Extraction apparatus, extraction method, computer readable medium
An extraction apparatus can obtain a first alert and a second alert that are generated, when an anomaly occurs in a control system, in order to provide notification of the anomaly. The extraction apparatus includes: a classification unit configured to generate association information associating the first alert with the second alert; a learning unit configured to learn a generation pattern of the second alert when the anomaly occurs due to a cause other than a cyber-attack based on the association information generated by the classification unit and a generation pattern of the first alert when the anomaly occurs due to a cause other than a cyber-attack; and an extraction unit configured to extract, from among the second alerts, the second alert generated due to a cyber-attack based on the generation pattern of the second alert that is learned by the learning unit and output the extracted second alert.
1. An extraction apparatus capable of obtaining a first alert and a second alert that are generated, when an anomaly occurs in a control system, in order to provide notification of the anomaly, wherein
the extraction apparatus comprises:
at least one memory storing one or more instructions; and
at least one processor configured to execute to one or more instruction to:
generate association information associating the first alert with the second alert;
learn a generation pattern of the second alert when the anomaly occurs due to a cause other than a cyber-attack based on the association information generated by the at least one processor and a generation pattern of the first alert when the anomaly occurs due to a cause other than a cyber-attack; and
extract, from among the second alerts, the second alert generated due to a cyber-attack based on the generation pattern of the second alert that is learned by the at least one processor and output the extracted second alert,
wherein the at least one processor is further configured to perform the learning by replacing the first alert in the generation pattern of the first alert when the anomaly occurs due to a cause other than the cyber-attack with the second alert associated with the first alert based on the association information.
2. The extraction apparatus according to claim 1 , wherein the at least one processor is further configured to estimate the first alert and the second alert that have been generated due to the same cause and generate the association information associating the estimated first alert with the estimated second alert.
3. The extraction apparatus according to claim 2 , wherein the cat least one processor is further configured to estimate the first alert and the second alert that have been generated due to the same cause based on information about the occurrence time of the anomaly included in the first alert and the second alert.
4. The extraction apparatus according to claim 2 , wherein the at least one processor is further configured to estimate the first alert and the second alert that have been generated due to the same cause based on information about the occurrence location of the anomaly included in the first alert and the second alert.
5. The extraction apparatus according to claim 2 , wherein the at least one processor is further configured to estimate the first alert and the second alert that have been generated due to the same cause based on information about the type of the anomaly included in the first alert and the second alert.
6. The extraction apparatus according to claim 1 , wherein the at least one processor is further configured to:
determine that among the second alerts, the second alert that matches the generation pattern of the second alert learned by the at least one processor is the second alert generated due to a cause other than the cyber-attack, and
determine that among the second alerts, the second alert that does not match the generation pattern of the second alert learned by the at least one processor is the second alert generated due to a cyber-attack.
7. The extraction apparatus according to claim 1 , wherein the at least one processor is further configured to discard the second alert generated due to a cause other than the cyber-attack.
8. The extraction apparatus according to claim 1 , wherein the first alert is an alert that the control system itself generates, when an anomaly occurs in the control system, in order to provide notification of the anomaly, and
the second alert is an alert that a system other than the control system generates, when an anomaly occurs in the control system, in order to provide notification of the anomaly.
9. An extraction method performed by an extraction apparatus capable of obtaining a first alert and a second alert that are generated, when an anomaly occurs in a control system, in order to provide notification of the anomaly, the extraction method comprising:
a classification step of generating association information associating the first alert with the second alert;
a learning step of learning a generation pattern of the second alert when the anomaly occurs due to a cause other than a cyber-attack based on the association information generated by the classification step and a generation pattern of the first alert when the anomaly occurs due to a cause other than a cyber-attack; and
an extraction step of extracting, from among the second alerts, the second alert generated due to a cyber-attack based on the generation pattern of the second alert that is learned by the learning step and outputting the extracted second alert,
wherein the learning operation is performed by replacing the first alert in the generation pattern of the first alert when the anomaly occurs due to a cause other than the cyber-attack with the second alert associated with the first alert based on the association information.
10. A non-transitory computer readable medium storing a program for causing a computer capable of obtaining a first alert and a second alert that are generated, when an anomaly occurs in a control system, in order to provide notification of the anomaly to execute:
a classification process of generating association information associating the first alert with the second alert;
a learning process of learning a generation pattern of the second alert when the anomaly occurs due to a cause other than a cyber-attack based on the association information generated by the classification process and a generation pattern of the first alert when the anomaly occurs due to a cause other than a cyber-attack; and
an extraction process of extracting, from among the second alerts, the second alert generated due to a cyber-attack based on the generation pattern of the second alert that is learned by the learning process and outputting the extracted second alert,
wherein the learning process is performed by replacing the first alert in the generation pattern of the first alert when the anomaly occurs due to a cause other than the cyber-attack with the second alert associated with the first alert based on the association information.