LOG ANALYZING SYSTEM AND METHOD

• US 20180124083A1
• Filed: 10/27/2017
• Published: 05/03/2018
• Est. Priority Date: 11/01/2016
• Status: Active Grant

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: UCHIYAMA, Hiroki, YATO, Akifumi, OHKUBO, Satoshi, YAMAGUCHI, Kohhei
• Granted Patent: US 10,523,696 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 11/3006 where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems multiprogramming arrangements G06F9/46; allocation of resources G06F9/50
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 17/40 Data acquisition and logging for input to computer G06F3/00
• CPC Class Codes: H04L 41/069 using logs of notifications; Post-processing of notifications
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/50 Testing arrangements
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

Proposed are a log analyzing system and a log analyzing method capable of more effectively defending a control system from unauthorized access. The log analyzing system which analyzes a communication log of a control device comprises a network device which receives a communication packet corresponding to the communication log from a network, and a monitoring device which monitors communication to the network device, wherein the monitoring device obtains a difference between a communication pattern of the communication packet and a stable pattern, which is a pattern of a communication in a state of no unauthorized access, restores the communication packet based on the difference, and notifies the restored communication packet.

Claims

1. A log analyzing system which analyzes a communication log of a control device, the log analyzing system comprising:

a network device which receives a communication packet corresponding to the communication log from a network; and

a monitoring device which monitors communication to the network device,

wherein the monitoring device obtains a difference between a communication pattern of the communication packet and a stable pattern, which is a pattern of a communication in a state of no unauthorized access, restores the communication packet based on the difference, and notifies the restored communication packet.

2. The log analyzing system according to claim 1,

wherein the network device replicates the communication packet and sends the replicated communication packet to the monitoring device.

3. The log analyzing system according to claim 1,

wherein the monitoring device extracts the communication pattern from a plurality of the communication packets based on a variation in a transmission/reception cycle and a transmission/reception size of each of the plurality of communication packets.

4. The log analyzing system according to claim 1,

wherein a collection device collects the communication packets from the network device, and

wherein the monitoring device restores the communication packets based on the communication packets collected by the collection device.

5. The log analyzing system according to claim 4,

wherein the monitoring device restores the communication packets based on the communication packets collected by each of a plurality of the collection devices.

6. The log analyzing system according to claim 1,

wherein the monitoring device comprises a collection device which collects the communication packets, obtains the difference between the communication pattern of the communication packets and the stable pattern of the communication, and restores the communication packets based on the difference, and the monitoring device additionally notifies the restored communication packets.

7. The log analyzing system according to claim 1,

wherein the monitoring device displays the communication packets in a time series, and displays the communication packets of the stable pattern and the communication packets based on the difference in an identifiable manner.

8. The log analyzing system according to claim 1,

wherein the monitoring device is set according to an operational status of the control device,

wherein the operational status is a trial condition for the monitoring device to acquire the stable pattern of the communication, and an operating condition other than the trial condition, and

wherein the monitoring device is restricted of executable processing based on the setting.

9. A log analyzing method in a log analyzing system which analyzes a communication log of a control device,

wherein the log analyzing system comprises:

a network device which receives a communication packet corresponding to the communication log from a network; and

a monitoring device which monitors communication to the network device, and wherein the log analyzing method comprises;

a first step of the monitoring device obtaining a difference between a communication pattern of the communication packet and a stable pattern, which is a pattern of a communication in a state of no unauthorized access;

a second step of the monitoring device restoring the communication packet based on the difference; and

a third step of the monitoring device notifying the restored communication packet.