Attack analysis device, attack analysis method, and attack analysis program

Abstract

To provide an attack analysis device, an attack analysis method, and an attack analysis program that improve efficiency of a calculation of estimating a cyber attack an electronic control system suffers.SOLUTION: An attack analysis device 10 analyzes an attack to an electronic control system, and comprises: a log acquisition unit 101 that acquires a log indicative of abnormality and location detected by the electronic control system; an index acquisition unit 102 that acquires an index indicative of an internal state of a moving body or / and external state thereof when abnormality occurs; an attack / abnormality relation information storage unit 105 that stores attack / abnormality relation information indicative of a relation among prediction attack information indicative of an attack the electronic control system may suffer, prediction abnormality information indicative of abnormality predicted to occur when suffering the attack, and prediction abnormality location information indicative of a location where the predicted abnormality occurs; an attack estimation unit 106 that estimates the suffered attack on the basis of the index in addition to the log and attack / abnormality relation information; and an output unit 108 that outputs attack information indicative of the estimated attack.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present disclosure relates to a technique for analyzing attacks against electronic control systems mounted on devices such as mobile objects, mainly automobiles, and relates to an attack analysis device, an attack analysis method, and an attack analysis program. [Background technology]

[0002] In recent years, technologies for driving assistance and autonomous driving control, including V2X (vehicle-to-vehicle communication and vehicle-to-infrastructure communication), have been attracting attention. As a result, vehicles are equipped with communication functions, and so-called connected vehicles are becoming more common. As a result, the possibility of vehicles being subject to cyber attacks such as unauthorized access is increasing. Therefore, it is necessary to analyze cyber attacks against vehicles and develop countermeasures.

[0003] There are various methods for detecting abnormalities that occur in a vehicle and analyzing cyber attacks based on the detected abnormalities. For example, Patent Document 1 describes a method for collecting detected abnormality data and identifying the type of attack corresponding to the abnormality by comparing a combination of items in which an abnormality was detected with an abnormality detection pattern that is specified in advance for each attack.

[0004] Furthermore, Patent Document 2 discloses a device that prevents the intrusion of unauthorized information by using the results of a determination as to whether the defense functions and functions other than the defense functions installed in the electronic control device are normal or abnormal when the electronic control device detects an abnormality, to determine measures to block unauthorized information. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2020-123307 A [Patent Document 2] Patent Publication No. 2022-017873 Summary of the Invention [Problem to be solved by the invention]

[0006] The present inventors have found the following problems. When inferring attacks on electronic control systems using security logs, which indicate anomalies detected in an electronic control system and the location within the electronic control system where the anomaly was detected, and attack-anomaly relationship information, which indicates combinations of anomalies predicted to occur if an electronic control system is subjected to a cyber-attack, further improvements are required in the accuracy of the estimation and the amount of calculations required for the estimation.

[0007] One aspect of the present disclosure aims to improve the accuracy of estimating cyber attacks suffered by an electronic control system.

[0008] Another aspect of the present disclosure aims to reduce the amount of calculations required to estimate a cyber-attack that has been sustained on an electronic control system.

[0009] It should be noted that the above two objectives may be achieved not only in one case but also in other cases, where both are achieved. [Means for solving the problem]

[0010] One aspect of the present disclosure is an attack analysis device that analyzes attacks against an electronic control system (S) mounted on a moving object, comprising: a log acquisition unit (101) that acquires a security log indicating an abnormality detected in the electronic control system and a location within the electronic control system where the abnormality was detected; an indicator acquisition unit (102) that acquires an indicator indicating an internal state and / or an external state of the moving object when the abnormality occurs; an attack / anomaly relationship information storage unit (105) for storing attack / anomaly relationship information indicating a relationship between predicted attack information indicating an attack that the electronic control system may receive, predicted anomaly information indicating an anomaly that is predicted to occur when the electronic control system receives the attack, and predicted anomaly position information indicating a position in the electronic control system where the predicted anomaly will occur; an attack estimation unit (106) for estimating an attack that has been made to the electronic control system based on the security log, the attack / anomaly related information, and the indicator; and an output unit (108) that outputs attack information indicating the estimated attack.

[0011] With this configuration, the attack analysis device disclosed herein infers attacks using indicators indicating the internal state and / or external state of the mobile object when an abnormality occurs, in addition to security logs and attack / anomaly relationship information, thereby improving the accuracy of the estimation and / or reducing the amount of calculations required for the estimation.

[0012] In addition, the claims and the numbers in parentheses attached to the constituent elements of the invention described in this section indicate the correspondence between the present invention and the embodiments described below, and are not intended to limit the present invention. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 is an explanatory diagram showing the positional relationship between an attack analysis device and an electronic control system according to each embodiment. [Diagram 2] Block diagram showing an example of the configuration of the electronic control system S [Diagram 3] An explanatory diagram showing the contents of the security log [Figure 4] FIG. 1 is a block diagram showing an example of the configuration of an attack analysis device according to each embodiment; [Diagram 5] An explanatory diagram explaining the concept of situation information [Figure 6] An explanatory diagram explaining the concept of attack / anomaly related information [Figure 7a] FIG. 1 is an explanatory diagram for explaining a specific example of an attack estimation method of the attack analysis device according to each embodiment. [Figure 7b] FIG. 1 is an explanatory diagram for explaining a specific example of an attack estimation method of the attack analysis device according to each embodiment. [Figure 7c] FIG. 1 is an explanatory diagram for explaining a specific example of an attack estimation method of the attack analysis device according to each embodiment. [Figure 7d]FIG. 1 is an explanatory diagram for explaining a specific example of an attack estimation method of the attack analysis device according to each embodiment. [Figure 8] A flowchart for explaining the operation of the attack analysis device of each embodiment. [Figure 9] FIG. 1 is a block diagram showing an outline of an entire system including an attack analysis device according to a first embodiment. [Figure 10] FIG. 1 is a block diagram showing an example of the configuration of an attack analysis device according to a first embodiment. [Figure 11] An explanatory diagram showing the relationship between the individual and common locations of ECUs. [Figure 12] FIG. 13 is an explanatory diagram showing a vehicle situation determination condition table; [Figure 13] FIG. 13 is an explanatory diagram showing a power supply state determination table; [Figure 14] FIG. 13 is an explanatory diagram showing an attack estimation matching table. [Figure 15] FIG. 1 is an explanatory diagram showing a method for reducing the computation load when using an attack estimation matching table; [Figure 16] 1 is a timing chart illustrating the operation of the attack analysis device according to the first embodiment. [Figure 17] FIG. 13 is a block diagram showing a configuration example of an attack analysis device or an attack analysis system according to a second embodiment. [Figure 18] FIG. 1 is a diagram for explaining an electronic control system that is the analysis target of an attack analysis device according to a second embodiment. [Figure 19] FIG. 13 is a diagram for explaining an example of an ECU, an entry point, and an external connection destination according to the second embodiment. [Figure 20] FIG. 11 is a diagram for explaining an example of a driving situation / attack relationship table according to the second embodiment. [Figure 21] FIG. 11 is a diagram for explaining an example of a driving situation / attack relationship table according to the second embodiment. [Figure 22] FIG. 11 is a block diagram showing an example of the configuration of an entry point candidate generation unit according to the second embodiment. [Figure 23] FIG. 11 is a block diagram showing an example of the configuration of an attack estimation unit according to the second embodiment. [Figure 24] FIG. 13 is a diagram for explaining an example of an attack-anomaly relationship table according to the second embodiment. [Diagram 25] FIG. 13 is a diagram for explaining an example of an attack-anomaly relationship table according to the second embodiment. [Figure 26] FIG. 11 is a block diagram showing a configuration example of an estimation result verification unit according to the second embodiment. [Figure 27] 1 is a flowchart showing the operation of an attack analysis system according to a second embodiment. [Figure 28] FIG. 13 is a block diagram showing a configuration example of an attack analysis system according to a first modification of the second embodiment. [Figure 29] FIG. 13 is an explanatory diagram for explaining the arrangement of an attack analysis device according to a modified example of the second embodiment. [Diagram 30] FIG. 13 is a block diagram showing a configuration example of an attack analysis system according to a second modification of the second embodiment. [Diagram 31] FIG. 13 is a block diagram showing a configuration example of an attack analysis system according to a third modification of the second embodiment. [Diagram 32] FIG. 11 is a block diagram showing a configuration example of an attack analysis device according to a third embodiment. [Diagram 33] FIG. 11 is a diagram for explaining a table stored in the storage unit of the third embodiment. [Diagram 34] FIG. 11 is a diagram for explaining a method for determining whether a security log is a false positive log according to the third embodiment. [Diagram 35] FIG. 13 is a diagram for explaining an example of an attack-anomaly relationship table according to the third embodiment. [Diagram 36] 11 is a flowchart for explaining the operation of the attack analysis device according to the third embodiment. [Figure 37] 11 is a flowchart for explaining the operation of the attack analysis device according to the third embodiment. [Figure 38] FIG. 13 is a diagram for explaining a table stored in a storage unit in a modified example of the third embodiment. [Figure 39] FIG. 13 is a diagram for explaining a method for determining whether a security log is a false positive log according to a modification of the third embodiment. [Diagram 40] FIG. 13 is a diagram for explaining a method for determining whether a security log is a false positive log according to a modification of the third embodiment. [Diagram 41] A flowchart for explaining the operation of an attack analysis device according to a modification of the third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Hereinafter, exemplary embodiments of the present disclosure will be described with reference to the drawings.

[0015] The present invention means the invention described in the claims or the Summary of the Invention section, and is not limited to the following embodiments. Furthermore, at least the words in quotation marks mean the words described in the claims, the Summary of the Invention section, or the invention understood from each embodiment, and are not limited to the following embodiments.

[0016] The configurations and methods described in the dependent claims are optional configurations and methods in the invention described in the independent claims. The configurations and methods of the embodiments corresponding to the configurations and methods described in the dependent claims, and the configurations and methods described only in the embodiments without being described in the claims, are optional configurations and methods in the present invention. The configurations and methods described in the embodiments when the description of the claims is broader than the description of the embodiments are also optional configurations and methods in the present invention in the sense that they are examples of the configurations and methods of the present invention. In either case, by being described in the independent claims, they become essential configurations and methods of the present invention.

[0017] The effects described in the embodiments are effects obtained when the configurations of the embodiments are provided as examples of the present invention, and are not necessarily effects that the present invention possesses.

[0018] When there are multiple embodiments (including modified examples, the same applies below), the configurations disclosed in each embodiment are not limited to each embodiment, but can be combined across the embodiments. For example, a configuration disclosed in one embodiment may be combined with another embodiment. Also, configurations disclosed in each of the multiple embodiments may be collected and combined.

[0019] The problem described in the section on problems to be solved by the invention is not a publicly known problem, but was discovered independently by the inventor, and this, together with the configuration and method of the present invention, is a fact that affirms the inventive step of the invention.

[0020] 1. Configurations and other aspects underlying each embodiment (1) Positional relationship between the attack analysis device 10 and the electronic control system S The positional relationship between the attack analysis device 10 and the electronic control system S in each embodiment will be described with reference to FIG.

[0021] The attack analysis device 10 is a device that analyzes attacks against the electronic control system S. More specifically, it is a device that receives a security log generated by a security sensor of the electronic control device 20 that constitutes the electronic control system S, and analyzes attacks against the electronic control system S based on the security log. Here, the attack analysis devices 11 to 13 of each embodiment will be collectively referred to as the attack analysis device 10.

[0022] As shown in Fig. 1(a) and Fig. 1(b), the attack analysis device 10 is "mounted" on a vehicle, which is a "mobile body", together with an electronic control device 20 constituting an electronic control system S, and as shown in Fig. 1(c), the electronic control device 20 constituting an electronic control system S is "mounted" on a vehicle, which is a "mobile body", and the attack analysis device 10 is realized by a server device or SOC (Security Operation Center) or the like provided outside the vehicle. Furthermore, it is assumed that an attack analysis device 10a, which is a part of the attack analysis device 10, is "mounted" on a vehicle, which is a "mobile body", and an attack analysis device 10b, which is the remaining part of the attack analysis device 10, is provided outside the vehicle. Hereinafter, the electronic control device 20 is abbreviated as ECU (Electronic Control Unit) 20. Where: "Mobile object" refers to an object that can move and can move at any speed. It also includes cases where the mobile object is stationary. For example, it includes, but is not limited to, automobiles, motorcycles, bicycles, pedestrians, ships, aircraft, and objects mounted on these. "Mounted" includes not only the case where the device is directly fixed to the moving body, but also the case where the device is not fixed to the moving body but moves with the moving body, such as the case where the device is carried by a person riding on the moving body, or the case where the device is mounted on cargo placed on the moving body.

[0023] The example shown in Fig. 1(a) is an example in which an independent attack analysis device 10 is provided inside the electronic control system S, or the function of the attack analysis device 10 is built into at least one of the ECUs 20 constituting the electronic control system S. The example shown in Fig. 1(b) is an example in which the attack analysis device 10 is provided outside the electronic control system S, but from the viewpoint of the connection form, it is substantially the same as Fig. 1(a). 1(a) and 1(b), the attack analysis device 10 and the ECU 20 are connected via an in-vehicle communication network such as a Controller Area Network (CAN) or a Local Interconnect Network (LIN). Alternatively, the connection may be made using any communication method, whether wired or wireless, such as Ethernet (registered trademark), Wi-Fi (registered trademark), or Bluetooth (registered trademark). Note that a connection refers to a state in which data can be exchanged, and includes not only cases in which different hardware is connected via a wired or wireless communication network, but also cases in which virtual machines realized on the same hardware are virtually connected to each other.

[0024] In the cases of FIG. 1(c) and FIG. 1(d), all or part of the attack analysis device 10 is provided outside the electronic control system S, but since the attack analysis device 10 is provided outside the vehicle, the connection form is usually different from that of FIG. 1(a) and FIG. 1(b). The attack analysis device 10 and the electronic control system S are connected via a communication network using a wireless communication method such as IEEE802.11 (Wi-Fi (registered trademark)), IEEE802.16 (WiMAX (registered trademark)), W-CDMA (Wideband Code Division Multiple Access), HSPA (High Speed ​​Packet Access), LTE (Long Term Evolution), LTE-A (Long Term Evolution Advanced), 4G, and 5G. Alternatively, DSRC (Dedicated Short Range Communication) can be used. When the vehicle is parked in a parking lot or housed in a repair shop, a wired communication method can be used instead of a wireless communication method. For example, a LAN (Local Area Network), the Internet, or a fixed telephone line can be used.

[0025] In the cases of Figures 1(a) and 1(b), the cyber-attack can be analyzed without delay within the attacked vehicle without communication with external devices, allowing for a more rapid response to the cyber-attack.

[0026] In contrast, in the cases of Figure 1(c) and Figure 1(d), for example, it is possible to use the abundant resources of a server device to analyze cyber attacks. Furthermore, it is possible to centrally analyze cyber attacks on the server device without installing new devices or programs in existing vehicles.

[0027] In the following embodiments, the explanation will be given on the premise of the arrangement shown in FIG. In each embodiment, the electronic control system S is described as an in-vehicle system mounted on a vehicle, but the electronic control system S is not limited to an in-vehicle system and can be applied to any electronic control system consisting of multiple ECUs. For example, the electronic control system S may be mounted on a stationary or fixed object instead of a moving object. Also, a part of the attack analysis device 10 may be provided in a server device, and the remaining part may be provided in a mobile body or other device.

[0028] In FIG. 1(d), the attack analysis device 10a may be, for example, a device including a situation estimation unit 104 described below, and the attack analysis device 10b may be a device including an attack estimation unit 106 described below.

[0029] In addition, the attack analysis device 10 can determine whether an abnormality indicated by a received security log is an abnormality caused by a cyber-attack or an abnormality caused by a reason other than a cyber-attack, and in the former case, analyze the cyber-attack based on the security log, and in the latter case, consider it to be a false positive log and not analyze the cyber-attack. A part having such a function can be defined as a log determination device. The log determination device is an example of a device including the situation estimation unit 104.

[0030] The log determination device may be provided in a stage preceding the processing of the attack analysis device 10, or may be included in the attack analysis device 10. Although not shown in Fig. 1, in the cases of Fig. 1(a) and Fig. 1(b), the log determination device is also mounted on the vehicle. In contrast, in the case of Fig. 1(c), the log determination device may be provided in a server device or the like which is the attack analysis device 10, or only the log determination device may be provided on the vehicle. In this case, the former is arranged as shown in Fig. 1(c), and the latter is arranged as shown in Fig. 1(d).

[0031] (2) Configuration of Electronic Control System S Fig. 2 is a diagram showing an example of the configuration of an electronic control system S. The electronic control system S is made up of a plurality of ECUs 20 and an in-vehicle network (NW1 to NW3) that connects these. Fig. 2 shows eight ECUs (ECU20a to ECU20h) as an example, but the electronic control system S is naturally made up of any number of ECUs. In the following explanation, when describing a single or a plurality of electronic control devices as a whole, they will be described as ECU20 or each ECU20, and when describing each individual electronic control device specifically, they will be described as ECU20a, ECU20b, ECU20c, ....

[0032] In the case of FIG. 2, the ECUs 20 are connected to each other via the in-vehicle communication network or the like described in the explanation of FIG. 1(a) and FIG. 1(b).

[0033] The electronic control system S shown in FIG. 2 includes an integrated ECU 20a, an external communication ECU 20b, zone ECUs (20c, 20d), and individual ECUs (20e to 20h).

[0034] The integrated ECU 20a is an ECU that has a function of controlling the entire electronic control system S and also has a gateway function of mediating communication between the ECUs 20. The integrated ECU 20a is also called a gateway ECU (G-ECU) or a mobility computer (MC). The integrated ECU 20a may also be a relay device or a gateway device.

[0035] The external communication ECU 20b is an ECU having a communication unit that communicates with an external device provided outside the vehicle, for example, in each embodiment, the server device 30. The communication method used by the external communication ECU 20b is the wireless communication method or the wired communication method described in the explanation of FIG. In order to realize a plurality of communication methods, a plurality of external communication ECUs 20b may be provided. Also, instead of providing the external communication ECU 20b, the integrated ECU 20a may include the function of the external communication ECU 20b.

[0036] The zone ECUs (20c, 20d) are ECUs with a gateway function appropriately arranged according to the location and function of the individual ECUs described below. For example, the zone ECU 20c is an ECU having a gateway function that mediates communication between the individual ECUs 20e and 20f arranged at the front of the vehicle and other ECUs 20, and the zone ECU 20d is an ECU having a gateway function that mediates communication between the individual ECUs 20g and 20h arranged at the rear of the vehicle and other ECUs 20. The zone ECUs (20c, 20d) are sometimes called domain computers (DC). The individual ECUs 20e and 20f are connected to the zone ECU 20c via a network 2 (NW2), and the individual ECUs 20g and 20h are connected to the zone ECU 20d via a network 3 (NW3).

[0037] The individual ECUs (20e to 20h) can be configured with ECUs having any desired functions. For example, they can be drive system electronic control devices that control the engine, steering, brakes, etc., vehicle body electronic control devices that control meters, power windows, etc., information system electronic control devices such as navigation devices, or safety control system electronic control devices that perform control to prevent collisions with obstacles or pedestrians. Also, the ECUs may not be parallel to each other, but may be classified as master and slave. Depending on the functions realized by each individual ECU (20e to 20h), necessary sensors may be connected to each individual ECU (20e to 20h). For example, a speed sensor, an acceleration sensor, an angular velocity sensor, a temperature sensor, a seat sensor, and a voltmeter may be included, but are not limited to these. Furthermore, these sensors may be connected to the integrated ECU 20a or the zone ECUs (20c, 20d) instead of to each individual ECU (20e to 20h).

[0038] Each ECU 20 may be a physically independent electronic control device, or a virtualized electronic control device realized using virtualization technology. When each ECU 20 is realized by different hardware, it is sufficient that they are connected via a wired or wireless communication method, and when multiple virtualized electronic control devices are realized on the same hardware, it is sufficient that the virtualized electronic control devices are virtually connected to each other.

[0039] In the case of Fig. 1(a), the attack analysis device 10 is provided inside the electronic control system S, and is realized by an integrated ECU 20a or an individual ECU 20e, for example, as shown in Fig. 2. When realized by an individual ECU 20e, the individual ECU 20e may be an ECU dedicated to the attack analysis device 10. In the case of Fig. 1(c), the attack analysis device 10 is provided outside the electronic control system S, and is realized by a server device 30 as shown in Fig. 2. In this case, the server device 30 receives the security log transmitted via the external communication ECU 20b.

[0040] Each ECU 20 has a security sensor, and the security sensor generates a security log when it detects an abnormality that occurs in the ECU 20 or in the network connected to the ECU 20. Details of the security log will be described in the next section. It is not necessary for all the ECUs 20 to include a security sensor.

[0041] (3)Security log details FIG. 3 is a diagram showing the contents of the security log generated by the security sensor of the ECU 20. As shown in FIG.

[0042] The security log has fields of an ECU ID indicating identification information of an ECU in which a security sensor is mounted, a sensor ID indicating identification information of the security sensor, an event ID indicating identification information of an event related to an abnormality detected by the security sensor, a counter indicating the number of occurrences of the event, a timestamp indicating the time of occurrence of the event, and context data indicating details of the output of the security sensor. The security log may further have a header storing information indicating the protocol version and the state of each field.

[0043] According to the specifications defined by AUTOSAR (AUTomotive Open System ARchitecture), IdsM Instance ID corresponds to ECU ID, Sensor Instance ID corresponds to sensor ID, Event Definition ID corresponds to event ID, Count corresponds to counter, Timestamp corresponds to timestamp, Context Data corresponds to context data, Protocol Version corresponds to Protocol Header corresponds to header.

[0044] Although Fig. 3 shows an example of an abnormality log that is generated when an abnormality occurs (for example, when an event is successful), a normal log that is generated when no abnormality occurs (for example, when an event is successful) may have the same specifications as Fig. 3. In that case, for example, an abnormality log and a normal log can be distinguished by using different event IDs for when an abnormality occurs and when an event is successful. Also, by setting a flag indicating the presence or absence of context data in the header, the abnormality log and the normal log can be distinguished by checking the flag.

[0045] Also, while FIG. 3 shows a security log generated by the physically independent ECU 20, it may be a security log generated by a virtual ECU.

[0046] The security log generated by the security sensor is called SEv, and the narrowed down accurate security log is called QSEv. For example, the security sensor of the individual ECU (20e to 20h) in Fig. 2 generates SEv and reports it to an intrusion detection system manager (IdsM) not shown, and when the SEv passes through a certification filter in the IdsM and satisfies a specified criterion, it is transmitted from the intrusion detection reporter to the outside of the vehicle as QSEv. The security log in this embodiment is a concept that includes both SEv and QSEv.

[0047] In addition, the security log in each embodiment may be a log generated by a function called in-vehicle Security Information and Event Management (SIEM), which collects and manages information regarding events that occur within an electronic control system.

[0048] In the following embodiments, particularly in the first embodiment, the security log may be referred to as an abnormality log because the security log notifies an abnormality. Also, the security log may be referred to as a vehicle log because the security log is generated in the vehicle.

[0049] Moreover, in each of the following embodiments, particularly in embodiment 3, attention is focused on false positive logs. A false positive log refers to a security log in which a detected event indicated in the security log is an event caused by something other than a cyber-attack on the electronic control system S. False positive logs include security logs in which an event indicates an abnormality (sometimes referred to as an abnormality log or an abnormality security log), as well as security logs in which an event indicates a non-abnormality or success (sometimes referred to as a normal log or a successful security log). Examples of detected events include input of a correct or incorrect password, and an example of an event not caused by a cyber-attack is a user operation. In the third embodiment, attention is focused on the false positive log of the abnormal log, but the false positive log of the normal log may also be used.

[0050] (4) Configuration of Attack Analysis Device 10 The configuration of the attack analysis device 10 will be described with reference to Fig. 4. The attack analysis device 10 includes a log acquisition unit 101, an index acquisition unit 102, a situation information storage unit 103, a situation estimation unit 104, an attack / anomaly relationship information storage unit 105, an attack estimation unit 106, a matching degree calculation unit 107, and an output unit 108.

[0051] The log acquisition unit 101 "acquires" a security log indicating an abnormality detected in the electronic control system S and the location within the electronic control system S where the abnormality was detected. For example, when the security log of Fig. 3 is received, the type of abnormality is indicated in the event ID and context data, and the location where the abnormality was detected is indicated in the ECU ID and sensor ID. Here, "obtain" includes not only obtaining by receiving from another device or block, but also obtaining by generating by oneself.

[0052] The indicator acquisition unit 102 "acquires" an indicator that indicates the internal state and / or external state of the vehicle "when an abnormality occurs." The indicator may be information indicating the internal or external state of the vehicle, such as the outputs of various sensors connected to the individual ECUs (20e to 20h), a CAN frame, various information received from an external device, position information and time information received by a GPS receiver, etc. Specific examples of the indicator are as follows. (a) Indicators of internal state In-vehicle sensor output, vehicle power supply status, communication network status, vehicle diagnostic information, ECU status, location information, and information to identify the vehicle (b) Indicators of external state information Outside temperature, outside humidity, weather, known false positive log occurrence patterns, conditions for disabling security event logs, and the operating status of external devices outside the vehicle Specific examples of the indices and examples of using the indices will be described in detail in each embodiment. Where: "When an abnormality occurs" is not limited to a time or a time instant, but may be any time instant as long as the occurrence of an abnormality is a condition, a trigger, or a subject of evaluation. In addition, in the case of a time or a time instant, it may be the time (time) when the abnormality occurs, the time (time) when a security log indicating the abnormality is generated, the time (time) when a security log is received, or even a time (time) immediately before the occurrence of the abnormality. The "internal state" refers to various states that depend on a moving body, such as the operating state of a vehicle, the state of the vehicle itself or the parts that make up the vehicle, or the state of functions that the vehicle has. The position of the vehicle is also included in the internal state because it indicates the state in which the vehicle itself is physically located at a specific position. The term "external state" refers to various states that can be conceived even without the presence of a moving body, and includes, for example, the outside temperature, the time (clock), or the operating state of a device outside the moving body.

[0053] The log acquisition unit 101 and the index acquisition unit 102 may be configured as a single acquisition unit. The index may include the security log acquired by the log acquisition unit 101. In other words, if the internal and external states of the vehicle can be estimated using the security log, the security log can also be evaluated as an index showing the internal and external states of the vehicle. In this case, for example, as shown in FIG. 1, the log acquisition unit 101 may be configured to output the security log as an index to the index acquisition unit 102.

[0054] The situation information storage unit 103 stores situation information indicating the relationship between the index and the corresponding situation. FIG. 5 is a diagram illustrating the concept of situation information. For example, as shown in Fig. 5(a), there may be a relationship in which situations A to D are determined in response to a combination of indicators a to d. Or, as shown in Fig. 5(b), there may be a relationship in which a situation (y) is determined when an indicator (x) is determined. In this way, when an intermediate fact, a situation, can be inferred from a fact indicated by a single or multiple indicators, the relationship between the indicator and the situation can be expressed in a table such as Fig. 5(a), a graph such as Fig. 5(b), or a mathematical formula. Information indicating these relationships is called situation information. Specific examples of situation information will be described in each embodiment.

[0055] The situation estimation unit 104 estimates a "situation" of the vehicle corresponding to the index, using the index acquired by the index acquisition unit 102 and the situation information stored in the situation information storage unit 103. For example, in Fig. 5(a), when the indexes acquired by the index acquisition unit 102 are index a, index c, and index d, situation B is estimated as the situation. A specific example of estimating a situation will be described in each embodiment. Here, the "situation" of a moving object may be any fact that is inferred from an indicator and is related to the moving object.

[0056] The estimation in the situation estimation unit 104 is not limited to one stage, but may be multiple stages. For example, a first situation (i.e., a primary intermediate fact) may be estimated from an index, and a second situation (i.e., a secondary intermediate fact) may be estimated from the first situation. In the first embodiment described below, two-stage estimation is performed, and in the second embodiment, one-stage estimation is performed.

[0057] The attack / anomaly relationship information storage unit 105 stores an attack / anomaly relationship table indicating the relationship between cyber attacks and anomalies occurring in the electronic control system S. More specifically, the attack / anomaly relationship table indicates the relationship between predicted attack information indicating attacks that the electronic control system S may receive, predicted anomaly information indicating anomalies predicted to occur when the attack is received, and predicted anomaly position information indicating the position in the electronic control system where the predicted anomaly will occur.

[0058] FIG. 6 is a diagram for explaining the concept of the attack / anomaly relationship table (corresponding to "attack / anomaly relationship information") used in each embodiment. The attack / anomaly relationship table shown in FIG. 6 indicates, for each type of cyber-attack (attacks A to X), the anomalies that will occur when the electronic control system S is subjected to a cyber-attack (corresponding to "predicted anomaly information") and the location where the anomaly will occur (corresponding to "predicted anomaly location information"). When subjected to a cyber-attack, it is expected that, for example, multiple anomalies will occur at one or multiple locations. Therefore, it is preferable that the attack / anomaly relationship table indicates a combination of multiple anomalies that will occur when subjected to an attack and the location where the anomaly occurred. 6, the predicted attack information includes the type of cyber-attack (attacks A to X) as well as the assumed starting point and target points of the attack in the event of a cyber-attack, but this is just one example. For example, it may be only the type of cyber-attack, only the attack starting point position, only the target point of the attack, only the attack starting point position and the target point of the attack, only the attack starting point position, the intermediate position and the target point of the attack, or other information related to the cyber-attack.

[0059] In FIG. 6, the predicted abnormality position, the attack starting point position, and the attack target position are represented by identifiers expressed in hexadecimal numbers, and each identifier represents a position. Furthermore, the positions corresponding to the identifiers may be concrete positions or abstract positions. Examples of concrete positions include the type of each ECU 20 and the type of security sensor. Examples of the former can be defined as 0000 for the outside, 0x01 for the external communication ECU 20b, 0x02 for the integrated ECU 20a, and 0x03 for the zone ECU 20c. Examples of abstract positions include the hierarchy in which each ECU 20 exists, the network to which each ECU 20 is connected, and the functions and characteristics of the ECU 20.

[0060] In FIG. 6, for example, when a cyber-attack of attack type A occurs in the electronic control system S, it is predicted that abnormalities A, C, and D will occur in the external communication ECU 20b. The attack origin of attack A is outside the electronic control system S, and the attack target is the external communication ECU 20b. The attack origin may be a position inside the electronic control system S, or it may be outside the electronic control system S. The attack origin being outside the electronic control system S means that the electronic control system S is under cyber-attack from outside the vehicle.

[0061] The attack / anomaly relationship table in Figure 6 has a table format, but any format of database is acceptable. The name of the attack / anomaly relationship table is arbitrary. For example, the attack / anomaly relationship table may be called a pattern matching table (PMT) or anomaly detection pattern.

[0062] The attack / anomaly relationship table can create / generate a pattern of anomaly occurrence by simulating which security sensor of which ECU 20 will detect an anomaly in which order when an attack occurs, based on the arrangement of the ECUs 20 constituting the electronic control system S, the connection relationship of the ECUs 20 (also called network topology), and the arrangement of the security sensors provided in the ECUs 20. Furthermore, it may be based on information regarding the monitoring targets of the security sensors and the rules for monitoring them. However, the creation and generation of the attack-anomaly relationship table is not limited to this method. For example, AI or machine learning may be used. Also, the table may be generated using anomaly occurrence patterns of security sensors in past attacks.

[0063] The attack / anomaly relationship table in Fig. 6 has predicted attack information and predicted anomaly information, but in addition to this, it may further have predicted non-anomaly information indicating a non-anomaly event predicted to occur in the event of an attack, and predicted non-anomaly position information indicating a position in the electronic control system where the predicted non-anomaly event will occur. In other words, the attack / anomaly relationship table may be configured to indicate the relationship between the predicted attack information, predicted anomaly information, predicted anomaly position information, predicted non-anomaly information, and predicted non-anomaly position information. In this case, the predicted anomaly position information and the predicted non-anomaly position information may be integrated into one predicted position information.

[0064] In this case, normal logs may be used in addition to abnormal logs as security logs that are pattern matched with the attack / anomaly relationship table. Also, a security log determined to be a false positive abnormal log or a false positive normal log may not be used for attack inference. Alternatively, weighting may be applied to predicted anomaly information and predicted non-anomaly information in the attack-anomaly relationship table that correspond to an anomaly indicated by a security log determined to be a false positive abnormal log or a non-anomaly indicated by a security log determined to be a false positive normal log.

[0065] The attack estimation unit 106 estimates an attack that the electronic control system S has received based on the security log acquired by the log acquisition unit 101, the attack-anomaly relationship table stored in the attack-anomaly relationship information storage unit 105, and the indicators acquired by the indicator acquisition unit 102. More specifically, it estimates an attack that the electronic control system S has received based on the situation estimated by the situation estimation unit 104 using the indicators. When the situation estimation unit 104 is a separate device, the attack estimation unit 106 also serves as a situation acquisition unit that receives the situation. Here, "based on" includes not only the direct use of indicators, but also the indirect use of indicators. In other words, it also includes the case where an intermediate fact is inferred (or presumed) from an indicator and an attack is inferred using the inferred (or presumed) intermediate fact.

[0066] The attack estimation unit 106 estimates, as the attack to be estimated, for example, an attack type and / or an attack path. Among these, the attack path can be estimated by using the predicted attack information in the attack-anomaly relationship table. For example, if the predicted attack information indicates the attack starting point location and the attack target location, the attack starting point location and the attack target location are regarded as the attack path. If the predicted attack information indicates the attack starting point location, the intermediate location, and the attack target location, the attack starting point location, the intermediate location, and the attack target location may be regarded as the attack path, or the attack starting point location and the attack target location may be regarded as the attack path. To estimate the attack path, an attack-anomaly relationship table in which neither the attack starting point position nor the attack target position is indicated in the predicted attack information may be used. In this case, the predicted anomaly position in the attack-anomaly relationship table is regarded as the attack path. For example, for an attack type in which ECU20a, NW1, ECU20c, NW2, and ECU20f in the configuration diagram of FIG. 2 are the predicted anomaly positions, these predicted anomaly positions are regarded as the attack path. When this attack type is estimated by comparing the security log with the attack-anomaly relationship table, it is estimated that ECU20a, NW1, ECU20c, NW2, and ECU20f are the attack path. The attack direction in the estimated attack path may be estimated using data indicating the direction of communication included in the context data of the security log. For example, when the communication direction indicated by the data included in the context data of the security log is the direction from ECU20a to ECU20f, the attack direction may be estimated to be the direction from ECU20a to ECU20f. When data indicating communication in the direction from ECU 20a to ECU 20f and data indicating communication in the direction from ECU 20f to ECU 20a are included in the context data of the security log, the attack direction may be estimated to be in both directions, from ECU 20a to ECU 20f and from ECU 20f to ECU 20a. In an attack-anomaly relationship table in which the predicted attack information does not indicate either the attack starting point position or the attack target position, the attack type included in the predicted attack information may be referred to as a predicted anomaly occurrence pattern of the attack path.

[0067] An example of an attack estimation method performed by the attack estimation unit 106 will be described below with reference to FIGS. First, a specific example of a normal attack estimation method that is not based on indicators will be described with reference to FIG. Assume that the security log acquired by the log acquisition unit 101 indicates that anomalies B, C, and D were detected at position 0x02, for example. Meanwhile, in the attack-anomaly relationship table in Fig. 6, the predicted attack information in which the predicted anomaly position information is 0x02 and the predicted anomaly information corresponds to anomalies B, C, and D is attack C. Therefore, the attack estimation unit 106 estimates that attack C has occurred.

[0068] Next, a specific example of an attack estimation method based on an index according to each embodiment will be described with reference to Fig. 7a, Fig. 7b, Fig. 7c, and Fig. 7d. Each embodiment is an example in which an attack estimation is performed by modifying the attack-anomaly relationship table.

[0069] Example 1 As in the example previously described in FIG. 5, it is assumed that situation B is estimated by the situation estimation unit 104 using the index acquired by the index acquisition unit 102. In situation B, it is assumed that the location of 0x03, for example, is not related to a cyber attack. In this case, the attack estimation unit 106 does not "use for attack estimation" the "part" of (a) that includes the location of 0x03 in the predicted anomaly location information in the attack-anomaly relationship table in FIG. 7a, and the "part" of (b) that includes the location of 0x03 in the predicted attack information. In this way, the attack estimation unit 106 can reduce the amount of calculation required for attack estimation by performing attack estimation without using the attack-anomaly relationship table for the part estimated not to be related to a cyber-attack. In particular, when the attack analysis device 10 is mounted on a vehicle, attack estimation can be performed even if the resources allocated to the attack analysis device 10 are small. Where: The term "part" includes not only a part of one piece of attack / anomaly related information, but also at least one piece of multiple pieces of attack / anomaly related information. "Not used for attack estimation" includes not only cases where it is not actively used for attack estimation, but also cases where a part that includes a location estimated to be related to an attack by referring to an indicator is used as predicted abnormal location information or predicted attack information for attack estimation, and the other parts are not used passively for attack estimation.

[0070] In addition, in FIG. 7a, the operation of the attack estimation unit 106 in a case where a specific position in a certain situation is estimated to be unrelated to a cyber-attack has been described, but the present invention can also be applied to a case where a specific anomaly in a certain situation is estimated to be unrelated to a cyber-attack. For example, in situation B, it is assumed that anomaly A is unrelated to a cyber-attack. In this case, the attack estimation unit 106 may "not use for attack estimation" the "portions" of the attack-anomaly relationship table in FIG. 7a that include anomaly A in the predicted anomaly information, that is, the portions of anomaly A at the positions 0x01, 0x02, and 0x03.

[0071] This can also be applied to cases where a specific location and a specific anomaly are estimated to be unrelated to a cyber-attack. For example, in situation B, it is assumed that anomaly C at location 0x03 is unrelated to a cyber-attack. In this case, the attack estimation unit 106 may "not use for attack estimation" the portion of anomaly C at location 0x03 in the attack-anomaly relationship table in FIG. 7a.

[0072] The above example is an example in which one attack-anomaly relationship table is not used in part, but an attack-anomaly relationship table may be prepared for each situation, and a corresponding attack-anomaly relationship table may be selected according to the situation. In other words, an attack-anomaly relationship table may be prepared for each situation, excluding predicted attack information, predicted anomaly location information, and predicted anomaly information corresponding to positions and / or anomalies that are presumed not to be related to cyber attacks.

[0073] Example 2 Although the first embodiment is a case where a position not related to a cyber attack is estimated from a situation, it can also be applied to a case where a position related to a cyber attack is estimated from a situation. For example, in situation B, it is assumed that the position of 0x02 is estimated to be related to a cyber attack. In this case, the attack estimation unit 106 uses, for attack estimation, the "part" of (c) that includes the position of 0x02 in the predicted anomaly position information in the attack-anomaly relationship table in FIG. 7b, and the "part" of (d) that includes the position of 0x02 in the predicted attack information. In this way, the attack estimation unit 106 can reduce the amount of calculation required for attack estimation by using the attack-anomaly relationship table of the part estimated to be related to a cyber-attack. In particular, when the attack analysis device 10 is mounted on a vehicle, attack estimation can be performed even if the resources allocated to the attack analysis device 10 are small. Here, "using for attack estimation" includes not only active use for attack estimation, but also passive use for attack estimation by not using parts that include locations that are estimated to be unrelated to attacks by referring to indicators as predicted abnormal location information or predicted attack information for attack estimation.

[0074] In addition, in FIG. 7b, the operation of the attack estimation unit 106 in the case where a specific position in a certain situation is estimated to be related to a cyber-attack has been described, but the present invention can also be applied to the case where a specific anomaly in a certain situation is estimated to be related to a cyber-attack. For example, in situation B, anomalies A and B are estimated to be related to a cyber-attack. In this case, the attack estimation unit 106 may "use for attack estimation" the "portion" of the attack-anomaly relationship table in FIG. 7b that includes anomaly A and anomaly B in the predicted anomaly information, that is, the portion of anomaly A and anomaly B at each of the positions 0x01, 0x02, and 0x03.

[0075] This can also be applied to cases where a specific position and a specific anomaly are estimated to be related to a cyber attack. For example, in situation B, it is assumed that anomaly A and anomaly B at positions 0x01 and 0x02 are estimated to be related to a cyber attack. In this case, the attack estimation unit 106 may "use for attack estimation" the portion of anomaly A and anomaly B at positions 0x01 and 0x02 in the attack-anomaly relationship table in FIG. 7b.

[0076] The above example is an example of using a part of one attack-anomaly relationship table, but an attack-anomaly relationship table may be prepared for each situation, and a corresponding attack-anomaly relationship table may be selected according to the situation. In other words, an attack-anomaly relationship table may be prepared for each situation, which consists only of predicted attack information, predicted anomaly location information, and predicted anomaly information corresponding to positions and / or anomalies presumed to be related to cyber attacks.

[0077] Example 3 In the first embodiment, an attack was inferred without using the attack-anomaly relationship table of the part that is inferred not to be related to a cyber-attack. In the present embodiment, an attack is inferred by weighting the attack-anomaly relationship table of the "part" that is inferred not to be related to a cyber-attack. As in the first embodiment, in situation B, for example, the position of 0x01 is assumed to be unrelated to a cyber-attack. Therefore, the attack estimation unit 106 assigns a weight (w) to the pattern (e) including the position of 0x01 as predicted anomaly position information in the attack-anomaly relationship table in FIG. 7c, and / or the pattern (f) including the position of 0x01 as predicted attack information. For example, in FIG. 7c, the patterns (e) and (f) are multiplied by a coefficient of 0≦w<1, here 0.5. The value of the coefficient can be appropriately determined in light of the degree to which they are unrelated to a cyber-attack.

[0078] In the attack-anomaly relationship table weighted in this way, it is possible to estimate an attack and obtain a matching degree indicating the degree of certainty that the attack has occurred. The matching degree can be calculated, for example, by dividing the inner product of the vector value of the attack-anomaly relationship table for the estimated attack and the vector value of the security log indicating the detected attack by the sum of the vector values ​​of the attack-anomaly relationship table before weighting for the estimated attack, but is not limited to this. The matching degree is calculated by a matching degree calculation unit 107 described later. Matching degree = (vector value of attack-anomaly relationship table) * (vector value of security log) / (vector value of attack-anomaly relationship table before weighting) (* denotes dot product.) The degree of matching when no weighting is applied can be calculated as follows: Matching degree = (vector value of attack-anomaly relationship table) * (vector value of security log) / (vector value of attack-anomaly relationship table)

[0079] For example, suppose that the security log acquired by the log acquisition unit 101 indicates that anomalies A, C, and D were detected at position 0x01. In this case, in the attack-anomaly relationship table of FIG. 7c, the predicted attack information in which the predicted anomaly position information is 0x01 and the predicted anomaly information corresponds to anomalies A, C, and D is attack A. Therefore, the attack estimation unit 106 estimates that attack A has occurred. Then, the matching degree can be calculated as follows. Matching degree = 0.5 x 1 (abnormal A) + 0.5 x 1 (abnormal C) + 0.5 x 1 (abnormal D) / (1 (abnormal A) + 1 (abnormal B) + 1 (abnormal C)) = 1.5 / 3 = 0.5

[0080] In contrast, the matching degree without weighting is: Matching degree = 1 x 1 (abnormal A) + 1 x 1 (abnormal C) + 1 x 1 (abnormal D) / (1 (abnormal A) + 1 (abnormal B) + 1 (abnormal C)) = 3 / 3 = 1.0

[0081] The weighting in the attack-anomaly relationship table in Figure 7c indicates the proportion of anomalies at each location that are related to cyber attacks, so the matching degree calculated with weighting added can be said to represent the certainty that an estimated cyber attack occurred. In other words, in this example, the matching degree without weighting is 1, meaning that the possibility of attack A occurring is evaluated as 100%, while the matching degree with weighting is 0.5, meaning that the possibility of attack A occurring is evaluated as 50%.

[0082] As another example, suppose that the security log acquired by the log acquisition unit 101 indicates that anomalies A and C were detected at position 0x01. In this case, in the attack-anomaly relationship table of FIG. 7c, there is no predicted attack information in which the predicted anomaly position information is 0x01 and the predicted anomaly information completely matches anomalies A and C, but the closest predicted attack information is attack A. Therefore, the attack estimation unit 106 estimates that attack A has occurred. Then, the matching degree can be calculated as follows: Matching degree = 0.5 x 1 (abnormal A) + 0.5 x 1 (abnormal C) + 0.5 x 0 (abnormal D) / (1 (abnormal A) + 1 (abnormal B) + 1 (abnormal C)) = 1.0 / 3 = 0.33

[0083] In contrast, the matching degree without weighting is: Matching degree = 1 x 1 (abnormal A) + 1 x 1 (abnormal C) + 1 x 0 (abnormal D) / (1 (abnormal A) + 1 (abnormal B) + 1 (abnormal C)) = 2 / 3 = 0.66

[0084] In other words, in this example, the matching degree without weighting is 0.66, meaning that the possibility of attack A occurring is evaluated as 66%, while the matching degree with weighting is 0.33, meaning that the possibility of attack A occurring is evaluated as 33%.

[0085] In this way, the weighting has the significance of reducing the contribution of predicted anomaly information or predicted anomaly location information of a location that is estimated not to be related to an attack in a situation to the matching degree. Then, the attack estimation unit 106 performs attack estimation using the weighted attack-anomaly relationship table, thereby making it possible to perform attack estimation taking into account the degree of association with a cyber attack.

[0086] The above example is an example of weighting one attack-anomaly relationship table, but an attack-anomaly relationship table may be prepared for each situation, and a corresponding attack-anomaly relationship table may be selected according to the situation. In other words, an attack-anomaly relationship table may be prepared for each situation in which weighting is applied to predicted attack information, predicted anomaly location information, and predicted anomaly information corresponding to positions and / or anomalies that are presumed not to be related to cyber attacks.

[0087] Example 4 In the first to third embodiments, the attack was inferred after modifying the attack-anomaly relationship table by focusing on the position where an anomaly occurred in relation to a cyber-attack. In the present embodiment, the attack is inferred by focusing on the anomaly that occurred. The situation estimation unit 104 estimates the cause of the anomaly as a situation based on the index acquired by the index acquisition unit 102. Then, if the estimated situation is not caused by a cyber attack, the attack estimation unit 106 determines that the anomaly indicated by the security log is a false positive log generated by detecting an anomaly different from an anomaly caused by an attack on the electronic control system S, and does not estimate an attack using the false positive log. In this way, by not using false positive logs to perform attack inference, it is possible to reduce the amount of calculation required for attack inference. In particular, when the attack analysis device 10 is mounted on a vehicle, attack inference can be performed even if the resources allocated to the attack analysis device 10 are small.

[0088] In the situation described in the fourth embodiment, instead of using false positive logs to make an attack inference, as described in the third embodiment, an attack inference is made using false positive logs, but by modifying the attack-anomaly relationship table, an attack inference can be made that takes into account the degree to which the false positive logs are related to a cyber attack. For example, if the anomaly indicated by the false positive log is anomaly C that occurred at position 0x01, weighting (w) is applied to the part (g) in the attack-anomaly relationship table in Fig. 7d, i.e., the pattern of anomaly C at position 0x01. The weighting method is the same as in the third embodiment.

[0089] The part having the function of determining whether or not a log is a false positive, as described in the fourth embodiment, corresponds to a log determination device.

[0090] 4, when a combination of an anomaly and an anomaly position in a security log is not exactly the same as a combination of predicted anomaly information and predicted anomaly position information, the matching degree calculation unit 107 calculates the matching degree of these combinations. The matching degree refers to the degree of agreement between an anomaly indicated by a security log and an anomaly indicated by predicted anomaly information.

[0091] The output unit 108 outputs “attack information” indicating the attack estimated by the attack estimation unit 106. The attack information is, for example, an attack type and / or an attack path. The attack information may further include the matching degree calculated by the matching degree calculation unit 107. Here, "attack information" may be any information related to an attack, such as the type or category of the attack, the attack path such as the starting point or target of the attack, or the damage caused by the attack.

[0092] (5) Operation of the Attack Analysis Device 10 Next, the operation of the attack analysis device 10 will be described with reference to Fig. 8. Fig. 8 not only shows an attack analysis method executed by the attack analysis device 10, but also shows the processing procedure of an attack analysis program that can be executed by the attack analysis device 10. The order of these processes is not limited to the order shown in Fig. 8. In other words, the order may be changed as long as there are no constraints such as a relationship in which a certain step utilizes the result of the previous step. The same applies to the flowcharts and timing charts of Fig. 8 and subsequent figures.

[0093] The attack analysis device 10 has an attack / anomaly relationship information storage unit 105 that stores an attack / anomaly relationship table that shows the relationship between predicted attack information that indicates attacks that the electronic control system may be subjected to, predicted anomaly information that indicates anomalies that are predicted to occur if the attack is received, and predicted anomaly position information that indicates the position within the electronic control system where the predicted anomaly will occur.

[0094] The log acquisition unit 101 of the attack analysis device 10 acquires a security log indicating an abnormality detected in the electronic control system S and the location within the electronic control system S where the abnormality was detected (S101). The index acquisition unit 102 acquires an index indicating the internal state and / or the external state of the vehicle when the abnormality occurs (S102). The situation estimation unit 104 estimates the vehicle situation corresponding to the indicator acquired in S102 (S103). The attack on the electronic control system S is estimated (S104) based on the security log acquired in S101, the attack / anomaly relationship table stored in the attack / anomaly relationship information storage unit 105, and the index acquired in S102. In the case of based on the index, for example, the attack on the electronic control system S is estimated (S104) based on the vehicle situation estimated in S103. The output unit 108 outputs attack information indicating the attack estimated in S104 (S105).

[0095] (6) Summary As described above, according to the attack analysis device 10 of each embodiment, attacks are inferred based on indicators in addition to the security log and the attack / anomaly relationship table, thereby improving the efficiency of calculations for inferring cyber attacks suffered by an electronic control system. In addition, the corresponding vehicle situation is inferred based on the indicators, and attacks are inferred based on the situation in addition to the security log and the attack / anomaly relationship table. This makes it possible to select and execute the calculations required for attack inference depending on the situation, thereby further improving the efficiency of calculations to infer cyber attacks that electronic control systems have received.

[0096] 2. Embodiment 1 This embodiment is mainly based on the description of Patent Application No. 2022-158597. The attack analysis device of this embodiment is referred to as attack analysis device 11.

[0097] (1) Overview of overall structure First, a schematic configuration of the entire system including the attack analysis device 11 of this embodiment will be described. As shown in FIG. 9, in this embodiment, the overall system 1 includes a vehicle (e.g., an automobile) and an external server 30, and the vehicle and the external server 30 are configured to communicate with each other, for example, via a wireless communication network (e.g., the Internet, etc.).

[0098] The vehicle is equipped with a vehicle control system S (i.e., an electronic control system that controls the operation of the vehicle) that is subject to cyber-attacks, and the external server 30 is equipped with an attack analysis device 11 that analyzes cyber-attacks against the vehicle control system S. The attack analysis device 11 may be installed in the vehicle.

[0099] The vehicle control system S includes a plurality of electronic control units (hereinafter, ECU) 20. ECU is an abbreviation for Electronic Control Unit. In addition, various sensors, switches, etc. (i.e., sensors 21) are connected to the vehicle control system S in order to detect the state of each component of the vehicle control system S. Specifically, the sensors, switches, etc. constituting the sensors 21 are connected to the ECU 20.

[0100] A signal serving as an index showing the state of each component of the vehicle detected by the sensors 21 (i.e., a vehicle situation determination signal described later, hereinafter corresponding to "index") is input to the vehicle control system S. The vehicle situation determination signal is transmitted to the attack analysis device 11 of the external server 30. In this embodiment, the index is a signal capable of estimating a vehicle situation showing the state of the vehicle described later. When the estimation of the vehicle situation using the indicators is performed in the vehicle, the vehicle situation obtained as a result of the estimation may be transmitted to the attack analysis device 11 of the external server 30.

[0101] Furthermore, as described below, in the event of a cyber-attack in the vehicle control system S, a security sensor (not shown) installed in each ECU 20 detects the occurrence of an abnormality due to the cyber-attack and generates a vehicle log (i.e., an abnormality log, which is a signal indicating the abnormality, collectively referred to as a "security log"), and this vehicle log is then transmitted to the attack analysis device 11 of the external server 30.

[0102] <Vehicle control system> The vehicle control system S is a system that controls the operation of the vehicle, and each ECU 20 is connected via a bus (not shown) etc. In other words, each ECU 20 is connected via an in-vehicle network.

[0103] In addition, the power supply state of each ECU 20 can be individually controlled, and can be changed to a stopped or sleep state depending on the vehicle situation indicating the overall condition of the vehicle (i.e., the state of the vehicle defined according to each vehicle situation determination signal), as described below.

[0104] Here, "stop" refers to a state in which power is not supplied to the ECU 20, and "sleep" refers to a state in which the ECU 20 pauses normal operation and waits for normal operation until, for example, a wake-up signal is input. Note that in the sleep state, lower power is supplied than during normal operation, which contributes to power saving.

[0105] The ECU 20 arranged in the vehicle control system S is equipped with the security sensor that monitors the inside of the ECU 20 and the network to which the ECU 20 is connected. When the security sensor detects an abnormality that has occurred inside the ECU 20 or in the network, the security sensor generates the vehicle log as a security log.

[0106] Here, the vehicle log includes abnormality information (equivalent to "abnormality") indicating the abnormality detected by the security sensor, and abnormality location information (equivalent to "location") indicating the location where the abnormality detected by the security sensor occurred. The vehicle log may further include identification information for identifying the vehicle control system S, identification information of the security sensor that detected the abnormality, identification information of the ECU 20 in which the security sensor is mounted, the time when the abnormality was detected, the number of times when the abnormality was detected, the order in which the abnormality was detected, the contents of the data received before the abnormality was detected, and information on the IP addresses (source and destination), etc.

[0107] <About the Attack Analysis Device> The attack analysis device 11 is a device that analyzes a cyber attack based on a vehicle log or the like generated in the vehicle when the vehicle (more specifically, the vehicle control system S) is subjected to a cyber attack.

[0108] The attack analysis device 11 is a well-known electronic processing device equipped with a CPU, and memories such as a ROM and a RAM. In other words, the attack analysis device 11 is a device equipped with a well-known microcomputer (not shown). The memory is not limited to a memory within the microcomputer, but may be various storage devices (e.g., a hard disk, etc.) outside the microcomputer.

[0109] Various functions executed by the electronic control unit (ECU 20) and the electronic processing device are realized by the CPU executing a program stored in a non-transient tangible recording medium. In this example, the memory corresponds to the non-transient tangible recording medium storing the program. Furthermore, the execution of this program results in the execution of a method corresponding to the program.

[0110] In addition, the memory stores not only various programs (e.g., programs that analyze cyber attacks) but also various data (e.g., various tables) used when executing the various programs.

[0111] The method of realizing the various functions of the electronic control unit (ECU 20) and the electronic processing device is not limited to software, and some or all of the elements may be realized using one or more pieces of hardware. For example, when the above functions are realized by electronic circuits that are hardware, the electronic circuits may be realized by digital circuits including multiple logic circuits, or analog circuits, or a combination of these.

[0112] (2) Configuration and Function of Attack Analysis Device 11 Next, the functional configuration of the attack analysis device 11 will be described. In this embodiment, as shown in FIG. 10, the attack analysis device 11 functionally comprises an abnormality log acquisition unit 111, an index acquisition unit 112, a vehicle situation relationship table storage unit 113, an equipment state estimation unit 114, an attack / abnormality relationship table storage unit 115, an attack estimation unit 116, a matching degree calculation unit 117, and an output unit 118.

[0113] Each component will be described below. a) The abnormality log acquisition unit 111 (corresponding to the "log acquisition unit") is configured to receive a vehicle log transmitted from the vehicle. As described above, the vehicle log includes abnormality information indicating the content of an abnormality caused by a cyber attack detected by the security sensor, and abnormality position information indicating the position where the abnormality occurred.

[0114] The abnormality information indicates the type of abnormality. The abnormality location information includes information indicating the location of which ECU 20 is abnormal and information indicating the location of which bus connected to the ECU 20 is abnormal.

[0115] Examples of the abnormality of the ECU 20 include an abnormality (i.e., a frame abnormality) in information (i.e., a frame) transmitted and received between the ECUs 20, an abnormality (i.e., a bus abnormality), a host type abnormality, etc. In other words, the abnormality includes various abnormalities caused by a cyber attack on the vehicle control system S, such as a frame abnormality, a bus abnormality, and a host type abnormality.

[0116] In this embodiment, as described later (see, for example, FIG. 14), the anomaly information includes types of anomalies such as anomaly A to anomaly D. Furthermore, the positions of the anomalies include, for example, the first layer to the third layer. Note that the number of types of anomalies and the number of layers are not limited to this.

[0117] Here, the first to third layers will be described with reference to FIG. The first to third layers classify, for example, three types of ECUs 20 that operate in the same way in the vehicle situation. In other words, the ECUs 20 that operate in the same way in the power on and off states are classified. Note that the off state includes the sleep state.

[0118] For example, as shown in FIG. 11, a case will be described in which a plurality of ECUs α to ε are taken as the ECU 20 and each of the ECUs α to ε is given an identification number (that is, an identification number for an individual position).

[0119] Since ECU α and ECU β have the same power on / off operation in a vehicle situation (i.e., vehicle situation), they are given the same identification number (i.e., identification number indicating a shared position), for example, 0x01, as the ECU 20 in the first layer.

[0120] Moreover, since there is no ECU 20 having the same power on / off operation as ECU γ, an identification number indicating a common position, for example, 0x02, is assigned to ECU γ as an ECU 20 in the second layer. Furthermore, since ECU δ and ECU ε have the same power on / off operation in the vehicle situation, they are assigned an identification number indicating the same common position as the ECU 20 in the third layer, for example, 0x03.

[0121] Although the first to third layers in which the ECUs 20 are standardized have been given as an example here, the abnormality position may simply be indicated by the position of each ECU 20 (for example, an identification number indicating an individual position) without standardization.

[0122] b) The index acquisition unit 112 (corresponding to the "index acquisition unit") is configured to receive a vehicle situation determination signal transmitted from a vehicle, as shown in FIG. As described above, this vehicle situation determination signal is a signal that serves as an index showing the state of each component of the vehicle detected by the sensors 21, and is used to estimate the vehicle situation based on the vehicle situation determination condition table (see Figure 12) described later.

[0123] c) The device state estimation unit 114 (corresponding to a "situation estimation unit") is configured to estimate the vehicle situation. Specifically, the device state estimation unit 114 is configured to use the vehicle situation determination signal received by the index acquisition unit 112 to estimate a vehicle situation indicating the overall state of the vehicle based on a vehicle situation determination condition table (see FIG. 12) described later.

[0124] The device state estimation unit 114 is configured to estimate the power state (corresponding to the "situation") of each ECU 20, specifically, whether each ECU is on or off, based on the vehicle situation and a power state determination table (see FIG. 13) described later. Note that the estimation of whether each ECU 20 is on or off may be performed by the attack estimation unit 116.

[0125] d) The attack estimation unit 116 (corresponding to the "attack estimation unit") is configured to estimate the attack path and the attack type of a cyber attack. Specifically, the attack estimation unit 116 is configured to estimate the attack path and the attack type based on the power on / off information (corresponding to the "situation") of each ECU 20 obtained based on the vehicle situation estimated by the device state estimation unit 114 and the vehicle log information (i.e., the abnormality position information of each layer commonized with the abnormality information such as abnormality A to abnormality D) obtained from the abnormality log acquisition unit 111. The procedure of this estimation will be described in detail later.

[0126] e) The matching degree calculation unit 117 calculates a matching degree indicating the degree of match between a combination of anomaly information and anomaly position information and a combination of predicted anomaly information and predicted anomaly position information in FIG. 14 described later.

[0127] The degree of matching can be expressed, for example, as a percentage (e.g., %) of the degree of matching of the anomalies by comparing the combinations of anomalies indicated by the actually acquired vehicle logs with the combinations of anomalies in the predicted anomaly patterns in the matching table for estimating attack paths, which will be described later.

[0128] For example, if four anomalies in the vehicle log perfectly match four anomalies in the predicted anomaly pattern, the matching degree is 100%, and if only three anomalies match, the matching degree is 3 / 4 of 100%, or 75%.

[0129] In addition, the degree of matching may be expressed, for example, by a numerical value obtained by dividing the difference between the number of abnormalities indicated by the vehicle log and the number of abnormalities indicated by the predicted abnormality pattern by the number of abnormalities indicated by the vehicle log or the number of abnormalities indicated by the predicted abnormality pattern.

[0130] f) The output unit 118 (corresponding to the “output unit”) is configured to output the estimation result estimated by the attack estimation unit 116 and the calculation result calculated by the matching degree calculation unit 117. g) The vehicle situation relationship table storage unit 113 is set in a memory, and stores a vehicle situation determination condition table as shown in FIG. 12 and a power supply state determination table indicating the power supply state of the ECU 20 for each vehicle situation as shown in FIG. 13.

[0131] <About the vehicle situation judgment condition table> Next, the vehicle situation determination condition table will be described with reference to FIG. As shown in FIG. 12, the vehicle situation determination condition table is a table in which indicators indicating the state of each component of the vehicle are arranged horizontally (column arrangement direction: column direction) in the figure, and the overall state of the vehicle (e.g., driving state, etc.) is arranged vertically (row arrangement direction: row direction) in the figure.

[0132] The indicators indicating the state of each component of the vehicle are items corresponding to situation determination signals indicating the state of each component obtained from the sensors 21. Examples of these indicators include vehicle speed, mode (e.g., driving mode or diagnostic mode), occupants (e.g., number of occupants), battery voltage, charging state, shift position, etc.

[0133] The vehicle situation indicates the overall state of the vehicle specified by the index. Examples of the vehicle situation include at least one of the following: city driving, high-speed driving, stopped (with passengers), stopped (without passengers), automatic driving, low battery while driving, slowing down, reversing, fault diagnosis, and default states other than the above-mentioned exemplary states.

[0134] The default state may be, for example, an undeterminable state, an unclear situation state, or other initial setting state that is set in advance. In addition, when the vehicle is traveling in an urban area, it can be determined, for example, from map data that the vehicle is traveling in a specific urban area or traveling at less than a specific speed. When the vehicle is traveling at high speed, it can be determined that the vehicle is traveling on an expressway or traveling at a speed above a specific speed. When the vehicle is in autonomous driving mode, it can be determined. When the battery level is low while the vehicle is traveling, it can be determined that the battery level is below a specific level while the vehicle is traveling. When the vehicle is slowly traveling, it can be determined that the speed indicates a speed below a specific speed.

[0135] Therefore, by using the vehicle situation determination condition table, each vehicle situation can be estimated from the state of each configuration specified by the vehicle situation determination signal (for example, the state indicated by each indicator such as vehicle speed and shift position).

[0136] <About the power supply status determination table> Next, the power supply state determination table will be described with reference to FIG. As shown in FIG. 13, the power supply state determination table is a table in which the power supply on (ON) / off (OFF) states of each ECU 20 (e.g., ECU A to J) are arranged horizontally in the figure, and each vehicle situation is arranged vertically in the figure.

[0137] Therefore, by using the power supply state determination table, it is possible to know the power supply on / off state of each of the ECUs A to J from each vehicle situation. In addition, among the ECUs A to J, those that have the same power on / off state according to each vehicle situation are included in the same layer. For example, ECU A and ECU F, and ECUC and ECU H can be regarded as ECUs 20 in the same layer.

[0138] <About the matching table for attack path estimation> h) The attack / anomaly relationship table storage unit 115 (corresponding to the "attack / anomaly relationship information storage unit") is set in a memory, and the attack / anomaly relationship table storage unit 115 stores a matching table for estimating an attack path (corresponding to the "attack / anomaly relationship information") as shown in FIG. 14.

[0139] The matching table for estimating an attack path is a table in which predicted anomaly information corresponding to the type of anomaly detected by the security sensor and predicted anomaly position information corresponding to the position of anomaly indicating each layer including each ECU 20 are arranged horizontally in the figure, and types of cyber attacks and cyber attack paths are arranged vertically in the figure. The predicted anomaly information is arranged according to the predicted anomaly position corresponding to each layer.

[0140] In addition, predicted anomaly information is information that indicates the type of anomaly that is predicted to occur if a cyber-attack is actually committed, and predicted anomaly location information is information that indicates the location of an anomaly that is predicted to occur if a cyber-attack is actually committed.

[0141] The types of abnormality are, for example, abnormalities A to D, and the locations of the abnormalities are the layers (for example, the first to third layers) including each ECU 20. The types of cyber-attacks (i.e., attack types) are, for example, attack A to attack X, and the path of the attack is, for example, an attack path (i.e., an estimated path) defined by the location of the starting point of the attack and the location of the target of the attack. Attacks A to X include various known cyber-attacks.

[0142] Also, 0x01 to 0x03 of the attack starting point and the attack target indicate common first to third layer identification numbers as described above (see FIG. 11), and 0000 indicates the outside of the vehicle. In this way, a matching table for estimating an attack path is a table that shows the relationship between the type of anomaly, the location of the anomaly, and the attack type and attack path when an anomaly occurs that is indicated by the type of anomaly, such as anomalies A to D, and the location of the anomaly, such as each layer, and the attack type and attack path are determined.

[0143] Therefore, by using the matching table for inferring an attack path, it is possible to determine (i.e., estimate) the attack type and attack path from the type of anomaly and the location of the anomaly.

[0144] (3) Attack type and attack path estimation method Next, a method for estimating an attack type and an attack path using the attack estimation matching table will be described with reference to FIG.

[0145] In this embodiment, the attack type and attack path are estimated by comparing the match state between a combination of anomaly information indicating the actual type of anomaly contained in the vehicle log and anomaly location information indicating the location where the anomaly occurred, and a combination of predicted anomaly information and predicted anomaly location information in the attack path estimation matching table. A specific description will be given below.

[0146] <Basic estimation method> First, a basic estimation method for estimating an attack type and an attack path will be described. In this estimation method, vehicle logs are analyzed for all ECUs 20 (thus, layers). For example, the location and type of anomaly are obtained from a group of vehicle logs in a certain time frame (i.e., a group of vehicle logs to be analyzed and required for analyzing an attack), and it is confirmed which position in the attack estimation matching table (i.e., which position in each column in each row of the table) this actual anomaly corresponds to.

[0147] This makes it possible to determine the pattern of abnormalities in the actual vehicle logs (i.e., the actual abnormality pattern that indicates the arrangement of whether or not there are actual abnormalities) that corresponds to the predicted abnormality pattern in the attack estimation matching table (e.g., the arrangement pattern of ○ (i.e., circles) in each row).

[0148] Therefore, by using the attack estimation matching table to compare the actual abnormality pattern with the predicted abnormality pattern in the attack estimation matching table, the attack type and attack route can be estimated.

[0149] For example, when an actual abnormality pattern and a predicted abnormality pattern completely match, the attack type and attack path can be identified from the attack estimation matching table. When an actual abnormality pattern and a predicted abnormality pattern do not completely match, the attack type and attack path can be estimated according to the degree of match.

[0150] An example of the above-mentioned process will be described below, but the present invention is not limited to this example. Note that the attack path will be described as an example. (Step 1) A group of vehicle logs (i.e., one or more vehicle logs) that serve as input for estimating an attack path is obtained.

[0151] (Step 2) Next, estimate the attack path by following the steps (2-1) to (2-5) below. (2-1) One vehicle log is retrieved, and it is analyzed to determine which ECU 20 (thus, which layer) of the security sensor the vehicle log indicates is abnormal (that is, the location and type of the abnormality).

[0152] (2-2) Next, by referring to the matching table for estimating an attack, it is determined which ECU 20 (thus, which layer) in the column direction (horizontal direction) of the matching table for estimating an attack is abnormal (i.e., which column the abnormality relates to).

[0153] (2-3) Next, for the identified columns, the presence or absence of anomalies is checked along the row direction (vertical direction) of the attack estimation matching table, and when a row with a ○ (circle) is reached, that attack path is stored as a candidate attack path.

[0154] (2-4) Next, the above-mentioned process (2-3) is repeated until the end of the row (i.e., the number of attack paths). (2-5) Return to step 1 above and compare the next vehicle log.

[0155] (Step 3) Next, after checking all vehicle logs, the stored attack path candidates are stored as the estimated attack path results. Note that the attack path candidates indicate the attack path candidates before the output is finalized, and if the same attack path candidate is estimated multiple times, the later estimated attack path candidate is not stored.

[0156] (Step 4) Next, the stored attack paths are output as inferred results. <Estimation method according to power supply status> The main steps in this estimation method are similar to the processing described above in the <Basic Estimation Method>. Here, we will mainly explain in detail the method of estimating the attack type and attack path that is performed in response to the power being turned on and off to the ECU 20, which is the key part of this embodiment.

[0157] In this estimation method, for example, when a powered-off ECU 20 (hence a layer) is included in the target (or starting point) of an attack, as in the box surrounded by a dashed line in Fig. 15, the analysis of this attack is skipped. In other words, in light of the fact that powered-off ECUs 20 cannot be the starting point or target of a cyber-attack, these ECUs 20 are estimated not to be related to a cyber-attack, and can be skipped.

[0158] Also, for example, analysis of vehicle logs corresponding to abnormalities A to D related to powered-off ECUs 20 (thus, for example, the third layer) is skipped, as shown in the box surrounded by the dashed line in Fig. 15. In other words, in light of the fact that no vehicle logs are generated from powered-off ECUs 20, it is presumed that these ECUs 20 are not related to cyber attacks, and therefore they can be skipped.

[0159] A specific example will be described below in order, but the present invention is not limited to the following process. Note that an attack path will be described as an example. (Step 1) A group of vehicle logs (i.e., one or more vehicle logs) that serve as input for estimating an attack path is obtained.

[0160] (Step 2) Next, estimate the attack path by following the steps (2-1) to (2-7) below. (2-1) One vehicle log is retrieved, and it is analyzed to determine which ECU 20 (thus, which layer) of the security sensor the vehicle log indicates is abnormal (that is, the location and type of the abnormality).

[0161] (2-2) If the result of the process in (2-1) indicates that the vehicle log to be analyzed corresponds to abnormalities A to D of the ECU 20 that is considered not to have been in operation due to being powered off, the process thereafter (e.g., processes in (2-3) to (2-6)) is skipped, and the process returns to (step 1) to analyze the next vehicle log. That is, for example, the analysis of the vehicle log in the range enclosed by the dashed line in FIG. 15 is omitted.

[0162] (2-3) Next, by referring to the matching table for estimating an attack, it is determined which ECU 20 (thus, which layer) in the column direction (horizontal direction) of the matching table for estimating an attack is abnormal (i.e., which column the abnormality relates to).

[0163] (2-4) Next, for the identified columns, the presence or absence of anomalies is checked along the row direction (vertical direction) of the attack estimation matching table, and when a row with a ○ (circle) is reached, that attack path is stored as a candidate attack path.

[0164] (2-5) If the power supply of either the attack source ECU 20 (thus, the layer) or the attack target ECU 20 (thus, the layer) is off during the execution of the process of (2-4) above, the comparison of the presence or absence of anomalies is skipped. In other words, for example, the analysis of attacks in the area surrounded by the dashed line in FIG. 15 is omitted.

[0165] (2-6) Next, the above-mentioned processes (2-4) to (2-5) are repeated until the end of the row (that is, for the number of attack paths). (2-7) Return to step 1 and compare the next vehicle log.

[0166] (Step 3) Next, after checking all vehicle logs, the stored attack path candidates are stored as the estimated attack path results. Note that the attack path candidates indicate the attack path candidates before the output is finalized, and if the same attack path candidate is estimated multiple times, the later estimated attack path candidate is not stored.

[0167] (Step 4) Next, the attack path estimation results are output. Therefore, when the result of checking all vehicle logs shows that the actual vehicle logs match anomalies A, C, and D in the first layer, for example, as in attack A in Fig. 15 (i.e., 100% match), it can be estimated that the cyber attack is an attack path with the attack starting point being 0000 and the attack target being 0x01. It can also be estimated that the cyber attack is attack A.

[0168] In other words, when the pattern of the combination of abnormality information and abnormality location information in the actual vehicle log (i.e., the actual abnormality pattern) matches the pattern in one row of the attack estimation matching table (i.e., the predicted abnormality pattern), the attack path and attack type corresponding to the predicted abnormality pattern can be suitably estimated.

[0169] Also, for example, if the vehicle log only partially matches one row of the pattern in the attack estimation matching table, the degree of matching can be determined to be low. For example, if only two out of three match, the degree of matching can be considered to be 2 / 3.

[0170] Furthermore, for example, if the abnormality based on the acquired vehicle log (i.e., the abnormality in the actual abnormality pattern) is located in the second layer in the attack estimation matching table and the abnormality types are three, corresponding to abnormality A, abnormality B, and abnormality C, then by referring to the predicted abnormality pattern in the attack estimation matching table, the attack types (or attack paths) are estimated to be attack B, attack C, and attack D.

[0171] In this case, the matching degree is estimated to be 2 / 3 for attack B, 2 / 3 for attack C, and 3 / 3 for attack D (i.e., 100%).

[0172] (4) Content of processing Next, the process executed by the attack analysis device 11 will be described with reference to the timing chart of FIG.

[0173] The index acquisition unit 112 receives a vehicle situation determination signal from the vehicle control system S of the vehicle (S111). The abnormality log acquisition unit 111 receives a vehicle log including abnormality information and abnormality position information from the vehicle control system S of the vehicle (S112).

[0174] The device state estimation unit 114 estimates the vehicle situation based on the vehicle situation determination signal by using the vehicle situation determination condition table (S113).

[0175] The attack estimation unit 116 uses a matching table for attack estimation to compare the combination of the type of abnormality and the location of the abnormality contained in the vehicle log obtained from the abnormality log acquisition unit 111 with multiple predicted abnormality patterns that are predicted to occur in the event of a cyber-attack (i.e., by matching the combination of the type of abnormality and the location of the abnormality contained in the vehicle log with the predicted abnormality patterns in the matching table for attack estimation), thereby estimating the attack path and attack type of the cyber-attack (S114).

[0176] In particular, in this embodiment, as described above, when the attack estimation unit 116 estimates an attack path, etc., the calculation range for the estimation is set so that an ECU 20 with its power off is identified from the power state determination table based on the vehicle situation estimated by the device state estimation unit 114, and processing unnecessary for estimating the attack path, etc. is omitted based on that ECU 20 with its power off.

[0177] That is, when the powered-off ECU 20 (hence, the layer) is included in the target of the attack (or the starting point of the attack), the analysis of the attack is skipped, as shown in the box surrounded by the dashed line in Fig. 15. Also, for example, as shown in the box surrounded by the dashed line in Fig. 15, the analysis of the vehicle log of the security sensor arranged in the powered-off ECU 20 (hence, for example, the third layer) is skipped.

[0178] As shown in the power supply state determination table, the power on / off state of each ECU 20 is determined according to the vehicle situation, and as shown in the table in FIG. 11, the ECU 20 corresponding to each layer is determined.

[0179] The estimation results of the attack path and the like estimated by the attack estimation unit 116 and the vehicle situation estimated by the device state estimation unit 114 are output to the matching degree calculation unit 117. The matching degree calculation unit 117 calculates the matching degree by the various methods described above (S115).

[0180] Further, the ECU 20 that was powered off when the vehicle log was generated is identified from the vehicle situation. If there is an ECU 20 that was powered off, it is not included in the calculation of the matching degree.

[0181] Next, the estimated results of the attack path, etc. and the matching degree are output to the output unit 118, and the analysis results (i.e., the estimated results of the attack path, etc. and the matching degree) are output from the output unit 118 to a specified device outside the attack analysis device 11 (for example, a storage device of the external server 30, etc.).

[0182] (5) Effects (a) According to this embodiment, the attack path and / or attack type of a cyber attack can be estimated by comparing the anomaly information and anomaly location information contained in the vehicle log with multiple predicted anomaly patterns that are predicted to occur in the event of a cyber attack.

[0183] In addition, when estimating an attack path, etc., the range of the estimation is determined based on the vehicle situation, so that the necessary calculations can be selected and performed according to the vehicle situation. This can improve the calculation efficiency when estimating an attack path, etc., and reduce the calculation load.

[0184] More specifically, in this embodiment, the range of estimation for estimating the attack path, etc. can be set based on the power on / off state of the ECU 20 obtained from the vehicle situation. For example, for the vehicle log of the ECU 20 with the power off, calculations for estimating the attack path, etc. can be omitted. This can increase the calculation efficiency when estimating the attack path, etc., and reduce the calculation load.

[0185] (b) In this embodiment, the predicted abnormality pattern is linked to the attack origin ECU 20 and the attack target ECU 20. If the attack origin ECU 20 or the attack target ECU 20 is included in the power-off ECU 20 in the vehicle situation when the abnormality is detected, the process of estimating the attack path, etc., can be skipped for the predicted abnormality pattern linked to the power-off ECU 20.

[0186] (c) In this embodiment, for predicted abnormality patterns corresponding to the ECU 20 that is powered off in the vehicle situation when an abnormality is detected, the process of estimating an attack path, etc. can be skipped.

[0187] (d) In this embodiment, a table showing the relationship between the attack path and / or attack type, predicted anomaly information indicating the type of anomaly predicted to occur when subjected to a cyber-attack, and predicted anomaly location information indicating the location of the anomaly predicted to occur when subjected to a cyber-attack can be used as an attack estimation matching table used when estimating an attack path, etc.

[0188] Therefore, the attack path and attack type of a cyber attack can be inferred from a combination of predicted anomaly information and predicted anomaly location information (e.g., a predicted anomaly pattern) in an attack estimation matching table (e.g., an attack estimation matching table in which combinations of anomaly types and anomaly locations are shared) that corresponds to a combination of anomaly types and anomaly locations that have actually been obtained (e.g., an actual anomaly pattern).

[0189] (e) In this embodiment, the degree of matching can indicate the degree of similarity between the information contained in the vehicle log and the predicted abnormality pattern. (f) In this embodiment, the vehicle situation may be at least one of the following: driving in a city, driving at a high speed of at least a predetermined speed, stopped with an occupant present, stopped with no occupant present, driving autonomously, when the remaining battery charge drops below a predetermined level while driving, driving slowly at a speed below a predetermined speed, driving backward, charging, undergoing fault diagnosis, a default state other than the various states described above, etc. Note that the vehicle situation is not limited to these examples, and may include various vehicle situations that indicate the state of the vehicle (for example, the moving state or use state of the vehicle, etc.).

[0190] (6) Modifications of this embodiment Although the embodiment of the present disclosure has been described above, it goes without saying that the present disclosure is not limited to the above embodiment and can take various forms. The following modifications can be modifications of the present embodiment as well as other embodiments.

[0191] (2a) In this embodiment, a vehicle is used as an example of a device equipped with an electronic control system S that is subject to cyber-attacks, but this is not limited to this and can be applied to any electronic control system equipped with multiple ECUs.

[0192] For example, the electronic control system S may be an electronic control system mounted on any mobile body, or may be mounted on a stationary body rather than a mobile body.

[0193] (2b) In the present embodiment, an example has been given in which the attack analysis device 11 is mounted on an external server, but a part or the entire attack analysis device 11 may be mounted on a vehicle. (2c) In this embodiment, the ECUs are shared, but they do not have to be shared. In this case, for example, an attack estimation matching table in which each ECU is arranged instead of each layer in FIG. 14 can be used.

[0194] (2d) The contents of this disclosure include at least one of the attack vectors and attack types of cyber attacks. (2e) The attack analysis apparatus 11 described in the present disclosure may be implemented by a special purpose computer provided by configuring a processor and memory programmed to perform one or more functions embodied in a computer program.

[0195] Alternatively, the attack analysis apparatus 11 described in the present disclosure may be implemented by a special purpose computer provided by configuring a processor with one or more special purpose hardware logic circuits.

[0196] Alternatively, the attack analysis apparatus 11 described in the present disclosure may be implemented by one or more special purpose computers configured by a combination of a processor and memory programmed to perform one or more functions and a processor configured by one or more hardware logic circuits.

[0197] The computer program may be stored in a computer-readable non-transitory tangible recording medium as instructions executed by a computer. The method for realizing the functions of each unit included in the attack analysis device 11 does not necessarily need to include software, and all of the functions may be realized using one or more pieces of hardware.

[0198] (2f) In addition to the above-mentioned attack analysis device 11, the present disclosure can also be realized in various forms, such as a device having the attack analysis device 11 as a component, a program for causing the computer of the attack analysis device 11 to function, a non-transient tangible recording medium such as a semiconductor memory on which this program is recorded, and a processing method of the attack analysis device 11 (e.g., an attack analysis method).

[0199] (2g) Multiple functions possessed by one component in the above embodiments may be realized by multiple components, or one function possessed by one component may be realized by multiple components. Also, multiple functions possessed by multiple components may be realized by one component, or one function realized by multiple components may be realized by one component. Also, part of the configuration of each of the above embodiments may be omitted. Also, at least part of the configuration of each of the above embodiments may be added to or substituted for the configuration of another embodiment.

[0200] (7) Invention understood from this embodiment The inventions that can be understood from at least the disclosure of this embodiment are listed below.

[0201] (Invention 1) An attack analysis device (11) that analyzes a cyber-attack based on an abnormality occurring in an electronic control system (S) when the electronic control system is subjected to a cyber-attack, The electronic control device (20) included in the electronic control system has a power state that can be individually controlled and can be changed to a stopped or sleep state depending on a situation that indicates the state of the device in which the electronic control system is installed, an abnormality log acquisition unit (111) configured to acquire an abnormality log generated when the abnormality occurs in the electronic control system, the abnormality log including information on the type of the abnormality and the location of the abnormality; an attack estimation unit (116) configured to estimate an attack path and / or an attack type of the cyber-attack by comparing information included in the abnormality log acquired by the abnormality log acquisition unit with one or more predicted abnormality patterns indicating a combination of the abnormalities predicted to occur in the event of the cyber-attack; Equipped with When the estimation is performed by the attack estimation unit, a calculation range for performing the estimation is determined based on the situation of the device. Attack analysis equipment.

[0202] (Invention 2) The attack analysis device according to claim 1, an index acquisition unit (112) configured to acquire an index capable of estimating the situation of the device from the device; an apparatus state estimation unit (114) configured to estimate the situation of the apparatus from the indicator; Further equipped with When the estimation is performed by the attack estimation unit, a calculation range for performing the estimation is determined based on the situation of the device estimated by the device state estimation unit. Attack analysis device.

[0203] (Invention 3) The attack analysis device according to claim 1, A calculation range for performing the estimation is set based on the stopped or sleep state of the power state of the electronic control device obtained from the situation of the device. Attack analysis device.

[0204] (Invention 4) The attack analysis device according to claim 3, With respect to the abnormality log of the electronic control device in the power supply state of the stopped or the sleep state, the process of making the estimation is omitted by comparing the abnormality log with the predicted abnormality pattern. Attack analysis device.

[0205] (Invention 5) The attack analysis device according to claim 1, The predicted abnormality pattern is linked to the electronic control device at a predicted attack point indicating the starting point of the cyber attack, When the electronic control device at the predicted attack site is included in the electronic control device in the stopped or sleep state in the situation of the device when the abnormality is detected, the process of making the estimation is omitted by comparing the predicted abnormality pattern associated with the electronic control device in the stopped or sleep state with the abnormality log. Attack analysis device.

[0206] (Invention 6) The attack analysis device according to claim 1, The predicted abnormality pattern is linked to the electronic control device of a predicted attack target that indicates a target of the cyber attack, When the electronic control device that is the target of the predicted attack is included in the electronic control device that is in the stopped or sleep state in the situation of the device when the abnormality is detected, the process of making the estimation is omitted by comparing the predicted abnormality pattern associated with the electronic control device that is in the stopped or sleep state with the abnormality log. Attack analysis device.

[0207] (Invention 7) The attack analysis device according to claim 1, Among the predicted abnormality patterns, for the predicted abnormality pattern corresponding to the electronic control device that is in the stopped or sleep state in the situation of the device when the abnormality is detected, the process of making the estimation is omitted by comparing it with the abnormality log. Attack analysis device.

[0208] (Invention 8) The attack analysis device according to claim 1, The predicted anomaly pattern is a table configured to indicate predicted anomaly information indicating the anomaly predicted to occur when the cyber-attack is received, and a predicted anomaly position indicating a position of the anomaly predicted to occur when the cyber-attack is received, The attack path and / or the attack type of the cyber attack are estimated by comparing the abnormality log. Attack analysis equipment.

[0209] (Invention 9) The attack analysis device according to claim 1, and calculating a matching degree indicating a degree of similarity between information included in the abnormality log and the predicted abnormality pattern. Attack analysis equipment.

[0210] (Invention 10) An attack analysis device according to claim 9, The information included in the abnormality log acquired by the abnormality log acquisition unit is compared with the predicted abnormality pattern that is predicted to occur in the event of the cyber-attack, and the matching degree is calculated based on the degree of agreement between the information included in the abnormality log and the predicted abnormality pattern. Attack analysis equipment.

[0211] (Invention 11) The attack analysis device according to claim 1, When the device is a vehicle, the situation of the vehicle is at least one of the following: driving in a city, driving at a high speed of a predetermined speed or more, stopped with an occupant, stopped without an occupant, driving automatically, when the battery level drops below a predetermined level while driving, driving slowly at a speed less than a predetermined speed, driving backward, charging, undergoing a fault diagnosis, and a default state other than the various states. Attack analysis equipment.

[0212] (Invention 12) The attack analysis device according to claim 2, and determining the situation of the device from the index based on a table in which the index corresponds to the situation of the device. Attack analysis equipment.

[0213] (Invention 13) The attack analysis device according to claim 1, The method is configured to estimate the attack path and / or the attack type of the cyber-attack from the information included in the abnormality log based on a table that corresponds the information included in the abnormality log acquired by the abnormality log acquisition unit with the predicted abnormality pattern that is predicted to occur in the event of the cyber-attack. Attack analysis device.

[0214] (Invention 14) An attack analysis device according to claim 13, As the table, a table showing a relationship between the attack path and / or the attack type, predicted anomaly information indicating the anomaly predicted to occur when the cyber-attack is received, and a predicted anomaly location indicating the location of the anomaly predicted to occur when the cyber-attack is received is used, The attack path and / or the attack type of the cyber attack is estimated from a combination of the predicted anomaly information and the predicted anomaly position corresponding to a combination of the type of the anomaly and the position of the anomaly. Attack analysis device.

[0215] (Invention 15) An attack analysis method for analyzing a cyber-attack based on an abnormality occurring in an electronic control system (S) when the electronic control system is subjected to a cyber-attack, comprising: The electronic control device (20) included in the electronic control system has a power state that can be individually controlled and can be changed to a stopped or sleep state depending on a situation that indicates the state of the device in which the electronic control system is installed, An abnormality log is obtained when the abnormality occurs in the electronic control system, the abnormality log including information on the type of the abnormality and the location of the abnormality (S112); When estimating the attack path and / or attack type of the cyber-attack by comparing the information included in the acquired abnormality log with one or more predicted abnormality patterns indicating a combination of the abnormalities predicted to occur in the event of the cyber-attack, a calculation range for performing the estimation is determined based on the situation of the device (S114). Attack analysis method.

[0216] (Invention 16) An attack analysis program executable by an attack analysis device (11) for analyzing a cyber-attack based on an abnormality occurring in an electronic control system (S) when the electronic control system (S) is subjected to a cyber-attack, The electronic control device (20) included in the electronic control system has a power state that can be individually controlled and can be changed to a stopped or sleep state depending on a situation that indicates the state of the device in which the electronic control system is installed, An abnormality log is obtained when the abnormality occurs in the electronic control system, the abnormality log including information on the type of the abnormality and the location of the abnormality (S112); When estimating the attack path and / or attack type of the cyber-attack by comparing the information included in the acquired abnormality log with one or more predicted abnormality patterns indicating a combination of the abnormalities predicted to occur in the event of the cyber-attack, a calculation range for performing the estimation is determined based on the situation of the device (S114). Attack analysis program.

[0217] 3. Embodiment 2 This embodiment is mainly based on the description of Patent Application No. 2022-157432. The attack analysis device of this embodiment is referred to as an attack analysis device 12 .

[0218] (1) Overall configuration of the attack analysis device 10 The attack analysis device 12 of this embodiment will be described with reference to Fig. 17. The attack analysis device 12 is a device that analyzes attacks against an electronic control system S provided in a moving object described later. The attack analysis device 12 includes an entry point candidate generation unit 120, an attack estimation unit 220, and an estimation result verification unit 320. In the following embodiment, a device having the attack estimation unit 220 is referred to as an attack analysis device, and the entry point candidate generation unit 120, the attack estimation unit 220, and the estimation result verification unit 320 are collectively referred to as an attack analysis system. Therefore, Fig. 17 is also a diagram showing the attack analysis system 1 of this embodiment.

[0219] In the present embodiment described below, an example will be described in which the electronic control system S subjected to a cyber attack is an in-vehicle system provided in a vehicle. Also, the attack analysis device 12 of the present embodiment is provided outside the vehicle as shown in FIG. 1(c).

[0220] (2) Electronic control system S and various tables The electronic control system S will be described with reference to Fig. 18. The electronic control system S is composed of a plurality of electronic control units (hereinafter, ECUs). In the example shown in Fig. 18, the electronic control system S has ECU-1 to 5, and each ECU is connected via an in-vehicle network.

[0221] An ECU constituting the electronic control system S is equipped with a security sensor that monitors the inside of the ECU and the network to which the ECU is connected. When the security sensor detects an abnormality that occurs inside the ECU or in the network, it generates a security log and outputs it to an entry point candidate generating unit 120 described later. Hereinafter, the log generated and output by the security sensor is referred to as a security log. The security log includes abnormality information indicating the abnormality detected by the security sensor and abnormality position information indicating the position where the abnormality detected by the security sensor occurred. The security log may further include identification information for identifying the electronic control system S, identification information of the security sensor that detected the abnormality, identification information of the ECU in which the security sensor is mounted, the time when the abnormality was detected, the number of times when the abnormality was detected, the order in which the abnormality was detected, the contents of data received before the abnormality was detected, information on IP addresses (source and destination), and the like.

[0222] The electronic control system S is connected to external connection destinations using a wireless communication method or a wired communication method. In the example shown in Fig. 18, the external connection destinations of the electronic control system S are composed of AP-1 to AP-5. Examples of the external connection destinations include a Home Energy Management System (HEMS), a desk lamp, a roadside device, a non-contact charger, another vehicle, a diagnostic device, and an OEM center.

[0223] When the electronic control system S is subjected to a cyber-attack from a connected destination, the attack path and the location of damage can be accurately estimated by identifying the entry point, which is the point of entry of the attack. FIG. 18 shows an example in which, when the electronic control system S is subjected to a cyber-attack, each of ECU1 to ECU5 becomes entry points EP1 to EP5, respectively. Alternatively, the entry points may be identified by an interface. Each ECU may be a physical ECU or a virtual ECU.

[0224] A specific example of an entry point will be described with reference to FIG. In the case of an attack from an external connection destination shown in the right column of Fig. 19, the interfaces shown in the middle column are entry points, and the ECUs having the entry points are shown in the left column. In the example shown in the figure, the multimedia ECU has Wi-Fi, Bluetooth (registered trademark), and USB as interfaces, so each interface is an entry point. Alternatively, the ECU shown in the left column may be defined as the entry point. Alternatively, as shown in Fig. 19, the combination of the interface shown in the middle column and the ECU shown in the left column may be defined as the entry point.

[0225] FIG. 20 is a diagram showing an example of a driving condition-attack relationship table (corresponding to "driving condition-abnormality relationship information"). In the driving condition-attack relationship table shown in FIG. 20, the external connection destination (corresponding to "connection destination information") and the entry point of the attack predicted from the connection destination (corresponding to "predicted entry point") in the electronic control system S shown in FIG. 18 are stored in association with the driving condition of the vehicle when an abnormality occurs, that is, the driving condition corresponding to the entry point (corresponding to "predicted driving condition"). That is, for each external connection destination, the driving condition of the vehicle when the connection destination can be connected is associated. In the example of FIG. 20, the external connection destinations that can be connected in each driving state are all of AP-1 to AP-5 in the case of driving condition C1, AP-1, AP-3, and AP-5 in the case of driving condition C2, and AP-3 and AP-5 in the case of driving condition C3. Here, the "driving conditions" include not only the internal conditions while the vehicle is traveling, such as the behavior, operation, and mode of the vehicle itself, but also the external conditions while the vehicle is traveling, such as the ambient temperature, position, and time of day of the vehicle.

[0226] FIG. 21 is a diagram showing the presence or absence of connection possibility depending on the vehicle speed for external connection destinations, such as a HEMS, a desk lamp, another vehicle, a diagnostic device for maintenance work at a vehicle dealership, and a roadside device. That is, this is an example in which the driving situation is the "speed" of the vehicle. The speeds shown in the figure may be classified according to the connection possibility of the connection destination, for example, 0 km / h is a stop, 0 km / h or more and less than 20 km / h is a low speed, and 20 km / h or more is a high speed. Note that an upper limit may be set for the high speed depending on the performance of the device to be connected. In this case, the high speed may be set in multiple stages. Here, "speed" refers to not only the speed in the narrow sense indicated by the distance traveled per unit time, but also information that can indirectly specify the speed in the narrow sense, such as the time required per unit distance, position information between two points and the required time, etc. Alternatively, it may be defined as a range of speeds.

[0227] By using the driving status-attack relationship table, it is possible to identify or narrow down the external connection destination and entry point using the driving status of the vehicle when an abnormality occurs. For example, since a vehicle cannot connect to a power stand while it is moving, if an abnormality occurs in a moving vehicle, it is possible to eliminate the possibility of an attack from a power stand or to evaluate the possibility as low. In addition to obtaining the vehicle speed as speed information, it can also be obtained as the transition of location information or the state of the gear shift that reflects the vehicle's driving status.

[0228] If the vehicle's driving condition is distinguished by temperature, for example the air temperature around the vehicle or the temperature of the components that make up the vehicle, then connections that do not work at the temperature when an abnormality occurs can be excluded from being the source of a cyber attack. When the vehicle's running state is distinguished by time or date and time, a connection destination that is not operating at the time the abnormality occurs can be excluded from the source of the attack. When the driving state of a vehicle is distinguished according to its geographic location, it is possible to exclude from the source of an attack connection destinations that do not exist economically or legally depending on the country or state in which the vehicle is driving when an abnormality occurs. As shown in Figures 20 and 21, there is usually a one-to-one correspondence between external connection destinations that are the source of a cyber attack and entry points, but an entry point may cover multiple external connection destinations.

[0229] The driving situation / attack relationship tables in Figures 20 and 21 correspond to the situation information explained using Figure 5. In addition, in the driving situation / attack relationship table, the vehicle's driving situation at the time of the abnormality occurrence corresponds to an "indicator," and the entry point and external connection destination correspond to a "situation." In other words, the driving situation / attack relationship table is used to estimate the entry point corresponding to the driving situation based on the input driving situation.

[0230] (3) Configuration of the entry point candidate generation unit 120 The entry point candidate generation unit 120 will be described with reference to Fig. 22. The entry point candidate generation unit 120 includes an input unit 121, a driving condition / attack related information storage unit 122, an entry point candidate estimation unit 123, and an output unit .

[0231] The input unit 121 (corresponding to a "log acquisition unit" and an "index acquisition unit") acquires a security log indicating an abnormality detected by the electronic control system S, and the vehicle driving conditions (corresponding to an "index") "when the abnormality occurred." For example, the driving conditions at the time indicated by a timestamp that identifies when the abnormality occurred and that is included in the security log may be acquired. The driving conditions are acquired from various sensors and ECUs in the vehicle.

[0232] The driving condition / attack relationship information storage unit 122 is a storage unit that stores a driving condition / attack relationship table (corresponding to "driving condition / attack relationship information") that indicates the relationship between predicted entry points, which are the entry points of predicted attacks, and the predicted driving conditions corresponding to the predicted entry points.

[0233] The entry point candidate estimation unit 123 (corresponding to a "situation estimation unit") estimates external connection destinations and entry point candidates (corresponding to "situations") that may have potential connection in the driving conditions acquired by the input unit 121 based on the driving condition / attack relationship table stored in the driving condition / attack relationship information storage unit 122.

[0234] For example, when using the driving condition / attack relationship table of Figure 20, when the driving condition at the time when an abnormality occurs in the security log is C2, the entry point candidate estimation unit 123 identifies AP-1, AP3, and AP-5 as possible connection destinations to which the electronic control system S can be connected in that driving condition, and identifies EP-1, EP-3, and EP-5 as possible entry point candidates.

[0235] The output unit 124 outputs the security log acquired by the input unit 121 and the entry point candidates estimated by the entry point candidate estimation unit 123 to the attack estimation unit 220 described later.

[0236] Note that the security log may be directly input to the attack estimation unit 220 described below, without being acquired from the input unit 121. In this case, the output unit 124 outputs the entry point candidates to the attack estimation unit 220.

[0237] (4) Configuration of the attack estimation unit 220 23, the attack estimation unit 220 will be described. The attack estimation unit 220 includes an input unit 221, an attack / anomaly relationship information storage unit 222, an estimation unit 223, a matching degree calculation unit 224, and an output unit 225.

[0238] The input unit 221 acquires the security log and the entry point candidates from the entry point candidate generation unit 120 .

[0239] The attack / anomaly relationship information storage unit 222 is a storage unit that stores an attack / anomaly relationship table (corresponding to "attack / anomaly relationship information"). The attack / anomaly relationship table is a table that shows the relationship between predicted attack information indicating attacks that the electronic control system S may be subjected to, predicted anomaly information indicating anomalies predicted to occur in the electronic control system in the event of a cyber attack, and predicted anomaly position information indicating the position in the electronic control system S where the predicted anomaly will occur.

[0240] FIG. 24 is a diagram showing an example of the attack-abnormality relationship table. The attack-abnormality relationship table shown in FIG. 24 shows, for each type of attack (attack A to attack L), the abnormality that will occur when the electronic control system S is attacked (corresponding to "predicted abnormality information") and the location where the abnormality will occur (corresponding to "predicted abnormality location information") among ECU-1 to ECU-5. As shown in FIG. 24, when an attack occurs, it is assumed that multiple abnormalities will occur at multiple locations. Therefore, it is preferable that the attack-abnormality relationship table shows a combination of multiple abnormalities that will occur when an attack occurs and their locations.

[0241] FIG. 24 further shows the correspondence between the type of attack and the entry point assumed when the attack is carried out. In this embodiment, the "predicted attack information" is composed of an attack type and an entry point, but may also include other information. For example, it may include an attack path consisting of an attack starting point location and an attack target location. However, if the attack path is included, the attack starting point location may be substituted without providing a separate entry point column. In other words, if the attack starting point location is an interface or ECU that constitutes an entry point, these become the entry point.

[0242] For example, in the case of an attack of attack type A, it is predicted that in the electronic control system S, abnormalities A, C, D, and E will occur in ECU-1, and abnormalities A and B will occur in ECU-3. It is also predicted that the entry point from which attack A originates is EP-1.

[0243] The estimation unit 223 estimates an attack that the electronic control system S has received, based on the security log and the attack-anomaly relationship table input from the input unit 221. At this time, the estimation unit 223 estimates the attack using a portion of the attack-anomaly relationship table that includes the entry point candidates input from the input unit 221. Specifically, the estimation unit 223 uses the attack-anomaly relationship table narrowed down by the entry point candidates to identify an attack that has a combination of predicted anomaly information and predicted anomaly location information that corresponds to a combination of anomaly information and anomaly location information included in one or more security logs. "Corresponding to a combination" means that the combination is the same or similar.

[0244] In this way, by using an attack-anomaly relationship table narrowed down by entry point candidates, the number of columns of predicted attack information to be compared with security logs can be reduced, improving the efficiency of attack estimation. For example, in the example shown in Fig. 20, when the driving situation when the abnormality occurred is C2, the entry point is either EP-1, EP-3, or EP-5. Therefore, only attacks A, B, F, G, K, and L whose entry points are EP-1, EP-3, or EP-5 are targeted for analysis. In this way, by estimating entry point candidates based on the driving situation when the abnormality occurred, it is possible to limit the analysis targets of the attack-anomaly relationship table in Fig. 24 to attacks that correspond to the entry point candidates.

[0245] Note that an attack-anomaly relationship table may be created for each entry point candidate. In this case, as shown in Fig. 25, the attack-anomaly relationship tables for entry points EP-1, EP-3, and EP-5 are selected, and attacks with combinations of predicted anomaly information are identified from these tables.

[0246] The entry point candidates estimated based on the driving conditions may be used to verify the estimated attack instead of narrowing down the targets to be matched in the attack-anomaly relationship table. The verification is performed by the estimation result verification unit 320.

[0247] If the combination of predicted anomaly information and predicted anomaly location information that is exactly the same as the combination of anomaly information and anomaly location information does not exist in the attack-anomaly relationship table, the estimation unit 223 identifies the closest combination from among the combinations of predicted anomaly information and predicted anomaly location included in the attack-anomaly relationship table, and estimates that the attack type indicating the closest combination is an attack on the electronic control system.

[0248] When there are a plurality of closest combinations (for example, attack A and attack B), the estimation unit 203 may estimate that the type of attack received by the electronic control system is either attack A or attack B.

[0249] The estimation unit 223 may further estimate anomalies that will occur in the future in the electronic control system S or attacks that will be received in the future from the difference between the combination of the anomaly information and the anomaly position information and the combination of the predicted anomaly information and the predicted anomaly position information. For example, if the number of anomalies indicated by the anomaly information is smaller than the number of anomalies indicated by the predicted anomaly information, there is a risk that an anomaly not included in the anomalies indicated by the predicted anomaly information will occur in the future. Therefore, the estimation unit 223 estimates that the difference between the anomaly indicated by the predicted anomaly information and the anomaly indicated by the anomaly information is an anomaly that will occur in the electronic control system in the future. In such a case, the output unit 225 described later may output future anomaly information indicating the difference between the anomaly indicated by the predicted anomaly information and the anomaly indicated by the anomaly information.

[0250] Furthermore, if the number of abnormalities indicated by the anomaly information is smaller than the number of abnormalities indicated by the predicted anomaly information, the abnormality indicated by the anomaly information is an abnormality that occurs before an attack, and there is a possibility that further abnormalities will occur as a result of future attacks. Therefore, the estimation unit 223 estimates attacks that the electronic control system S may be subjected to in the future, assuming abnormalities that may occur in the future. In such a case, the output unit 225, which will be described later, may output future attack information indicating that the attack type included in the attack information is an attack that the electronic control system will be subjected to in the future.

[0251] When a combination of anomaly information and anomaly position information is not exactly the same as a combination of predicted anomaly information and predicted anomaly position information, the matching degree calculation unit 224 calculates the matching degree of these combinations. The matching degree is represented by, for example, a numerical value obtained by dividing the difference between the number of anomalies indicated by the anomaly information and the number of anomalies indicated by the predicted anomaly information by the number of anomalies indicated by the anomaly information or the predicted anomaly information.

[0252] The output unit 225 outputs “attack information” indicating the attack estimated by the estimation unit 223 to the estimation result verification unit 320 described later. The attack information may further include the matching degree calculated by the matching degree calculation unit 224.

[0253] Furthermore, as described above, if the estimation unit 223 estimates an abnormality that may occur in the electronic control system in the future or an attack that the electronic control system S may be subjected to in the future, the output unit 225 may output attack information including future attack information or future abnormality information.

[0254] (5) Configuration of the estimation result verification unit 320 The estimation result verification unit 320 will be described with reference to Fig. 26. The estimation result verification unit 320 includes an attack information acquisition unit 321 and a verification unit 322.

[0255] The attack information acquisition unit 321 acquires the attack information output from the output unit 225 .

[0256] The verification unit 322 verifies the contents included in the attack information. For example, the verification unit 322 verifies the accuracy of the estimation result by the attack estimation unit 220 from the matching degree included in the attack information. For example, if the matching degree is lower than a predetermined matching degree, the verification unit 322 determines that the estimation result by the attack estimation unit 220 is incorrect. Alternatively, the verification unit 322 may instruct the attack estimation unit 220 to perform analysis again together with estimation results of past or future security logs.

[0257] The verification unit 322 may further verify the accuracy of the attack-anomaly relationship table from the matching degree. For example, if estimation results with low matching degrees occur consecutively, it is determined that the association between the predicted anomaly information and the predicted anomaly position information included in the attack-anomaly relationship table is not accurate, and the table needs to be reset or updated.

[0258] (6) Operation of Attack Analysis Device 11 Next, the operation of the attack analysis device 12 will be described with reference to Fig. 27. Note that the operation of the attack analysis device 12 can also be thought of as the operation of the attack analysis system 1.

[0259] The input unit 121 of the entry point candidate generating unit 120 acquires a security log indicating an abnormality detected in the electronic control system S, and the vehicle running conditions when the abnormality occurred (S121). The entry point candidate estimation unit 123 estimates entry point candidates that are candidates for the entry point of an attack in the driving situation acquired in S121 based on the driving situation / attack relationship table stored in the driving situation / attack relationship information storage unit 122 (S122). The output unit 124 outputs the security log and the entry point candidates estimated in S122 (S123).

[0260] The input unit 221 of the attack estimation unit 220 acquires the security log and the entry point candidates output in S123 (S124). The estimation unit 223 estimates the attack that the electronic control system has received based on the attack-anomaly relationship information including the entry point candidate in the predicted attack information and the security log (S125). At this time, if there is a difference between the combination of the predicted anomaly information and the predicted anomaly position information stored in the attack-anomaly relationship table and the combination of the anomaly information and the anomaly position information included in the security log, the matching degree calculation unit 224 calculates the matching degree between the predicted anomaly information and the predicted anomaly position information and the anomaly information and the anomaly position information (S126). Then, the output unit 225 outputs attack information indicating the estimated attack, including the matching degree (S127).

[0261] The attack information acquisition unit 321 of the estimation result verification unit 320 acquires the attack information output in S127 (S128). Upon acquiring the attack information, the verification unit 322 verifies the attack estimation result included in the attack information (S129).

[0262] (7) Summary As described above, according to the attack analysis device 12 of the present disclosure, when an electronic control system is attacked, entry point candidates are estimated using the vehicle's running conditions when an abnormality occurs, and the attack is estimated by narrowing down the entry point candidates. This makes it possible to efficiently analyze attacks and reduce the processing load. Furthermore, according to the attack analysis device 12 of the present disclosure, attacks are inferred using an attack-anomaly relationship table in which the contents of predicted anomalies are associated with entry points. However, when estimation is performed using an attack-anomaly relationship table that has been narrowed down in advance to entry point candidates, predicted attack information that is not actually relevant can be excluded from the estimation target in advance, which results in improved accuracy in attack estimation. Furthermore, attacks are inferred using an attack-anomaly relationship table in which the predicted anomaly content and entry point are associated, so it is also possible to output entry point information in addition to attack information as an inferred result.

[0263] (8) Variations In the modified example of the second embodiment, at least a part of the entry point candidate generation unit 120 and the estimation result verification unit 320 is provided in a device different from the device in which the attack estimation unit 220 is provided. In this section, differences from the second embodiment will be mainly described. Note that the configurations and operations of the entry point candidate generation unit 120, the attack estimation unit 220, and the estimation result verification unit 320 are the same as those of the second embodiment, and therefore descriptions thereof will be omitted.

[0264] Fig. 28 is a diagram showing an example of an attack analysis system including the attack analysis device 12 of Modification 1. In the example of Fig. 28, the attack analysis device 12 includes only the attack estimation unit 220, and the entry point candidate generation unit 120 and the estimation result verification unit 320 are provided in the verification device 21. The attack analysis device 12 and the verification device 21 are collectively referred to as the attack analysis system 2.

[0265] Fig. 29 is a diagram illustrating the attack analysis device 12 of Modification 1. As shown in Fig. 29, in Modification 1, a server device installed outside the vehicle is the attack analysis device 12, and a verification device 21 is mounted on the vehicle.

[0266] In this case, the input unit 221 of the attack analysis device 12 obtains from the verification device 21 mounted on the vehicle a security log indicating an abnormality detected in the electronic control system S, and candidate entry points which are candidates for the entry point of the attack in the driving conditions of the vehicle when the abnormality occurred.

[0267] In the first modification, the entry point candidates and security logs output from the entry point candidate generation unit 120 are transmitted to the attack estimation unit 220 via a wireless communication network. Similarly, the attack information output from the attack estimation unit 220 is transmitted to the estimation result verification unit 320 via a wireless communication network. Therefore, although not shown in FIG. 29, the attack analysis device 12 and the verification device 21 may be equipped with a wireless communication unit and an antenna, or the output unit 124 of the entry point candidate generation unit 120 and the attack information acquisition unit 321 of the estimation result verification unit 320 may have a function as a wireless communication unit.

[0268] Among the processes executed in the attack analysis system, the process of estimating a cyber-attack received by the electronic control system S, i.e., the process in the attack estimation unit 220, places the heaviest load on the vehicle. Therefore, by providing the server device with the attack analysis device 12 having the attack estimation unit 220, it is possible to significantly reduce the load on the vehicle.

[0269] FIG. 30 shows a second modification of the second embodiment. In the second modification, the attack analysis device 12 includes an entry point candidate generation unit 120 in addition to the attack estimation unit 220. In this case, the attack analysis device 12 may be a server device, as in the configuration shown in FIG. 29, but the attack analysis device 12 may be a device mounted on a vehicle, and the verification device 21 may be realized as a server device. In this case, the attack estimation unit 220 verifies the attack estimation result in the server device. In the server device, in order to verify the estimation results of attacks in a plurality of electronic control systems, it becomes possible to determine, for example, whether or not the attack-anomaly relationship table needs to be reset or updated by comparing it with the estimation results in other electronic control systems.

[0270] Moreover, Fig. 31 shows a third modification of the second embodiment. In the third modification, the attack analysis device 12 includes an inference result verification unit 320 in addition to the attack estimation unit 220. The entry point candidate generation unit 120 is provided in the entry point candidate generation device 21. In the third modification, it is preferable that the attack analysis device 12 having the same arrangement as in Fig. 29, that is, the attack estimation unit 220 and the inference result verification unit 320 with a large processing load, is a server device.

[0271] The above-mentioned modified examples are also applicable to other embodiments and modified examples. That is, in Fig. 4, for example, the index acquisition unit 102, the situation information storage unit 103, and the situation estimation unit 104 may be provided in the vehicle, and the log acquisition unit 101, the attack / anomaly relationship information storage unit 105, and the attack estimation unit 106 may be provided in the server device.

[0272] (9) Invention understood from this embodiment The inventions that can be understood from at least the disclosure of this embodiment are listed below.

[0273] (Invention 1) An attack analysis device that analyzes attacks against an electronic control device system installed in a mobile object, an acquisition unit (121) that acquires a security log indicating an abnormality detected in the electronic control system and a traveling state of the moving object when the abnormality occurred; a driving situation / attack relationship information storage unit (122) for storing driving situation / attack relationship information indicating a relationship between a predicted entry point, which is a predicted entry point of an attack, and a predicted driving situation corresponding to the predicted entry point; an entry point candidate estimation unit (123) that estimates an entry point candidate that is a candidate of an entry point of an attack in the driving situation based on the driving situation-attack relationship information; an attack / anomaly relationship information storage unit (222) for storing attack / anomaly relationship information indicating a relationship between predicted attack information indicating an attack that the electronic control system may receive, predicted anomaly information indicating an anomaly that is predicted to occur when the electronic control system receives the attack, and predicted anomaly position information indicating a position in the electronic control system where the predicted anomaly will occur; an estimation unit (223) for estimating an attack that the electronic control system has received based on the attack / anomaly relationship information including the entry point candidate in the predicted attack information and the security log; and an output unit (225) that outputs attack information indicating the estimated attack. Attack Analysis Device (12).

[0274] (Invention 2) The traveling condition is the speed of the moving object. An attack analysis device according to invention 1.

[0275] (Invention 3) The traveling conditions include one or more of a group consisting of a position of the moving object, an air temperature around the moving object, and a time or a time of day; An attack analysis device according to invention 1.

[0276] (Invention 4) The driving situation / attack related information further includes destination information that is a destination of the predicted entry point. An attack analysis device according to invention 1.

[0277] (Invention 5) The attack analysis device is provided outside the moving body. An attack analysis device according to any one of Inventions 1 to 4.

[0278] (Invention 6) The attack analysis device is mounted on a moving object. An attack analysis device according to any one of Inventions 1 to 4.

[0279] (Invention 7) An attack analysis device that analyzes attacks against an electronic control device system installed in a mobile object, an acquisition unit (221) that acquires a security log indicating an abnormality detected in the electronic control system and an entry point candidate that is a candidate for an entry point of an attack in a traveling state of the moving object when the abnormality occurs; an attack / anomaly relationship information storage unit (222) for storing attack / anomaly relationship information indicating a correspondence relationship between predicted attack information indicating an attack that the electronic control system may receive, predicted anomaly information indicating an anomaly that is predicted to occur when the electronic control system receives the attack, and predicted anomaly position information indicating a position in the electronic control system where the predicted anomaly will occur; an estimation unit (223) for estimating an attack that the electronic control system has received based on the attack / anomaly relationship information including the entry point candidate in the predicted attack information and the security log; and an output unit (225) that outputs attack information indicating the estimated attack. Attack Analysis Device (12).

[0280] (Invention 8) An attack analysis method executed by an attack analysis device that analyzes attacks against an electronic control device system installed in a mobile object, comprising: The attack analysis device includes: a driving situation / attack relationship information storage unit (122) for storing driving situation / attack relationship information indicating a relationship between a predicted entry point, which is a predicted entry point of an attack, and a predicted driving situation corresponding to the predicted entry point; an attack / anomaly relationship information storage unit (222) for storing attack / anomaly relationship information indicating a relationship between predicted attack information indicating an attack that the electronic control system may receive, predicted anomaly information indicating an anomaly that is predicted to occur when the electronic control system receives the attack, and predicted anomaly position information indicating a position in the electronic control system where the predicted anomaly will occur; The attack analysis method includes: A security log indicating an abnormality detected in the electronic control system and a traveling condition of the moving object when the abnormality occurred are acquired (S121); Based on the driving situation-attack relationship information, an entry point candidate that is a candidate of an entry point of an attack in the driving situation is estimated (S122); An attack on the electronic control system is estimated based on the attack / anomaly related information including the entry point candidate in the predicted attack information and the security log (S125); outputting attack information indicating the estimated attack (S127); Attack analysis method.

[0281] (Invention 9) An attack analysis program executable by an attack analysis device that analyzes attacks against an electronic control device system installed in a mobile object, The attack analysis device includes: a driving situation / attack relationship information storage unit (122) for storing driving situation / attack relationship information indicating a relationship between a predicted entry point, which is a predicted entry point of an attack, and a predicted driving situation corresponding to the predicted entry point; an attack / anomaly relationship information storage unit (222) for storing attack / anomaly relationship information indicating a relationship between predicted attack information indicating an attack that the electronic control system may receive, predicted anomaly information indicating an anomaly that is predicted to occur when the electronic control system receives the attack, and predicted anomaly position information indicating a position in the electronic control system where the predicted anomaly will occur; The attack analysis program: A security log indicating an abnormality detected in the electronic control system and a traveling condition of the moving object when the abnormality occurred are acquired (S121); Based on the driving situation-attack relationship information, an entry point candidate that is a candidate of an entry point of an attack in the driving situation is estimated (S122); An attack on the electronic control system is estimated based on the attack / anomaly related information including the entry point candidate in the predicted attack information and the security log (S125); outputting attack information indicating the estimated attack (S127); Attack analysis program.

[0282] 4. Embodiment 3 The attack analysis device of this embodiment is referred to as an attack analysis device 13 .

[0283] (1) Configuration of the Attack Analysis Device 13 32 is a block diagram showing the configuration of the attack analysis device 13 in this embodiment. The attack analysis device 13 includes a log acquisition unit 131, an erroneous operation frequency information acquisition unit 132, a storage unit 133, a false positive log determination unit 134, an attack / anomaly relationship information storage unit 135, an attack estimation unit 136, and an output unit 138.

[0284] The log acquisition unit 131, the erroneous operation frequency information acquisition unit 132, the storage unit 133, and the false positive log determination unit 134 constitute the log determination device 23. The log determination device 23 may be included in the attack analysis device 13 as a part of the attack analysis device 13, or as shown in Figures 29 and 31 of the second embodiment, the log determination device 23 may be mounted on a vehicle, and an attack determination device having blocks other than the log determination device 23 may be realized in a server device outside the vehicle.

[0285] The log acquisition unit 131 (corresponding to the "log acquisition unit" and "index acquisition unit") acquires a security log (corresponding to the "security log" and "index") generated by a security sensor mounted in the ECU 20. The configuration of the electronic control system S is as described in FIG. 2, and the contents of the security log are as described in FIG. 3.

[0286] 1(c) for the electronic control system S, the log acquisition unit 131 acquires the security logs by receiving them via a communication network using a wireless communication method. The log acquisition unit 131 may acquire a plurality of aggregated security logs collectively, or may acquire the generated security logs sequentially. When the log acquisition unit 131 acquires the generated security logs sequentially, the attack analysis device 13 may further include a log storage unit (not shown) that temporarily stores the security logs acquired by the log acquisition unit 131.

[0287] The false positive log determination unit 134 (corresponding to a "situation estimation unit") estimates whether the cause of the abnormality indicated by the security log acquired by the log acquisition unit 131 is a cyber attack (corresponding to a "situation") based on the "frequency" at which the security log (corresponding to an "indicator") was generated. If the cause of the abnormality indicated by the security log is not a cyber attack, the security log is determined to be a false positive log. Here, a false positive log refers to a security log generated by detecting an abnormality other than an abnormality caused by the electronic control system S being attacked. More specifically, the false positive determination unit 134 estimates whether the cause of the abnormality indicated by the security log acquired by the log acquisition unit 131 is an incorrect operation by the vehicle user (corresponding to a "situation") based on the "frequency" at which the security log was generated. If the cause of the abnormality indicated by the security log is an incorrect operation by the vehicle user, the security log is determined to be a false positive log. As described above, there is a one-to-one correspondence between the estimation result of whether the cause of the abnormality indicated by the security log is a cyber-attack (specifically, the estimation result of whether it is a user's misoperation) and whether the security log is a false positive log. In the following explanation, the operation of the false positive log determination unit 134, which involves estimating whether it is a cyber-attack (specifically, estimating whether it is a user's misoperation), will be omitted, and the false positive log determination unit 134 will be described as determining whether it is a false positive log. Here, "frequency" is indicated by, for example, the number of times, the time, the period, etc. at which a security log is generated.

[0288] 3, a security log has a time when an event occurred. Therefore, the false positive log determination unit 134 can obtain the frequency at which a security log is generated based on the time stamp of the security log. Alternatively, the frequency at which a security log is generated may be obtained based on the time when the log acquisition unit 131 receives the security log.

[0289] The false positive log determination process in the false positive log determination unit 134 uses information stored in the storage unit 133. The storage unit 133 is a memory unit that stores information used in determining false positive logs. Fig. 33 is a diagram showing an example of information stored in the storage unit 133. A table showing the correspondence between event IDs and reference frequencies, which will be described later, is stored here.

[0290] The event IDs stored in the storage unit 133 are event IDs that indicate identification information of events related to abnormalities that may occur due to erroneous operation by the “user” of the electronic control system S, among the event IDs. Here, the term "user" includes not only the owner of the electronic control system, but also a person who uses the electronic control system temporarily.

[0291] The reference frequency stored in the storage unit 133 is a frequency that is a criterion for determining whether or not a security log is a false positive log. In the example shown in Fig. 33, a period and a number of times are stored as the reference frequency, but the present invention is not limited to these.

[0292] For example, when a user of a vehicle equipped with the electronic control system S mistakenly inputs a password required for connecting to Wi-Fi (registered trademark) or the like, or when a worker at a maintenance shop or dealer performs an incorrect authentication operation, the security sensor detects an abnormality caused by the incorrect operation and generates a security log. In another example, when a worker at a maintenance shop or dealer performs an incorrect operation such as mixing up programs or terminating the work before all software updates are completed when updating software installed in the ECU 20, the security sensor detects an abnormality caused by the incorrect operation and generates a security log. Events related to abnormalities that may occur due to such user's incorrect operation are limited. Therefore, an event ID indicating an event related to an abnormality that may occur due to a user's incorrect operation is stored in the storage unit 133. Then, when the event ID included in the security log acquired by the log acquisition unit 131 is the same as the event ID stored in the storage unit 133, the false positive log determination unit 134 performs a process of determining whether the security log is a false positive log or not. As a result, for security logs having event IDs related to abnormalities that are unlikely to occur due to user error, no determination process is performed to determine whether or not they are false positive logs, thereby reducing the amount of processing involved in the log determination process.

[0293] Specifically, if the frequency at which the security log was generated is lower than the reference frequency stored in the storage unit 133, the false positive log determination unit 134 infers that the cause of the abnormality indicated by the security log is an incorrect operation by the vehicle user, and determines that the security log is a false positive log. Here, "more than" includes both cases where the value is the same as the comparison target and cases where it is not.

[0294] 33, the storage unit 133 stores the time (10 s) and the number of times (3 times) as the reference frequency of the security log of the event ID (A). This indicates that the number of security logs generated in 10 s is 3. Therefore, the false positive log determination unit 134 determines whether the frequency at which the security log was generated is less than 3 times in 10 s.

[0295] The process of determining whether a security log is a false positive log will be described with reference to FIG. 34. In the example shown in FIG. 34(a), security logs are generated six times in 10 seconds, which is a higher frequency than the reference frequency. Therefore, it is presumed that the cause of the abnormality indicated by the security log is a cyber attack (i.e., it is presumed that it is not a user's erroneous operation), and it is determined that none of the security logs shown in FIG. 34(a) are false positive logs. In contrast, in the example shown in FIG. 34(b), security logs are generated two times in 10 seconds, which is lower than the reference frequency. Therefore, it is presumed that the cause of the abnormality indicated by the security log is not a cyber attack (i.e., it is presumed that it is a user's erroneous operation), and it is determined that none of the security logs shown in FIG. 34(b) are false positive logs.

[0296] In the example shown in Fig. 34, the frequency of security logs generated within 10 seconds from the time the first security log was generated is compared with the standard frequency. However, the frequency of security logs is not limited to the frequency from the time the first security log was generated. For example, the frequency of security logs generated within 10 seconds from the time the last security log was generated may be compared with the standard frequency. Alternatively, the frequency of security logs generated within 10 seconds from the time each security log was generated may be calculated, and each frequency may be compared with the standard frequency.

[0297] Since the number of times a user repeats an erroneous operation is limited, it is highly likely that security logs are not generated very frequently due to the user's erroneous operation. In contrast, if the electronic control system S is subjected to, for example, a brute force attack or a DoS attack, it is expected that security logs will be generated very frequently. Therefore, a reference frequency is set, and if the frequency at which a security log is generated is lower than the reference frequency, the false positive log determination unit 134 determines that the security log was generated due to a user's erroneous operation, that is, that it is a false positive log.

[0298] In this embodiment, the frequency of security log generation is described as the number of times that security logs are generated within a predetermined period, but is not limited thereto. For example, the cycle in which security logs are generated may be used as the frequency. For example, since the speed at which a user can perform an operation is limited, the cycle in which erroneous operations are repeated is likely not to be very short. In contrast, if the electronic control system S is subjected to a brute force attack or a DoS attack by mechanical processing, the cycle in which security logs are generated is likely to be extremely short. Therefore, the cycle in which security logs are generated may be used as the frequency to determine whether a security log is a false positive log.

[0299] FIG. 33 illustrates a table showing the correspondence between the event ID and the reference frequency, but the event ID and the reference frequency may be stored in association with the ECU-ID. For example, the ECU 20a and the ECU 20c may generate security logs having the same event ID (A). However, the security logs generated in different ECUs are generated by detecting different abnormalities. Therefore, even if the security logs have the same event ID (A), one security log may be generated by the security sensor detecting an abnormality caused by an attack, and the other security log may be generated by the security sensor detecting an abnormality caused by an erroneous operation. Therefore, in addition to the event ID and the reference frequency, the ECU-ID may be stored in association with the event ID and the reference frequency.

[0300] In addition, the security log acquired by the log acquisition unit 131 may contain a mixture of security logs having various event IDs, but the security logs having different event IDs are logs generated by detecting different abnormalities. Therefore, the false positive log determination unit 134 determines whether or not a security log is a false positive log by determining whether or not the frequency at which security logs having a common event ID were generated is lower than a reference frequency associated with the event ID stored in the storage unit 133. In addition, when the ECU-ID is stored in the storage unit 133, the false positive log determination unit 134 determines whether or not a security log is a false positive log by determining whether or not the frequency at which security logs having a common ECU-ID were generated is lower than a reference frequency associated with the event ID and ECU-ID stored in the storage unit 133.

[0301] The false positive log determination unit 134 outputs the determination result to the attack estimation unit 136. For example, a flag indicating that the security log is a false positive log is added as false positive information to a security log that the false positive log determination unit 134 has determined to be a false positive log, and the security log is output. The false positive information may be added by being stored in the context data of the security log shown in FIG. 3, for example. In this way, by adding a flag as false positive information to the security log, it becomes possible to easily distinguish between a security log generated by an attack and a security log generated by a user's operation mistake.

[0302] In the embodiment described below, a case is described in which the false positive log determination unit 134 assigns false positive information to a security log that has been determined to be a false positive log, but the false positive information may be assigned to a security log that has been determined not to be a false positive log by the false positive log determination unit 134. In this case, the false positive information indicates information indicating that the security log to which the information has been assigned is not a false positive log.

[0303] Alternatively, the false positive log determination unit 134 may output to the attack inference unit 136 identification information of the security log that has been determined to be a false positive log. According to the output of the false positive log determination unit 134, the attack inference unit 136 can identify security logs (false positive logs) that are not used for attack inference, and can omit less necessary attack inference.

[0304] When the security sensor detects an abnormality caused by a user's operation error and generates a security log, the operation error frequency information acquisition unit 132 acquires operation error frequency information indicating the "frequency" of the user's operation error. Based on this operation error frequency information, the reference frequency stored in the storage unit 133 is updated.

[0305] The frequency of operational errors tends to differ from user to user. For example, user a tends to make two or three operational errors within one minute, while another user b may make ten or more operational errors within one minute. As a result, it may happen that the security log of user a is determined to be a false positive log, while the security log of user b is not determined to be a false positive log. Therefore, it is desirable to set a standard frequency according to the user by acquiring information on the frequency of operational errors when the user makes an operational error and updating the standard frequency based on the frequency of the user's operational errors.

[0306] The attack / anomaly relationship information storage unit 135 stores an attack / anomaly relationship table indicating the relationship between cyber attacks and anomalies occurring in the electronic control system S. The attack / anomaly relationship table is as described in FIG. 6, so FIG. 6 and its description will be quoted.

[0307] The attack estimation unit 136 estimates the attack that has been received by the electronic control system S based on the security log acquired by the log acquisition unit 131, the attack / anomaly relationship table stored in the attack / anomaly relationship information storage unit 135, and the judgment result of the false positive log judgment unit 134.

[0308] A case where the attack estimation unit 136 uses the attack-anomaly relationship table of FIG. 35 will be described. When the false positive log determination unit 134 outputs a determination result that the security log indicating anomaly B occurring at the position 0x02 is not caused by a cyber attack, the attack estimation unit 136 multiplies a pattern in which the predicted anomaly location information is 0x02 and the predicted anomaly information is anomaly B by, for example, a weight of 0.5. Then, by using this corrected attack-anomaly relationship table for attack estimation, it is possible to evaluate the attack estimation score in the case where a false positive log has occurred lower than the attack estimation score in the case where a false positive log has not occurred. This makes it possible to improve the accuracy of the attack estimation of a cyber attack in the case where a false positive log has occurred. Note that if the weighting coefficient is set to 0, false positive logs will not be reflected in the score. Therefore, if it is certain that a security log is a false positive log, it is desirable to set the coefficient to 0.

[0309] The coefficient to be multiplied by the weighting factor may be determined based on a quantitative evaluation of the determination result of the false positive log determination unit 134. For example, a plurality of standard frequencies may be prepared, and the frequency at which security logs were generated within a predetermined period may be classified in relation to the plurality of standard frequencies, and a coefficient determined according to the classification result may be used.

[0310] The attack inference unit 136 may not use the attack-anomaly relationship table and may not perform attack inference. For example, when the false positive log determination unit 134 outputs a determination result that the security log indicating anomaly B that occurred at 0x02 is a false positive log that is not caused by a cyber attack, the attack inference unit 136 may not perform attack inference using the false positive log.

[0311] (3) Operation of the Attack Analysis Device 13 The operation of the attack estimation device 13 will be described with reference to FIGS.

[0312] The log acquisition unit 131 acquires a security log generated when a security sensor mounted in each of the multiple ECUs 20 constituting the electronic control system S detects an abnormality (S131). The false positive log determination unit 134 determines whether the security log acquired in S131 is a false positive log (S132). Specifically, it determines whether the security log is a false positive log based on the frequency at which the security log was generated. A specific flow of S132 will be described later with reference to FIG.

[0313] When it is determined in S132 that the log is a false positive log (S133: Y), the false positive log determining unit 134 assigns false positive information to the security log determined to be a false positive log (S134).

[0314] The operation error frequency information acquisition unit 132 acquires operation error frequency information indicating the frequency with which the user has performed an operation error (S135). Based on the erroneous operation frequency information acquired in S135, the storage unit 133 updates the reference frequency (S136).

[0315] The false positive determination unit 134 transmits the security log that has been determined to be a false positive log and to which false positive information has been added (S137).

[0316] The attack estimation unit 136 modifies the attack-anomaly relationship table based on the false positive information (S139). Then, the attack estimation unit 136 performs attack estimation using the modified attack-anomaly relationship table, and the output unit 138 outputs attack information indicating the estimated attack (S139).

[0317] Next, the process of determining whether or not the security log is a false positive log in S132 will be described with reference to FIG. The false positive log determination unit 134 determines whether or not the event ID in the security log is the same as the event ID stored in the storage unit 133 (S231). Here, if the event ID in the security log is different from the event ID stored in storage unit 133 (S231: N), it is determined that the security log is not a false positive log (S232).

[0318] On the other hand, if the event ID in the security log is the same as the event ID stored in storage unit 133 (S231: Y), false positive log determination unit 134 further determines whether the frequency of the security log is lower than the reference frequency (S233). If the frequency of the security log is lower than the reference frequency (S233: Y), the false positive log determination unit 134 determines that the security log is a false positive log (S234). On the other hand, if the frequency of the security log is higher than the reference frequency (S233: N), the false positive log determination unit 134 determines that the security log is not a false positive log (S232). Then, the false positive log determination unit 134 outputs the determination result (S235).

[0319] (4) Summary As described above, according to this embodiment, it is possible to determine that a security log generated due to a user's erroneous operation is a false positive log. As a result, the attack analysis device 13 that analyzes attacks using security logs can eliminate false positive logs or lower the evaluation of false positive logs, and can analyze attacks using security logs other than false positive logs, thereby improving the accuracy of attack analysis.

[0320] (5) Variations In this modification, a method for determining whether or not a security log is a false positive log will be described using a method different from that in embodiment 3. Since the configuration of the attack analysis device in this embodiment is the same as that in embodiment 3, this modification will be described with reference to the configuration diagram in FIG.

[0321] The log receiving unit 131 of this modified example acquires a security log indicating that a predetermined event has been successful in the electronic control system S, in addition to a security log generated when a security sensor detects an abnormality. Hereinafter, in order to distinguish between a security log generated when an abnormality is detected and a security log indicating that a predetermined event has been successful, these will be referred to as an abnormality security log and a success security log, respectively.

[0322] As in the third embodiment, the false positive log determination unit 134 performs a false positive log determination using the information stored in the storage unit 133. Fig. 38 shows an example of a table stored in the storage unit 133 of this embodiment. The storage unit 133 shown in Fig. 38 stores a table indicating the correspondence between the event ID, the reference frequency, and the event ID of the successful security log (hereinafter, the successful event ID).

[0323] The successful event ID is an event ID indicating identification information of an event that may be successful when the user of the electronic control system S performs a correct operation after an erroneous operation by the user. For example, it is possible that a correct password input or authentication operation is performed after an erroneous operation such as a user of a vehicle equipped with the electronic control system S inputting an incorrect password required for connecting to Wi-Fi (registered trademark) or an operator at a maintenance shop or dealer performing an incorrect authentication operation. In this way, when a correct password input or authentication operation is performed, a security log indicating that the event is successful is generated. Therefore, the successful event ID indicating an event that may occur after the user's erroneous operation is stored in the storage unit 133. Then, when the event ID included in the successful security log acquired by the log acquisition unit 131 is the same as the successful event ID stored in the storage unit 133, the false positive log determination unit 134 determines whether the abnormal security log is a false positive log based on the frequency with which an abnormal security log was generated before the successful security log.

[0324] In the example of FIG. 38, a success event ID is associated with the event IDs (A) and (C), but a success event ID is not associated with the event ID (B). Depending on the type of event, a security log for a success event may not be acquired, so a success event ID is not associated with all event IDs. Therefore, when a success event ID is not associated, such as with event ID (B), a method similar to that of embodiment 3 is used to determine whether the security log is a false positive log.

[0325] Using FIG. 39, the process of determining whether or not a security log in this modified example is a false positive log will be described. In the example shown in FIG. 39(a), five abnormal security logs having an event ID (A) were generated in the 10 seconds before the time when a successful security log having an event ID (D) was generated, and the frequency is higher than the reference frequency. Therefore, it is determined that none of the abnormal security logs shown in FIG. 39(a) are false positive logs. In contrast, in the example shown in FIG. 39(b), two abnormal security logs were generated in the 10 seconds before the time when a successful security log was generated, and the frequency is lower than the reference frequency. Therefore, it is determined that all of the abnormal security logs shown in FIG. 39(b) are false positive logs.

[0326] In the example shown in Fig. 39(a), in addition to the abnormal security log, the successful security log may also be determined to be a false positive log. Also, in the example shown in Fig. 39(b), in addition to the abnormal security log, the successful security log may also be determined to be a false positive log. In other words, false positive determination may be performed on security logs that include both abnormal security logs and successful security logs.

[0327] The false positive log determination unit 134 of this modification may further not determine that an abnormal security log generated immediately before a successful security log is a false positive log even if the frequency of the abnormal security log is lower than the reference frequency. It takes a certain amount of time for a user to perform an operation. Therefore, if a successful security log is generated immediately after an abnormal security log is generated, that is, if the time from the occurrence of an abnormality to the occurrence of a successful event is shorter than the time required for a user to perform an operation, it is highly likely that the abnormality has not occurred due to a user's incorrect operation, but due to an attack by mechanical processing. Therefore, the false positive log determination unit 134 may not determine that an abnormal security log generated during a predetermined period before the time when the successful security log was generated is a false positive log.

[0328] For example, in the example shown in Figure 40, abnormal security logs were generated twice in the 10 seconds prior to the time the successful security log was generated, and the frequency is lower than the reference frequency. However, in the example of Figure 40, an abnormal security log was generated in a specified period (1 second in Figure 40) prior to the time the successful security log was generated. Therefore, of the abnormal security logs, the log L1 is determined to be a false positive log, but the log L2 is not determined to be a false positive log.

[0329] The attack analysis device 13 of this modification executes each process shown in Fig. 36, similar to the attack analysis device 13 of the third embodiment. However, in the attack analysis device 13 of this modification, the process of determining whether or not a log is a false positive log in S132 is different from that of the third embodiment. Therefore, the process of determining whether or not a log is a false positive log in this modification will be explained using Fig. 41. Note that the same reference numerals as Fig. 37 are used for the processes in Fig. 41 that are common to Fig. 37.

[0330] The false positive log determination unit 134 determines whether or not the event ID in the security log is the same as the event ID stored in the storage unit 133 (S231). Here, if the event ID in the security log is different from the event ID stored in storage unit 133 (S231: N), it is determined that the security log is not a false positive log (S232).

[0331] On the other hand, if the event ID in the security log is the same as the event ID stored in the storage unit 133 (S231: Y), the false positive log determination unit 134 further determines whether or not a successful event ID associated with the event ID is stored in the storage unit 133 (S331). If a successful event ID associated with the event ID is stored in storage unit 133 (S331: Y), it is further determined whether log acquisition unit 131 has acquired a successful security log having the successful event ID (S332). Here, if log acquisition unit 131 has acquired a success security log, it is determined whether or not the frequency of abnormal security logs generated before the success security log is lower than a reference frequency (S233). Then, if the frequency of the security log is lower than the reference frequency (S233: Y), the false positive log determining unit 134 determines that the security log is a false positive log (S234). Furthermore, if the frequency of the security log is higher than the reference frequency (S233: N), the false positive log determining unit 134 determines that the security log does not contain a false positive log (S234).

[0332] On the other hand, in S331, if a successful event ID associated with the event ID is not stored in the storage unit 133 (S331:N), as in embodiment 3, it is determined whether the frequency of abnormal security logs is lower than the standard frequency (S233). Then, the false positive log determination unit 134 outputs the determination result (S235).

[0333] As described above, according to this modified example, by using a security log indicating that an event was successful, it is possible to determine with higher accuracy that a security log generated due to a user's incorrect operation is a false positive log.

[0334] 5. Inventions understood from the present disclosure Based on the above embodiments (including examples and modifications), the present disclosure discloses the following inventions.

[0335] (Invention 1) An attack analysis device for analyzing attacks against an electronic control system (S) mounted on a moving object, a log acquisition unit (101) that acquires a security log indicating an abnormality detected in the electronic control system and a location within the electronic control system where the abnormality was detected; an indicator acquisition unit (102) that acquires an indicator indicating an internal state and / or an external state of the moving object when the abnormality occurs; an attack / anomaly relationship information storage unit (105) for storing attack / anomaly relationship information indicating a relationship between predicted attack information indicating an attack that the electronic control system may receive, predicted anomaly information indicating an anomaly that is predicted to occur when the electronic control system receives the attack, and predicted anomaly position information indicating a position in the electronic control system where the predicted anomaly will occur; an attack estimation unit (106) for estimating an attack that has been made to the electronic control system based on the security log, the attack / anomaly related information, and the indicator; and an output unit (108) that outputs attack information indicating the estimated attack. Attack analysis device (10).

[0336] (Invention 2) The apparatus further includes a situation estimation unit (104) for estimating a situation of the moving object corresponding to the indicator based on the indicator, The attack estimation unit estimates an attack that the electronic control system has received based on the security log, the attack / anomaly relationship information, and the situation. An attack analysis device according to invention 1.

[0337] (Invention 3) the attack estimation unit does not use a portion of the attack-anomaly relationship information that includes a position in the electronic control system that is estimated not to be related to the attack in the situation as the predicted anomaly position information or the predicted attack information for attack estimation; An attack analysis device according to Invention 1 or Invention 2.

[0338] (Invention 4) the attack estimation unit does not use a portion of the attack-anomaly relationship information that includes an anomaly in the electronic control system that is estimated not to be related to the attack in the situation as the predicted anomaly information for estimating the attack; An attack analysis device according to any one of Inventions 1 to 3.

[0339] (Invention 5) The attack estimation unit uses a portion of the attack-anomaly relationship information including a position in the electronic control system that is estimated to be related to the attack in the situation as the predicted anomaly position information or the predicted attack information for attack estimation. An attack analysis device according to claim 1 or 2.

[0340] (Invention 6) the attack estimation unit uses a portion of the attack-anomaly relationship information, the portion including an anomaly in the electronic control system that is estimated to be related to the attack in the situation, as the predicted anomaly information, for estimating the attack; An attack analysis device according to any one of Inventions 1 to 2 or 5.

[0341] (Invention 7) the attack estimation unit uses the attack / anomaly relationship information obtained by weighting a portion of the attack / anomaly relationship information that includes a position in the electronic control system that is estimated not to be related to the attack in the situation as the predicted anomaly information or the predicted anomaly position information, for attack estimation; An attack analysis device according to any one of Inventions 1 to 6.

[0342] (Invention 8) the attack estimation unit uses the attack / anomaly relationship information obtained by weighting a portion of the attack / anomaly relationship information that includes an anomaly in the electronic control system that is estimated not to be related to the attack in the situation as the predicted anomaly information, for attack estimation; An attack analysis device according to any one of Inventions 1 to 7.

[0343] (Invention 9) As the weighting (w), a coefficient of 0≦w<1 is multiplied. An attack analysis device according to claim 8.

[0344] (Invention 10) the situation estimation unit estimates whether the cause of the anomaly indicated by the security log is a cyber-attack, and if the cause of the anomaly is not a cyber-attack, determines that the security log is a false positive log; the attack estimation unit does not perform attack estimation using the security log that is the false positive log; An attack analysis device according to any one of Inventions 1 to 9.

[0345] (Invention 11) The indicators also include the security log acquired by the log acquisition unit. An attack analysis device according to any one of Inventions 1 to 10.

[0346] (Invention 12) the situation estimation unit estimates a vehicle situation, which is a state of operation and / or traveling of the moving object, based on the indicator, and estimates a power supply state of one or more electronic control devices constituting the electronic control system from the vehicle situation; The attack estimation unit does not use a portion of the attack-anomaly relationship information including a position in the electronic control system that is estimated not to be related to the attack as the predicted anomaly position information or the predicted attack information based on the power supply state for attack estimation. An attack analysis device according to any one of Inventions 1 to 4.

[0347] (Invention 13) The indicator is at least one of the speed, mode, number of occupants, battery voltage, charge state, and shift position of the vehicle. An attack analysis device according to claim 12.

[0348] (Invention 14) The situation estimation unit estimates an entry point candidate that is a candidate for an entry point of an attack based on the indicator; the attack estimation unit uses a portion of the attack-anomaly relationship information that includes the entry point candidate as the predicted attack information for attack estimation. An attack analysis device according to any one of Inventions 1 to 2 or 5 to 6.

[0349] (Invention 15) The indicator is a speed of the moving object. An attack analysis device according to invention 14.

[0350] (Invention 16) The indicator is at least one of the location of the moving object, the temperature around the moving object, and the time or a time of day. An attack analysis device according to invention 14 or 15.

[0351] (Invention 17) the situation estimation unit estimates whether the cause of the abnormality indicated by the security log is a cyber-attack based on a frequency at which the security log was generated as the indicator, and if the cause of the abnormality is not a cyber-attack, determines that the security log is a false positive log; the attack estimation unit uses the attack-anomaly relationship information obtained by weighting (w) the predicted anomaly information corresponding to the anomaly indicated by the security log at the position in the electronic control system indicated by the security log, which is the false positive log, among the attack-anomaly relationship information, for attack estimation; An attack analysis device according to any one of Inventions 1 to 2 or 7 to 9.

[0352] (Invention 18) the situation estimation unit estimates whether or not the cause of the anomaly indicated by the security log is a cyber-attack based on a frequency at which the security log was generated as the indicator, and if the cause is not a cyber-attack, determines that the security log is the false positive log; the attack estimation unit does not perform attack estimation using the security log that is the false positive log; An attack analysis device according to any one of Inventions 1 to 2 or 10.

[0353] (Invention 19) the situation estimation unit estimates whether or not the cause of the abnormality indicated by the security log is an erroneous operation by a user of the moving object based on a frequency at which the security log was generated as the indicator, and if the cause is an erroneous operation by the user, determines that the security log is the false positive log; An attack analysis device according to invention 17 or 18.

[0354] (Invention 20) When the frequency is lower than a reference frequency, the situation estimation unit estimates that the cause of the abnormality indicated by the security log is an erroneous operation by a user of the mobile object. 19. An attack analysis device according to claim 19.

[0355] (Invention 21) An attack analysis device for analyzing attacks against an electronic control system (S) mounted on a moving object, a log acquisition unit (101) that acquires a security log indicating an abnormality detected in the electronic control system and a location within the electronic control system where the abnormality was detected; a situation acquisition unit (106) that acquires a situation of the moving object estimated from an index indicating an internal state and / or an external state of the moving object when the abnormality occurs; an attack / anomaly relationship information storage unit (105) for storing attack / anomaly relationship information indicating a relationship between predicted attack information indicating an attack that the electronic control system may receive, predicted anomaly information indicating an anomaly that is predicted to occur when the electronic control system receives the attack, and predicted anomaly position information indicating a position in the electronic control system where the predicted anomaly will occur; an attack estimation unit (106) for estimating an attack that has been received by the electronic control system based on the security log, the attack / anomaly related information, and the situation; and an output unit (108) that outputs attack information indicating the estimated attack. Attack analysis device (10).

[0356] (Invention 22) The attack analysis device is provided outside the moving body. An attack analysis device according to any one of Inventions 1 to 21.

[0357] (Invention 23) The attack analysis device is mounted on a moving object. An attack analysis device according to any one of Inventions 1 to 21.

[0358] (Invention 24) An attack analysis method executed by an attack analysis device for analyzing attacks against an electronic control system (S) mounted on a moving object, comprising: The attack analysis device includes: an attack / abnormality relationship information storage unit (105) for storing attack / abnormality relationship information indicating a relationship between predicted attack information indicating an attack that the electronic control system may receive, predicted abnormality information indicating an abnormality that is predicted to occur when the electronic control system receives the attack, and predicted abnormality position information indicating a position in the electronic control system where the predicted abnormality will occur; The attack analysis method includes: Obtaining a security log indicating an abnormality detected in the electronic control system and a location within the electronic control system where the abnormality was detected (S101); An index indicating an internal state and / or an external state of the moving object when the abnormality occurs is acquired (S102); Inferring an attack on the electronic control system based on the security log, the attack / anomaly related information, and the indicator (S104); outputting attack information indicating the estimated attack (S105); Attack analysis method.

[0359] (Invention 25) An attack analysis program executable by an attack analysis device for analyzing attacks against an electronic control system (S) mounted on a moving object, The attack analysis device includes: an attack / abnormality relationship information storage unit (105) for storing attack / abnormality relationship information indicating a relationship between predicted attack information indicating an attack that the electronic control system may receive, predicted abnormality information indicating an abnormality that is predicted to occur when the electronic control system receives the attack, and predicted abnormality position information indicating a position in the electronic control system where the predicted abnormality will occur; The attack analysis program Obtaining a security log indicating an abnormality detected in the electronic control system and a location within the electronic control system where the abnormality was detected (S101); An index indicating an internal state and / or an external state of the moving object when the abnormality occurs is acquired (S102); Inferring an attack on the electronic control system based on the security log, the attack / anomaly related information, and the indicator (S104); outputting attack information indicating the estimated attack (S105); Attack analysis program.

[0360] 6. Summary The features of the attack analysis device and the like in each embodiment of the present invention have been described above.

[0361] The terms used in each embodiment are merely examples and may be replaced with synonymous terms or terms having the same functions.

[0362] The block diagrams used to explain the embodiments classify and organize the configuration of the device by function. The blocks showing the respective functions are realized by any combination of hardware or software. In addition, since the block diagrams show the functions, they can also be understood as disclosures of a method invention and a program invention that realizes the method.

[0363] The order of the functional blocks that can be understood as the processes, flows, and methods described in each embodiment may be changed as long as there are no constraints such as a relationship in which one step utilizes the results of another step prior to it.

[0364] The terms first, second, through Nth (N is an integer) used in each embodiment and in the claims are used to distinguish two or more configurations or methods of the same type, and do not limit the order or superiority or inferiority.

[0365] Each embodiment is based on an attack analysis device for analyzing cyber attacks against an electronic control system installed in a vehicle, but the present invention also includes dedicated or general-purpose devices other than for vehicles, unless otherwise limited in the claims.

[0366] Moreover, examples of the form of the attack analysis device of the present invention include the following. Examples of the component form include a semiconductor element, an electronic circuit, a module, and a microcomputer. Examples of semi-finished products include electronic control units (ECUs (Electric Control Units)) and system boards. Finished product forms include mobile phones, smartphones, tablets, personal computers (PCs), workstations, and servers. Other examples include devices with communication functions, such as video cameras, still cameras, and car navigation systems.

[0367] Additionally, necessary functions such as an antenna and a communication interface may be added to the attack analysis device.

[0368] It is assumed that the attack analysis device of the present invention will be used, particularly on the server side, for the purpose of providing various services. In providing such services, the attack analysis device of the present invention will be used, the method of the present invention will be used, and / or the program of the present invention will be executed.

[0369] In addition, the present invention can be realized not only by dedicated hardware having the configuration and functions described in each embodiment, but also as a combination of a program for realizing the present invention recorded on a recording medium such as a memory or a hard disk, and general-purpose hardware having a dedicated or general-purpose CPU and memory capable of executing the program.

[0370] A program stored in a non-transient physical recording medium (for example, an external storage device (hard disk, USB memory, CD / BD, etc.) or an internal storage device (RAM, ROM, etc.)) of dedicated or general-purpose hardware can be provided to the dedicated or general-purpose hardware via a recording medium, or via a communication line from a server without using a recording medium. This makes it possible to always provide the latest functions through program upgrades. [Industrial Applicability]

[0371] The attack analysis device of the present invention is intended primarily for analyzing attacks received by electronic control systems installed in automobiles, but may also be intended for analyzing attacks against normal systems not installed in automobiles. [Explanation of symbols]

[0372] 10, 11, 12, 13 Attack analysis device, 101 Log acquisition unit, 102 Index acquisition unit, 103 Situation information storage unit, 104 Situation estimation unit, 105 Attack / anomaly related information storage unit, 106 Attack estimation unit, 107 Matching degree calculation unit, 108 Output unit, 20 ECU, 30 Server device

Claims

1. An attack analysis device for analyzing attacks on an electronic control system (S) mounted on a mobile vehicle, A log acquisition unit (101) acquires a security log indicating an abnormality detected in the electronic control system and the location within the electronic control system where the abnormality was detected. An indicator acquisition unit (102) acquires an indicator that shows the internal state and / or external state of the moving body when the aforementioned abnormality occurs, An attack / anomaly relationship information storage unit (105) stores attack / anomaly relationship information that shows the relationship between predictive attack information that indicates attacks the electronic control system may be subjected to, predictive anomaly information that indicates anomalies that are expected to occur when the attack occurs, and predictive anomaly location information that indicates the location within the electronic control system where the predicted anomaly occurs. In addition to the security logs and attack / anomaly relationship information, an attack estimation unit (106) estimates the attack on the electronic control system based on the indicators, The system includes an output unit (108) that outputs attack information indicating the estimated attack, Attack analysis device (10).

2. The system further includes a situation estimation unit (104) that estimates the situation of the moving body corresponding to the aforementioned indicator, based on the aforementioned indicator. The attack estimation unit estimates the attack the electronic control system has suffered based on the security log, the attack / anomaly relationship information, and the situation. The attack analysis apparatus according to claim 1.

3. The attack estimation unit does not use the portion of the attack / anomaly relationship information that includes a location within the electronic control system that is estimated not to be related to the attack in the given situation as the predicted anomaly location information or the predicted attack information for attack estimation. The attack analysis apparatus according to claim 2.

4. The attack estimation unit does not use the portion of the attack-anomaly relationship information that includes anomalies within the electronic control system that are estimated not to be related to the attack in the given situation as predicted anomaly information for attack estimation. The attack analysis apparatus according to claim 2.

5. The attack estimation unit uses the portion of the attack / anomaly relationship information that includes a location within the electronic control system that is estimated to be related to the attack in the given situation as the predicted anomaly location information or the predicted attack information for attack estimation. The attack analysis apparatus according to claim 2.

6. The attack estimation unit uses the portion of the attack-anomaly relationship information that includes anomalies within the electronic control system that are estimated to be related to the attack in the given situation as predicted anomaly information for attack estimation. The attack analysis apparatus according to claim 2.

7. The attack estimation unit uses the attack / anomaly relationship information, which has been weighted to include the portion of the attack / anomaly relationship information that includes a location within the electronic control system that is estimated not to be related to the attack in the given situation, as the predicted anomaly information or predicted anomaly location information, for attack estimation. The attack analysis apparatus according to claim 2.

8. The attack estimation unit uses the attack-anomaly relationship information, which has been weighted to include the portion of the attack-anomaly relationship information that includes anomalies within the electronic control system that are estimated not to be related to the attack in the given situation, as predicted anomaly information, for attack estimation. The attack analysis apparatus according to claim 2.

9. The aforementioned weighting (w) is multiplied by a coefficient such that 0 ≤ w < 1. The attack analysis apparatus according to claim 7.

10. The situation estimation unit estimates whether the cause of the anomaly indicated by the security log is a cyberattack, and if the cause of the anomaly is not a cyberattack, it determines that the security log is a false positive log. The attack estimation unit does not perform attack estimation using the security log, which is the false positive log. The attack analysis apparatus according to claim 2.

11. The aforementioned indicators also include the security logs acquired by the log acquisition unit. The attack analysis apparatus according to claim 1.

12. The indicator does not include the security log acquired by the log acquisition unit. The attack analysis apparatus according to claim 1.

13. The situation estimation unit estimates the vehicle situation, which is the operation and / or driving conditions of the moving body, based on the indicators, and estimates the power supply state of each of the one or more electronic control devices constituting the electronic control system from the vehicle situation. The attack estimation unit, based on the power supply state, does not use in attack estimation any portion of the attack / anomaly relationship information that includes a location within the electronic control system that is estimated to be unrelated to the attack, as the predicted anomaly location information or the predicted attack information. The attack analysis apparatus according to claim 3.

14. The indicator is at least one of the following: the speed of the mobile body, mode, number of occupants, battery voltage, charge status, and shift position. The attack analysis apparatus according to claim 13.

15. The situation estimation unit estimates candidate entry points, which are candidates for attack entry points, based on the indicators. The attack estimation unit uses the portion of the attack-anomaly relationship information that includes the entry point candidate as the predicted attack information for attack estimation. The attack analysis apparatus according to claim 5.

16. The aforementioned index is the speed of the moving body. The attack analysis apparatus according to claim 15.

17. The indicator is at least one of the following: the position of the moving object, the temperature around the moving object, and time or hour. The attack analysis apparatus according to claim 15.

18. The situation estimation unit estimates, based on the frequency with which the security log is generated as an indicator, whether the cause of the anomaly indicated by the security log is a cyberattack, and if the cause of the anomaly is not a cyberattack, it determines that the security log is a false positive log. The attack estimation unit uses the attack-anomaly relationship information, which is obtained by weighting (w) the predicted anomaly information corresponding to the anomaly indicated by the security log at the location within the electronic control system indicated by the false positive log among the attack-anomaly relationship information, for attack estimation. The attack analysis apparatus according to claim 7.

19. The situation estimation unit estimates whether the cause of the anomaly indicated by the security log is a cyberattack based on the frequency at which the security log is generated as an indicator, and if it is not a cyberattack, it determines that the security log is a false positive log. The attack estimation unit does not perform attack estimation using the security log, which is the false positive log. The attack analysis apparatus according to claim 10.

20. The situation estimation unit estimates, based on the frequency with which the security log is generated as an indicator, whether the cause of the anomaly indicated by the security log is due to user error on the mobile device, and if it is due to user error, it determines that the security log is a false positive log. The attack analysis apparatus according to claim 18 or 19.

21. The situation estimation unit estimates that if the frequency is lower than the standard frequency, the cause of the anomaly indicated in the security log is a user error on the mobile device. The attack analysis apparatus according to claim 20.

22. An attack analysis device for analyzing attacks on an electronic control system (S) mounted on a mobile vehicle, A log acquisition unit (101) acquires a security log indicating an abnormality detected in the electronic control system and the location within the electronic control system where the abnormality was detected. A situation acquisition unit (106) acquires the situation of the moving body estimated from the indicators, based on an indicator showing the internal and / or external state of the moving body when the aforementioned abnormality occurs. An attack / anomaly relationship information storage unit (105) stores attack / anomaly relationship information that shows the relationship between predictive attack information that indicates attacks the electronic control system may be subjected to, predictive anomaly information that indicates anomalies that are expected to occur when the attack occurs, and predictive anomaly location information that indicates the location within the electronic control system where the predicted anomaly occurs. In addition to the security logs and attack / anomaly relationship information, an attack estimation unit (106) estimates the attack on the electronic control system based on the situation, The system includes an output unit (108) that outputs attack information indicating the estimated attack, Attack analysis device (10).

23. The attack analysis device is located outside the mobile body. An attack analysis apparatus according to any one of claims 1 to 19 and 22.

24. The attack analysis device is mounted on a mobile vehicle. An attack analysis apparatus according to any one of claims 1 to 19 and 22.

25. An attack analysis method performed by an attack analysis device that analyzes attacks on an electronic control system (S) mounted on a mobile body, The attack analysis device is The system has an attack / anomaly relationship information storage unit (105) that stores attack / anomaly relationship information showing the relationship between predictive attack information indicating attacks that the electronic control system may be subjected to, predictive anomaly information indicating anomalies that are expected to occur when the system is subjected to the attack, and predictive anomaly location information indicating the location within the electronic control system where the predicted anomaly occurs. The aforementioned attack analysis method is, A security log is obtained indicating the abnormality detected in the electronic control system and the location within the electronic control system where the abnormality was detected (S101). An index indicating the internal and / or external state of the moving body when the aforementioned abnormality occurs is obtained (S102), In addition to the security logs and the attack / anomaly relationship information, the attack on the electronic control system is estimated based on the indicators (S104). Output attack information indicating the estimated attack (S105). Attack analysis methods.

26. An attack analysis program executable by an attack analysis device that analyzes attacks on an electronic control system (S) mounted on a mobile object, The attack analysis device is The system has an attack / anomaly relationship information storage unit (105) that stores attack / anomaly relationship information showing the relationship between predictive attack information indicating attacks that the electronic control system may be subjected to, predictive anomaly information indicating anomalies that are expected to occur when the system is subjected to the attack, and predictive anomaly location information indicating the location within the electronic control system where the predicted anomaly occurs. The aforementioned attack analysis program, A security log is obtained indicating the abnormality detected in the electronic control system and the location within the electronic control system where the abnormality was detected (S101). An index indicating the internal and / or external state of the moving body when the aforementioned abnormality occurs is obtained (S102), In addition to the security logs and the attack / anomaly relationship information, the attack on the electronic control system is estimated based on the indicators (S104). Output attack information indicating the estimated attack (S105). The attack analysis device is made to perform a process that includes the following: Attack analysis program.

Images