Information processing device, abnormality analysis method, and recording medium

Abstract

The present invention provides an information processing device, comprising: a storage processing unit, which establishes a correspondence between first data output by any one of one or more devices and a first feature context associated with the first data and stores them in a storage unit; and an analysis unit, which, when receiving second data from any one of the one or more devices, obtains a second feature context associated with the second data, and analyzes abnormalities in the received second data based on the received second data and the obtained second feature context, as well as the first data and the first feature context stored in the above-mentioned storage unit.

Description

Technical Field

[0001] The present invention relates to an information processing device, an abnormality analysis method, and a program. Background Art

[0002] In the connected car (a vehicle connected to an external network) that is expected to become more common in the future, there is an expectation for improved convenience, such as wireless software upgrades of ECUs (Electronic Control Units), which were previously performed at dealerships.

[0003] On the other hand, since vehicles and their control devices are connected to external networks, there is a concern that they may become targets of cyber attacks from malicious attackers, just like conventional IT equipment. In fact, there is also research that shows that it is possible to illegally tamper with the ECU installed in the vehicle through access from the external network and seize control of the vehicle.

[0004] Various countermeasure technologies are being studied for such threats, but there is no countermeasure that can completely prevent the risk of cyber attacks. Therefore, effective post-attack measures are also needed in the event of a cyber attack. In the case of an attack that takes control of the vehicle by tampering with the ECU, there is a method of continuously monitoring the communication generated in the vehicle network in order to take countermeasures in the vehicle, thereby detecting anomalies. However, since the computing resources of vehicle-mounted equipment are generally insufficient, it is difficult to apply anomaly detection methods with a large computing load.

[0005] Therefore, recently, research is being conducted on the following server-client collaborative processing technology for network attacks, that is, not only processing is performed in the vehicle, but also by utilizing both the cloud and the vehicle, processing with a higher computing load is performed in the cloud, and processing with a lower computing load and requiring low latency is performed on the vehicle-mounted device (for example, non-patent document 1).

[0006] <Prior Art Literature>

[0007] <Non-patent literature>

[0008] Non-patent document 1: "Search for the prevention of intrusion and defense against cyber attacks", [online], Internet

[0009] <URL:https: / / news.panasonic.com / jp / press / data / 2017 / 10 / jn171010-2 / jn171010-2.html> Summary of the invention

[0010] <Problems to be Solved by the Invention>

[0011] There are many cases where abnormalities such as cyber attacks on vehicles are overwhelmingly rare in terms of the overall number of detections. In other words, the detection results often include false positives due to operational errors, setting changes, changes in environmental factors, etc. When abnormalities that may indicate a cyber attack are detected, analysis is required to determine the treatment method to be implemented along with the detection results, but there is a problem that false detections such as the above increase the analysis cost.

[0012] It should be noted that the above-mentioned problem is not limited to vehicles, but is considered to be a common issue for various devices connected to the network.

[0013] The present invention is made in view of the above-mentioned points, and its purpose is to reduce the cost of analyzing the data output by the device.

[0014] <Methods used to solve the problem>

[0015] Therefore, in order to solve the above-mentioned problems, an information processing device comprises: a storage processing unit, which establishes a correspondence between first data output by any one of one or more devices and a first feature context associated with the first data and stores them in the storage unit; and an analysis unit, which, when receiving second data from any one of the one or more devices, obtains a second feature context associated with the second data, and analyzes abnormalities in the received second data based on the received second data and the obtained second feature context, as well as the first data and the first feature context stored in the above-mentioned storage unit.

[0016] <Effects of the Invention>

[0017] It can reduce the cost of analyzing the data output by the device. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a diagram showing a system configuration example in an embodiment of the present invention.

[0019] Figure 2 It is a diagram showing a hardware configuration example of the monitoring server 10 in the embodiment of the present invention.

[0020] Figure 3 1 is a diagram showing a hardware configuration example of the vehicle 20 in the embodiment of the present invention.

[0021] Figure 4 1 is a diagram showing an example of the functional configuration of the vehicle 20 and the monitoring server 10 in the embodiment of the present invention.

[0022] Figure 5 This is a flowchart for explaining an example of a processing procedure when a log is generated.

[0023] Fig. 6A It is a diagram showing an example of the structure of a log.

[0024] Figure 6B It is a diagram showing an example of the structure of a log.

[0025] Figure 7 It is a diagram showing a configuration example of the control log DB 271 .

[0026] Figure 8 It is a diagram showing a configuration example of the sensor log DB 272 .

[0027] Fig. 9 This is a flowchart for explaining an example of a processing procedure when receiving a log.

[0028] Fig.10 It is a diagram showing a configuration example of the feature knowledge DB 173 .

[0029] Fig.11 This is a flowchart for explaining an example of a processing procedure when a processing method is determined. DETAILED DESCRIPTION

[0030] Hereinafter, embodiments of the present invention will be described based on the drawings. Figure 1 FIG. 1 is a diagram showing an example of a system configuration in an embodiment of the present invention. Figure 1 In the embodiment, a plurality of vehicles 20 are cars (connected cars) connected to various servers (monitoring server 10, service providing server 30a, service providing server 30b, etc.) via a network N1 such as the Internet. For example, each vehicle 20 is connected to the network N1 via a wireless network such as a mobile communication network, thereby communicating with various servers.

[0031] The service providing server 30a and the service providing server 30b (hereinafter referred to as "the service providing server 30" when not distinguishing between them) are one or more computers for providing a predetermined service to the vehicle 20 or for providing a predetermined service based on information collected from the vehicle 20. For example, the service providing server 30a can provide a telematics service. In addition, the service providing server 30b can provide a service based on data collected from each vehicle 20.

[0032] The monitoring server 10 is one or more computers that detect the occurrence of abnormalities in the vehicle 20, analyze the contents of the abnormalities, etc. based on data transmitted (uploaded) from the vehicle 20. As an example of the abnormality, a network attack on the vehicle 20 through the network can be cited.

[0033] Figure 2 FIG. 1 is a diagram showing an example of the hardware configuration of the monitoring server 10 in the embodiment of the present invention. Figure 2 In the embodiment, the monitoring server 10 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a CPU 104, an interface device 105, etc., which are connected to each other by a bus B.

[0034] The program for the processing in advance on the monitoring server 10 is provided through a recording medium 101 such as a CD-ROM. If the recording medium 101 storing the program is set in the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 through the drive device 100. However, the installation of the program does not necessarily have to be performed through the recording medium 101, and it can also be downloaded from other computers through the network. The auxiliary storage device 102 stores the installed program and stores necessary files, data, etc.

[0035] When there is an instruction to start a program, the memory device 103 reads and stores the program from the auxiliary storage device 102. The CPU 104 executes the functions of the monitoring server 10 according to the program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network.

[0036] Figure 3 FIG. 2 is a diagram showing an example of the hardware configuration of the vehicle 20 in the embodiment of the present invention. Figure 3 In the embodiment, the vehicle 20 includes a communication device 210, an information subsystem 220, a control subsystem 230, a gateway device 240, etc.

[0037] The communication device 210 includes a communication module for connecting to the network N1, a communication module for communicating with other vehicles 20 or equipment on the road, and a communication module for connecting to a smartphone via a wireless LAN or short-range wireless communication.

[0038] The information subsystem 220 is a part that performs information processing according to the installed program, and includes a CPU 221, a memory device 222, an auxiliary storage device 223, a display device 224, and an input device 225. The auxiliary storage device 223 stores the installed program and various data used by the program. The memory device 222 reads and stores the program as the startup object from the auxiliary storage device 223. The CPU 221 executes the function of the information subsystem 220 according to the program stored in the memory device 222. The display device 224 is used to display a GUI (Graphical User Interface) based on the program. The input device 225 is an operating component such as a key or a touch panel, which is used to input various operation instructions. It should be noted that an in-vehicle device such as a car navigation or a head unit of a car audio is an example of the information subsystem 220.

[0039] The control subsystem 230 is a part for controlling the behavior of the vehicle 20 , and includes a plurality of microcomputers 231 for various controls, etc. For example, an ECU (Electronic Control Unit) is an example of the microcomputer 231 .

[0040] The gateway device 240 is a gateway (e.g., CGW (Central Gateway)) for connecting the information subsystem 220 and the control subsystem 230. That is, the communication protocol handled in the information subsystem 220 is, for example, the IP protocol, and the communication protocol used in the control subsystem 230 for communication with the microcomputer 231 is a non-IP protocol (e.g., CAN (Controller Area Network)) specifically used for control. Therefore, different gateway devices 240 are provided for absorbing these communication protocols.

[0041] It should be noted that, Figure 3 The hardware configuration shown is only an example. As long as the functions described below can be realized, the hardware configuration of the vehicle 20 is not particularly limited.

[0042] Figure 4 FIG. 2 is a diagram showing an example of the functional configuration of the vehicle 20 and the monitoring server 10 in the embodiment of the present invention. Figure 4In the embodiment, the information subsystem 220 of the vehicle 20 includes a control log acquisition unit 251, a sensor log generation unit 252, an abnormality determination unit 253, a feature context generation unit 254, a log transmission unit 255, and a detection algorithm receiving unit 256. For each of these units, one or more programs installed in the information subsystem 220 are implemented by causing the CPU 221 to execute the process. The information subsystem 220 also includes databases (storage units) such as the control log DB 271, the sensor log DB 272, and the detection algorithm DB 273. These databases (storage units) can be implemented using, for example, a memory device 222 or an auxiliary storage device 223.

[0043] The control log acquisition unit 251 is used to acquire the control log and save (store) it in the control log DB 271. The control log refers to log data related to the communication based on each microcomputer 231 in the control subsystem 230. The data of the communication content itself can also be used as the control log. Therefore, the control log is generated every time communication is performed through any microcomputer 231. It should be noted that the content of the communication, for example, shows the content of the communication related to the control of the vehicle 20, audio, infotainment information such as the car navigation, indicator display in the vehicle 20, etc.

[0044] The sensor log generation unit 252 is used to generate a sensor log and save it in the sensor log DB 272. The sensor log refers to log data including data (e.g., measurement values ​​based on the sensor, etc.) obtained from sensors (e.g., accelerometers, GPS (Global Positioning System) receivers, etc.) configured at various locations of the vehicle 20. The acquisition of data from each sensor and the generation of a sensor log based on the data are performed, for example, in a certain period or at the time of occurrence of a specific event. Each sensor may have a different sensor log generation time. In addition, the sensor that generates the sensor log may be a part of all sensors that the vehicle 20 has.

[0045] The abnormality determination unit 253 determines the degree (level) of abnormality based on the control log and the sensor log (hereinafter, referred to as "log" without distinguishing between them) by applying the detection algorithm stored in the detection algorithm DB 273. Specifically, the abnormality determination unit 253 calculates the value of the index indicating the degree of abnormality of the log generated by the vehicle 20 (hereinafter, referred to as "abnormality score"). However, the calculation of the abnormality score can be performed using only the control log or only the sensor log. The calculated abnormality score is stored in the control log DB 271 or the sensor log DB 272.

[0046] The feature context generation unit 254 is used to generate information associated with the log, which indicates the external environment of the vehicle 20 when the log was acquired or generated, the state of the vehicle 20, and the like (hereinafter referred to as "feature context"). For example, when calculating the abnormality score, the feature context generation unit 254 generates a feature context indicating the time when the log was acquired or generated, the external environment of the vehicle 20, the state of the vehicle 20, and the like. The feature context can be generated based on the log stored in the control log DB 271 or the sensor log DB 272, or based on the information acquired from the communication device 210.

[0047] When the time to send (upload) to the monitoring server 10 (hereinafter referred to as “sending time”) arrives, the log sending unit 255 sends the log stored in the control log DB 271 or the sensor log DB 272 to the monitoring server 10 while attaching a feature context.

[0048] The detection algorithm receiving unit 256 is used to receive a detection algorithm change request transmitted from the monitoring server 10, and to change (update) the detection algorithm DB 273 using the detection algorithm included in the change request.

[0049] On the other hand, the monitoring server 10 has a log receiving unit 151, a false detection / processing method judgment unit 152, a detection algorithm changing unit 153, a detection algorithm sending unit 154, and a processing method registration unit 155. Among these units, one or more programs installed in the monitoring server 10 are implemented by causing the CPU 104 to execute the process. In addition, the monitoring server 10 uses databases (storage units) such as the control log DB 171, the sensor log DB 172, the feature knowledge DB 173, and the detection algorithm DB 174. These databases (storage units) can be implemented using, for example, a storage device that can be connected to the auxiliary storage device 102 or the monitoring server 10 via a network.

[0050] The log receiving unit 151 is used to receive the log sent (uploaded) from the vehicle 20 and store the log in the control log DB 171 or the sensor log DB 172. In addition, the log receiving unit 151 is used to store the identification information of the microcomputer 231 or the sensor of the output source of the log, the abnormality score of the log, and the feature context in the feature knowledge DB 173.

[0051] The false detection / processing method determination unit 152 is used to analyze the abnormality of the log received by the log receiving unit 151. When the abnormality determination unit 253 of the vehicle 20 detects an abnormality, the false detection / processing method determination unit 152 determines whether the abnormality is caused by the false detection of the abnormality determination unit 253. Specifically, the false detection / processing method determination unit 152 extracts past records that are consistent or similar to the set of the log and feature context received by the log receiving unit 151 from the feature knowledge DB 173. It should be noted that the past records may be records related to different vehicles or records related to the same vehicle (records obtained at different times). In addition, the consistent or similar past records may be records that are consistent or similar only in the log or records that are consistent or similar only in the feature context. When the consistent or similar past records have been analyzed as having no abnormality and the abnormality score of the feature knowledge DB 173 is set to a value less than the abnormality detection threshold, even if the abnormality of the log is detected by the abnormality determination unit 253, the false detection / processing method determination unit 152 determines that the abnormality is caused by excessive detection by the abnormality determination unit 253. In addition, if the false detection / processing method determination unit 152 determines that it is over-detection, it can request the detection algorithm change unit 153 to change the detection algorithm.

[0052] In addition, when a processing method for past records that are consistent or similar to the received log is registered in the feature knowledge DB 173, the false detection / processing method judgment unit 152 also applies the processing method to the log. Examples of processing methods include treating it as a false detection and changing the abnormality score of the feature knowledge DB 173, changing the detection algorithm, etc. On the other hand, when there are no consistent or similar past records in the feature knowledge DB 173, or when there is no processing method, etc., a warning that a detailed analysis is required can be output.

[0053] The detection algorithm changing unit 153 changes part or all of the detection algorithms stored in the detection algorithm DB 174 based on a request from the false detection / processing method determining unit 152. It should be noted that the detection algorithm DB 174 stores the detection algorithms transmitted to each vehicle 20.

[0054] The detection algorithm transmitting unit 154 transmits a change request including the detection algorithm changed by the detection algorithm changing unit 153 to each vehicle 20 .

[0055] The processing method registration unit 155 registers the processing method input by an analyst or the like in response to the warning that a detailed analysis is required in the false detection / processing method determination unit 152 , in the feature knowledge DB 173 .

[0056] It should be noted that in Figure 4In the above description, an example in which the calculation of the anomaly score and the generation of the feature context are performed in the vehicle 20 is described, but the calculation of the anomaly score and the generation of the feature context may also be performed in the monitoring server 10. In addition, the anomaly score and the feature context may be manually input by an analyst or the like.

[0057] When the calculation of the abnormality score is performed in the monitoring server 10, the log sending unit 255 sends the log to the monitoring server 10 when the sending time arrives. The abnormality determination unit (not shown) of the monitoring server 10 calculates the abnormality score in the same manner as the abnormality determination unit 253 of the vehicle 20, and saves the abnormality score in the control log DB 171 or the sensor log DB 172.

[0058] When the feature context is generated in the monitoring server 10, the feature context generation unit (not shown) of the monitoring server 10 generates the feature context in the same manner as the feature context generation unit 254 of the vehicle 20, and stores the feature context in the feature knowledge DB 173. The feature context may be generated based on the log stored in the control log DB 171 or the sensor log DB 172 of the monitoring server 10, or may be generated based on information obtained through the interface device 105.

[0059] The following describes the processing steps performed by the information subsystem 220 of the vehicle 20. Figure 5 This is a flowchart for explaining an example of a processing procedure when a log is generated.

[0060] By acquiring the control log by the control log acquisition unit 251 or generating the sensor log by the sensor log generation unit 252, a certain log (hereinafter referred to as "object log") is saved in the control log DB 271 or the sensor log DB 272 (S101).

[0061] Fig. 6A as well as Figure 6B It is a diagram showing an example of the structure of a log. Fig. 6AAn example of a control log is shown below. The control log includes date and time, vehicle ID and element ID, Data[0], Data[1], Data[2], Data[3], Data[4], ..., etc. (hereinafter referred to as "Data[]"). Date and time is the date and time when the control log is obtained (the date and time when the communication of the control log is performed). Vehicle ID is the identification information of the vehicle 20. Element ID is the identification information of the constituent element of the vehicle 20. Element ID in the control log is the identification information of the microcomputer 231 that performed the communication of the control log. Data[] is the data included in the communication. For example, if the communication is related to the control of the engine, the values ​​of the parameters related to the control of the engine become the values ​​of the Data[]. However, not only the values ​​of the parameters related to the control of the engine can be included, but also data such as checksums and counters can be included in Data[].

[0062] on the other hand, Figure 6B An example of a sensor log is shown. The sensor log includes date and time, vehicle ID, element ID, and data specific to the sensor of the sensor log. Date and time is the date and time when the sensor log is generated. Vehicle ID is the identification information of vehicle 20. Element ID is the identification information of the sensor that is the output source of the data of the sensor log. In addition, Figure 6B The sensor log in is a sensor log based on data obtained from the acceleration sensor, and therefore includes Acc_X, Acc_Y, and Acc_Z as data unique to the acceleration sensor. Acc_X, Acc_Y, and Acc_Z are acceleration in the X-axis direction, acceleration in the Y-axis direction, and acceleration in the Z-axis direction, respectively.

[0063] Figure 7 2 is a diagram showing an example of the structure of the control log DB 271. Figure 7 As shown, each record of the control log DB271 includes Fig. 6A The items and the anomaly scores are shown. At the moment of step S101, the value of the anomaly score is empty. This is because the value of the anomaly score is determined in step S102.

[0064] Figure 8 2 is a diagram showing an example of the structure of the sensor log DB 272. Figure 8 As shown, each record of the sensor log DB 272 includes Figure 6BThe items shown in the figure and the abnormality score. At the time of step S101, the value of the abnormality score is empty for the same reason as the control log DB271. It should be noted that the format of the sensor log is different for each sensor. For example, if it is a sensor log of a GPS receiver, it contains latitude and longitude, etc. Therefore, in the sensor log DB272, each sensor (each element ID) can be distinguished and the sensor log can be stored in a different table.

[0065] The abnormality determination unit 253 is used to determine (calculate) the abnormality score of the target log and save it in the control log DB 271 or the sensor log DB 272 (S102). The determination of the abnormality score is performed at a constant cycle, and can be performed in response to the generation of logs containing specific values, or can be performed each time a certain amount of logs required for abnormal determination is saved.

[0066] The determination (calculation) of the abnormality score of the object log can be performed using a known technique. For example, the abnormality score can be determined based on the communication interval between the microcomputers 231 and the data value output by the microcomputers 231. In addition, for example, the abnormality score can be determined by inputting the object log into a learned model (e.g., a neural network) that is set to input the log and output the abnormality score. The abnormality score can be 0 or 1 to indicate the presence or absence of an abnormality, or it can be a value that represents the degree of abnormality in a range from a minimum value (e.g., 0) to a maximum value (e.g., 1). In addition, the determination of the abnormality score can be performed using both the control log and the sensor log. For example, the determination of the abnormality score can also be performed using only one of the control log and the sensor log.

[0067] When the abnormality determination unit 253 determines the abnormality score, the feature context generation unit 254 generates a feature context for the target log (S103). The feature context generation unit 254 generates a feature context not only when the abnormality score of the target log is greater than the abnormality detection threshold, that is, when the target log is detected as abnormal, but also when the abnormality score of the target log is less than the abnormality detection threshold, that is, when the target log is detected as normal.

[0068] The feature context generating unit 254 is used to generate a spatial feature context representing the external environment of the vehicle 20, a temporal feature context representing the time when the log is obtained or generated, and a behavior feature context representing the behavior of the vehicle 20. In addition, a traffic domain-related context representing information related to the traffic conditions of the vehicle 20 and a vehicle domain-related context representing information related to the state of the vehicle 20 may also be generated.

[0069] Examples of spatial feature contexts are weather, location, obstacles, temperature, rainfall, humidity, air pressure, wind speed, etc. Examples of temporal feature contexts are time, day of the week, season, event, etc. Examples of behavioral feature contexts are speed, acceleration, angular velocity, etc. obtained from sensors of the self-vehicle 20 or sensors of other vehicles, etc. Examples of traffic domain-related contexts are driving routes, road conditions, traffic flow, slope, altitude, width, lanes, etc. Examples of vehicle domain-related contexts are vehicle type, year, optional features, fault history, ECU installed, attack history, attack activity information, etc. It should be noted that the classification of these feature contexts is only for convenience. For example, temperature, rainfall, humidity, air pressure, wind speed, etc. can be classified as temporal feature contexts, and slope, altitude, etc. can also be classified as spatial feature contexts. In addition, any combination of the above feature contexts can be used, and other feature contexts can also be used.

[0070] For example, when information such as weather and temperature can be obtained from a smartphone, an external server, or the like through the communication device 210, the feature context generation unit 254 generates a spatial feature context representing the meteorological environment. For example, the feature context generation unit 254 generates a spatial feature context representing the location of the vehicle 20 from the sensor log of the GPS receiver stored in the sensor log DB 272. For example, the feature context generation unit 254 generates a behavior feature context representing the speed and acceleration of the vehicle 20 using the sensor log of the GPS receiver stored in the sensor log DB 272 and the control log of the vehicle speed stored in the control log DB 271. Each feature context may generate an instantaneous value, or may generate a continuous value or a discrete value within a period.

[0071] When the sending time arrives, the log sending unit 255 sends the target log to the monitoring server 10 by attaching a feature context to the target log (S104). The log sending unit 255 can send both the log detected as abnormal (i.e., the log with an abnormality score greater than the abnormality detection threshold) and the log detected as normal (i.e., the log with an abnormality score less than the abnormality detection threshold) to the monitoring server 10, or send the log detected as abnormal and not send the log detected as normal. In addition, the log sending unit 255 can select the log to be sent based on a priority or a standard set in advance.

[0072] It should be noted that the monitoring server 10 can perform the determination of the anomaly score (S102) and the generation of the feature context (S103) after the monitoring server 10 receives the object log.

[0073] The following describes the processing steps performed by the monitoring server 10. Fig. 9 This is a flowchart for explaining an example of a processing procedure when receiving a log.

[0074] The log receiving unit 151 receives the object log together with the feature context, and saves the object log in the control log DB 171 or the sensor log DB 172, and saves the feature context in the feature knowledge DB 173 (S201). Figure 7 as well as Figure 8 The same structure.

[0075] Fig.10 1 is a diagram showing an example of the structure of the feature knowledge DB 173. Fig.10 As shown, each record of the feature knowledge DB173 includes a feature context and a processing method in addition to the date and time, vehicle ID, element ID, and abnormality score in the control log DB171 or the sensor log DB172. The feature context received by the log receiving unit 151 is saved in the feature context. Since the processing method is registered in step S303, it is empty. The vehicle 20 and the microcomputer 231 or the sensor that are the output source of the object log can be identified by the combination of the vehicle ID and the element ID. It should be noted that the correspondence between the records of the feature knowledge DB173 and the records of the control log DB171 or the sensor log DB172 can be identified by the group of date and time, vehicle ID, and element ID, or by appending the log ID representing the record of the control log DB171 or the sensor log DB172 to the feature knowledge DB173.

[0076] When the abnormality score is greater than the abnormality detection threshold (S202: Yes), the following processing is performed. It should be noted that if the log transmission unit 255 of the vehicle 20 does not transmit a log with an abnormality score less than the abnormality detection threshold, step S202 may not be performed.

[0077] The false detection / processing method determination unit 152 determines (calculates) the similarity between the target log or feature context and the past records stored in the feature knowledge DB 173 (S203). When the feature context is generated as a continuous value, the continuous value may be converted into a discrete value for similarity determination.

[0078] The determination method of consistency or similarity can be performed using known techniques. For example, complete consistency or partial consistency can be used. In addition, for example, the similarity can be determined by inputting the object log, feature context, and a record in the feature knowledge DB 173 into a learned model (e.g., a neural network), and the learned model (e.g., a neural network) is set to input various logs and feature contexts and output their respective similarities. In addition, statistical processing such as outlier testing can be performed. The determination of consistency or similarity of feature contexts can be performed across multiple feature contexts. In the case of making a determination across multiple contexts, a weight corresponding to the feature context can be applied.

[0079] When there are consistent or similar past records in the feature knowledge DB 173 (S204: Yes), and when there is a processing method that can be automatically implemented for the record in the feature knowledge DB 173 (S205: Yes), the false detection / processing method judgment unit 152 implements the processing method (S206).

[0080] For example, it is assumed that the abnormality determination unit 253 determines that the microcomputer 231 responsible for the control of the brake of the vehicle 20 is operating beyond the threshold value. As a result, a behavior feature context representing the behavior of the brake is generated from the control log of the microcomputer 231, and a spatial feature context representing the location of the vehicle 20 and a traffic domain-related dependency context representing the occurrence of a traffic jam are generated from the sensor log of the GPS receiver, the sensor log of the camera or the distance sensor, VICS (registered trademark) information, V2V (Vehicle-to-Vehicle) or V2I (Vehicle-to-Infrastructure) information. Although other feature contexts such as the vehicle domain-related context representing the state of the vehicle 20 are also generated, a higher weight is applied to the feature context associated with the control of the brake. The weight is a coefficient added to the feature context in the determination of abnormalities including false detection, and can be installed in the form of a logarithmic coefficient relative to the feature context. Here, since the similarity of the feature context of behavior, the feature context of space, and the traffic domain-related context is focused on, a higher weight is applied to these feature contexts. The false detection / processing method determination unit 152 retrieves consistent or similar past records from the feature knowledge DB 173. When the abnormality score of the consistent or similar past record is less than the abnormality detection threshold, the false detection / processing method determination unit 152 determines that a false detection has occurred due to a traffic jam, and updates the value of the abnormality score related to the control log of the microcomputer 231 in the feature knowledge DB 173. In addition, when a processing method that can be automatically implemented is set for the consistent or similar past record, the false detection / processing method determination unit 152 implements the processing method.

[0081] For example, it is assumed that the abnormality determination unit 253 determines that the microcomputer 231 responsible for controlling the wipers of the vehicle 20 is operating beyond the threshold value, and as a result, a behavior feature context indicating the behavior of the wipers is generated from the control log of the microcomputer 231, a spatial feature context indicating that the weather is rainy is generated from an external server, and a vehicle domain related context indicating the type of vehicle is generated. Here, regarding the control of the wipers, since the similarity of the behavior feature context, the spatial feature context, and the vehicle domain related context is focused on, a higher weight is applied to these feature contexts. The false detection / processing method determination unit 152 retrieves consistent or similar past records from the feature knowledge DB 173. When the abnormality score of the consistent or similar past record is less than the abnormality detection threshold, the false detection / processing method determination unit 152 determines that the false detection occurs because the threshold for determining the abnormality of the wipers is inappropriate, and updates the value of the abnormality score related to the control log of the microcomputer 231 in the feature knowledge DB 173. In addition, when a processing method that can be automatically implemented is set for the consistent or similar past record, the false detection / processing method determination unit 152 implements the processing method.

[0082] On the other hand, when there is no consistent or similar past record in the feature knowledge DB 173 (S204: No), or when there is no processing method that can be automatically implemented for the record in the feature knowledge DB 173 (S205: No), the false detection / processing method determination unit 152 outputs a warning that a detailed analysis is required because it is an unknown detection (S207). The warning can be notified to other analyzers or analysts by the monitoring server 10.

[0083] In the example of abnormal detection of the microcomputer 231 responsible for controlling the above-mentioned brakes, or abnormal detection of the microcomputer 231 responsible for controlling the wipers, when the false detection / processing method judgment unit 152 cannot determine whether it is a false detection, a detailed analysis is requested from other analyzers or analysts.

[0084] Other analyzers or analysts refer to the logs stored in the control log DB 171 or the sensor log DB 172, and the feature context stored in the feature knowledge DB 173, and perform anomaly analysis. Since the feature context is given to the log, it is also possible to determine whether there is a possibility of large-scale anomalies (anomalies across multiple vehicles 20) such as network attacks. The analysis method of the anomaly is not limited to the prescribed method. For example, it can be based on a learned model (neural network, etc.), or other known technologies can be used. In addition, in determining whether there is a possibility of anomalies, information such as the CERT (Computer Emergency Response Team) of the automobile company, the SOC (Security Operation Center) owned by other companies, and announcements from security vendors can be used.

[0085] The processing method is determined based on the analysis results of other analyzers or analysts. For example, for a log determined to be a false detection, a processing method is determined to change the detection algorithm so that it is no longer detected as abnormal. For example, for a log determined not to be a false detection, a processing method is determined to check or repair the faulty part, update the software of the microcomputer 231, the auxiliary storage device 223, etc.

[0086] The following describes the processing steps performed by the monitoring server 10 after the analysis by other analyzers or analysts is completed. Fig.11 This is a flowchart for explaining an example of a processing procedure when a processing method is determined.

[0087] The processing method registration unit 155 receives the processing method determined by other analyzers or analysts (S301). Among the processing methods, there are processing methods that can be automatically implemented and processing methods that cannot be automatically implemented because they require inspection or repair at a dealer. The processing methods that can be automatically implemented include, for example, changing the detection algorithm used by the abnormality determination unit 253, handling false detections, notifying the owner of the vehicle 20, and other pre-set contact information.

[0088] When the processing method registration unit 155 receives a processing method that can be automatically implemented (S302: Yes), the processing method is registered in the feature knowledge DB 173 (S303). It should be noted that for a processing method that cannot be automatically implemented, the content that it cannot be automatically implemented can also be registered in the feature knowledge DB 173.

[0089] In addition, when a processing method such as changing the detection algorithm is registered in the feature knowledge DB 173 (S304: Yes), the false detection / processing method judgment unit 152 requests the detection algorithm change unit 153 to change the detection algorithm, and the detection algorithm change unit 153 changes the detection algorithm stored in the detection algorithm DB 174 (S305). The change of the detection algorithm includes the change of the feature extraction method used by the abnormality determination unit 253, the change of the weight of the feature, the adjustment of the threshold, the setting of the white list indicating the conditions that are not determined as abnormal, etc.

[0090] The detection algorithm sending unit 154 sends the detection algorithm to the vehicle 20 via the wireless or other interface device 150 (S306). The detection algorithm can be sent at a fixed period or in accordance with the change of the detection algorithm. It should be noted that the detection algorithm sending unit 154 can notify the owner of the vehicle 20 of the need to update the detection algorithm to a pre-set contact method, and the update of the detection algorithm in the vehicle 20 is performed at the dealership, etc. The detection algorithm receiving unit 256 of the vehicle 20 receives the detection algorithm and changes the detection algorithm DB273. The changed detection algorithm is stored in the detection algorithm receiving unit 256 of the vehicle 20. Figure 5 is used to determine the anomaly score in step S102.

[0091] Thus, in this embodiment, since feature context is given to the log, it is easy to grasp the state of abnormal detection. As a result, the cost required for the analysis of the right and wrong judgment and meaning of the detection result can be reduced. In addition, by updating the detection algorithm according to the judgment of false detection, the occurrence of false detection can be reduced.

[0092] It should be noted that, in this embodiment, although the vehicle 20 is described as an example of a device, this embodiment can also be applied to other devices with communication functions. For example, this embodiment can also be applied to industrial control devices such as robots in factories, sensors, audio equipment, home appliances, communication terminals (smartphones, tablet terminals, etc.) deployed in various places, and devices generally called IoT (Internet of Things) devices.

[0093] As described above, according to this embodiment, data (logs) generated in the vehicle 20 are sent to the monitoring server 10 with feature context attached. The monitoring server 10 can reduce the cost required for log analysis by storing the sent logs and feature contexts in the feature knowledge DB 173 in association with each other.

[0094] Furthermore, the monitoring server 10 can reduce the amount of logs that analysts and the like need to analyze by registering automatically executable processing methods in the feature knowledge DB 173 .

[0095] In addition, when excessive detection occurs, the monitoring server 10 can reduce the occurrence of excessive detection by changing the detection algorithm of the vehicle 20 in a manner that does not cause the excessive detection.

[0096] It should be noted that, in the present embodiment, the vehicle 20 is an example of a device. The monitoring server 10 is an example of an information processing device. The log receiving unit 151 is an example of a storage processing unit. The false detection / processing method determination unit 152 is an example of an analysis unit. The processing method registration unit 155 is an example of a registration unit. The detection algorithm change unit 153 and the detection algorithm transmission unit 154 are examples of a change unit.

[0097] As mentioned above, although the embodiment of the present invention is described in detail, the present invention is not limited to this specific embodiment, and various modifications and changes can be made within the scope of the gist of the present invention described in the claims.

[0098] This international application claims the priority based on Japanese Patent Application No. 2018-192415 filed on October 11, 2018, and the entire contents of No. 2018-192415 are cited in this international application.

[0099] Description of Reference Numerals

[0100] 10 Monitoring Servers

[0101] 20 Vehicles

[0102] 30a Service provider server

[0103] 30b Service provider server

[0104] 100 Drive unit

[0105] 101 Recording Media

[0106] 102 Auxiliary storage device

[0107] 103 Memory device

[0108] 104 CPU

[0109] 105 Interface device

[0110] 151 Log receiving department

[0111] 152 False detection / processing method judgment unit

[0112] 153 Detection Algorithm Change Department

[0113] 154 Detection algorithm sending unit

[0114] 155 Processing Method Registration Department

[0115] 171 Control log DB

[0116] 172 Sensor log DB

[0117] 173 Feature Knowledge DB

[0118] 174 Detection Algorithm DB

[0119] 210 Communication devices

[0120] 221 CPU

[0121] 222 Memory device

[0122] 223 Auxiliary storage device

[0123] 224 Display device

[0124] 225 Input Device

[0125] 220 Information subsystem

[0126] 230 Control subsystem

[0127] 231 Microcomputer

[0128] 240 Gateway Device

[0129] 251 Control log acquisition unit

[0130] 252 Sensor log generation unit

[0131] 253 Abnormality Judgment Department

[0132] 254 Feature Context Generation Unit

[0133] 255 Log sending department

[0134] 256 Detection algorithm receiving unit

[0135] 271 Control log DB

[0136] 272 Sensor Log DB

[0137] 273 Detection Algorithm DB

[0138] B Bus

Claims

1. An information processing device, comprising: a storage processing unit that stores the first data output by any one of the one or more devices and the first feature context associated with the first data in a corresponding manner in the storage unit, and stores the calculated abnormality score indicating the degree of abnormality of the first data in the storage unit in correspondence with the first data or the first feature context; and an analysis unit that, when receiving second data from any one of the one or more devices, obtains a second feature context associated with the second data, and analyzes an anomaly of the received second data based on the received second data and the obtained second feature context, and the first data, the first feature context, and the anomaly score stored in the storage unit, The first data is log data obtained or generated according to the operation of the device. The first feature context associated with the first data represents a state of the device when the first data is obtained or generated. The second data is received after the first data is stored in the storage unit.

2. The information processing device according to claim 1, wherein: The information processing device also has: a registering unit, which registers the processing method to be implemented on the first data in correspondence with the first data or the first feature context in the storage unit, The above analysis part applies weights corresponding to the feature context, The log data includes at least one of a control log related to communication based on the device and a sensor log obtained from a sensor.

3. The information processing device according to claim 2, wherein: The analysis unit extracts data consistent with or similar to the received second data, or extracts a feature context consistent with or similar to the acquired second feature context from the storage unit, and outputs a processing method for the extracted data or feature context.

4. The information processing device according to any one of claims 1 to 3, wherein: The information processing device also has: A change unit changes a detection algorithm of a device that outputs the second data based on the analysis result of the analysis unit.

5. The information processing device according to any one of claims 1 to 3, wherein: The first feature context and the second feature context include at least one of a spatial feature context representing an external environment of the device, a temporal feature context representing a time when the device outputs data, and a behavioral feature context representing a behavior of the device.

6. The information processing device according to any one of claims 1 to 3, wherein: In the above-mentioned analysis unit, based on the result of determining whether the above-mentioned second data is consistent with or similar to the above-mentioned first data, or the result of determining whether the above-mentioned second feature context data is consistent with or similar to the above-mentioned first feature context data, the above-mentioned anomaly score stored in the above-mentioned storage unit is extracted, and based on the extracted anomaly score, the anomaly of the above-mentioned second data is analyzed.

7. An abnormality analysis method, in which an information processing device performs the following steps: A storage processing step, which establishes a correspondence between the first data output by any one of the one or more devices and the first feature context associated with the first data and stores them in a storage unit, and stores the calculated abnormality score indicating the degree of abnormality of the first data and the first data or the first feature context in the storage unit in correspondence with each other; and an analysis step, in which, when receiving second data from any one of the one or more devices, a second feature context associated with the second data is obtained, and based on the received second data and the obtained second feature context, and the first data, the first feature context and the anomaly score stored in the storage unit, an anomaly analysis is performed on the received second data, The first data is log data obtained or generated according to the operation of the device. The first feature context associated with the first data represents a state of the device when the first data is obtained or generated. The second data is received after the first data is stored in the storage unit. 8 . A recording medium storing a program for causing an information processing device to function as each unit according to claim 1 .

Images