Log analyzing system and method

• US 10,523,696 B2
• Filed: 10/27/2017
• Issued: 12/31/2019
• Est. Priority Date: 11/01/2016
• Status: Active Grant

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: Uchiyama, Hiroki, Yato, Akifumi, Ohkubo, Satoshi, Yamaguchi, Kohhei
• Primary Examiner(s): Zarrineh, Shahriar
• Application Number:
  US15/795,429
• Publication Number:
  US 20180124083A1
• Time in Patent Office: 795 Days
• Field of Search: 726 22
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 17/40 Data acquisition and logging for input to computer G06F3/00
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

Proposed are a log analyzing system and a log analyzing method capable of more effectively defending a control system from unauthorized access. The log analyzing system which analyzes a communication log of a control device comprises a network device which receives a communication packet corresponding to the communication log from a network, and a monitoring device which monitors communication to the network device, wherein the monitoring device obtains a difference between a communication pattern of the communication packet and a stable pattern, which is a pattern of a communication in a state of no unauthorized access, restores the communication packet based on the difference, and notifies the restored communication packet.

Claims

1. A log analyzing system which analyzes a log of communications of a control device, the log analyzing system comprising:

a network device which receives a plurality of communication packets corresponding to the communications of the control device from a network; and

a monitoring device which monitors the plurality of communication packets to the network device including reception times and reception sizes of the plurality of communication packets,

wherein the monitoring device is programmed to;

create time series data indicating respective reception times and receptions sizes of the plurality of communication packets,

frequency convert the time series data to generate information of respective frequencies and strength of the plurality of communication packets based on the respective reception times and receptions sizes of the plurality of communication packets,

extract an abnormal pattern by determining a difference between the frequency-converted time series data and a predetermined stable pattern representing communication in a state of no unauthorized access, and

inverse frequency convert the extracted abnormal pattern to acquire one or more respective times and sizes of one or more abnormal communication packets among the plurality of communication packets, and

output the one or more abnormal communication packets including the respective times and sizes thereof.

2. The log analyzing system according to claim 1,

wherein the network device is programmed to replicate the plurality of communication packets and sends the plurality of replicated communication packets to the monitoring device.

3. The log analyzing system according to claim 1,

wherein the monitoring device receives the plurality of communication packets based on communications collected by a collection device connected to the network device.

4. The log analyzing system according to claim 1,

wherein the monitoring device is programmed to:

output a display screen which includes the plurality of communication packets in time series, and the one or more abnormal communication packets in an identifiable manner with the communication packets of the stable pattern in time series.

5. The log analyzing system according to claim 1,

wherein the monitoring device is programmed to:

acquire the stable pattern according to an operational status which is a trial condition of the control device.

6. A log analyzing method in a log analyzing system which analyzes a log of communications of a control device,

wherein the log analyzing system includes:

a network device which receives a plurality of communication packets corresponding to the communications of the control device from a network; and

a monitoring device which monitors the plurality of communication to the network device,

the log analyzing method comprising;

creating time series data indicating respective reception times and receptions sizes of the plurality of communication packets,

frequency converting the time series data to generate information of respective frequencies and strength of the plurality of communication packets based on the respective reception times and receptions sizes of the plurality of communication packets,

extracting an abnormal pattern by determining a difference between the frequency-converted time series data and a predetermined stable pattern representing communication in a state of no unauthorized access, and

inverse frequency converting the extracted abnormal pattern to acquire one or more respective times and sizes of one or more abnormal communication packets among the plurality of communication packets, and

outputting the one or more abnormal communication packets including the respective times and sizes thereof.