Attack source recognition system, attack source recognition device, attack source recognition method, and program

Abstract

An attack source recognition system according to one embodiment of the present invention comprises: a plurality of electronic control devices; a gateway device communicably connected to the plurality of electronic control devices; and an analysis device communicably connected to the plurality of electronic control devices, the electronic control device including: a generation unit configured to generate history information of a message transmitted from a process executed by the electronic control device; and a transmission unit configured to transmit at least a portion of the history information to the analysis device, the gateway device having: a detection unit configured to detect an attack message from among messages transmitted and received by the plurality of electronic control devices, the analysis device having: a recognition unit configured to recognize the attack message from among the messages transmitted and received by the plurality of electronic control devices; when the attack message is detected, the electronic control device identifies a transmission source of the attack message by using detection information relating to the attack message and information received from the plurality of electronic control devices.

Description

Technical Field

[0001] The present invention relates to an attack source identification system, an attack source identification device, an attack source identification method and a program. Background Art

[0002] In machinery such as vehicles (such as automobiles, special vehicles, motorcycles, bicycles, etc.), machine tools, construction machinery, agricultural machinery, industrial machinery, etc., multiple electronic control devices (ECU: Electronic Control Unit: Electronic Control Unit) are installed. In addition, as a representative communication network between these ECUs, there is a controller area network (CAN: Controller Area Network). The communication between each ECU on the CAN (also called CAN communication, CAN message or simply message) includes an ID (also called CAN-ID) and a payload. CAN-ID is used to identify the data content or the sending node, determine the priority of communication arbitration, etc. The payload carries a maximum of 8 bytes of data, and the data contains the value of one or more signals. Taking a vehicle as an example, as a signal, there are signals related to the state and control such as speed, lateral speed, accelerator, brake, acceleration, steering angle, etc.

[0003] In recent years, the danger of cyber attacks on communication networks such as CAN (i.e., control networks used for mechanical control) has become a concern. For example, it is known that an attack transmission of a CAN-ID associated with a target function can be inserted by connecting an illegal ECU to the network or illegally rewriting the actions of an existing ECU, thereby inducing illegal actions of the target function. Various methods have been studied for detecting such attacks on CAN. For example, non-patent document 1 discloses a method (network-type CAN-IDS) for monitoring a CAN communication network and detecting the insertion of an attack CAN message as an abnormality. This method is that in the communication of a certain CAN-ID sent at a constant cycle, if an attack CAN message for the CAN-ID is inserted, the observation period of the communication of the CAN-ID will change to be shorter than the predetermined period, and this situation will be detected as an abnormality. Ideally, the network-type CAN-IDS is set at a position where the CAN communication can be overlooked. For example, in a central gateway (CGW) type network structure, setting the network-type CAN-IDS in the GW is an example of an ideal setting method.

[0004] <Prior Art Literature>

[0005] <Non-patent literature>

[0006] Non-patent document 1: Toshifumi Otsuka and Okasuke Ishigo, "Intrusion detection method for in-vehicle LAN without changing existing ECUs", Information Processing Society Research Report, Vol. 2013-EMB-28, No. 6, pp. 31-35, 2013. Summary of the invention

[0007] <Problems to be Solved by the Invention>

[0008] In addition, although the attack is analyzed when a network attack is detected, one of the important purposes of network attack analysis is to identify the attack source device and the malware process / program in the device. However, there is no source and destination address in CAN communication, and the network CAN-IDS cannot identify which device (and thus which process in the device) is the attack source.

[0009] On the other hand, if a host-type CAN-IDS is installed in each ECU, it is possible to identify the source of the attack while detecting the attack if the ECU is the source of the attack. However, the host-type CAN-IDS is sometimes unable to detect attacks such as inserting attack CAN messages. For example, consider a situation where an attack CAN message is sent at a given cycle from an ECU connected to a CAN bus different from the ECU that sends the normal CAN message. In this case, the host-type CAN-IDS of the ECU that sends the attack CAN message cannot observe the normal CAN message because the CAN bus is different from the ECU that sends the normal CAN message. Therefore, the host-type CAN-IDS of the ECU that sends the attack CAN message sometimes recognizes the observation period of the attack CAN message as a predetermined period and cannot detect the attack.

[0010] The present invention has been made in view of the above-mentioned aspects, and provides a technology for identifying the transmission source of attack communication.

[0011] <Methods used to solve the problem>

[0012] An attack source identification system involved in one embodiment of the present invention includes: multiple electronic control devices; a gateway device, which is communicably connected to the multiple electronic control devices; and an analysis device, which is communicably connected to the multiple electronic control devices, wherein the electronic control device has: a generation unit, which is configured to generate historical record information of messages sent from a process executed by itself; and a sending unit, which is configured to send at least a part of the historical record information to the analysis device, the gateway device has: a detection unit, which is configured to detect attack messages from messages sent and received by the multiple electronic control devices, and the analysis device has: an identification unit, which is configured to use detection information related to the attack message and information received from the multiple electronic control devices to identify the sending source of the attack message when the attack message is detected.

[0013] <Effects of the Invention>

[0014] A technology for identifying the source of attack communications can be provided. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] FIG. 1 is a diagram showing the overall configuration of an attack source identification system in Embodiment 1. In FIG.

[0016] FIG. 2 is a diagram showing an example of a detailed functional configuration of a history collection unit.

[0017] FIG. 3 is a diagram showing an example of history information.

[0018] FIG. 4 is a flowchart showing the recording and transmission processing of history information in the first embodiment.

[0019] FIG. 5 is a flowchart showing attack detection and attack source identification processing in Embodiment 1. FIG.

[0020] FIG. 6 is a diagram showing the overall configuration of an attack source identification system in Embodiment 2. In FIG.

[0021] FIG. 7 is a flowchart showing the processing of recording and transmitting history information in the second embodiment.

[0022] FIG. 8 is a diagram showing an example of bit allocation of an extract of history information (part 1).

[0023] FIG. 9 is a diagram showing an example of bit allocation of the extract of history information (part 2).

[0024] FIG. 10 is a flowchart showing attack detection and attack source identification processing in the second embodiment. DETAILED DESCRIPTION

[0025] An embodiment of the present invention is described below. In the following embodiment, an attack source identification system 1 is mainly described, which assumes that CAN is a control network and can identify an attack source that attacks CAN communication (i.e., an ECU that sends the attack CAN communication or a process in the ECU, etc.). The so-called attack CAN communication refers to illegal CAN communication intended to carry out a certain attack. In addition, CAN communication can also be called, for example, a CAN message or simply a message.

[0026] In the attack source identification system 1 involved in this embodiment, the attack CAN communication is detected by the network type CAN-IDS, and when the attack CAN communication is detected, the history of CAN communication sent (issued) by each ECU is compared with the detection result, thereby identifying the attack source. Therefore, the attack source identification system involved in this embodiment mainly has the following three functional parts.

[0027] The history collection unit 110 is a functional unit that records CAN communications sent by a process of a device such as an ECU as history records, and sends the history records to the analysis unit 310 .

[0028] Detection unit 210: a functional unit that detects attacks on CAN communications using a network-type CAN-IDS.

[0029] Analysis unit 310: A functional unit that compares the detection result of the detection unit 210 with the history records received from the history collection unit 110 to identify the source of the attack on the CAN communication.

[0030] The following describes an embodiment of the attack source identification system 1 according to the present embodiment. In addition, CAN is assumed as the control network in the following, but it is not limited to CAN. For example, even when network-type attack detection is performed on a communication protocol in which the source address is not included in the communication message or a communication protocol in which the source address is easily disguised even if it exists, the present embodiment can also be applied.

[0031] [Implementation Method 1]

[0032] First, the first embodiment will be described. The first embodiment is a case where the attack source specifying system 1 has a monitoring network implemented by an arbitrary communication method in addition to a control network implemented by a CAN bus.

[0033] <Overall structure>

[0034] FIG1 shows the overall structure of the attack source specifying system 1 in Embodiment 1. As shown in FIG1 , the attack source specifying system 1 in Embodiment 1 includes a plurality of ECUs 10, CGWs 20, and an analysis device 30. Each ECU 10 and CGW 20 is connected to a CAN bus 40. In addition, each ECU 10, CGW 20, and analysis device 30 is connected to a monitoring NW 50 as a monitoring network.

[0035] In the example shown in FIG. 1 , each of the plurality of ECUs 10 is referred to as “ECU 10-1”, “ECU 10-2”, “ECU 10-11”, “ECU 10-12”, etc. In the example shown in FIG. 1 , there are a plurality of CAN buses 40. Each of the plurality of CAN buses 40 is referred to as “CAN bus 40-1”, “CAN bus 40-2”, etc.

[0036] Here, the attack source identification system 1 in the first embodiment has a central gateway type network structure. In the example shown in FIG. 1 , ECU 10-1 and ECU 10-2 are connected to CAN bus 40-1. ECU 10-11 and ECU 10-12 are connected to CAN bus 40-2. In addition, CGW 20 exists as a central gateway, which is connected to both CAN bus 40-1 and CAN bus 40-2.

[0037] ECU10 is an electronic control unit. Each ECU10 has a history collection unit 110. The history collection unit 110 is implemented, for example, by causing a computing device such as a processor to execute processing of one or more programs (including modules) maintained by ECU10. In addition, in the example shown in FIG1 , the history collection unit 110 of ECU10-1 is recorded as "history collection unit 110-1", the history collection unit 110 of ECU10-2 is recorded as "history collection unit 110-2", the history collection unit 110 of ECU10-11 is recorded as "history collection unit 110-11", and the history collection unit 110 of ECU10-12 is recorded as "history collection unit 110-12", etc.

[0038] Here, the detailed functional structure of the history collection unit 110 is shown in FIG2 . As shown in FIG2 , the history collection unit 110 includes a monitoring unit 111 , a history information generating unit 112 , and a recording / transmitting unit 113 .

[0039] The monitoring unit 111 monitors the process of the ECU 10 having the history collection unit 110, and when the process sends (issues) CAN communication, obtains information such as CAN-ID, payload, and process name of the process that issues the CAN communication from the CAN communication. In addition, the monitoring unit 111 can obtain information such as CAN-ID, payload, and process name not only from the CAN communication sent by the process, but also from the CAN communication received by the process.

[0040] Since the monitoring unit 111 requires high speed, it is preferably implemented by a kernel module or a program that operates in the kernel space. When the monitoring unit 111 is implemented by a program that operates in the kernel space, for example, eBPF (extended Berkeley Packet Filter) can be used in Linux (registered trademark), and BPF, DTrace, etc. can be used in BSD and QNX.

[0041] The history information generating unit 112 generates history information based on various information acquired by the monitoring unit 111. At this time, the history information generating unit 112 generates history information by performing predetermined statistical processing or necessary processing on the various information.

[0042] The recording / transmitting unit 113 records the history information generated by the history information generating unit 112 in a memory provided in the ECU 10, and transmits the history information with its own ECU name assigned thereto to the analyzing device 30 via the monitoring NW 50. In addition, when transmitting the history information with its own ECU name assigned thereto to the analyzing device 30, the recording / transmitting unit 113 may transmit all the history information, or may select and discard the history information as required and transmit only a part of the history information (e.g., only the history information that has not yet been transmitted, etc.).

[0043] Here, an example of history record information is shown in FIG3 . As shown in FIG3 , the history record information is composed of a plurality of rows (records), each row including time, issuing CAN-ID, number of issuances, entropy, and issuing process name. Each row constituting the history record information is obtained by statistically processing various information obtained by the monitoring unit 111 according to the same CAN-ID at given intervals (1 minute in the example shown in FIG3 ). For example, the number of issuances is the number of CAN communications with the CAN-ID that are sent during the period. In addition, entropy is the amount of change in the payload of the CAN communication with the CAN-ID during the period. In addition, the issuing process name is the name of the process that issues (sends) the CAN communication with the CAN-ID.

[0044] The example shown in FIG3 is a history information generated by the history collection unit 110 of a certain ECU 10, which usually sends CAN communication having any one of three CAN-IDs (32A, 32C, 32E). As shown in FIG3, in the history information, it is recorded that the malware process attack sent a large number (the number of transmissions is "500") of CAN communications with the same payload (i.e., entropy "0") with CAN-ID "0AA".

[0045] The CGW 20 is a central gateway that functions as a network-type CAN-IDS. The CGW 20 includes a detection unit 210. The detection unit 210 is implemented by causing a computing device such as a processor to execute processing of one or more programs (including modules) stored in the CGW 20.

[0046] The detection unit 210 detects the attack CAN communication and sends the detection information indicating the detection result to the analysis device 30 via the monitoring NW 50. The detection information includes, for example, the time when the attack CAN communication is detected (detection time), the CAN-ID included in the attack CAN communication, etc. In addition, the detection unit 210 can detect the attack CAN communication by the same method as the known network type CAN-IDS.

[0047] The analysis device 30 is a device for identifying a transmission source (attack source) of an attack on CAN communication. The analysis device 30 includes an analysis unit 310. The analysis unit 310 is implemented by causing a computing device such as a processor to execute processing of one or more programs (including modules) stored in the analysis device 30.

[0048] The analysis unit 310 stores the history information (history information to which the ECU name is assigned) received from the history collection unit 110 in the memory of the analysis device 30. In addition, the analysis unit 310 may delete (clear) the history information stored in the memory, for example, when a predetermined period has passed or when history information with the same ECU name as the already stored history information is received.

[0049] In addition, when the analysis unit 310 receives the detection information from the detection unit 210, it compares the detection information with the historical record information maintained in the memory to identify the source of the attack on the CAN communication. That is, the analysis unit 310 compares the time (detection time) and CAN-ID contained in the detection information with the time and CAN-ID contained in each historical record information, and identifies the ECU10 with the ECU name assigned to the historical record information containing the consistent time and CAN-ID and the process with the issuing process name corresponding to the time and CAN-ID as the source of the attack on the CAN communication (attack source). Among them, the time does not need to be completely consistent, as long as their difference is within a given range, it can be considered consistent. In addition, it is also possible to use only CAN-ID instead of the time for comparison.

[0050] The analysis device 30 may be located inside a machine (eg, a vehicle) equipped with the ECU 10 and the CGW 20 , or may be located outside the machine, and may communicate with the machine in a wired or wireless manner.

[0051] <Recording and sending of history information>

[0052] Hereinafter, the recording and transmission processing of the history information in the first embodiment will be described with reference to Fig. 4 . Hereinafter, as an example, the recording and transmission processing of the history information about a certain ECU 10 will be described.

[0053] Every time a CAN communication is issued (sent) from a process of the ECU 10 , the monitoring unit 111 of the history collection unit 110 acquires information such as CAN-ID, payload, and process name from the CAN communication (step S101 ).

[0054] The history information generating unit 112 of the history collecting unit 110 generates history information based on various information acquired by the monitoring unit 111 at a given period (e.g., 1 minute) (step S102). At this time, the history information generating unit 112 generates history information by performing given statistical processing (e.g., calculation of the number of emission, calculation of entropy, etc.) and necessary processing (e.g., conversion of data format, etc., as required) on the various information.

[0055] The recording / transmitting unit 113 of the history collection unit 110 records the history information generated by the history information generating unit 112 in the memory of the ECU 10, and transmits the history information to which the ECU name of the ECU 10 is assigned to the analyzing device 30 via the monitoring NW 50 (step S103). Thus, the history information to which the ECU name is assigned is retained in the memory of the analyzing device 30 by the analyzing unit 310 of the analyzing device 30.

[0056] <Attack detection and attack source identification processing>

[0057] Hereinafter, the attack detection and attack source identification processing in Embodiment 1 will be described with reference to FIG. 5 .

[0058] When the detection unit 210 of the CGW 20 detects an attack on the CAN communication (Yes in step S201 ), the detection unit 210 transmits the detection information to the analysis device 30 (step S202 ).

[0059] The analysis unit 310 of the analysis device 30 compares the time (detection time) and CAN-ID included in the detection information received from the CGW 20 with the time and CAN-ID included in each history information stored in the memory to identify the ECU name and process name of the attack source (step S203).

[0060] In addition, depending on the interval at which the history collection unit 110 sends the history information, when the analysis unit 310 receives the detection information, there may be an ECU 10 that has not yet sent the history information at that time (the latest history information). Therefore, the analysis unit 310 may wait until the latest history information is received from all ECUs 10 and then perform the above comparison.

[0061] In addition, as described above, the comparison may be performed using only the CAN-ID instead of the time. In this case, the analysis unit 310 may compare the CAN-ID included in the detection information received from the CGW 20 with the CAN-ID included in each history record information stored in the memory, and identify the ECU name and process name corresponding to the CAN-ID that matches them as the attack source.

[0062] Here, in the case of an attack such as inserting an attack on CAN communication, the CAN communication of the CAN-ID used for the attack is sent from at least two or more sending sources, namely, a normal sending source (ECU name and process name) and an illegal sending source (ECU name and process name). Therefore, in this case, the analysis unit 310 identifies multiple sending sources as candidates for attack sources through the above-mentioned comparison, and then identifies the actual attack source from these candidates. As a method of identifying the actual attack source from multiple attack source candidates, for example, the following method can be cited: using the association information between the ECU name and process name and the CAN-ID determined in advance by design, the ECU name and process name not included in the association information are identified as the actual attack source. Alternatively, for example, in the case of identifying the candidate of the attack source only by comparing the CAN-ID without using the time, the candidate of the attack source of the CAN communication of the CAN-ID that sent the CAN-ID at the time consistent with the time (detection time) included in the detection information can also be identified as the actual attack source.

[0063] [Implementation Method 2]

[0064] Next, Embodiment 2 will be described. Embodiment 2 is a case where the attack source identification system 1 does not have the monitoring NW 50 due to cost constraints, etc. In Embodiment 2, differences from Embodiment 1 are mainly described, and descriptions of the same components as Embodiment 1 are omitted.

[0065] <Overall structure>

[0066] FIG6 shows the overall structure of the attack source identification system 1 in Embodiment 2. As shown in FIG6 , the attack source identification system 1 in Embodiment 2 is different from Embodiment 1 in that the monitoring NW 50 does not exist. Therefore, the history record collection unit 110 of each ECU 10 sends the history record information to the analysis device 30 via the CAN bus 40 (and the CGW 20). At this time, in order not to oppress the communication band of the CAN bus 40, it is preferred that the communication volume of the history record information is as small as possible. Therefore, in this embodiment, the recording / transmission unit 113 of the history record collection unit 110 sends an excerpt of the history record information to the analysis device 30. In addition, the CGW 20 and the analysis device 30 are communicatively connected via any communication method.

[0067] <Recording and sending of history information>

[0068] Hereinafter, the recording and transmission processing of the history information in the second embodiment will be described with reference to Fig. 7 . Hereinafter, the recording and transmission processing of the history information about a certain ECU 10 will be described as an example.

[0069] Steps S301 and S302 in FIG. 7 are the same as steps S101 and S102 in FIG. 4 , and thus description thereof will be omitted.

[0070] After step S302, the recording / transmitting unit 113 of the history collection unit 110 records the history information generated by the history information generating unit 112 in the memory of the ECU 10, and transmits an excerpt of the history information (hereinafter referred to as history information excerpt) to the analysis device 30 via the CAN bus 40 to which it is connected (step S303). Thus, the history information excerpt is retained in the memory of the analysis device 30 by the analysis unit 310 of the analysis device 30.

[0071] At this time, the recording / transmitting unit 113 can generate a history information excerpt based on the rows in a given period (e.g., 1 minute) of the history information, and transmit the history information excerpt in one frame of CAN communication. In addition, the recording / transmitting unit 113 transmits the CAN communication using a value inherent to the ECU 10 as the CAN-ID. By setting the CAN-ID of the CAN communication representing the history information excerpt to a value inherent to each ECU 10, the analyzing unit 310 of the analyzing device 30 can identify which ECU 10 the history information excerpt of the CAN communication is.

[0072] Here, FIG8 shows an example of bit assignment (bit assignment of CAN frame) when a history information excerpt is represented by one frame of the standard format of CAN communication. FIG8 shows an example of bit assignment when a CAN-ID sent in a given period (for example, 1 minute) is used as a history information excerpt. In addition, in the example shown in FIG8, a case where CAN-ID "700" is specified in CAN communication when ECU10-1 sends a history information excerpt is shown.

[0073] In the standard format, the CAN-ID is represented by an 11-bit length. Therefore, if the number of CAN-IDs sent from the ECU 10 is less than 5, it is possible to directly specify these CAN-IDs as payloads (up to 64 bits) and send the history information excerpt in only one frame. On the other hand, in the case where malware or the like sends additional CAN-IDs, the CAN-IDs sent from the ECU 10 may be more than 6, so in this case, there may be CAN-IDs that are not specified in the history information excerpt of one frame. Even in this case, the existence of unspecified CAN-IDs can be conveyed by specifying the "number of CAN-IDs sent" with 9 bits starting from the offset (Offset) "0". In addition, if the communication band of the CAN bus 40 is sufficient, the history information excerpt can be represented by multiple frames instead of just one frame.

[0074] In addition, FIG. 9 shows an example of bit allocation (bit allocation of CAN frame) when a history information excerpt is represented by one frame of the extended format of CAN communication. FIG. 9 is an example of bit allocation when the number of CAN-IDs issued in a given period (for example, 1 minute) is set as a history information excerpt. In addition, in the example shown in FIG. 9, a case where CAN-ID "700" is specified in CAN communication when ECU10-1 sends a history information excerpt is shown. In the extended format, CAN-ID is represented by a length of 29 bits.

[0075] As shown in Fig. 9, in the extended format, for example, the number of CAN-IDs issued can be specified every 4 bits. At this time, in the case where malware or the like sends an additional CAN-ID, the number of CAN-IDs issued is collectively specified as "other IDs issued number".

[0076] <Attack detection and attack source identification processing>

[0077] Hereinafter, the attack detection and attack source identification processing in Embodiment 2 will be described with reference to FIG. 10 .

[0078] Steps S401 and S402 of FIG. 10 are the same as steps S201 and S202 of FIG. 5 , and thus description thereof will be omitted.

[0079] After step S402, the analysis unit 310 of the analysis device 30 uses the detection information received from the CGW 20 and the historical record information excerpt stored in the memory to identify the attack source (step S403). At this time, the analysis unit 310 may also obtain historical record information other than the excerpt from the corresponding ECU 10 as needed, and then perform the same comparison as in the first embodiment to identify the attack source.

[0080] For example, when the bit-assignment history information extracts shown in FIG8 are stored in the memory, the analysis unit 310 can identify the attack source (ECU 10) by comparing the CAN-ID included in the detection information with the CAN-ID included in each history information extract. Therefore, the analysis unit 310 can further obtain history information from the ECU 10 and then identify the process of the attack source.

[0081] In addition, for example, in a case where the bit-assigned history information excerpt shown in FIG. 9 is maintained in the memory, when the "other ID issuance number" of the history information excerpt is assigned a value greater than 1, the analysis unit 310 can obtain the history information corresponding to the history information excerpt from the corresponding ECU 10, and then perform the same comparison as in Implementation Example 1 to identify the source of the attack.

[0082] In addition, acquisition of the history information can be realized by installing the analysis unit 310 as an ECU diagnostic function via the CAN bus 40, for example.

[0083] [Implementation method 3]

[0084] Next, the third embodiment is described. The attack source identification system 1 in the third embodiment may be a combination of the first embodiment and the second embodiment. That is, in the attack source identification system 1 in the third embodiment, only a part of the ECUs 10 (e.g., ECUs 10-1, ECUs 10-2, etc.) may be connected to the monitoring NW 50, while the other ECUs 10 (e.g., ECUs 10-11, ECUs 10-12, etc.) are not connected to the monitoring NW 50. In this case, the ECUs 10 connected to the monitoring NW 50 are set to be the same as in the first embodiment, and the ECUs 10 not connected to the monitoring NW 50 are set to be the same as in the third embodiment.

[0085] [Summarize]

[0086] As described above, the attack source identification system 1 according to the present embodiment can identify the attack source by comparing the attack source with the message sending history information, such as the message sending history, even when the sending source address cannot be obtained from the message (or when the acquisition is difficult). Therefore, for example, network attack analysis can be effectively performed.

[0087] The present invention is not limited to the above-described specifically disclosed embodiments, and various modifications, changes, and combinations with known technologies are possible without departing from the scope of the claims.

[0088] Explanation of symbols

[0089] 1: Attack source identification system

[0090] 10: ECU

[0091] 20: CGW

[0092] 30: Analytical device

[0093] 40: CAN bus

[0094] 50: Monitoring NW

[0095] 110: History Record Collection Department

[0096] 111: Monitoring Department

[0097] 112: History record information generation unit

[0098] 113: Recording / Sending Department

[0099] 210: Inspection Department

[0100] 310: Analysis Department.

Claims

1. An attack source identification system, comprising: multiple electronic control devices; a gateway device communicably connected to the plurality of electronic control devices; as well as an analysis device communicatively connected to the plurality of electronic control devices, The electronic control device comprises: a generating unit configured to generate history information of messages sent from a process executed by the self-process; and a transmitting unit configured to transmit at least a part of the history information to the analyzing device, The gateway device has: a detection unit configured to detect an attack message from messages sent and received by the plurality of electronic control devices, The analysis device comprises: The identification unit is configured to identify a transmission source of the attack message by using detection information related to the attack message and information received from the plurality of electronic control devices when the attack message is detected.

2. The attack source identification system according to claim 1, wherein: The generating unit is configured to generate history information including a message ID indicating identification information of a message sent from a process executed by the unit and a process name indicating a name of the process. The sending unit is configured to send information including at least the message ID and the process name to the analyzing device. The identification unit is configured to compare the message ID of the attack message contained in the detection information with the message ID contained in each information received from the multiple electronic control devices, and identify the electronic control device that is the source of the information including a process name corresponding to the mutually consistent message IDs and the message ID as the source of the attack message.

3. The attack source identification system according to claim 2, wherein: The sending unit is configured to send information including the time when the message was sent to the analyzing device, The identification unit is configured to also compare the time when the attack message is detected contained in the detection information with the time contained in each information received from the multiple electronic control devices, and identify the electronic control device that is the source of the information including a process name corresponding to the message ID and time that are consistent with each other and the message ID and time as the source of the attack message.

4. The attack source identification system according to claim 2 or 3, wherein: The electronic control device further includes an acquisition unit configured to acquire a message ID of the message and a process name of the process each time a message is sent from a process executed by the electronic control device. The generating unit is configured to generate the history information using the message ID and the process name acquired by the acquiring unit.

5. The attack source identification system according to claim 4, wherein: The message is a CAN message, The acquisition unit is configured to acquire the CAN-ID of the CAN message and the process name of the process each time a CAN message is sent from a process executed by the process itself.

6. An attack source identification device, comprising: multiple electronic control devices; a gateway device communicably connected to the plurality of electronic control devices; as well as an analysis device communicatively connected to the plurality of electronic control devices, The electronic control device comprises: a generating unit configured to generate history information of messages sent from a process executed by the self-process; and a transmitting unit configured to transmit at least a part of the history information to the analyzing device, The gateway device has: a detection unit configured to detect an attack message from messages sent and received by the plurality of electronic control devices, The analysis device comprises: The identification unit is configured to identify a transmission source of the attack message by using detection information related to the attack message and information received from the plurality of electronic control devices when the attack message is detected.

7. An attack source identification method for an attack source identification system, the attack source identification system comprising: multiple electronic control devices; a gateway device communicably connected to the plurality of electronic control devices; as well as an analysis device communicatively connected to the plurality of electronic control devices, The electronic control device performs the following process: Generates a process that generates history information of messages sent from a process that executes itself; and sending process, sending at least a part of the historical record information to the analyzing device, The gateway device performs the following process: a detection process, detecting attack messages from messages sent and received by the plurality of electronic control devices, The analysis device performs the following process: The identification process, when the attack message is detected, uses the detection information related to the attack message and the information received from the plurality of electronic control devices to identify the transmission source of the attack message.

8. A program is a program of an attack source identification system, wherein the attack source identification system comprises: multiple electronic control devices; a gateway device communicably connected to the plurality of electronic control devices; as well as an analysis device communicatively connected to the plurality of electronic control devices, The program is used to enable the electronic control device to execute the following process: Generates a process that generates history information of messages sent from a process that executes itself; and sending process, sending at least a part of the historical record information to the analyzing device, The gateway device is enabled to execute the following process: a detection process, detecting attack messages from messages sent and received by the plurality of electronic control devices, And the analysis device performs the following process: The identification process, when the attack message is detected, uses the detection information related to the attack message and the information received from the plurality of electronic control devices to identify the transmission source of the attack message.

Images