Monitoring apparatus and monitoring method
View Patent ↗A monitoring apparatus includes: a user input acquirer that acquires information based on input provided by a user to a user input device; and a communication anomaly detector that detects a communication anomaly in communication that is being observed, and the communication anomaly detector detects the communication anomaly based on information about a packet whose source or destination includes a monitoring target device and the information based on the input corresponding to the packet.
1 . A monitoring apparatus, comprising:
a processor; and
a memory including a program that, when executed by the processor, causes the processor to perform operations, the operations including:
acquiring key input information based on an input provided by a user; and
detecting a communication anomaly in a communication that is observed on a network,
wherein the processor detects the communication anomaly based on information about a packet whose source or destination includes a monitoring target device, by determining whether the information about the packet matches the key input information acquired based on the input corresponding to the packet,
the key input information based on the input includes screen information indicating a display screen of the monitoring target device when the packet is transmitted, and
the processor detects the communication anomaly based on the information about the packet whose source or destination includes the monitoring target device and the screen information corresponding to the packet.
2 . The monitoring apparatus according to claim 1 ,
wherein the key input information based on the input includes history information indicating a history of input provided by the user when the packet is transmitted, and
the processor switches a method for detecting the communication anomaly according to the history information.
3 . The monitoring apparatus according to claim 2 ,
wherein the history information indicates whether the input has been provided by the user when the packet is transmitted, and
the processor switches the method for detecting the communication anomaly according to whether the input has been provided by the user when the packet is transmitted.
4 . The monitoring apparatus according to claim 3 ,
wherein the processor switches a model for detecting the communication anomaly when switching of the method for detecting the communication anomaly.
5 . The monitoring apparatus according to claim 4 ,
wherein when the input has been provided by the user when the packet is transmitted, the processor does not detect the communication anomaly using the model for detecting the communication anomaly, and when the input has not been provided by the user when the packet is transmitted, the processor detects the communication anomaly using the model.
6 . The monitoring apparatus according to claim 4 , wherein the operations further include:
learning the model based on a predetermined learning period.
7 . The monitoring apparatus according to claim 6 ,
wherein the processor generates a first list and a second list as the model,
the first list is learned based on first attribute information of a first packet when the input is provided by the user at a first time of transmission of the first packet during the predetermined learning period, and
the second list is learned based on second attribute information of a second packet when the input is not provided by the user at a second time of transmission of the second packet during the predetermined learning period.
8 . The monitoring apparatus according to claim 6 ,
wherein the processor generates a first machine learning model and a second machine learning model as the model,
the first machine learning model is learned by first machine learning using: first input information that is first attribute information of a first packet when the input is provided by the user at a first time of transmission of the first packet during the predetermined learning period; and first correct answer information that is a first detection result indicating normal or anomaly, and
the second machine learning model is learned by second machine learning using: second input information that is second attribute information of a second packet when the input is not provided by the user at a second time of transmission of the second packet during the predetermined learning period; and second correct answer information that is a second detection result indicating normal or anomaly.
9 . The monitoring apparatus according to claim 1 ,
wherein the processor detects the communication anomaly based on coordinates and a value of a character string obtained by performing optical character recognition (OCR) on the screen information corresponding to the packet and a value obtained by parsing the packet.
10 . The monitoring apparatus according to claim 9 ,
wherein the processor identifies target coordinates on the display screen based on attribute information of the packet, and detects the communication anomaly based on whether a value displayed at the target coordinates identified among coordinates of one or more character strings, each being the character string, matches the value obtained by parsing the packet.
11 . The monitoring apparatus according to claim 10 , wherein the operations further include:
learning, based on a predetermined learning period, a model for identifying the target coordinates on the display screen.
12 . The monitoring apparatus according to claim 11 ,
wherein the model is a list in which the attribute information of the packet is associated with the target coordinates on the display screen.
13 . The monitoring apparatus according to claim 12 ,
wherein the target coordinates are coordinates at which a value that matches the value obtained by parsing the packet is displayed on the display screen when the packet is transmitted in the predetermined learning period.
14 . The monitoring apparatus according to claim 1 ,
wherein software that is capable of transferring the key input information based on the input to the monitoring apparatus is installed in the monitoring target device, and
the processor acquires the key input information when the software transfers the key input information based on the input.
15 . The monitoring apparatus according to claim 1 , further comprising:
a transfer device that is connected between the processor and the monitoring target device and that is capable of transferring the key input information based on the input to the monitoring apparatus,
wherein the user input acquirer acquires the key input information when the transfer device transfers the key input information based on the input.
16 . The monitoring apparatus according to claim 1 ,
wherein the monitoring target device is a control device for controlling a production facility provided in a factory.
17 . A monitoring method comprising:
acquiring key input information based on an input provided by a user; and
detecting, by a processor, a communication anomaly in a communication that is observed on a network,
wherein the processor detects the communication anomaly based on information about a packet whose source or destination includes a monitoring target device, by determining whether the information about the packet matches the key input information acquired based on the input corresponding to the packet,
the key input information based on the input includes screen information indicating a display screen of the monitoring target device when the packet is transmitted, and
the processor detects the communication anomaly based on the information about the packet whose source or destination includes the monitoring target device and the screen information corresponding to the packet.
18 . The monitoring apparatus according to claim 1 ,
wherein the key input information includes keystroke information.