Detection method, detection system, and detection program
View Patent ↗Using sensor data indicating a state of a control target ( 2 ) outputted from a sensor ( 3 ) and a control input to control the state of the control target ( 2 ), a state estimation unit ( 4 a ) of a controller ( 4 ) calculates an estimate of the state of the control target ( 2 ). Further, a calculation unit ( 4 b ) of the controller ( 4 ) calculates the control input to which colored noise in a predetermined frequency band is added, according to the calculated estimate of the state of the control target ( 2 ).
1. A detection method executed in a detection system comprising a sensor and a controller, the detection method comprising:
a state estimation process of the controller calculating, using sensor data indicating a state of a control target outputted from the sensor and a control input to control the state of the control target, an estimate of the state of the control target;
a calculation process of the controller calculating the control input to which colored noise in a predetermined frequency band is added, according to the estimate of the state of the control target which has been calculated; and
responsive to the state estimate process and the calculation process, detecting an attack using past sensor data when a difference between the estimate of the state of the control target and an output of the calculation process exceeds a predetermined threshold.
2. The detection method according to claim 1 , further comprising:
selecting, in the calculation process, the predetermined frequency band using a predetermined index.
3. A detection system comprising:
a sensor; and
a controller which includes:
state estimation circuitry configured to calculate, using sensor data indicating a state of a control target outputted from the sensor and a control input to control the state of the control target, an estimate of the state of the control target;
calculation circuitry configured to calculate the control input to which colored noise in a predetermined frequency band is added, according to the estimate of the state of the control target which has been calculated; and
detection circuitry configured to detect an attack using outputs from the state estimation circuitry and the calculation circuitry when a difference between the estimate of the state of the control target and an output of the calculation circuitry exceeds a predetermined threshold.
4. A non-transitory computer readable medium including instructions, which when executed, cause a computer to execute:
calculating, using sensor data indicating a state of a control target outputted from the sensor and a control input to control the state of the control target, an estimate of the state of the control target;
calculating the control input to which colored noise in a predetermined frequency band is added, according to the estimate of the state of the control target which has been calculated; and
responsive to the calculating the estimate and the calculating the control input, detecting an attack when a difference between the estimate of the state of the control target and an output of the calculating the control input exceeds a predetermined threshold.
5. The detection method according to claim 1 , further comprising:
controlling an actuator when the attack is detected.
6. The detection system of claim 3 , further comprising:
an actuator which is controlled in response to a detection, by the detection circuitry, of the attack.
7. The non-transitory computer readable medium according to claim 4 , which further includes instructions which further cause the computer to execute:
controlling an actuator when the attack is detected.