Data determination apparatus, data determination method, and computer readable medium

• US 10,171,252 B2
• Filed: 12/22/2015
• Issued: 01/01/2019
• Est. Priority Date: 01/16/2015
• Status: Active Grant

• Current Assignee: Mitsubishi Electric Corporation
• Original Assignee: Mitsubishi Electric Corporation
• Inventors: Yamaguchi, Teruyoshi, Shimizu, Koichi, Kobayashi, Nobuhiro, Nakai, Tsunato
• Primary Examiner(s): Tokuta, Shean
• Application Number:
  US15/510,981
• Publication Number:
  US 20170279622A1
• Time in Patent Office: 1,106 Days
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 9/36 with means for detecting characters not meant for transmission

Abstract

A data determination apparatus of the present invention includes a state transition model storage unit to store a state transition model representing a state transition, a state management unit to hold an operating state of an own apparatus based on the state transition model, a communication permission list storage unit to store, as a communication permission list, communication permitted data whose communications are permitted in respective operating states, a communication unit to obtain communication determination data, and a determination unit to determine whether or not the communication determination data is communication permitted data whose communication has been permitted in a current operating state, using the current operating state and the communication permission list.

Claims

1. A data determination apparatus comprising:

processing circuitry configured to

measure a period of time during which an operating state of the data determination apparatus continues;

store a state transition model representing a state transition between respective operating states of a plurality of operating states according to obtained information obtained by the data determination apparatus;

store a history of the obtained information as an obtained information history;

hold an operating state of the data determination apparatus based on the state transition model;

store, as a communication permission list, communication permitted data whose communications are permitted in the respective operating states of the plurality of operating states;

obtain communication data as communication determination data; and

obtain the communication determination data obtained, obtain the operating state of the data determination apparatus held as a current operating state, and determine whether or not the communication determination data is communication permitted data whose communication has been permitted in the current operating state, using the current operating state and the communication permission list, wherein

the obtained information includes the communication data obtained by the communication, an operation signal indicating receipt of an operation on the data determination apparatus, and a timer signal output from the timer,

the processing circuitry generates the state transition model and the communication permission list, based on the obtained information history,

the processing circuitry generates the state transition model by setting a wait state when a period of time elapsed between successive communication data included in the Obtained information history is a first period or more, setting, as a first change point, a point of time of having obtained information other than the communication data and setting each of states before and after the first change point as a first operating state, and setting, as a second change point, a point of time of having obtained transition communication data whereby an operating state transition has been determined to be made in each first operating state and setting each of states before and after the second change point as a second operating state.

2. The data determination apparatus according to claim 1, wherein the processing circuitry outputs an alarm indicating detection of abnormality when the communication determination data is determined not to be the communication permitted data.

3. The data determination apparatus according to claim 1, wherein the processing circuitry blocks the communication when the communication determination data is determined not to be the communication permitted data.

4. The data determination apparatus according to claim 1, wherein the processing circuitry transitions the operating state of the data determination apparatus based on the state transition model when the communication determination data is determined to be the communication permitted data.

5. The data determination apparatus according to claim 1, wherein the processing circuitry transitions the operating state of the data determination apparatus to an abnormal state when the communication determination data is determined not to be the communication permitted data.

6. The data determination apparatus according to claim 1, wherein the processing circuitry sets, in the communication permission list, the communication data communicated in each operating state included in the state transition model, as the communication permitted data.

7. The data determination apparatus according to claim 1, wherein the processing circuitry extracts the transition communication data, using a clustering method.

8. A data determination method comprising:

measuring a period of time during which an operating state of a data determination apparatus continues;

storing a state transition model representing a state transition between respective operating states of a plurality of operating states according to obtained information obtained by the data determination apparatus;

storing a history of the obtained information as an obtained information history;

holding an operating state of the data determination apparatus based on the state transition model;

storing, as a communication permission list, communication permitted data whose communications are permitted in the respective operating states of the plurality of operating states;

obtaining communication data as communication determination data; and

obtaining the communication determination data obtained, obtaining the operating state of the data determination apparatus held as a current operating state, and determining whether or not the communication determination data is communication permitted data whose communication has been permitted in the current operating state, using the current operating state and the communication permission list, wherein

the obtained information includes the communication data obtained by the communication, an operation signal indicating receipt of an operation on the data determination apparatus, and a timer signal output from the timer,

the state transition model and the communication permission list are generated based on the obtained information history,

the state transition model is generated by setting a wait state when a period of time elapsed between successive communication data included in the obtained information history is a first period or more, setting, as a first change point, a point of time of having obtained information other than the communication data and setting each of states before and after the first change point as a first operating state, and setting, as a second change point, a point of time of having obtained transition communication data whereby an operating state transition has been determined to be made in each first operating state and setting each of states before and after the second change point as a second operating state.

9. A non-transitory computer readable medium storing a program of a data determination apparatus comprising a state transition model storage unit to store a state transition model representing a state transition between respective operating states of a plurality of operating states, and a communication permission list storage unit to store, as a communication permission list, communication permitted data whose communications are permitted in the respective operating states of the plurality of operating states, the program causing a computer to:

measure a period of time during which an operating state of a data determination apparatus continues;

store a state transition model representing a state transition between respective operating states of a plurality of operating states according to obtained information obtained by the data determination apparatus;

store a history of the obtained information as an obtained information history;

hold an operating state of the data determination apparatus based on the state transition model;

store, as a communication permission list, communication permitted data whose communications are permitted in the respective operating states of the plurality of operating states;

obtain communication data as communication determination data; and

obtain the communication determination data obtained in the communication process, obtaining the operating state of the data determination apparatus held in the state management process as a current operating state, and determining whether or not the communication determination data is communication permitted data whose communication has been permitted in the current operating state, using the current operating state and the communication permission list, wherein

the obtained information includes the communication data obtained by the communication, an operation signal indicating receipt of an operation on the data determination apparatus, and a timer signal output from the timer,

the state transition model and the communication permission list are generated based on the obtained information history,

the state transition model is generated by setting a wait state when a period of time elapsed between successive communication data included in the obtained information history is a first period or more, setting, as a first change point, a point of time of having obtained information other than the communication data and setting each of states before and after the first change point as a first operating state, and setting, as a second change point, a point of time of having obtained transition communication data whereby an operating state transition has been determined to be made in each first operating state and setting each of states before and after the second change point as a second operating state.

10. A data determination apparatus comprising:

processing circuitry configured to

measure a period of time during which an operating state of a data determination apparatus continues;

store a state transition model representing a state transition between respective operating states of a plurality of operating states according to obtained information obtained by the data determination apparatus;

store a history of the obtained information as an obtained information history;

hold an operating state of the data determination apparatus based on the state transition model;

store, as a communication permission list, communication permission rules including communication permitted data whose communications are permitted in the respective operating states of the plurality of operating states, a permission condition under which communication of each communication permitted data is permitted, and a permission process when the communication of the communication permitted data is permitted;

obtain communication data as communication determination data; and

obtain the communication determination data obtained, a current operating state being the operating state of the data determination apparatus held, and a timer value being a current value, and determine whether or not the communication determination data satisfies a communication permission rule that permits the communication in the current operating state, using the current operating state, the communication permission list, and the timer value, wherein

the obtained information includes the communication data obtained by the communication, an operation signal indicating receipt of an operation on the data determination apparatus, and a timer signal output from the timer,

the processing circuitry generates the state transition model and the communication permission list, based on the obtained information history,

the processing circuitry generates the state transition model by setting a wait state when a period of time elapsed between successive communication data included in the obtained information history is a first period or more, setting, as a first change point, a point of time of having obtained information other than the communication data and setting each of states before and after the first change point as a first operating state, and setting, as a second change point, a point of time of having obtained transition communication data whereby an operating state transition has been determined to be made in each first operating state and setting each of states before and after the second change point as a second operating state.

11. The data determination apparatus according to claim 10,

wherein the processing circuitry stores, as the permission condition, a timer permitted value indicating a value range to permit the communication of the communication permitted data, and stores, as the permission process, a timer set value to be set when the communication of the communication permitted data is permitted;

and

wherein the processing circuitry determines whether or not the communication determination data satisfies the communication permission rule, using a determination result indicating whether or not the timer value is within the range of the timer permitted value.

12. The data determination apparatus according to claim 10, wherein the processing circuitry:

manages each flag; and

obtains the current operating state, the communication permission list, the timer value, and a flag value being a current value of the flag, and determines whether or not the communication determination data satisfies the communication permission rule that permits the communication in the current operating state, using the current operating state, the communication permission list, the timer value, and the flag value.

13. The data determination apparatus according to claim 12,

wherein the processing circuitry further stores, as the permission condition, a flag permitted value being a value of the flag to permit the communication of the communication permitted data, and further stores, as the permission process, a flag set value to be set in the flag when the communication of the communication permitted data is permitted;

and

wherein the processing circuitry determines whether or not the communication determination data satisfies the communication permission rule, using a determination result indicating whether or not the flag value is the flag permitted value.

14. The data determination apparatus according to claim 10, wherein the processing circuitry outputs an alarm indicating detection of abnormality when the communication determination data is determined not to satisfy the communication permission rule.

15. The data determination apparatus according to claim 10, wherein the processing circuitry blocks the communication when the communication determination data is determined not to satisfy the communication permission rule.

16. The data determination apparatus according to claim 10, wherein the processing circuitry transitions the operating state of the data determination apparatus based on the state transition model when the communication determination data is determined to satisfy the communication permission rule.

17. A data determination method comprising:

measuring a period of time during which an operating state of a data determination apparatus continues;

storing a state transition model representing a state transition between respective operating states of a plurality of operating states according to obtained information obtained by the data determination apparatus;

storing a history of the obtained information as an obtained information history;

holding an operating state of the data determination apparatus based on the state transition model;

storing, as a communication permission list, communication permitted data whose communications are permitted in the respective operating states of the plurality of operating states;

obtaining communication data as communication determination data; and

obtaining the communication determination data obtained, a current operating state being the operating state of the data determination apparatus held, and a timer value being a current value, and determining whether or not the communication determination data satisfies a communication permission rule that permits the communication in the current operating state, using the current operating state, the communication permission list, and the timer value, wherein

the obtained information includes the communication data obtained by the communication, an operation signal indicating receipt of an operation on the data determination apparatus, and a timer signal output from the timer,

the state transition model and the communication permission list are generated based on the obtained information history,

the state transition model is generated by setting a wait state when a period of time elapsed between successive communication data included in the obtained information history is a first period or more, setting, as a first change point, a point of time of having obtained information other than the communication data and setting each of states before and after the first change point as a first operating state, and setting, as a second change point, a point of time of having obtained transition communication data whereby an operating state transition has been determined to be made in each first operating state and setting each of states before and after the second change point as a second operating state.

18. A non-transitory computer readable medium storing a program of a data determination apparatus comprising a state transition model storage unit to store a state transition model representing a state transition between respective operating states of a plurality of operating states and a communication permission list storage unit to store, as a communication permission list, communication permission rules including communication permitted data whose communications are permitted in the respective operating states of the plurality of operating states, a permission condition under which communication of each communication permitted data is permitted, and a permission process when the communication of the communication permitted data is permitted, the program causing a computer to:

measure a period of time during which an operating state of a data determination apparatus continues;

store a state transition model representing a state transition between respective operating states of a plurality of operating states according to obtained information obtained by the data determination apparatus;

store a history of the obtained information as an obtained information history;

hold an operating state of the data determination apparatus based on the state transition model;

store, as a communication permission list, communication permitted data whose communications are permitted in the respective operating states of the plurality of operating states;

obtain communication data as communication determination data; and

obtain the communication determination data obtained in the communication process, a current operating state being the operating state of the data determination apparatus held in the state management process, and a timer value being a current value of a timer unit to measure a period of time, and determining whether or not the communication determination data satisfies a communication permission rule that permits the communication in the current operating state, using the current operating state, the communication permission list, and the timer value, wherein

the obtained information includes the communication data obtained by the communication, an operation signal indicating receipt of an operation on the data determination apparatus, and a timer signal output from the timer,

the state transition model and the communication permission list are generated based on the obtained information history,

the state transition model is generated by setting a wait state when a period of time elapsed between successive communication data included in the obtained information history is a first period or more, setting, as a first change point, a point of time of having obtained information other than the communication data and setting each of states before and after the first change point as a first operating state, and setting, as a second change point, a point of time of having obtained transition communication data whereby an operating state transition has been determined to be made in each first operating state and setting each of states before and after the second change point as a second operating state.