Monitoring system, setting device, and monitoring method

A setting device for a monitoring system monitoring communication related to an FA network,

• wherein the monitoring system comprises a first processor of a control device coupled to and controlling a plurality of production devices in the FA network via a second network and a second processor coupled to the first processor and configured to monitor the communication according to monitoring setting information, and detect an attack on the FA network when a flow rate of communication exceeds a threshold value of a bandwidth of the communication, and
• the setting device comprises a third processor communicatively coupled to the second processor via a first network different from the second network, and configured to:
• collect data indicating a status of communication on the FA network through the second processor and the first network;
• and
• receive and analyze the data collected according to pre-registered information related to a setting of the communication on the FA network, and generate the monitoring setting information for monitoring the communication, the monitoring setting information comprises the threshold value of the bandwidth, a communication protocol and communication content for each of the plurality of production devices connected to the first processor, and at least two of the production devices are communicated with the first processor with different communication protocols having different threshold value of the bandwidth and different communication contents, and,
• in response to the detection of the attack on FA network, the second processor is further configured to limit the flow rate of the communication according to a user-specified bandwidth value, and the first processor is further configured to output a notification to a user when the bandwidth exceeds the threshold value as to inform the user of the attack on the FA network based on the monitor setting information generated by the third processor.

A monitoring method of a monitoring system monitoring communication related to an FA network, the monitoring method comprising:

• a step in which a second processor coupled to a first processor of a control device coupled to and controlling a plurality of production devices in the FA network via a second network and a third processor communicatively coupled to the second processor via a first network different from the second network collect data indicating a status of communication on the FA network;
• a step in which the third processor of the monitoring system receives and analyzes the data collected according to pre-registered information related to a setting of the communication on the FA network, and generates monitoring setting information for monitoring the communication, wherein the monitoring setting information comprises a threshold value of a bandwidth, a communication protocol and communication content for each of the plurality of production devices connected to the first processor, and at least two of the production devices are communicated with the first processor with different communication protocols having different threshold value of the bandwidth and different communication contents;
• a step in which a first processor and the second processor of the monitoring system monitor communication to be monitored according to the monitoring setting information and detect an attack on the FA network by determining a flow rate of communication exceeds the threshold value of the bandwidth corresponding to the communication protocol of each production device to which the communication is directed;
• a step in which limit the flow rate of the communication to be monitored according to a user-specified bandwidth value and output a notification to a user when the bandwidth exceeds the threshold value in response to the detection of the attack on the FA network based on the monitor setting information generated by the third processor, as to inform the user of the attack on the FA network.