Log management apparatus and security attack detection / analysis system

Abstract

A log management apparatus and a security attack detection / analysis system are provided. The log management apparatus (100) has a log collection section (101) that receives logs generated by security sensors, a storage section (102) that stores the logs, a statistical analysis section (104) that obtains statistical calculation results by performing statistical analysis of a plurality of the logs, and a transmission section (106) that transmits the logs or the statistical calculation results in accordance with prescribed conditions.

Description

[0001] Cross-reference to related applications

[0002] This application is based on Japanese Patent Application No. 2020-120721, filed on July 14, 2020, the contents of which are incorporated herein by reference. Technical Field

[0003] This application relates to a system for detecting / analyzing cyberattacks, primarily a security attack detection / analysis system comprising a log management device mounted on a mobile device and a central device located externally to the mobile device. Background Technology

[0004] In recent years, technologies such as V2X (Vehicle-to-Everything) communication, particularly vehicle-to-vehicle (V2X) communication, for driver assistance and autonomous driving control have gained significant attention. Along with this, vehicles have acquired communication capabilities, and the so-called vehicle networking continues to develop. As a result, the possibility of vehicles being attacked by cyberattacks has increased. Because vehicles move at high speeds, there is a possibility of losing control of the vehicle due to a cyberattack, thus requiring more robust defenses against cyberattacks.

[0005] In the field of computer systems, countermeasures against cyberattacks have been adopted in the past.

[0006] For example, Patent Document 1 describes a log output device that determines whether a security log needs to be output.

[0007] Patent Document 1: Japanese Patent Application Publication No. 2020-38439

[0008] Here, the inventors have discovered the following issues.

[0009] Safety sensors are installed in the electronic control unit (ECU) of a vehicle, which is a moving body. These safety sensors monitor the ECU itself, its communications, and output safety logs. If all safety logs are uploaded to a central device for analysis, the communication load increases.

[0010] Furthermore, generally speaking, the processing power of a central device is higher than that of the electronic control unit installed in the vehicle. Therefore, there are situations where the electronic control unit installed in the vehicle cannot perform anomaly detection, but the central device can.

[0011] Furthermore, even when anomaly detection is performed through a central device, there may be instances where information such as safety logs is insufficient. In such cases, if additional information can be obtained from the vehicle in question or from vehicles of the same type, more accurate anomaly detection can be achieved, and analysis can be performed on multiple vehicles. Summary of the Invention

[0012] The purpose of this disclosure is to realize a log management device that can reduce communication with the central device and reduce the processing load of the central device.

[0013] Furthermore, the purpose of this disclosure is to realize a central device capable of performing attack analysis and collecting necessary information through a central device.

[0014] Furthermore, the aforementioned issue cites the case of mounting the log management device in a vehicle as an example, but this is only presented as one example. Even without mounting the log management device in a vehicle, issues such as increased communication volume and the need for proper allocation of processing power among various units and entities may arise.

[0015] One aspect of the log management device disclosed herein includes: a log collection unit for receiving logs generated by a security sensor; a storage unit for storing the logs; a statistical analysis unit for obtaining statistical calculation results by performing statistical analysis on multiple logs; and a transmission unit for transmitting the logs or the statistical calculation results according to predetermined conditions.

[0016] Another log management method disclosed herein is a log management method executed by a log management device, which receives logs generated by security sensors, saves the logs, calculates statistical results by performing statistical analysis on multiple logs, and sends the logs or the statistical results according to specified conditions.

[0017] Another aspect of the log management program disclosed herein is a log management program that can be executed by a log management device, receives logs generated by security sensors, saves the logs, calculates statistical results by performing statistical analysis on multiple logs, and sends the logs or the statistical results according to specified conditions.

[0018] Another aspect of the security attack detection / analysis system disclosed herein is a security attack detection / analysis system comprising a log management device and a central device. The log management device includes: a log collection unit for receiving logs generated by security sensors; a storage unit for storing the logs; a statistical analysis unit for calculating statistical results by performing statistical analysis on multiple logs; and a sending unit for sending the logs or the statistical calculation results according to predetermined conditions. The central device includes: a receiving unit for receiving the logs or the statistical calculation results; an analysis unit for analyzing the logs or the statistical calculation results and generating an upload request based on the analysis results, wherein the upload request is a request to upload additional logs or additional statistical calculation results; and a sending unit for sending the upload request to the log management device.

[0019] Furthermore, the parenthetical numbers in the claims indicating the constituent elements of the invention indicate the correspondence between the invention described in the claims and the embodiments described below, and are not intended to limit the invention described in the claims.

[0020] With the structure described above, the amount of communication with the central device can be reduced, as can the processing load of the central device.

[0021] In addition, it can perform attack analysis and collect necessary information through the central device. Attached Figure Description

[0022] Figure 1 This is a diagram illustrating a structural example of a security attack detection / analysis system according to an embodiment of the present disclosure.

[0023] Figure 2 This is a block diagram illustrating a structural example of a log management device according to an embodiment of the present disclosure.

[0024] Figure 3 This is a block diagram illustrating a structural example of the central device in an embodiment of the present disclosure.

[0025] Figure 4 This is a flowchart illustrating the operation of the log management device according to an embodiment of the present disclosure.

[0026] Figure 5 This is a flowchart illustrating the operation of the log management device according to an embodiment of the present disclosure.

[0027] Figure 6 This is a flowchart illustrating the operation of the central device in an embodiment of this disclosure.

[0028] Figure 7 This is a flowchart illustrating the operation of the central device in an embodiment of this disclosure. Detailed Implementation

[0029] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings.

[0030] Furthermore, the invention described below refers to the invention as described in the claim and is not limited to the embodiments described below. Additionally, at least the statements within quotation marks refer to the statements described in the claim and are similarly not limited to the embodiments described below.

[0031] The structures and methods described in the dependent claims of the claim are any structures and methods in the invention described in the independent claims of the claim. The structures and methods of the embodiments corresponding to the structures and methods described in the dependent claims, as well as structures and methods not described in the claims but only described in the embodiments, are any structures and methods in this invention. The structures and methods described in the embodiments where the description in the claim is broader than the description in the embodiments, are also any structures and methods in this invention in the sense of being examples of the structures and methods of this invention. In any case, the structures and methods that become essential to the invention through the independent claims described in the claim are...

[0032] The effects described in the embodiments are effects of situations where the structure is an example of an embodiment of the present invention, and are not necessarily effects of the present invention.

[0033] In the presence of multiple implementations, the structures disclosed in each implementation are not limited to that specific implementation, but can also be combined across implementations. For example, the structure disclosed in one implementation can be combined with other implementations. Alternatively, structures disclosed separately in multiple implementations can be grouped together and combined.

[0034] The subject matter described in this disclosure is not a known subject matter, but was discovered independently by the inventor, and together with the structure and method of this disclosure, it affirms the inventiveness of the invention.

[0035] 1. First Implementation Method

[0036] (1) Overall structure of the security attack detection / analysis system

[0037] First, use Figure 1 The overall structure of the security attack detection / analysis system in this embodiment is described.

[0038] The security attack detection / analysis system 1 includes a log management device 100 and a central device 200.

[0039] Log management device 100 is connected to central device 200 via communication network 2.

[0040] In this embodiment, the log management device 100 is "mounted" on a vehicle, which is a "mobile body". However, it may also be mounted on a fixed object instead of a mobile body.

[0041] Here, "moving body" refers to an object capable of movement at any speed. It also includes situations where the moving body is stationary. Examples include cars, motorcycles, bicycles, pedestrians, ships, airplanes, and the objects carried by them, but it is not limited to these.

[0042] Furthermore, the term "mounted" includes not only cases where the object is directly fixed to the moving body, but also cases where it moves with the moving body even though it is not fixed to it. Examples include cases where the object is held by a person riding the moving body, and cases where the object is mounted on a load placed on the moving body.

[0043] When communication network 2 is a wireless communication method, it can use, for example, IEEE 802.11 (WiFi, registered trademark), IEEE 802.16 (WiMAX, registered trademark), W-CDMA (Wideband Code Division Multiple Access), HSPA (High Speed ​​Packet Access), LTE (Long Term Evolution), LTE-A (Long Term Evolution Advanced), 4G, 5G, etc. Alternatively, it can use DSRC (Dedicated Short Range Communication).

[0044] When the communication network is wired, such as a LAN (Local Area Network), the Internet, or a landline telephone line, examples of wired communication include a vehicle parked in a parking lot or a vehicle being taken to a repair shop.

[0045] Wireless communication networks can also combine wireless and wired communication methods. For example, the log management device 100 can be connected to the base station device in the cellular system via wireless communication, while the base station device and the central device 200 can be connected via wired communication methods such as the backbone lines of telecommunications companies or the Internet.

[0046] (2) Structure of the log management device

[0047] use Figure 2 The structure of the log management device 100 of this embodiment will be described.

[0048] The log management device 100 includes a log collection unit 101, a storage unit 102, a control unit 103, a sending unit 106, and a receiving unit 107. Furthermore, the control unit 103 implements a statistical analysis unit 104 and an attack detection unit 105.

[0049] The log management device 100 can include a general-purpose CPU (Central Processing Unit), volatile memory such as RAM, non-volatile memory such as ROM, flash memory, or hard disk, various interfaces, and internal buses connecting them. Furthermore, it can be configured to perform functions by executing software on this hardware. Figure 2 The functions of each module are described below. Figure 3 The same applies to the central device 200 shown.

[0050] Of course, the log management device 100 can also be implemented using dedicated hardware such as LSI.

[0051] In this embodiment, the log management device 100 is assumed to be an electronic control unit (ECU, hereinafter referred to as ECU) as a semi-finished product, but is not limited thereto. For example, as a component, semiconductor circuits and semiconductor modules can be cited; as a finished product, personal computers (PCs), smartphones, mobile phones, and navigation systems can be cited.

[0052] Furthermore, the log management device 100 can be composed of a single ECU or multiple ECUs. For example, a communication ECU can be responsible for communication with external systems.

[0053] Alternatively, the viewpoint can be changed, and the multiple ECUs including the communication ECU can be understood as the log management device 100 of this embodiment.

[0054] The log collection unit 101 is connected to one or more ECUs connected to the log management device 100 via the vehicle network, and receives security logs sent from the security sensors installed in each ECU. The security sensors monitor each ECU itself and the communication between each ECU, detect anomalies such as attacks, and generate normal and abnormal reports through the security logs.

[0055] exist Figure 2 In this configuration, the log collection unit 101 is connected to ECU1, ECU2, and ECU3 via the vehicle network. ECU1 and ECU2 are equipped with safety sensors that monitor each ECU itself and their communication. ECU3 is not equipped with any safety sensors.

[0056] In addition to safety sensors, ECU1, ECU2, and ECU3 can also have defensive functions and generate logs that notify the operating status of each ECU. Furthermore, these logs can be used as the processing object in this embodiment, either in place of the safety log or together with it.

[0057] ECU1, ECU2, and ECU3 can be any type of ECU. Examples include drive system electronic control units that control the engine, steering wheel, and brakes; body system electronic control units that control the instrument panel, power windows, etc.; information system electronic control units such as navigation devices; or safety control system electronic control units that control collisions with obstacles or pedestrians. Furthermore, ECUs may not be listed side-by-side and can be classified as master devices or slave devices.

[0058] In addition to communication methods such as CAN (Controller Area Network) and LIN (Local Interconnect Network), in-vehicle networks can also use any communication method such as Ethernet, Wi-Fi, and Bluetooth.

[0059] The storage unit 102 stores the security logs collected by the log collection unit 101 from the log collection unit 101 via the control unit 103, or directly from the log collection unit 101. It may also store the statistical calculation results obtained by the statistical analysis unit 104, which will be described later.

[0060] The storage unit 102 is composed of non-volatile memory or volatile memory.

[0061] The control unit 103 controls the operation of the log collection unit 101, the storage unit 102, the sending unit 106, and the receiving unit 107. Furthermore, the control unit 103 implements the statistical analysis unit 104 and the attack detection unit 105 within itself.

[0062] The statistical analysis unit 104 calculates statistical results by performing statistical analysis on multiple security logs collected by the log collection unit 101. Examples of statistical analysis include the frequency, temporal distribution, or correlation of the same type of security logs. Other examples include the frequency, temporal distribution, or correlation of attack detection results determined by the attack detection unit 105 based on the security logs, as described later. Thus, the so-called statistical analysis of security logs includes both direct and indirect statistical analysis of the security logs.

[0063] The attack detection unit 105 performs attack detection based on the security logs collected by the log collection unit 101 and calculates the attack detection result. Attack detection involves multiple stages, such as identifying the attack, identifying the attack path, and identifying the damaged location. The attack detection unit 105 only needs to be able to perform at least one of these stages.

[0064] A so-called definitive attack refers to an attack that is definitively identified as originating from a security attack.

[0065] Determining the attack path means identifying which ECU or network is being attacked.

[0066] The so-called determination of the damaged area refers to identifying which ECU or which network is damaged.

[0067] Furthermore, as described above, the attack detection results obtained by the attack detection unit 105 can also be analyzed by the statistical analysis unit 104. In this case, statistical analysis of the security log is performed indirectly.

[0068] The transmitting unit 106 transmits the security log or statistical calculation results to the central device via antenna A according to the "prescribed conditions". Specifically, either the security log or the statistical calculation results are transmitted according to the "prescribed conditions". Examples of the prescribed conditions include the number of attack detections, the number of upload requests received from the central device, and the amount of security logs other than those upload requests; these will be explained in the section on the operation of the log management device described later. The control unit 103 can determine whether the prescribed conditions are met.

[0069] Here, the so-called "prescribed conditions" can refer to internal conditions related to logs and statistical calculation results, as well as external conditions based on instructions and information from other devices.

[0070] Furthermore, when the communication ECU responsible for external communication is set up separately from the log management device, the transmitting unit 106 sends the safety log and statistical calculation results to the communication ECU. However, in this case, the transmitting unit 106 also sends the safety log and statistical calculation results to the central device via the communication ECU, which is no different.

[0071] The receiving unit 107 receives the upload request for the security log and statistical calculation results from the central device 200 via antenna A.

[0072] (3) Structure of the central device

[0073] use Figure 3 The structure of the central device 200 in this embodiment will be described.

[0074] The central device 200 includes a receiving unit 201, a control unit 202, a storage unit 204, and a transmitting unit 205. Furthermore, the control unit 202 implements the analysis unit 203.

[0075] In this embodiment, the central device 200 is assumed to be a server device as a finished product, but is not limited thereto. For example, as a finished product, a workstation or personal computer (PC) can be cited; as a semi-finished product, an ECU can be cited; and as a component, a semiconductor circuit element can be cited.

[0076] The receiving unit 201 receives security logs or statistical calculation results sent from the log management device 100 via antenna A.

[0077] The control unit 202 controls the operation of the receiving unit 201, the storage unit 204, and the transmitting unit 205. Furthermore, the control unit 202 itself implements the analysis unit 203.

[0078] The analysis unit 203 analyzes the security logs or statistical calculation results received by the receiving unit 201. Furthermore, based on the analysis results, it generates an upload request, which is a request from the log management device 100 to upload additional logs or additional statistical calculation results.

[0079] The recipient of the upload request is not limited to the log management device 100 of the receiving source received by the receiving unit 201. For example, the log management device 100 installed in other vehicles of the same type can also be the recipient.

[0080] Here, "same type" means, in addition to the case of the same vehicle model, cases that share some commonality, such as cases that use the same components or the same platform.

[0081] The storage unit 204 stores the security logs and statistical calculation results received by the receiving unit 201. Additionally, it may also store upload requests generated by the analysis unit 203.

[0082] The sending unit 205 sends upload requests to the log management device 100, the source of the safety log and statistical calculation results, and / or to the log management device 100 installed in other vehicles of the "same type".

[0083] (4) Operation of the log management device

[0084] use Figure 4 and Figure 5 The flowchart below explains the operation of the log management device 100 in this embodiment.

[0085] Furthermore, the following actions not only represent the log management method executed by the log management device 100, but also the processing steps of the log management program that can be executed by the log management device 100.

[0086] Moreover, these processes are not limited to Figure 4 and Figure 5 The order shown is acceptable. That is, the order can be changed as long as there are no constraints such as the step utilizing the result of its predecessor.

[0087] Figure 4 This refers to actions related to the stable collection of logs by the log management device 100.

[0088] The log collection unit 101 receives the safety logs generated and sent by the safety sensors of ECU1 and ECU2 (S101). Then, the storage unit 102 stores the safety logs.

[0089] The attack detection unit 105 performs attack detection based on the received security logs (S102).

[0090] Attack detection can be performed by identifying at least one of the following: identifying the attack, identifying the attack path, or identifying the damaged area. If no attack detection is performed (S102: "No"), perform statistical analysis on the normal logs and calculate the statistical results. If attack detection is performed (S102: "Yes"), proceed to S104.

[0091] If the attack detection unit 105 detects an attack "more" than a specified number of times, the statistical analysis unit 104 performs statistical analysis to obtain statistical calculation results.

[0092] Furthermore, when the specified condition is set to the number of attack detections, if the number of attack detections is "less than" the specified number, the control unit 103 instructs the sending unit 106 to send the security log to the central device 200, and the sending unit 106 sends the security log to the central device 200. Conversely, if the number of attack detections is "more than" the specified number, the control unit 103 waits for an upload request from the central device 200 and instructs the sending unit 106 to send the statistical calculation results to the central device 200, and the sending unit 106 sends the statistical calculation results to the central device 200.

[0093] Here, "above" includes either the case with the specified number of times or the case without the specified number of times.

[0094] The term "below" includes either cases that include the specified number of times or cases that do not include the specified number of times.

[0095] In this embodiment, when the attack detection is detected for the first time as a predetermined condition (S104: "Yes"), the control unit 103 instructs the sending unit 106 to send the security log used during the attack detection to the central device 200. Then, the sending unit 106 sends the security log to the central device 200 (S105).

[0096] In addition to the security log, vehicle information indicating vehicle status and statistical calculation results of vehicle information, which are not shown in the diagram, can also be sent along with the output of the vehicle status monitoring function. The same applies in the next paragraph.

[0097] Furthermore, in this embodiment, if the attack detection is detected a second or more times as a predetermined condition (S104: "No"), the statistical analysis unit 104 performs statistical analysis on multiple security logs and calculates the statistical results (S103). For example, it calculates the number of times, frequency, time distribution, or correlation of the same type of security logs. Alternatively, the attack detection unit 105 calculates the number of times, frequency, time distribution, or correlation of attack detection results determined based on the security logs.

[0098] The calculated statistical results are not sent immediately. Instead, the control unit 103 waits for an upload request from the central device 200 and instructs the sending unit 106 to send the statistical results. The sending unit 106 then sends the statistical results. After the statistical results are sent, the attack count is reset.

[0099] However, the calculated statistical results can also be quickly transmitted from the transmitting unit 106.

[0100] Furthermore, in S104, the specified number of times is set to once as a condition, but it can also be set to two or more. For example, if the specified number of times is set to three, security logs can be sent until three anomaly detections are performed. If there are more than four anomaly detections, statistical analysis is performed to obtain statistical calculation results, and the statistical calculation results are sent while waiting for an upload request from the central device 200.

[0101] Furthermore, as a set condition, conditions other than the number of attack detections can also be set. For example, the number of times security logs are received or the frequency of receipt can also be set.

[0102] The specified conditions can also be changed automatically as needed or based on the conditions.

[0103] The content of statistical analysis can also be changed automatically as needed or based on conditions.

[0104] In this embodiment, since the target of the attack is either a security log or a statistical calculation result, it is not necessary to send all logs to the central device, thus reducing the amount of communication.

[0105] Furthermore, according to this embodiment, since statistical calculation results are sent while waiting for a request from the central device 200, the statistical calculation results can be sent only when the central device 200 determines that they are needed, thereby reducing the amount of communication.

[0106] Furthermore, according to this embodiment, since the central device 200 does not need to output statistical calculation results, the processing volume can be reduced.

[0107] Figure 5This refers to the action taken when the log management device 100 receives an upload request from the central device 200. In other words, it refers to the situation where the upload request meets the specified conditions.

[0108] The receiving unit 107 receives an upload request from the central device 200 (S111).

[0109] Control unit 103 determines whether a safety log or statistical calculation result can be sent (S112). In this determination, vehicle information output by a vehicle status monitoring function (not shown) is used. For example, since the vehicle can only use standby power when asleep, it is determined that it cannot be sent (S112: "No"). If it is determined that it can be sent (S112: "Yes"), the process proceeds to S113.

[0110] When the quantity of security logs received is set as a predetermined condition, if the quantity of security logs is "less than" a predetermined quantity, the control unit 103 instructs the sending unit 106 to send the security logs to the central device 200, and the sending unit 106 sends the security logs to the central device 200. Conversely, if the quantity of security logs is "more than" a predetermined quantity, the control unit 103 instructs the sending unit 106 to send the statistical calculation results to the central device 200, and the sending unit 106 sends the statistical calculation results to the central device 200.

[0111] Here, the term "quantity" includes not only the size of the logs, but also the number of logs and the frequency of log reception.

[0112] The term "above" includes either the case with the specified number of times or the case without the specified number of times.

[0113] The term "below" includes either the case with a specified number of times or the case without a specified number of times.

[0114] In this embodiment, when the number of security logs is one (S113: "Yes"), the control unit 103 instructs the sending unit 106 to send the security log to the central device 200. Then, the sending unit 106 sends the security log to the central device 200 (S114).

[0115] In addition, in this embodiment, if there are two or more security logs (S113: "No"), the control unit 103 instructs the sending unit 106 to send the statistical calculation results to the central device 200. Then, the sending unit 106 sends the statistical calculation results to the central device 200 (S115).

[0116] If S112 is "No", the statistical analysis unit 104 performs a statistical analysis of the reasons for the inability to send the security log in order to analyze the important factors that prevent the sending of the security log (S116). Then, if the sending is enabled (S117: "Yes"), the processing is moved to S113 based on the latest upload request among the previously received upload requests. As an example of the situation where the sending is enabled, the next IG-ON (ignition on) can be cited. If the sending is enabled (S117: "Yes"), the statistical calculation results of the statistical analysis of the reasons for the inability to send can also be sent further.

[0117] Furthermore, in S113, the number of security logs is set to 1 as a specified condition, but it can also be set to 2 or more. For example, if the number of security logs is set to 3, security logs can be sent until the number of security logs reaches 3, and if it is 4 or more, statistical calculation results can be sent.

[0118] Furthermore, as a set condition, conditions other than the number of security logs can also be set.

[0119] The specified conditions can also be changed automatically as needed or based on the conditions.

[0120] The content of statistical analysis can also be changed automatically as needed or based on conditions.

[0121] In this embodiment, since the sending target is set to either the security log or the statistical calculation result based on the number of security logs, it is not necessary to send all logs to the central device, thus reducing the amount of communication.

[0122] Furthermore, according to this embodiment, since statistical calculation results are sent while waiting for a request from the central device 200, the statistical calculation results can be sent only when the central device 200 determines that they are needed, thereby reducing the amount of communication.

[0123] Furthermore, according to this embodiment, since the central device 200 does not need to output the statistical calculation results that need to be performed during the analysis process, the processing load can be reduced. That is, the communication load with the central device 200 can be reduced without reducing the analysis accuracy in the central device 200.

[0124] (5) Operation of the central device

[0125] use Figure 6 and Figure 7 The flowchart below explains the operation of the central device 200 in this embodiment.

[0126] Furthermore, the following actions not only represent the security attack / analysis method executed by the central device 200, but also the processing steps of the security attack / analysis program that can be executed by the central device 200.

[0127] Moreover, these processes are not limited to Figure 6 and Figure 7 The order shown is acceptable. That is, the order can be changed as long as there are no constraints such as the step utilizing the result of its predecessor.

[0128] Figure 6 This refers to the action of receiving safety logs or statistical calculation results from the vehicle's log management device 100.

[0129] The receiving unit 201 of the central device 200 receives safety logs or statistical calculation results sent from a specific vehicle (S201). The safety logs or statistical calculation results received here can be, for example... Figure 4 The stable log collection security log (S105) or statistical calculation results (S103) of the log management device 100 based on a specific vehicle shown can also be as follows: Figure 5 The security log (S114) or statistical calculation result (S115) sent in response to the upload request from the central device 200 is shown. That is, Figure 6 The flowchart is connected to Figure 4 , Figure 5 And execute.

[0130] The analysis unit 203 performs attack analysis using the security logs or statistical calculation results received in S201 (S202). The attack analysis can also use the same algorithm as the attack detection unit 105 of the vehicle's log management device 100, but more detailed attack analysis can also be performed. The attack analysis method can use known methods.

[0131] If the system determines that an attack has occurred on a specific vehicle, or if it is impossible to determine whether an attack has occurred and further analysis is required (S203: "Yes"), the analysis unit 203 moves the processing to S204. At this point, it can be further determined whether the information required for the additional analysis is only needed from that specific vehicle, or if there is a security vulnerability that poses a danger to the same vehicle model, or if a broad collection of information is required. If the system determines that there has been no attack on a specific vehicle, the analysis unit 203 terminates the processing.

[0132] In order to collect information from a specific vehicle, or from some or all vehicles of the same model as the specific vehicle, the analysis unit 203 instructs the sending unit 205 to send an upload request (S204). Then, the sending unit 205 sends the upload request to the specific vehicle, or from some or all vehicles of the same model as the specific vehicle. The destination for the upload of the same model can be determined by using the vehicle registration data stored in the storage unit 204 of the central device 200.

[0133] The receiving unit 201 receives security logs or statistical calculation results from a single vehicle that is a specific vehicle, or from multiple vehicles that are part of or all of the same vehicle model as the specific vehicle. Then, the analysis unit 203 uses this information to perform attack analysis (S205). The multiple vehicles may or may not include the specific vehicle.

[0134] Thus, according to this embodiment, attack analysis can be performed through the central device 200, and a wide range of necessary information can be collected for attack analysis.

[0135] Figure 7 and Figure 6 Similarly, this refers to the action taken when receiving safety logs or statistical calculation results from the vehicle's log management device 100. (And...) Figure 6 Same steps reference Figure 6 The explanation is omitted.

[0136] In S201, if a safety log is received from a specific vehicle, the analysis unit 203 checks with the storage unit 204 whether statistical calculation results were received / saven from that specific vehicle in the past (S211). If no such results were received in the past (S211: "No"), the analysis unit 203 instructs the sending unit 205 to send an additional upload request for the statistical calculation results to that specific vehicle. Then, the sending unit 205 sends the additional upload request (S212). If the log was received in the past (S211: "Yes"), the process proceeds to S202.

[0137] Thus, according to this embodiment, when performing attack analysis through the central device 200, the accuracy of attack analysis can be improved by fully collecting information from specific vehicles.

[0138] 3. Other

[0139] (1) Changes to the conditions for sending object logs and statistical calculation results

[0140] exist Figure 4 S103, Figure 5In S113, the specified conditions are set as the number of attack detections and the number of security logs, but the specified conditions can also be set automatically or manually depending on the installation location of the security sensor (e.g., a specific ECU) and the importance of the communication bus connected to the security sensor. For example, it is also possible to set the number of attack detections as a specified condition.

[0141] Furthermore, for security-related information and privacy-related information such as location information, other logs and specified conditions can be modified. For example, for security-related information, increasing the number of attack detections and security logs as specified conditions can increase the amount of raw, unprocessed data. Conversely, for privacy-related information, decreasing the number of attack detections and security logs as specified conditions can reduce the amount of raw data containing explicitly private information.

[0142] (2) Priority of object logs and statistical calculation results

[0143] When sending object logs, for example, information related to security or privacy such as location information can be given higher priority than other logs.

[0144] (3) Understanding the invention from other perspectives

[0145] This disclosure can also be understood as an invention.

[0146] A log management device (100) has:

[0147] Log collection unit (101) collects logs generated by security sensors;

[0148] Storage unit (102) stores the above logs;

[0149] The sending unit (106) sends the aforementioned log to the outside; and

[0150] The statistical analysis department (104) calculates statistical results by performing statistical analysis on multiple of the aforementioned logs.

[0151] Under specified conditions, the aforementioned sending unit will send the aforementioned statistical calculation results to the outside instead of the aforementioned log.

[0152] 4. Summary

[0153] The features of the log management device, central device, and security attack detection / analysis system in the various embodiments of this disclosure have been described above.

[0154] Since the terms used in each embodiment are illustrative, they can also be replaced with synonymous terms or terms that contain synonymous functions.

[0155] The block diagrams used in the description of the implementation methods are categorized by function and organize the structure of the apparatus. Modules representing each function are implemented by any combination of hardware or software. Furthermore, because these block diagrams represent functional modules, they can also be understood as disclosures of inventions of methods and programs for implementing those methods.

[0156] For functional modules that can be understood as processes, flows, and methods described in various implementations, the order can be changed as long as there are no restrictions such as the relationship between a step and the result of other steps preceding it.

[0157] The terms "first," "second," or "Nth" (where N is an integer) used in various embodiments and claims are used to distinguish between two or more structures or methods of the same type, and do not limit the order or superiority of any particular method.

[0158] Each embodiment is based on a vehicle log management device mounted on a vehicle, but the present invention also includes dedicated or general-purpose log management devices other than those for vehicles, except as specifically defined in the claims.

[0159] In each embodiment, the description is based on the premise that the log management device disclosed in each embodiment is mounted on a vehicle, but it may also be based on the premise that it is held by a pedestrian.

[0160] Furthermore, the following examples can be cited as examples of the log management device and central device disclosed herein.

[0161] Examples of components include semiconductor elements, electronic circuits, modules, and microcomputers.

[0162] Examples of semi-finished products include electronic control units (ECUs) and system boards.

[0163] Examples of finished products include mobile phones, smartphones, tablets, personal computers (PCs), workstations, and servers.

[0164] In addition, it includes devices with communication functions, such as cameras, still cameras, and car navigation systems.

[0165] Additionally, necessary functions such as antennas and communication interfaces can be added to the log management device and central device.

[0166] It is assumed that the central apparatus of this disclosure is used for the purpose of providing various services. Along with providing such services, the central apparatus of this disclosure is used, the methods of this disclosure are used, and / or the procedures of this disclosure are performed.

[0167] Furthermore, this disclosure can be implemented not only by dedicated hardware having the structure and functions described in each embodiment, but also as a combination of a program for implementing this disclosure recorded on a recording medium such as a memory or hard disk, and general-purpose hardware having a dedicated or general-purpose CPU and memory capable of executing the program.

[0168] Programs stored on non-transitional physical recording media of dedicated or general-purpose hardware (e.g., external storage devices (hard disks, USB drives, CD / BDs, etc.) or internal storage devices (RAM, ROM, etc.)) can also be provided from a server to the dedicated or general-purpose hardware via the recording media, or without the recording media, through communication lines. This allows for the continuous provision of the latest functionality through program upgrades.

[0169] The log management device disclosed herein is primarily described as an electronic control device for automobiles, but it can be applied not only to two-wheeled motorcycles, electric bicycles, and railways, but also to all moving vehicles such as pedestrians, ships, and airplanes.

[0170] In addition, it can be used in various devices such as mobile phones, tablets, and game consoles for a variety of purposes.

Claims

1. A log management device, comprising: The log collection unit receives logs generated by security sensors; The storage department shall store the aforementioned logs; The statistical analysis department calculates the statistical results by performing statistical analysis on multiple of the aforementioned logs. The control department determines, based on the specified conditions, whether to send the aforementioned logs or the aforementioned statistical calculation results; as well as The sending department shall send the aforementioned logs or statistical calculation results according to the above-mentioned conditions. The aforementioned conditions include at least one of the following: the number of attack detections, the number of security logs received, the frequency of security log reception, the volume of security logs, or the number of upload requests received from the central device. The statistical analysis of the above logs includes: (i) statistical analysis of the number of times, frequency, time distribution, or correlation of the same type of security logs, or (ii) statistical analysis of the number of times, frequency, time distribution, or correlation of attack detection results determined based on security logs. The statistical analysis and calculation of the logs are performed in the aforementioned log management device. According to the aforementioned conditions, the aforementioned logs or statistical calculation results are sent from the aforementioned log management device to the aforementioned central device.

2. The log management device according to claim 1, wherein, It also includes an attack detection unit, which performs attack detection based on the aforementioned logs. When the number of attack detections exceeds a certain limit, the aforementioned statistical analysis department performs statistical analysis to obtain statistical calculation results.

3. The log management device according to claim 1, wherein, It also includes an attack detection unit, which performs attack detection based on the aforementioned logs. The above-mentioned conditions refer to the number of attack detections.

4. The log management device according to claim 3, wherein, If the number of attack detections is less than the specified number, the sending unit will send the logs to the central device. If the number of attack detections exceeds a certain limit, the sending unit waits for the upload request from the central device and sends the statistical calculation results to the central device.

5. The log management device according to claim 3, wherein, The number of attack detections can be set as a predetermined condition based on the location where the security sensors are installed or the importance of the communication bus connected to the security sensors.

6. The log management device according to claim 1, wherein, It also includes a receiving unit that receives upload requests from the central device, wherein the upload request is a request to upload the logs or the statistical calculation results. The above-mentioned conditions apply to the above-mentioned upload request.

7. The log management device according to claim 6, wherein, In addition to the aforementioned upload request, the above-mentioned conditions also include the aforementioned log volume.

8. The log management device according to claim 7, wherein, If the amount of the aforementioned log is below a predetermined amount, the aforementioned sending unit will send the aforementioned log to the aforementioned central device. When the amount of the aforementioned logs exceeds a specified amount, the aforementioned sending unit sends the aforementioned statistical calculation results to the aforementioned central device.

9. The log management device according to claim 6, wherein, If, after being unable to send the aforementioned logs or statistical calculation results, it becomes possible to send them, the sending unit sends the aforementioned logs or statistical calculation results based on the latest aforementioned upload request.

10. The log management device according to any one of claims 1 to 9, wherein, The log management device is mounted on a mobile device.

11. A log management method, which is a log management method executed by a log management device. Receive logs generated by security sensors. Save the above log. The statistical results are obtained by performing statistical analysis on multiple of the aforementioned logs. Based on the specified conditions, it will be determined whether to send the aforementioned logs or the aforementioned statistical calculation results. Send the above logs or statistical calculation results according to the above-mentioned conditions. The aforementioned conditions include at least one of the following: the number of attack detections, the number of security logs received, the frequency of security log reception, the volume of security logs, or the number of upload requests received from the central device. The statistical analysis of the above logs includes: (i) statistical analysis of the number of times, frequency, time distribution, or correlation of the same type of security logs, or (ii) statistical analysis of the number of times, frequency, time distribution, or correlation of attack detection results determined based on security logs. The statistical analysis and calculation of the logs are performed in the aforementioned log management device. According to the aforementioned conditions, the aforementioned logs or statistical calculation results are sent from the aforementioned log management device to the aforementioned central device.

12. A storage device storing a log management program executable by a log management device, wherein the log management program performs the following steps: Receive logs generated by security sensors. Save the above log. The statistical results are obtained by performing statistical analysis on multiple of the aforementioned logs. Based on the specified conditions, it will be determined whether to send the aforementioned logs or the aforementioned statistical calculation results. Send the above logs or statistical calculation results according to the above-mentioned conditions. The aforementioned conditions include at least one of the following: the number of attack detections, the number of security logs received, the frequency of security log reception, the volume of security logs, or the number of upload requests received from the central device. The statistical analysis of the above logs includes: (i) statistical analysis of the number of times, frequency, time distribution, or correlation of the same type of security logs, or (ii) statistical analysis of the number of times, frequency, time distribution, or correlation of attack detection results determined based on security logs. The statistical analysis and calculation of the logs are performed in the aforementioned log management device. According to the aforementioned conditions, the aforementioned logs or statistical calculation results are sent from the aforementioned log management device to the aforementioned central device.

13. A security attack detection / analysis system, comprising a log management device and a central device. The above-mentioned log management device has the following features: The log collection unit receives logs generated by security sensors; The storage department shall store the aforementioned logs; The statistical analysis department calculates the statistical results by performing statistical analysis on multiple of the aforementioned logs. The control department determines, based on the specified conditions, whether to send the aforementioned logs or the aforementioned statistical calculation results; as well as The sending department shall send the aforementioned logs or statistical calculation results according to the above-mentioned conditions. The aforementioned conditions include at least one of the following: the number of attack detections, the number of security logs received, the frequency of security log reception, the volume of security logs, or the number of upload requests received from the aforementioned central device. The statistical analysis of the above logs includes: (i) statistical analysis of the number of times, frequency, time distribution, or correlation of the same type of security logs, or (ii) statistical analysis of the number of times, frequency, time distribution, or correlation of attack detection results determined based on security logs. The statistical analysis and calculation of the logs are performed in the aforementioned log management device. According to the aforementioned conditions, the aforementioned logs or statistical calculation results will be sent from the aforementioned log management device to the aforementioned central device. The aforementioned central device has: The receiving unit receives the aforementioned logs or the aforementioned statistical calculation results; The analysis department analyzes the aforementioned logs or statistical calculation results, and generates the aforementioned upload request based on the analysis results. The aforementioned upload request is a request to upload additional logs or additional statistical calculation results. The sending unit sends the aforementioned upload request to the log management device.

14. The security attack detection / analysis system according to claim 13, wherein, The aforementioned log management device is mounted on a mobile device. The transmitting unit of the aforementioned central device sends the aforementioned upload request to the aforementioned log management device of the aforementioned mobile body and / or the log management device mounted on other mobile bodies of the same type.

Images