Abstract:
A remote monitoring system is a remote monitoring system that detects an anomaly in a state of a monitored target that operates autonomously, and the remote monitoring system includes: a state obtainer that obtains state information indicating a state of the monitored target from the monitored target; an information obtainer that obtains first sensing information indicating a result of sensing of the monitored target from an external information source that is provided outside the monitored target and performs sensing of the monitored target; a state estimator that estimates a first state of the monitored target based on the first sensing information; and a state comparer that compares the state information with estimated state information that is based on the first state.
Abstract:
A network protection device includes a packet capture unit which captures a network packet through an intelligent switch which performs connection in a communication network or across communication networks; a network analyzer which detects a threat in the network packet; a threat remover which removes the threat in the network packet; and a switch operator which changes from a first communication path, which connects a sender node to a receiver node without the threat remover, to a second communication path, which is different from the first communication path and connects the sender node to the receiver node through the threat remover when the threat is detected in the threat detector.
Abstract:
An anomaly detection system includes: a register value collector that collects register values of register numbers from a controller; a future state predictor that predicts a future state of the control system; a blacklist creator that creates a blacklist based on a prediction result; an anomaly determiner that determines whether the control system enters an anomalous state by checking the collected register values against the blacklist; and an outputter that outputs a determination result. The blacklist creator defines, as the blacklist: a predicted register number that is predicted, if a register value of the predicted register number is changed, to cause the control system to enter the anomalous state in the future; and a range of the register value within which the control system is predicted to enter the anomalous state, and dynamically creates the blacklist corresponding to a combination of the collected register values.
Abstract:
A method in the disclosure includes: receiving, from an information device, a device password which is used for controlling a target device via an in-house server apparatus and which is input on the information device using a setting screen; managing a device ID of the in-house server apparatus, a user ID, and the device password in association with one another; transmitting the device password to the in-house server apparatus to cause the in-house server apparatus to manage the device ID and the device password; transmitting, when login to an out-of-house server apparatus is authenticated, an authentication screen to the information device; receiving, from the information device, an input password that is input on the information device using the authentication screen; and when the received input password is identical to the device password that is associated with the user ID, approving a control of a target device by the information device.
Abstract:
A control method according to the present disclosure is performed by one of a plurality of servers each including a distributed ledger and includes: obtaining request transaction data including an analysis request identification (ID) uniquely identifying a request for analysis, and an access method for accessing relevant information usable for the analysis; and recording a block including the request transaction data into the distributed ledger. The control method further includes: obtaining analysis transaction data including an analysis result corresponding to the analysis request ID, log information associated with the analysis result, and threat intelligence information serving as a basis of the analysis result; obtaining a verification result for the analysis transaction data; generating a block including the analysis transaction data; and when the verification result indicates that the validity of the analysis transaction data has been verified, recording the block including the analysis transaction data into the distributed ledger.
Abstract:
A monitoring apparatus includes: a user input acquirer that acquires information based on input provided by a user to a user input device; and a communication anomaly detector that detects a communication anomaly in communication that is being observed, and the communication anomaly detector detects the communication anomaly based on information about a packet whose source or destination includes a monitoring target device and the information based on the input corresponding to the packet.