30 is abnormal when the plurality of events notified from the plurality of analysis devices 30 have a correlation greater than or equal to a predetermined correlation value. To do.
- the abnormality transmitting unit 76 of the analysis control unit 70 when the correlation detecting unit 74 determines that there is an abnormality, the analysis unit 50 of each of the plurality of first analysis devices 30-1 and the second analysis device 30-2.
- the analysis unit 50 is notified of the abnormality.
- the abnormality transmission unit 76 is an event transmitted from each analysis device 30 to each of the plurality of analysis devices 30 and is correlated with an event transmitted from another analysis device 30 and is abnormal.
- the data of the concealed part included in the determined event is included in the abnormality information and notified to the analysis unit 50.
- the abnormality receiving unit 62 receives the abnormality information notified from the analysis control unit 70 of the second analysis device 30-2. The abnormality receiving unit 62 transfers the received abnormality information to the concealing unit 58.
- the concealment unit 58 releases the concealment state of the concealed data included in the abnormality information.
- the concealment unit 58 transfers the abnormality information and the data for which the concealment is released to the monitoring unit 64.
- the monitoring unit 64 identifies the content of the abnormality notified by the second analysis device 30-2 in response to the notification of the abnormality information from the analysis control unit 70 of the second analysis device 30-2. For example, when the concealment unit 58 conceals the sensor attachment position and notifies the event, the monitoring unit 64 detects the sensor attachment position from the data for which the concealment is released. Accordingly, the concealment unit 58 can specify the position of the sensor that has generated the event that is determined to be abnormal by the second analysis device 30-2. And the monitoring part 64 performs the corresponding
- FIG. 3 shows a processing flow of the first analysis device 30-1 and the second analysis device 30-2 according to the present embodiment.
- FIG. 4 shows an example of an event acquired by the first analysis device 30-1 and an example of an event transmitted by the first analysis device 30-1.
- FIG. 5 shows an example of a table for concealing additional information.
- the first analysis device 30-1 acquires events that occur in the corresponding control system 20 at regular intervals.
- the first analysis device 30-1 acquires the temperature of the equipment provided in the backyard of the building managed by the corresponding control system 20 as an event every 10 minutes.
- the first analysis device 30-1 determines whether or not to notify the second analysis device 30-2 of each of the events acquired at regular intervals. For example, when the change in the event is larger than a predetermined change amount, the first analysis device 30-1 determines that the event should be notified to the second control system 20-2.
- the first analysis device 30-1 determines that the temperature (event) should be notified to the second control system 20-2. If first analysis apparatus 30-1 determines that notification is to be made (YES in S12), the process proceeds to step S13.
- the first analysis device 30-1 standardizes the data format of the event to be notified.
- the first analysis device 30-1 uses, as an example, a data format (for example, the computer) that can read the identification information representing the contents of the event and the event value representing the event value by the second analysis device 30-2.
- a data format for example, the computer
- the first analysis device 30-1 converts individual identification information expressed as “temperature” into common identification information expressed as “temperature sensor”. Further, in the example of FIG. 4, the first analysis device 30-1 converts the “time” (individual event value) expressed in the 12-hour format into the “time” (common event value) expressed in the 24-hour format. Event value). In the example of FIG. 4, “temperature” (individual event value) expressed in Fahrenheit is converted into “temperature” (common event value) expressed in Celsius.
- the first analysis device 30-1 includes data (for example, security-related data) that does not want the other analysis device 30 to know the content of the data representing the content of the event to be notified. And data representing detailed measurement points of events).
- the first analysis device 30-1 conceals sensor position information that is additional information of an event.
- the first analysis device 30-1 conceals the sensor position information represented as “backyard # 1” into a random code represented as “39485”.
- the first analysis device 30-1 stores a conversion table indicating a correspondence relationship between data before concealment and data after concealment. Then, the first analysis device 30-1 refers to the conversion table and conceals data.
- the first analysis device 30-1 may include sensor position information (backyard # 1, backyard # 2, main door # 1, main door # 2) indicating the sensor position as shown in FIG. Is converted into a corresponding random code (39485, 13456, 27321, 53884).
- the first analysis device 30-1 selects at least one second analysis device 30-2 from among the plurality of analysis devices 30 as an event transmission destination. For example, when there are a plurality of analysis apparatuses 30 that can receive an event from a plurality of analysis apparatuses 30 and determine whether or not an abnormality has occurred, the first analysis apparatus 30-1 One or more analysis devices 30 are selected as the second analysis device 30-2.
- the first analysis device 30-1 may dynamically change which of the plurality of analysis devices 30 is the second analysis device 30-2. For example, the first analysis device 30-1 sets which to be the second analysis device 30-2 in a certain period (for example, every day or every week).
- the first analysis device 30-1 may preferentially select the analysis device 30 having a short response time among the plurality of analysis devices 30 as the second analysis device 30-2. As a result, the first analysis device 30-1 can be notified of the abnormality earlier. In addition, the first analysis device 30-1 establishes a new second analysis device 30-2 on condition that the notification of the event is continued to the same second analysis device 30-2 for a certain period or more. You may choose. Thereby, the first analysis device 30-1 can prevent the second analysis device 30-2 from being fixed to one.
- step S16 the second analysis device 30-2 selected in step S15 is notified of the event standardized in step S13 and concealed in step S14.
- step S17 the second analysis device 30-2 receives an event from the first analysis device 30-1.
- the second analysis device 30-2 detects the correlation between the events notified from the plurality of analysis devices 30, and determines whether or not an abnormality has occurred in any of the plurality of control systems 20. Judging. More specifically, the second analysis device 30-2 includes an event notified from the first analysis device 30-1 and an event notified from an analysis device 30 other than the first analysis device 30-1. It is determined that there is an abnormality on the condition that there is a correlation. As an example, the second analysis device 30-2 includes a change in an event notified from the first analysis device 30-1, and an event notified from another analysis device 30 other than the first analysis device 30-1. Is determined to be abnormal on the condition that there is a correlation greater than or equal to a predetermined correlation value.
- the correlation detection unit 74 determines that the temperature is abnormal when the temperatures of the plurality of temperature sensors installed in each of the plurality of control systems 20 change in correlation with each other.
- a change occurs in one control system 20 in which the temperature of the temperature sensor rises from 20:20 to 30 and falls from 20:30 to 40. ing. Therefore, in such a case, the second analysis device 30-2 determines that the temperature sensor provided in the plurality of control systems 20 is abnormal on the condition that the temperature change is the same as in FIG.
- step S19 when the second analysis device 30-2 determines that there is an abnormality in step S18, the second analysis device 30-2 notifies the first analysis device 30-1 of the abnormality.
- the second analysis device 30-2 is an event transmitted from the first analysis device 30-1, which is correlated with an event transmitted from another analysis device 30 and determined to be abnormal.
- the data of the concealed part included in the information is included in the abnormality information and notified to the analysis unit 50.
- step S20 the first analysis device 30-1 receives the abnormality information notified from the second analysis device 30-2.
- step S21 the first analysis device 30-1 identifies the content of the abnormality that has occurred in the corresponding control system 20 based on the abnormality information notified from the second analysis device 30-2.
- the first analysis device 30-1 returns the data of the concealed portion included in the abnormality information notified from the second analysis device 30-2 to the data that has not been concealed with reference to the conversion table. Then, the first analysis device 30-1 identifies an abnormality that has occurred in the corresponding control system from the event for which the concealment is canceled. For example, the first analysis apparatus 30-1 refers to the conversion table as shown in FIG. 5 and identifies that the location where the abnormality has occurred is a sensor in the backyard of the building.
- the first analysis device 30-1 changes the mode for controlling the corresponding control system 20 to the alert mode.
- the first analysis device 30-1 reports the abnormality to the administrator of the corresponding control system 20.
- the first analysis device 30-1 increases the monitoring frequency of the corresponding control system 20.
- the first analysis device 30-1 may increase the monitoring frequency by increasing the event acquisition frequency.
- the first analysis device 30-1 stops an abnormal device or stops the power supply.
- a plurality of analysis devices 30 are present.
- a correlated event event
- the some analysis apparatus 30 can cooperate, and can detect abnormality more correctly and with sufficient sensitivity.
- the second analysis device 30-2 has a correlation between an event notified from the first analysis device 30-1 and an event notified from an analysis device 30 other than the first analysis device 30-1.
- the first analysis device 30-1 may be requested to notify the event that is not concealed.
- the first analysis device 30-1 notifies the second analysis device 30-2 without concealing the event in response to a request for notification of the non-confidential event.
- the second analysis device 30-2 receives the non-confidential event from the first analysis device 30-1, and receives the non-confidential event notified from the first analysis device 30-1.
- the correlation with the event notified from the analysis device 30 other than the first analysis device 30-1 is detected again.
- the second analysis device 30-2 determines that there is an abnormality on the condition that there is a correlation. Thereby, the second analyzer 30-2 can more accurately determine whether or not an abnormality has occurred.
- FIG. 6 shows an example of a hardware configuration of a computer 1900 according to the present embodiment.
- a computer 1900 according to this embodiment is connected to a CPU peripheral unit having a CPU 2000, a RAM 2020, a graphic controller 2075, and a display device 2080 that are connected to each other by a host controller 2082, and to the host controller 2082 by an input / output controller 2084.
- Input / output unit having communication interface 2030, hard disk drive 2040, and CD-ROM drive 2060, and legacy input / output unit having ROM 2010, flexible disk drive 2050, and input / output chip 2070 connected to input / output controller 2084 With.
- the host controller 2082 connects the RAM 2020 to the CPU 2000 and the graphic controller 2075 that access the RAM 2020 at a high transfer rate.
- the CPU 2000 operates based on programs stored in the ROM 2010 and the RAM 2020 and controls each unit.
- the graphic controller 2075 acquires image data generated by the CPU 2000 or the like on a frame buffer provided in the RAM 2020 and displays it on the display device 2080.
- the graphic controller 2075 may include a frame buffer for storing image data generated by the CPU 2000 or the like.
- the input / output controller 2084 connects the host controller 2082 to the communication interface 2030, the hard disk drive 2040, and the CD-ROM drive 2060, which are relatively high-speed input / output devices.
- the communication interface 2030 communicates with other devices via a network.
- the hard disk drive 2040 stores programs and data used by the CPU 2000 in the computer 1900.
- the CD-ROM drive 2060 reads a program or data from the CD-ROM 2095 and provides it to the hard disk drive 2040 via the RAM 2020.
- the ROM 2010, the flexible disk drive 2050, and the relatively low-speed input / output device of the input / output chip 2070 are connected to the input / output controller 2084.
- the ROM 2010 stores a boot program that the computer 1900 executes at startup and / or a program that depends on the hardware of the computer 1900.
- the flexible disk drive 2050 reads a program or data from the flexible disk 2090 and provides it to the hard disk drive 2040 via the RAM 2020.
- the input / output chip 2070 connects the flexible disk drive 2050 to the input / output controller 2084 and inputs / outputs various input / output devices via, for example, a parallel port, a serial port, a keyboard port, a mouse port, and the like. Connect to controller 2084.
- the program provided to the hard disk drive 2040 via the RAM 2020 is stored in a recording medium such as the flexible disk 2090, the CD-ROM 2095, or an IC card and provided by the user.
- the program is read from the recording medium, installed in the hard disk drive 2040 in the computer 1900 via the RAM 2020, and executed by the CPU 2000.
- a program installed in the computer 1900 and causing the computer 1900 to function as the analysis unit 50 includes an acquisition module, a determination module, a standardization module, a secret module, an event transmission module, an abnormality reception module, and a monitoring module. These programs or modules work with the CPU 2000 or the like to function the computer 1900 as the acquisition unit 52, the determination unit 54, the standardization unit 56, the concealment unit 58, the event transmission unit 60, the abnormality reception unit 62, and the monitoring unit 64, respectively.
- the information processing described in these programs is read by the computer 1900, whereby the acquisition unit 52, the determination unit 54, and the standardization unit 56, which are specific means in which the software and the various hardware resources described above cooperate. , Functioning as a concealment unit 58, event transmission unit 60, abnormal reception unit 62, and monitoring unit 64. And the specific analysis part 50 according to the intended use is constructed
- the program installed in the computer 1900 and causing the computer 1900 to function as the analysis control unit 70 includes an event reception module, a correlation detection module, and an abnormality transmission module. These programs or modules work with the CPU 2000 or the like to cause the computer 1900 to function as the event reception unit 72, the correlation detection unit 74, and the abnormal transmission unit 76, respectively.
- the information processing described in these programs is read by the computer 1900, whereby the event receiving unit 72, the correlation detecting unit 74, and the abnormal means which are specific means in which the software and the various hardware resources described above cooperate. It functions as the transmission unit 76. And the specific analysis control part 70 according to the intended use is constructed
- the CPU 2000 executes a communication program loaded on the RAM 2020 and executes a communication interface based on the processing content described in the communication program.
- a communication process is instructed to 2030.
- the communication interface 2030 reads transmission data stored in a transmission buffer area or the like provided on a storage device such as the RAM 2020, the hard disk drive 2040, the flexible disk 2090, or the CD-ROM 2095, and sends it to the network.
- the reception data transmitted or received from the network is written into a reception buffer area or the like provided on the storage device.
- the communication interface 2030 may transfer transmission / reception data to / from the storage device by a DMA (direct memory access) method. Instead, the CPU 2000 transfers the storage device or the communication interface 2030 as a transfer source.
- the transmission / reception data may be transferred by reading the data from the data and writing the data to the communication interface 2030 or the storage device of the transfer destination.
- the CPU 2000 is all or necessary from among files or databases stored in an external storage device such as a hard disk drive 2040, a CD-ROM drive 2060 (CD-ROM 2095), and a flexible disk drive 2050 (flexible disk 2090). These parts are read into the RAM 2020 by DMA transfer or the like, and various processes are performed on the data on the RAM 2020. Then, CPU 2000 writes the processed data back to the external storage device by DMA transfer or the like. In such processing, since the RAM 2020 can be regarded as temporarily holding the contents of the external storage device, in the present embodiment, the RAM 2020 and the external storage device are collectively referred to as a memory, a storage unit, or a storage device.
- the CPU 2000 can also hold a part of the RAM 2020 in the cache memory and perform reading and writing on the cache memory. Even in such a form, the cache memory bears a part of the function of the RAM 2020. Therefore, in the present embodiment, the cache memory is also included in the RAM 2020, the memory, and / or the storage device unless otherwise indicated. To do.
- the CPU 2000 performs various operations, such as various operations, information processing, condition determination, information search / replacement, etc., described in the present embodiment, specified for the data read from the RAM 2020 by the instruction sequence of the program. Is written back to the RAM 2020. For example, when performing the condition determination, the CPU 2000 determines whether or not the various variables shown in the present embodiment satisfy the conditions such as large, small, above, below, equal, etc., compared to other variables or constants. If the condition is satisfied (or not satisfied), the program branches to a different instruction sequence or calls a subroutine.
- the CPU 2000 can search for information stored in a file or database in the storage device. For example, in the case where a plurality of entries in which the attribute value of the second attribute is associated with the attribute value of the first attribute are stored in the storage device, the CPU 2000 displays the plurality of entries stored in the storage device. The entry that matches the condition in which the attribute value of the first attribute is specified is retrieved, and the attribute value of the second attribute that is stored in the entry is read, thereby associating with the first attribute that satisfies the predetermined condition The attribute value of the specified second attribute can be obtained.
- the program or module shown above may be stored in an external recording medium.
- an optical recording medium such as DVD or CD
- a magneto-optical recording medium such as MO
- a tape medium such as an IC card, and the like
- a storage device such as a hard disk or RAM provided in a server system connected to a dedicated communication network or the Internet may be used as a recording medium, and the program may be provided to the computer 1900 via the network.
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Automation & Control Theory (AREA)
- Theoretical Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Quality & Reliability (AREA)
- Artificial Intelligence (AREA)
- Evolutionary Computation (AREA)
- Mathematical Physics (AREA)
- Testing And Monitoring For Control Systems (AREA)
- Debugging And Monitoring (AREA)
- Computer And Data Communications (AREA)
- User Interface Of Digital Computer (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
Description
特許文献1 特表2007-506353号公報
20 制御システム
30 解析装置
40 ネットワーク
50 解析部
52 取得部
54 判定部
56 標準化部
58 秘匿部
60 イベント送信部
62 異常受信部
64 監視部
70 解析制御部
72 イベント受信部
74 相関検出部
76 異常送信部
1900 コンピュータ
2000 CPU
2010 ROM
2020 RAM
2030 通信インターフェイス
2040 ハードディスクドライブ
2050 フレキシブルディスク・ドライブ
2060 CD-ROMドライブ
2070 入出力チップ
2075 グラフィック・コントローラ
2080 表示装置
2082 ホスト・コントローラ
2084 入出力コントローラ
2090 フレキシブルディスク
2095 CD-ROM
Claims (18)
- 複数の制御システムの異常を検知する異常検知システムであって、
前記複数の制御システムのそれぞれに対応して設けられ、対応する制御システムで発生するイベントを取得して異常の有無を解析する複数の解析装置を備え、
前記複数の解析装置のうち第1の解析装置は、対応する前記制御システムで発生したイベントを、前記複数の解析装置のうち第2の解析装置に通知すべきか否かを判定し、
前記第2の解析装置は、前記第1の解析装置から通知されたイベントと、前記第1の解析装置以外の解析装置から通知されたイベントとの相関があることを条件として、異常と判断する
異常検知システム。 - 前記複数の解析装置のそれぞれは、対応する前記制御システムで発生したイベントのデータ形式を、前記第2の解析装置におけるデータ形式に変換して、前記イベントを標準化する標準化部を有する
請求項1に記載の異常検知システム。 - 前記第1の解析装置の標準化部は、対応する前記制御システムで発生したイベントのデータ形式を、前記複数の制御システムにおける標準のデータ形式に変換して、前記イベントを標準化する請求項2に記載の異常検知システム。
- 前記複数の解析装置のそれぞれは、対応する前記制御システムで発生したイベントの内容を表すデータの一部を秘匿化する秘匿部を有する
請求項1から3のいずれか一項に記載の異常検知システム。 - 前記第1の解析装置の前記秘匿部は、秘匿化前のデータと秘匿化後のデータと対応関係を示した変換テーブルを格納し、
前記第2の解析装置は、異常と判断した場合、前記第1の解析装置から受け取った秘匿後のイベントに含まれる秘匿化後のデータを含む異常情報を前記第1の解析装置へと通知し、
前記第1の解析装置の前記秘匿部は、前記第2の解析装置から通知された前記異常情報に含まれる秘匿化されたデータを前記変換テーブルを参照して秘匿化前のデータに変換して、対応する前記制御システムで発生した異常を特定する
請求項4に記載の異常検知システム。 - 前記第2の解析装置は、
前記第1の解析装置から通知されたイベントと、前記第1の解析装置以外の解析装置から通知されたイベントとの相関がある場合に、前記第1の解析装置に対して秘匿化されていないイベントの通知を要求し、
前記第1の解析装置から秘匿化されていないイベントを受け取って、前記第1の解析装置から通知された秘匿化されていないイベントと、前記第1の解析装置以外の解析装置から通知されたイベントとの相関があることを条件として異常と判断する
請求項4または5に記載の異常検知システム。 - 前記第2の解析装置は、前記複数の解析装置の少なくとも一部に対して異常を通知し、 異常の通知を受けた前記複数の解析装置の少なくとも一部は、対応する前記制御システムの監視頻度を増加させる
請求項1から6のいずれか一項に記載の異常検知システム。 - 前記第1の解析装置は、前記複数の解析装置のうちのいずれを前記第2の解析装置とするかを動的に変更する請求項1から7のいずれか一項に記載の異常検知システム。
- 前記第1の解析装置は、一定期間以上同一の前記第2の解析装置に対してイベントの通知を継続したことを条件として、新たな前記第2の解析装置を選択する請求項8に記載の異常検知システム。
- 前記第1の解析装置は、前記複数の解析装置のうちレスポンス時間が短い解析装置を優先して前記第2の解析装置として選択する請求項8または9に記載の異常検知システム。
- 前記第1の解析装置は、対応する前記制御システムで発生するイベントを取得して異常の有無を解析する解析部を有し、
前記第2の解析装置は、前記複数の制御システムの何れかでの異常の有無を解析する解析制御部を有し、
前記第1の解析装置の前記解析部は、対応する前記制御システムで発生するイベントを取得して前記第2の解析装置に通知すべきか否かを判定し、前記第2の解析装置に通知すべきと判定した場合には、取得したイベントを前記第2の解析装置の前記解析制御部へと転送し、
前記第2の解析装置の前記解析制御部は、複数の前記第1の解析装置からのイベント同士の相関を検出し、相関があることを条件として異常と判断し、異常と判断した場合に前記第1の解析装置の前記解析部へと通知し、
前記第1の解析装置の前記解析部は、前記第2の解析装置から通知された異常を対応する前記制御システムの管理者に対して報告する
請求項1から10のいずれか一項に記載の異常検知システム。 - 前記第2の解析装置は、異常と判断した場合、前記第1の解析装置に異常を通知し、
前記第1の解析装置は、前記第2の解析装置から通知された異常を前記制御システムの管理者に対して報告する
請求項1から11のいずれか一項に記載の異常検知システム。 - 前記第2の解析装置は、前記第1の解析装置から通知されたイベントの変化と、前記第1の解析装置以外の解析装置から通知されたイベントの変化との間の相関があることを条件として異常と判断する
請求項1から12のいずれか一項に記載の異常検知システム。 - 請求項11に記載された異常検知システムにおける前記解析部として機能する装置。
- 請求項11に記載された異常検知システムにおける前記解析制御部として機能する装置。
- コンピュータを、請求項14に記載の装置として機能させるプログラム。
- コンピュータを、請求項15に記載の装置として機能させるプログラム。
- 複数の制御システムの異常を検知する異常検知方法であって、
前記複数の制御システムのそれぞれに対応して、対応する制御システムで発生するイベントを取得して異常の有無を解析する複数の解析装置を設け、
前記複数の解析装置のうち第1の解析装置が、対応する前記制御システムで発生したイベントを、前記複数の解析装置のうち第2の解析装置に通知すべきか否かを判定するステップと、
前記第2の解析装置が、前記第1の解析装置から通知されたイベントと、前記第1の解析装置以外の解析装置から通知されたイベントとの相関があることを条件として、異常と判断するステップとを
備える異常検知方法。
Priority Applications (6)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
GB1320978.8A GB2505367B (en) | 2011-05-13 | 2012-05-08 | Anomaly Detection System for Detecting Anomaly In Multiple Control Systems |
US14/117,278 US9360855B2 (en) | 2011-05-13 | 2012-05-08 | Anomaly detection system for detecting anomaly in multiple control systems |
DE112012001160T DE112012001160T5 (de) | 2011-05-13 | 2012-05-08 | Unregelmäßigkeitserkennungssystem zum Erkennen einer Unregelmäßigkeit in mehreren Steuersystemen |
SG2013080361A SG194695A1 (en) | 2011-05-13 | 2012-05-08 | Fault sensing system for sensing fault in plurality of control systems |
CN201280021512.5A CN103502949B (zh) | 2011-05-13 | 2012-05-08 | 用于在多个控制***中检测异常的异常检测***、装置和方法 |
JP2013515083A JP5571847B2 (ja) | 2011-05-13 | 2012-05-08 | 複数の制御システムの異常を検知する異常検知システム |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
JP2011-108651 | 2011-05-13 | ||
JP2011108651 | 2011-05-13 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2012157471A1 true WO2012157471A1 (ja) | 2012-11-22 |
Family
ID=47176804
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/JP2012/061770 WO2012157471A1 (ja) | 2011-05-13 | 2012-05-08 | 複数の制御システムの異常を検知する異常検知システム |
Country Status (7)
Country | Link |
---|---|
US (1) | US9360855B2 (ja) |
JP (1) | JP5571847B2 (ja) |
CN (1) | CN103502949B (ja) |
DE (1) | DE112012001160T5 (ja) |
GB (1) | GB2505367B (ja) |
SG (1) | SG194695A1 (ja) |
WO (1) | WO2012157471A1 (ja) |
Cited By (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2016081044A3 (en) * | 2014-09-10 | 2016-07-21 | Honeywell International Inc. | Dynamic quantification of cyber-security risks in a control system |
JP2016139175A (ja) * | 2015-01-26 | 2016-08-04 | 株式会社東芝 | 監視制御システム、コントローラ、及び監視装置 |
JP6266181B1 (ja) * | 2017-01-27 | 2018-01-24 | 三菱電機株式会社 | 検索装置、監視システム、監視方法および検索プログラム |
JP2018025979A (ja) * | 2016-08-10 | 2018-02-15 | 株式会社ジェイテクト | 解析システム |
CN107957926A (zh) * | 2016-10-18 | 2018-04-24 | 美光科技公司 | 用于侦测错误事件的方法 |
JP2018513500A (ja) * | 2015-04-24 | 2018-05-24 | ゴールドマン サックス アンド カンパニー エルエルシー | ファブリック監視システムを用いてコンピューティングシステム及びネットワークに関与するイベントを扱うシステム及び方法 |
CN108900538A (zh) * | 2018-08-09 | 2018-11-27 | 深圳市永达电子信息股份有限公司 | 一种工控信号检测方法和装置 |
JP2020017302A (ja) * | 2015-10-09 | 2020-01-30 | フィッシャー−ローズマウント システムズ,インコーポレイテッド | 分散型工業パフォーマンス監視及び分析プラットフォーム |
Families Citing this family (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP6432998B2 (ja) * | 2014-03-14 | 2018-12-05 | Necフィールディング株式会社 | 情報提供装置、情報提供システム、情報提供方法、及びプログラム |
IL242808A0 (en) * | 2015-11-26 | 2016-04-21 | Rafael Advanced Defense Sys | System and method to detect cyber attacks on ics/scada controlled plants |
US10107718B2 (en) * | 2016-02-29 | 2018-10-23 | Epro Gmbh | Apparatus for capturing data related to an event indicating abnormal function of a machine |
CN110224970B (zh) * | 2018-03-01 | 2021-11-23 | 西门子公司 | 一种工业控制***的安全监视方法和装置 |
EP3553616A1 (de) * | 2018-04-11 | 2019-10-16 | Siemens Aktiengesellschaft | Ursachenbestimmung von anomalieereignissen |
US10896261B2 (en) | 2018-11-29 | 2021-01-19 | Battelle Energy Alliance, Llc | Systems and methods for control system security |
JP2020201638A (ja) * | 2019-06-07 | 2020-12-17 | 京セラドキュメントソリューションズ株式会社 | 監視システムおよび監視プログラム |
US11321304B2 (en) | 2019-09-27 | 2022-05-03 | International Business Machines Corporation | Domain aware explainable anomaly and drift detection for multi-variate raw data using a constraint repository |
DE102020108070A1 (de) * | 2020-03-24 | 2021-09-30 | Basler Aktiengesellschaft | Robuste Überwachung von Computersystemen und/oder Steuerungssystemen |
CN113093578A (zh) * | 2021-04-09 | 2021-07-09 | 上海商汤智能科技有限公司 | 控制方法及装置、电子设备和存储介质 |
CN117850375B (zh) * | 2024-03-05 | 2024-06-04 | 青岛天一红旗软控科技有限公司 | 一种生产线的多维度监测*** |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPH05164802A (ja) * | 1991-12-16 | 1993-06-29 | Fuji Xerox Co Ltd | 診断方法および装置 |
JP2009199246A (ja) * | 2008-02-20 | 2009-09-03 | Toshiba Corp | ノード稼働監視システムおよびノード稼働監視方法 |
WO2009144820A1 (ja) * | 2008-05-30 | 2009-12-03 | 東芝三菱電機産業システム株式会社 | 遠隔監視装置 |
Family Cites Families (27)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
DE3206891A1 (de) * | 1982-02-26 | 1983-09-15 | Robert Bosch Gmbh, 7000 Stuttgart | Verfahren zur fehlerdiagnose fuer speicherprogrammierbare steuerungen |
JPS62161037A (ja) * | 1986-01-09 | 1987-07-17 | Nippon Denso Co Ltd | 車両に搭載される総合診断装置 |
US5680541A (en) | 1991-12-16 | 1997-10-21 | Fuji Xerox Co., Ltd. | Diagnosing method and apparatus |
US5875431A (en) * | 1996-03-15 | 1999-02-23 | Heckman; Frank | Legal strategic analysis planning and evaluation control system and method |
US6347374B1 (en) * | 1998-06-05 | 2002-02-12 | Intrusion.Com, Inc. | Event detection |
US6178362B1 (en) | 1998-09-24 | 2001-01-23 | Silicon Energy Corp. | Energy management system and method |
US7539549B1 (en) * | 1999-09-28 | 2009-05-26 | Rockwell Automation Technologies, Inc. | Motorized system integrated control and diagnostics using vibration, pressure, temperature, speed, and/or current analysis |
US6405318B1 (en) * | 1999-03-12 | 2002-06-11 | Psionic Software, Inc. | Intrusion detection system |
GB2392250B (en) | 2001-06-25 | 2004-11-10 | Invensys Sys Inc | Sensor fusion using self evaluating process sensors |
JP4334176B2 (ja) | 2002-01-22 | 2009-09-30 | 株式会社東芝 | 建物省エネルギー評価監視装置 |
JP4221994B2 (ja) | 2002-04-23 | 2009-02-12 | パナソニック電工株式会社 | マネージメント・システム及びそれを用いたビル管理システム |
JP4160799B2 (ja) | 2002-08-09 | 2008-10-08 | 株式会社日立製作所 | 監視部ユニット、それを用いた監視システム、及び異常監視方法 |
KR100432675B1 (ko) | 2003-09-19 | 2004-05-27 | 주식회사 아이앤아이맥스 | 네트워크상의 장비들 간의 통신제어방법 및 이를 위한 장치 |
JP4363244B2 (ja) | 2003-10-30 | 2009-11-11 | 株式会社日立製作所 | エネルギー管理装置 |
JP2005149006A (ja) | 2003-11-13 | 2005-06-09 | Toshiba Corp | プロセス管理装置 |
JP4534719B2 (ja) | 2004-10-29 | 2010-09-01 | 株式会社富士通ゼネラル | ゲートウェイ装置 |
JP4310648B2 (ja) | 2005-03-28 | 2009-08-12 | 日本電気株式会社 | 設備環境データ分析システムおよび設備環境データ分析方法 |
JP2006331372A (ja) | 2005-05-30 | 2006-12-07 | Ipsquare Inc | エージェント装置、管理マネージャ装置および環境エネルギー管理システム |
WO2006136036A1 (en) | 2005-06-21 | 2006-12-28 | Abb Research Ltd | Diagnostic device for use in process control system |
US8284254B2 (en) * | 2005-08-11 | 2012-10-09 | Sightlogix, Inc. | Methods and apparatus for a wide area coordinated surveillance system |
WO2008136110A1 (ja) * | 2007-04-26 | 2008-11-13 | Mitsubishi Electric Corporation | 数値制御装置及び数値制御システム |
US7539593B2 (en) | 2007-04-27 | 2009-05-26 | Invensys Systems, Inc. | Self-validated measurement systems |
US8378670B1 (en) | 2007-10-02 | 2013-02-19 | Aichi Steel Corporation | Magneto-impedance element and magneto-impedance sensor including detection coil |
US8090592B1 (en) * | 2007-10-31 | 2012-01-03 | At&T Intellectual Property I, L.P. | Method and apparatus for multi-domain anomaly pattern definition and detection |
JP5185173B2 (ja) | 2009-03-26 | 2013-04-17 | 日本電信電話株式会社 | 自動警報通知装置、自動警報通知システム、および自動警報通知方法 |
EP2415022A4 (en) * | 2009-04-01 | 2016-12-14 | I-Cetana Pty Ltd | SYSTEMS AND METHODS FOR DETECTING ANOMALIES FROM DATA |
CN103443727B (zh) * | 2011-03-28 | 2016-04-13 | 国际商业机器公司 | 异常检测***以及异常检测方法 |
-
2012
- 2012-05-08 CN CN201280021512.5A patent/CN103502949B/zh active Active
- 2012-05-08 JP JP2013515083A patent/JP5571847B2/ja active Active
- 2012-05-08 DE DE112012001160T patent/DE112012001160T5/de active Pending
- 2012-05-08 SG SG2013080361A patent/SG194695A1/en unknown
- 2012-05-08 US US14/117,278 patent/US9360855B2/en active Active
- 2012-05-08 GB GB1320978.8A patent/GB2505367B/en active Active
- 2012-05-08 WO PCT/JP2012/061770 patent/WO2012157471A1/ja active Application Filing
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JPH05164802A (ja) * | 1991-12-16 | 1993-06-29 | Fuji Xerox Co Ltd | 診断方法および装置 |
JP2009199246A (ja) * | 2008-02-20 | 2009-09-03 | Toshiba Corp | ノード稼働監視システムおよびノード稼働監視方法 |
WO2009144820A1 (ja) * | 2008-05-30 | 2009-12-03 | 東芝三菱電機産業システム株式会社 | 遠隔監視装置 |
Cited By (14)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10162969B2 (en) | 2014-09-10 | 2018-12-25 | Honeywell International Inc. | Dynamic quantification of cyber-security risks in a control system |
WO2016081044A3 (en) * | 2014-09-10 | 2016-07-21 | Honeywell International Inc. | Dynamic quantification of cyber-security risks in a control system |
JP2016139175A (ja) * | 2015-01-26 | 2016-08-04 | 株式会社東芝 | 監視制御システム、コントローラ、及び監視装置 |
JP2018513500A (ja) * | 2015-04-24 | 2018-05-24 | ゴールドマン サックス アンド カンパニー エルエルシー | ファブリック監視システムを用いてコンピューティングシステム及びネットワークに関与するイベントを扱うシステム及び方法 |
JP7323255B2 (ja) | 2015-10-09 | 2023-08-08 | フィッシャー-ローズマウント システムズ,インコーポレイテッド | 分散型工業パフォーマンス監視及び分析プラットフォーム |
JP7274394B2 (ja) | 2015-10-09 | 2023-05-16 | フィッシャー-ローズマウント システムズ,インコーポレイテッド | 分散型工業パフォーマンス監視及び分析プラットフォーム |
JP2022084791A (ja) * | 2015-10-09 | 2022-06-07 | フィッシャー-ローズマウント システムズ,インコーポレイテッド | 分散型工業パフォーマンス監視及び分析プラットフォーム |
JP2020017302A (ja) * | 2015-10-09 | 2020-01-30 | フィッシャー−ローズマウント システムズ,インコーポレイテッド | 分散型工業パフォーマンス監視及び分析プラットフォーム |
JP2018025979A (ja) * | 2016-08-10 | 2018-02-15 | 株式会社ジェイテクト | 解析システム |
CN107957926A (zh) * | 2016-10-18 | 2018-04-24 | 美光科技公司 | 用于侦测错误事件的方法 |
WO2018138857A1 (ja) * | 2017-01-27 | 2018-08-02 | 三菱電機株式会社 | 検索装置、監視装置、監視方法および検索プログラム |
JP6266181B1 (ja) * | 2017-01-27 | 2018-01-24 | 三菱電機株式会社 | 検索装置、監視システム、監視方法および検索プログラム |
CN108900538A (zh) * | 2018-08-09 | 2018-11-27 | 深圳市永达电子信息股份有限公司 | 一种工控信号检测方法和装置 |
CN108900538B (zh) * | 2018-08-09 | 2021-03-23 | 深圳市永达电子信息股份有限公司 | 一种工控信号检测方法和装置 |
Also Published As
Publication number | Publication date |
---|---|
JPWO2012157471A1 (ja) | 2014-07-31 |
GB201320978D0 (en) | 2014-01-15 |
CN103502949B (zh) | 2016-01-20 |
CN103502949A (zh) | 2014-01-08 |
US9360855B2 (en) | 2016-06-07 |
GB2505367B (en) | 2014-09-17 |
US20150293516A1 (en) | 2015-10-15 |
JP5571847B2 (ja) | 2014-08-13 |
DE112012001160T5 (de) | 2013-12-19 |
GB2505367A (en) | 2014-02-26 |
SG194695A1 (en) | 2013-12-30 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
JP5571847B2 (ja) | 複数の制御システムの異常を検知する異常検知システム | |
US9760468B2 (en) | Methods and arrangements to collect data | |
JP4872944B2 (ja) | 運用管理装置、運用管理システム、情報処理方法、及び運用管理プログラム | |
US20120272308A1 (en) | Management system, management method and management program for managing industrial control system | |
US20130245793A1 (en) | Anomaly detection system, anomaly detection method, and program for the same | |
CN104639380A (zh) | 服务器监控方法 | |
JP2007323193A (ja) | 性能負荷異常検出システム、性能負荷異常検出方法、及びプログラム | |
US20120136970A1 (en) | Computer system and method for managing computer device | |
CN111522703A (zh) | 监控访问请求的方法、设备和计算机程序产品 | |
JP2009294837A (ja) | 障害監視システム及びデバイスと監視装置並びに障害監視方法 | |
CN107943654A (zh) | 一种快速判定服务器环境温度监控异常原因的方法 | |
JP5979185B2 (ja) | 運用管理装置、運用管理システム、情報処理方法、及び運用管理プログラム | |
WO2023181241A1 (ja) | 監視サーバ装置、システム、方法、及びプログラム | |
JP6168209B2 (ja) | 運用管理装置、運用管理システム、情報処理方法、及び運用管理プログラム | |
JP2012088887A (ja) | トレースデータ取得装置、トレースデータ取得装置のトレースデータ取得方法およびデバッグシステム | |
CN110851316A (zh) | 异常预警方法及装置、***、电子设备、存储介质 | |
US11733689B2 (en) | Control system, programmable logic controller, and information processing method | |
JP5590196B2 (ja) | 運用管理装置、運用管理システム、情報処理方法、及び運用管理プログラム | |
JP5516494B2 (ja) | 運用管理装置、運用管理システム、情報処理方法、及び運用管理プログラム | |
EP3748451B1 (en) | Information processing apparatus, alarm management system, and alarm management method | |
JP2013197601A (ja) | 障害検知装置、障害検知方法、及びプログラム | |
JP2021064414A (ja) | システム | |
JP2011034319A (ja) | 端末動作状態監視システム、端末動作状態監視方法、端末動作状態監視プログラム | |
JP2005235134A (ja) | アクセスログ処理装置、アクセスログ処理方法およびアクセスログ処理プログラム | |
JP2020107156A (ja) | 監視システム、監視プログラムおよびシステム |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 12786130 Country of ref document: EP Kind code of ref document: A1 |
|
WWE | Wipo information: entry into national phase |
Ref document number: 112012001160 Country of ref document: DE Ref document number: 1120120011600 Country of ref document: DE |
|
ENP | Entry into the national phase |
Ref document number: 2013515083 Country of ref document: JP Kind code of ref document: A |
|
WWE | Wipo information: entry into national phase |
Ref document number: 14117278 Country of ref document: US |
|
ENP | Entry into the national phase |
Ref document number: 1320978 Country of ref document: GB Kind code of ref document: A Free format text: PCT FILING DATE = 20120508 |
|
WWE | Wipo information: entry into national phase |
Ref document number: 1320978.8 Country of ref document: GB |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 12786130 Country of ref document: EP Kind code of ref document: A1 |