US 2020/0092313 A1Published application

Data determination device, data determination method, and data determination program

AssigneeMitsubishi Electric Corporation

InventorsTeruyoshi YAMAGUCHI, Tsunato NAKAI, Koichi SHIMIZU, Nobuhiro KOBAYASHI

Life of this patent

Estimating the term…

Loading patent…

Abstract

An allowed communication list conversion unit (123) assigns one or more flags to request communication and response communication, between which a correspondence relationship is described in a detection rule, and describes, in an allowed communication list, details of a flag operation specifying a value to be set to the flag and a flag condition for determining whether the value to be set is set in the flag, in association with each other. A determination unit (103) sets the value after determining that communication data on the request communication is normal, determines whether the value is set in the flag based on the flag condition when determining whether communication data on the response communication to the request communication is normal, and determines that the communication data on the response communication is normal when the value is set, to thereby reset the flag.

Claims8

Dependent claims

A data determination device, comprising:

a flag manager to store a current value of a flag set for an own device;
a state manager to store a current operation state of the own device transitioning between a plurality of operation states, and to cause the operation state of the own device to transition in accordance with a state transition model defining transition between the plurality of operation states, according to any one or more of an input signal from an outside and the current value of the flag stored in the flag manager;
an allowed communication list converter to convert a detection rule, which describes a correspondence relationship between communication data indicating request communication and communication data indicating response communication to the request communication, into an allowed communication list registering in advance communication data for which communication is allowed for each of the plurality of operation states;
and
determiner to determine whether communication data input to the own device is communication data in the current operation state registered in the allowed communication list by using any one or more of the current operation state of the own device stored in the state manager, the allowed communication list, and the current value of the flag stored in the flag manager, to thereby determine whether the communication data input to the own device is normal or abnormal,
wherein the allowed communication list converter is configured to, when converting the detection rule into the allowed communication list:
assign a flag to each of the request communication and the response communication, between which the correspondence relationship is described in the detection rule;
and
describe, in the allowed communication list, details of a flag operation specifying a set value to be set to the flag and a flag condition for determining whether the set value is set in the flag, in association with each other, and
wherein the determiner is configured to:
set the set value in the flag in accordance with the details of the flag operation after determining that communication data on the request communication is normal;
determine whether the set value is set in the flag based on the flag condition when determining whether communication data on the response communication to the request communication is normal;
and
determine that the communication data on the response communication is normal when the set value is set, to thereby reset the flag.

11 more elements

A data determination method, comprising:

storing a current value of a flag set for an own device;
causing an operation state of the own device to transition and storing a current operation state of the own device in accordance with a state transition model defining transition between a plurality of operation states of the own device according to any one or more of an input signal from an outside and the current value of the flag;
converting a detection rule, which describes a correspondence relationship between communication data indicating request communication and communication data indicating response communication to the request communication, into an allowed communication list registering in advance communication data for which communication is allowed for each of the plurality of operation states;
and
determining whether communication data input to the own device is communication data in the current operation state registered in the allowed communication list by using any one or more of the current operation state of the own device, the allowed communication list, and the current value of the flag, to thereby determine whether the communication data input to the own device is normal or abnormal,
wherein the method includes, when converting the detection rule into the allowed communication list:
assigning a flag to each of the request communication and the response communication, between which the correspondence relationship is described in the detection rule;
and
describing, in the allowed communication list, details of a flag operation specifying a set value to be set to the flag and a flag condition for determining whether the set value is set in the flag, in association with each other, and
wherein the method includes:
setting the set value in the flag in accordance with the details of the flag operation after determining that communication data on the request communication is normal;
determining whether the set value is set in the flag based on the flag condition when determining whether communication data on the response communication to the request communication is normal;
and
determining that the communication data on the response communication is normal when the set value is set, to thereby reset the flag.

11 more elements

A non-transitory computer readable storage medium embodied thereon a program executable by a computer, the program for causing, in order to determine data, the computer to function as:

a flag manager to store a current value of a flag set for an own device;
a state manager to store a current operation state of the own device transitioning between a plurality of operation states, and to cause the operation state of the own device to transition in accordance with a state transition model defining transition between the plurality of operation states according to any one or more of an input signal from an outside and the current value of the flag stored in the manager;
an allowed communication list converter to convert a detection rule, which describes a correspondence relationship between communication data indicating request communication and communication data indicating response communication to the request communication, into an allowed communication list registering in advance communication data for which communication is allowed for each of the plurality of operation states;
and
a determiner to determine whether communication data input to the own device is communication data in the current operation state registered in the allowed communication list by using any one or more of the current operation state of the own device stored in the state manager, the allowed communication list, and the current value of the flag stored in the flag manager, to thereby determine whether the communication data input to the own device is normal or abnormal,
wherein the allowed communication list converter is configured to, when converting the detection rule into the allowed communication list:
assign a flag to each of the request communication and the response communication, between which the correspondence relationship is described in the detection rule;
and
describe, in the allowed communication list, details of a flag operation specifying a set value to be set to the flag and a flag condition for determining whether the set value is set in the flag, in association with each other, and
wherein the determiner is configured to:
set the set value in the flag in accordance with the details of the flag operation after determining that communication data on the request communication is normal;
determine whether the set value is set in the flag based on the flag condition when determining whether communication data on the response communication to the request communication is normal;
and
determine that the communication data on the response communication is normal when the set value is set, to thereby reset the flag.

11 more elements

Dependencies are inferred from the claim text.