Back to results
US 11,057,401 B2Granted
Intrusion detection device, intrusion detection method, and computer readable medium
AssigneeMitsubishi Electric Corporation
InventorsTsunato Nakai, Teruyoshi Yamaguchi, Koichi Shimizu, Nobuhiro Kobayashi
Life of this patent
Estimating the term…
Abstract
A state detection section (105) detects states of a plurality of controllers (300, 400) included in a communication system (600). An attack determination section (103) selects, from among a plurality of whitelists (110) each of which is associated with a combination of states, a whitelist (110) associated with the combination of the states of the plurality of controllers (300, 400) detected by the state detection section (105). The attack determination section (103) detects an attack on the communication system (600) by using the selected whitelist (110).
Claims5
An intrusion detection device, comprising:
- a memory storing a respective predefined control state transition rule for each of the plurality of devices;
- and
- processing circuitry to:
- detect a current control state for each of a plurality of devices included in a communication system;
- determine, for each of the plurality of devices, whether the current control state detected for the device conforms to the respective predefined state transition rule stored for the device:
- determine a current system state corresponding to a combination of the current control states detected for the plurality of devices;
- determine whether the combination of the detected current control states of the plurality of devices corresponds to a predefined combination when the detected control state of each device is determined to conform to its respective predefined state transition rule;
- select, from among a plurality of whitelists each of which is associated with a combination of states, a whitelist associated with the current system state when the combination of the detected current control states is determined to correspond to the predefined combination;
- and
- detect an attack on the communication system by using the whitelist selected.
7 more elements
An intrusion detection method, comprising:
- storing a respective predefined control state transition rule for each of a plurality of devices included in the communication system;
- detecting a current control state for each of the plurality of devices included in a communication system;
- determining, for each of the plurality of devices, whether the current control state detected for the device conforms to the respective predefined state transition rule stored for the device;
- determining a current system state corresponding to a combination of the current control states detected for the plurality of devices;
- determining whether the combination of the detected current control states of the plurality of devices corresponds to a predefined combination when the detected control state of each device is determined to conform to its respective predefined state transition rule;
- selecting, from among a plurality of whitelists each of which is associated with a combination of states, a whitelist associated with the current system state;
- when the combination of the detected current control states is determined to correspond to the predefined combination;
- and
- detecting an attack on the communication system by using the selected whitelist.
6 more elements
A non-transitory computer readable medium storing an intrusion detection program that causes a computer to execute:
- a process of storing a respective predefined control state transition rule for each of a plurality of devices included in the communication system;
- a state detection process of detecting a current control state for each of the plurality of devices included in a communication system;
- a process of determining, for each of the plurality of devices, whether the current control state detected for the device conforms to the respective predefined state transition rule stored for the device;
- a current system state determining process of determining a current system state corresponding to a combination of the current control states detected for the plurality of devices;
- a process of determining whether the combination of the detected current control states of the plurality of devices corresponds to a predefined combination when the detected control state of each device is determined to conform to its respective predefined state transition rule;
- a selection process of selecting, from among a plurality of whitelists each of which is associated with a combination of states, a whitelist associated with the current system state when the combination of the detected current control states is determined to correspond to the predefined combination;
- and
- an attack detection process of detecting an attack on the communication system by using the whitelist selected by the selection process.
5 more elements
Dependencies are inferred from the claim text.