Abstract: A tampering detection device includes tampering detection circuitry configured to acquire an access pattern of a monitoring target file, extract a time-series pattern of access for each monitoring target file from the access pattern acquired, and determine a scan pattern on a basis of the time-series pattern of access extracted.

Abstract: Using sensor data indicating a state of a control target (2) outputted from a sensor (3) and a control input to control the state of the control target (2), a state estimation unit (4a) of a controller (4) calculates an estimate of the state of the control target (2). Further, a calculation unit (4b) of the controller (4) calculates the control input to which colored noise in a predetermined frequency band is added, according to the calculated estimate of the state of the control target (2).

Abstract: A storage unit stores a size of a free area of storage of target equipment, and software saved in the storage. The generation unit generates a graph including a number of nodes according to the size of the free area of the storage, and transmits the graph to the target equipment. The calculation unit calculates a hash value corresponding to each software block saved in the storage. The verification unit verifies the presence or absence of tampering of the storage of the target equipment using the hash value corresponding to the block calculated, a response calculated using the graph returned to a challenge that specifies a node of the graph, and a hash value corresponding to the block returned as the response to the challenge that specifies the block.

Abstract: Using sensor data indicating a state of a control target (2) outputted from a sensor (3) and a control input to control the state of the control target (2), a state estimation unit (4a) of a controller (4) calculates an estimate of the state of the control target (2). Further, a calculation unit (4b) of the controller (4) calculates the control input to which colored noise in a predetermined frequency band is added, according to the calculated estimate of the state of the control target (2).

Abstract: In a detection system (1) including a sensor (2) and a controller (3), an acquisition unit (2a) in the sensor (2) acquires sensor data, a calculation unit (2b) calculates, by using the sensor data, a MAC value from which non-tampering of the sensor data is verifiable, and a transmission unit (2d) transmits the sensor data to the controller (3) or transmits the MAC value to the controller (3) in place of the sensor data when the calculation unit (2b) has calculated the MAC value. In the controller (3), a reception unit (3a) receives the sensor data or the MAC value transmitted from the sensor (2), and when the reception unit (3a) has received the MAC value, a verification unit (3b) verifies the MAC value by using the sensor data last received by the reception unit (3a).