ANOMALY DETECTION SYSTEM, ANOMALY DETECTION METHOD, AND PROGRAM FOR THE SAME

摘要

A method is for handling an anomaly in an industrial control system (ICS) connected to a network with a plurality of other ICSs and an anomaly analyzer. An ICS receives status data from its own industrial process, and stores this status data as normal pattern data. The ICS transmits its own status data to one or more other ICSs. The ICS receives an indication from the anomaly analyzer that the ICS is suspected of having an anomaly. The ICS transmits alternate status data based on the normal pattern data stored during non-suspect operation, and stores the status data received from its own industrial process as real status data. In response to receiving from the anomaly analyzer an indication that the ICS is not operating anomalously, the ICS transmits the stored real data, and switches back to transmitting its own status data to one or more other ICSs.

主权项

1. A method for handling an anomaly in an industrial control system (ICS), a plurality of ICSs and an anomaly analyzer connected to a network, the method comprising:
receiving, by an ICS, its own status data from its own industrial process, and storing this status data as normal pattern data; transmitting, by the ICS, its own status data to one or more other ICSs; receiving, by the ICS, an indication from the anomaly analyzer that the ICS is suspected of having an anomaly; transmitting, by the ICS, alternate status data based on the normal pattern data stored during non-suspect operation, and storing the status data received from its own industrial process as real status data; in response to receiving from the anomaly analyzer an indication that the ICS is not operating anomalously, the ICS transmitting the stored real data, and switching back to transmitting its own status data to one or more other ICSs.