Incident Detection System

Abstract

A system that detects any unauthorized communication without imposing a processing load on a control device is provided. In the incident detection system configured to detect any security incident, a gateway device includes: an ID generation unit that generates its own gateway device identification information; a detection packet generation unit that generates a detection packet including control information transmitted from a control device and path information obtained by adding its own gateway device identification information to a communication packet; a log generation unit that generates log information including the detection packet; and a device communication unit that transmits the log information to a management server connected to the gateway device over a network or transmits the detection packet to a control device controlled based on the control information. In the incident detection system, the management server includes: a server communication unit that receives log information from a gateway device; a communication path extraction unit that stores assumed path information, obtained by extracting path information from the log information, in a storage unit in advance; and an incident detection unit that detects any unauthorized communication packet based on the assumed path information stored in the storage unit and path information included in the log information.

Dependencies are inferred from the claim text.