A technique capable of preventing the loss of packet data for any appropriate one of controllers connected to the same network is provided. An FA system includes a plurality of controllers. Each of the controllers includes: a buffer; a communication module for performing packet communication with one or more other controllers; a packet monitor module for buffering packet data generated in its own controller and packet data received by its own controller in the buffer; and a stop module for stopping, in response to a predetermined stop condition being satisfied, a buffering function of the packet monitor module for a controller specified from the plurality of controllers.

A computer-implemented method for implementing protocol-independent anomaly detection within an industrial control system (ICS) includes implementing a detection stage, including performing byte filtering using a byte filtering model based on at least one new network packet associated with the ICS, performing horizontal detection to determine whether a horizontal constraint anomaly exists in the at least one network packet based on the byte filtering and a horizontal model, including analyzing constraints across different bytes of the at least one new network packet, performing message clustering based on the horizontal detection to generate first cluster information, and performing vertical detection to determine whether a vertical anomaly exists based on the first cluster information and a vertical model, including analyzing a temporal pattern of each byte of the at least one new network packet.

A technique capable of preventing the loss of packet data for any appropriate one of controllers connected to the same network is provided. An FA system includes a plurality of controllers. Each of the controllers includes: a buffer; a communication module for performing packet communication with one or more other controllers; a packet monitor module for buffering packet data generated in its own controller and packet data received by its own controller in the buffer; and a stop module for stopping, in response to a predetermined stop condition being satisfied, a buffering function of the packet monitor module for a controller specified from the plurality of controllers.

A computer-implemented method for implementing protocol-independent anomaly detection within an industrial control system (ICS) includes implementing a detection stage, including performing byte filtering using a byte filtering model based on at least one new network packet associated with the ICS, performing horizontal detection to determine whether a horizontal constraint anomaly exists in the at least one network packet based on the byte filtering and a horizontal model, including analyzing constraints across different bytes of the at least one new network packet, performing message clustering based on the horizontal detection to generate first cluster information, and performing vertical detection to determine whether a vertical anomaly exists based on the first cluster information and a vertical model, including analyzing a temporal pattern of each byte of the at least one new network packet.

A control system is mounted with a function of transmitting/receiving a plurality of types of data together. If a plurality of data acquisition requests are made, the system creates a single grouping request by grouping the individual data acquisition requests. The grouping request is transmitted by a single communication session, and a device having received the grouping request acquires a plurality of pieces of data in response to the plurality of data acquisition requests included in the received request, creates the result of grouping of the acquired data, and transmits the result as a response to the grouping request.