Anomaly detection system for detecting anomaly in multiple control systems

A computer program product comprising:

• a storage device, said device having instructions included therein to configure a first analysis unit of a first analysis device to perform a method, said first analysis device one of a plurality of analysis devices of an anomaly detection system, each said analysis device associated with a respective control system, wherein said method comprises:
• acquiring events occurring in the associated respective control system;
• and
• analyzing the events to determine whether the associated respective control system has an anomaly;
• determining whether or not to indicate an acquired event to a second analysis device of the plurality of analysis devices;
• and
• transferring the event to the analysis control unit of the second analysis device if determining that the event is to be indicated to the second analysis device;
• wherein an analysis control unit of the second analysis device detects a correlation between the event indicated by the first analysis device with an event indicated by an analysis device other than the first analysis device, and determines that there is an anomaly on condition that the events has correlation, and indicates the anomaly to the analysis unit of the first analysis device if the analysis control unit determines that there is an anomaly, said method further comprising:
• receiving an indication of said determined anomaly from said second analysis unit;
• and
• reporting the anomaly indicated by the second analysis device to an administrator of the associated control system.

An anomaly detecting method for detecting an anomaly in a plurality of control systems, wherein

• a plurality of analysis devices are provided that are associated with the respective control systems and that acquire an event occurring in an associated control system and analyze the event to determine whether there is an anomaly, the method comprising:
• determining, by a first analysis device among the plurality of analysis devices, whether an event occurring in the associated control system is to be indicated to a second analysis device among the plurality of analysis devices;
• and
• determining by the second analysis device that there is an anomaly on condition that the event indicated by the first analysis device has correlation with an event indicated by an analysis device other than the first analysis device.