Information notification method and information notification device

Abstract

Acquiring event information of a plurality of events occurring due to a security attack to the monitored object in a past first period; determining, for each category of events, a trend of occurrence of the category of events in a future second period by the monitored object, and a priority of temporary response or permanent response for the category of events, on the basis of the acquired event information; and notifying the occurrence trends and priorities determined for each category of events.

Description

Technical Field

[0001] The present disclosure relates to an information notification method and an information notification device. Background Art

[0002] Patent Document 1 discloses an alarm notification device that performs cluster analysis based on the characteristics of an incident that has occurred, determines an incident that is more likely to be abnormal as a high priority based on the analysis result, and notifies an alarm.

[0003] Prior art literature

[0004] Patent Literature

[0005] Patent Document 1: Japanese Patent Application Publication No. 2019-175070 Summary of the invention

[0006] Problem that the invention aims to solve

[0007] However, the technology disclosed in Patent Document 1 is mainly intended to prioritize events that are more likely to cause abnormality among a large number of events notified, and is unable to prioritize events that may cause further damage.

[0008] Solutions for solving problems

[0009] An information notification method involved in one embodiment of the present invention performs the following processing: obtaining event information of multiple events that occurred due to security attacks on a monitored object in a first period in the past; determining, based on the obtained event information, for each category of events, the occurrence trend of events of that category occurring at the monitored object in a second period in the future, and the priority of temporary or permanent response to events of that category; and presenting the occurrence trend and priority determined for each category of events.

[0010] In addition, these general or specific methods may also be implemented through systems, methods, integrated circuits, computer programs, or non-transitory recording media such as computer-readable CD-ROMs, or may also be implemented through any combination of systems, methods, integrated circuits, computer programs, and non-transitory recording media.

[0011] Effects of the Invention

[0012] According to the above aspect, it is possible to preferentially deal with an event that may cause greater damage in the future, thereby suppressing the damage caused by the event. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 This is a schematic diagram of an information notification system according to an embodiment of the present invention.

[0014] Figure 2 This is a block diagram showing an example of the hardware configuration of the information processing device according to the embodiment.

[0015] Figure 3 This is a block diagram showing an example of the hardware configuration of the vehicle according to the embodiment.

[0016] Figure 4 This is a block diagram showing an example of the functional structure of the information notification system involved in the embodiment.

[0017] Figure 5 This is a table showing a specific example of event statistical information.

[0018] Figure 6 This is a table showing another example of event statistical information.

[0019] Figure 7 This is a table showing another example of event statistical information.

[0020] Figure 8 This is a table showing another example of event statistical information.

[0021] Fig. 9 It is a graph showing the change over time in the number of occurrences of event information.

[0022] Fig.10 This is a sequence diagram showing an example of an information notification method of the information notification system according to the embodiment.

[0023] Fig.11 This is a sequence diagram showing an example of an information notification method of the information notification system according to Modification 1.

[0024] Fig.12 This is a sequence diagram showing an example of an information notification method of the information notification system involved in Modification Example 2.

[0025] Fig.13 This is a sequence diagram showing an example of an information notification method of the information notification system involved in Modification Example 3.

[0026] Fig.14 This is a diagram showing an example of a probability density function in which an index indicating an occurrence trend is used as a probability variable.

[0027] Fig.15 This is a diagram showing an example of expressing distribution using a range including a plurality of index values ​​that an index indicating an occurrence trend may take.

[0028] Fig.16 This is a diagram showing an example of expressing distribution using a plurality of index values ​​that an index representing an occurrence trend may take.

[0029] Fig.17 This is a diagram for explaining a first example of a method for determining a priority according to Modification Example 4.

[0030] Fig.18 This is a diagram for explaining a second example of the method for determining the priority according to Modification Example 4.

[0031] Fig.19 This is a diagram for explaining a third example of the method for determining the priority according to Modification Example 4.

[0032] Fig. 20 This is a diagram for explaining a fourth example of the method for determining the priority according to Modification Example 4.

[0033] Fig.21 This is a diagram for explaining a fifth example of the method for determining the priority according to Modification Example 4.

[0034] Fig. 22 This is a diagram for explaining a sixth example of the method for determining the priority according to Modification Example 4.

[0035] Fig.23 This is a diagram for explaining a seventh example of the method for determining the priority according to Modification Example 4.

[0036] Fig.24 This is a diagram for explaining an eighth example of the method for determining the priority according to Modification Example 4.

[0037] Fig.25 This is a sequence diagram showing an example of an information notification method of the information notification system according to Modification 4. DETAILED DESCRIPTION

[0038] (Insights that form the basis of this disclosure)

[0039] If a weakness in information security is found in a vehicle or other device, the same type of security attack may occur multiple times in the device or other devices of the same model. Therefore, in order to minimize the damage caused by security attacks, the SIRT (Security Incident Response Team) should quickly determine whether to take temporary or permanent measures to deal with security attacks.

[0040] However, temporary responses, such as functional weakening (functional stoppage), have a great impact on end users. Therefore, there is a problem that it is difficult to decide to conduct temporary responses as a response to security attacks without sufficient judgment materials. In addition, in permanent responses, due to the limited number of SIRT personnel, it is difficult to respond to multiple incidents at the same time.

[0041] The present inventors have found, through intensive research, an information notification method and the like that can provide determination materials for easily and accurately determining whether temporary measures can be implemented and the priority of permanent measures.

[0042] The information notification method involved in the first embodiment of the present invention performs the following processing: obtaining event information of multiple events that occurred due to security attacks on the monitored object in the past first period; based on the obtained event information, determining, for each category of events, the occurrence trend of events of this category occurring in the monitored object in the future second period, and the priority of temporary or permanent response to events of this category; and presenting the occurrence trend and the priority determined for each category of events.

[0043] Therefore, it is possible to provide judgment materials for easily and accurately judging whether a temporary response can be implemented and the priority of a permanent response. For example, a SIRT that receives a notification can execute a temporary response or a permanent response as soon as possible, and can easily determine the implementation judgment of a temporary response and the implementation priority of a permanent response. Thus, even with limited personnel, it is possible to prioritize incidents that have a great impact on security.

[0044] The information notification method involved in the second embodiment of the present invention is, according to the information notification method involved in the first embodiment, the priority indicates that the higher the priority, the earlier the temporary response or the permanent response is performed, and the priority is determined based on the occurrence trend: the greater the damage caused by the security attack in the future, the higher the priority.

[0045] This makes it possible to preferentially respond to future events that will cause great damage due to security attacks even with a limited number of personnel.

[0046] An information notification method according to a third aspect of the present disclosure is the information notification method according to the second aspect, wherein the occurrence trend is related to a change over time in the number of occurrences of events of each category.

[0047] Therefore, for example, a SIRT that has received the notification can easily grasp the occurrence trend of future event information.

[0048] The information notification method involved in the fourth embodiment of the present disclosure is, according to the information notification method involved in the third embodiment, the occurrence trend is the slope of the time change at the first moment within the second period, and the priority is determined as follows: the larger the slope, the higher the priority.

[0049] According to this, an event with a larger slope and an increasing trend is determined to have a higher priority for response, and thus it is possible to encourage a higher priority response to an event with a larger slope and an increasing trend.

[0050] The information notification method involved in the 5th mode of the present disclosure is, according to the information notification method involved in the 3rd mode, the occurrence trend is a curve representing the time-dependent change in the second period, and the priority is determined as follows: the larger the maximum value of the curve, the higher the priority.

[0051] According to this, an event with a larger maximum value of the curve is determined to have a higher priority for response, and thus it is possible to encourage the event with a large maximum value of the curve to be dealt with more preferentially.

[0052] The information notification method involved in the 6th mode of the present disclosure is, based on the information notification method involved in the 3rd mode, the occurrence trend is a curve representing the time-dependent changes in the second period, and the priority is determined as follows: the longer the period in the curve that is larger than the prescribed number of occurrences, the higher the priority.

[0053] According to this, an event having a longer period than the predetermined number of occurrences is determined to have a higher priority for response, and thus it is possible to encourage a higher priority response to an event having a longer period than the predetermined number of occurrences.

[0054] The information notification method involved in the 7th mode of the present disclosure is, according to the information notification method involved in the 3rd mode, the occurrence trend is the total number of occurrences of events in the second period, and the priority is determined as follows: the larger the total number, the higher the priority.

[0055] According to this, an event having a larger total number of occurrences of event information in the second period is determined to have a higher priority for response, so that an event having a larger total number of occurrences of event information in the second period can be urged to be responded to with higher priority.

[0056] The information notification method involved in the 8th mode of the present disclosure is, according to the information notification method involved in the 3rd mode, the occurrence trend is the total number of events occurring within the second period, and the priority is determined as follows: the greater the total damage amount calculated by multiplying the total number by the damage amount caused by the occurrence of one event, the higher the priority.

[0057] According to this, an event with a larger total damage amount is determined to have a higher priority for response, and thus it is possible to encourage a higher priority response to an event with a large total damage amount.

[0058] The information notification method involved in the 9th mode of the present disclosure is, according to the information notification method involved in any one of the 1st to 8th modes, the occurrence trend includes the distribution of multiple indicator values ​​that may be determined in the determination in the indicator representing the occurrence trend.

[0059] Therefore, the priority can be determined in consideration of the accuracy of the prediction of the occurrence trend.

[0060] The information notification method according to a tenth aspect of the present disclosure is the information notification method according to the ninth aspect, wherein the distribution is represented by a probability density function in which an indicator representing the occurrence tendency is set as a probability variable.

[0061] Therefore, the priority can be determined in consideration of the probability of occurrence of the occurrence trend.

[0062] The information notification method according to the eleventh aspect of the present disclosure is the information notification method according to the ninth aspect, wherein the distribution is represented by a first range including the plurality of index values.

[0063] Therefore, the priority can be determined in consideration of the distribution of the occurrence trend.

[0064] The information notification method according to the twelfth aspect of the present disclosure is the information notification method according to any one of the ninth to eleventh aspects, wherein the priority is determined such that the larger the expected value based on the distribution, the higher the priority.

[0065] The information notification method involved in the 13th aspect of the present disclosure is, according to the information notification method involved in any one of the 9th to 11th aspects, the priority is determined such that the larger the maximum value among the multiple indicator values, the higher the priority.

[0066] The information notification method according to the 14th aspect of the present disclosure is the information notification method according to any one of the 9th to 11th aspects, wherein the priority is determined such that the larger the variance of the distribution is, the higher the priority is.

[0067] The information notification method involved in the 15th mode of the present disclosure is an information notification method involved in any one of the 9th to 11th modes, wherein the priority is determined as follows: the greater the proportion of the distribution of indicator values ​​above the first threshold in the indicator calculated based on the distribution, the higher the priority.

[0068] The information notification method involved in the 16th mode of the present disclosure is, according to the information notification method involved in any one of the 9th to 11th modes, the priority is determined using a machine learning model, and the machine learning model is generated by machine learning by taking multiple occurrence trends corresponding to multiple first event information generated in the past third period as input and using first evaluation values ​​determined respectively for the multiple occurrence trends as correct answer data.

[0069] The information notification method involved in the 17th mode of the present disclosure is, according to the information notification method involved in any one of the 9th to 11th modes, the priority ranking based on the priority is determined using a machine learning model, and the machine learning model is generated by machine learning by taking multiple occurrence trends corresponding to multiple first event information generated in the past third period as input and using the priority rankings determined respectively for the multiple occurrence trends as correct answer data.

[0070] The information notification method involved in the 18th mode of the present disclosure is, according to the information notification method involved in any one of the 9th to 11th modes, in the decision, the following processing is also performed: for at least two values ​​of the expected value based on the distribution, the maximum value of the multiple indicator values, the variance of the distribution, the proportion of the indicator value distribution above the first threshold in the indicator calculated based on the distribution, and the evaluation value determined using a machine learning model based on multiple occurrence trends corresponding to multiple first event information generated in the past third period, a second evaluation value is calculated by sorting the multiple events according to the size of the value; and a third evaluation value is calculated for each event by adding at least two second evaluation values ​​calculated respectively for the multiple events, and the priority is determined as follows: the larger the third evaluation value, the higher the priority.

[0071] The information notification method involved in the 19th mode of the present disclosure is, according to the information notification method involved in any one of the 9th to 11th modes, in the decision, further performing the following processing: calculating fourth evaluation values ​​for the multiple events respectively, and in the calculation of the fourth evaluation value, performing the following processing for the event to be dealt with: determining a fifth evaluation value corresponding to the size of the value based on at least two of the expected value based on the distribution, the maximum value among the multiple indicator values, the variance of the distribution, the proportion of the indicator value distribution above the first threshold in the indicator calculated based on the distribution, and the evaluation value determined using a machine learning model based on multiple occurrence trends corresponding to multiple first event information generated in the past third period; and calculating the fourth evaluation value by adding at least two of the fifth evaluation values, the priority is determined as follows: the larger the fourth evaluation value, the higher the priority.

[0072] The information notification method involved in the 20th mode of the present disclosure is, according to the information notification method involved in any one of the first to eighth modes, wherein in the decision, for each category of the event and each model of the monitored object, the occurrence trend of events of the category and the model of the monitored object in the second period in the future and the priority of temporary or permanent response to the events of the category and the model are determined.

[0073] Therefore, it is possible to determine the priority of temporary or permanent response for each type of event and each model of the monitored object.

[0074] The information notification method involved in the 21st mode of the present disclosure is, according to the information notification method involved in any one of the first to eighth modes, wherein in the determination, for each category of the event, the total amount of damage is calculated by multiplying the total number of event information generated for the category by the amount of damage generated by the generation of the event information of the category, and the priority is determined as follows: the larger the total amount of damage, the higher the priority.

[0075] Therefore, it is possible to determine the priority according to the total amount of damage.

[0076] The information notification method involved in the 22nd mode of the present disclosure is, according to the information notification method involved in any one of the 1st to 8th modes, further performing the following processing: calculating an indicator value related to the number of occurrences of the event category within the second period based on the occurrence trend of the event category determined for each category of the event; and notifying the recommendation of the temporary response when the indicator value exceeds the baseline value.

[0077] Therefore, when the index value related to the number of occurrences in the second period exceeds the reference value, it is possible to notify that a temporary measure is recommended.

[0078] The information notification method involved in the 23rd mode of the present disclosure is, according to the information notification method involved in the 10th mode, further performing the following processing: calculating a sixth evaluation value based on the occurrence trend of the category of the event determined for each category of the event; and in the case where the sixth evaluation value exceeds the baseline value, notifying the recommendation of the temporary response.

[0079] Therefore, when the fifth evaluation value exceeds the reference value, it is possible to notify that a temporary measure is recommended.

[0080] The information notification method involved in the 24th mode of the present disclosure is, according to the information notification method involved in any one of the 1st to 22nd modes, the occurrence trend is determined using a machine learning model, and the machine learning model is generated by machine learning by taking a plurality of first event information generated in a past third period as input and taking the actual situation of the occurrence trend of a plurality of second event information generated in a past fourth period after the third period as correct answer data.

[0081] Therefore, machine learning models can be used to predict the occurrence trends of future event information.

[0082] The information notification method involved in the 25th mode of the present disclosure is, according to the information notification method involved in any one of the 1st to 22nd modes, further performing the following processing: using a machine learning model to determine the total amount of damage caused by the security attack within the second period, the machine learning model is generated by machine learning using a plurality of first event information generated within a past third period as input and the total amount of damage based on a plurality of second event information generated within a past fourth period after the third period as correct answer data.

[0083] Therefore, it is possible to use machine learning models to predict the total amount of damage caused by future security attacks.

[0084] The information notification method involved in the 26th mode of the present disclosure is, according to the information notification method involved in any one of the 1st to 22nd modes, the occurrence trend is determined by using the correlation between the actual situation of the occurrence trend of multiple first event information generated in the past third period and multiple second event information generated in the past fourth period after the third period.

[0085] Therefore, it is possible to predict occurrence trends based on past actual events.

[0086] The information notification method involved in the 27th mode of the present disclosure is, according to the information notification method involved in any one of the 1st to 22nd modes, further performing the following processing: using the correlation between multiple first event information generated in the past third period and the actual situation of the total amount of damage based on multiple second event information generated in the past fourth period after the third period, to determine the total amount of damage caused by the security attack in the second period.

[0087] Therefore, the total amount of damage caused by security attacks in the future can be predicted based on past actual situations.

[0088] The information notification device involved in the 28th mode of the present disclosure comprises: an acquisition unit, which acquires event information of multiple events that occurred due to security attacks on a monitored object in a first period in the past; a decision unit, which determines, based on the acquired event information, for each category of events, the occurrence trend of events of the category occurring at the monitored object in a second period in the future, and the priority of temporary or permanent response to events of the category; and a presentation unit, which presents the occurrence trend and the priority determined for each category of events.

[0089] Therefore, it is possible to provide judgment materials for easily and accurately judging whether a temporary response can be implemented and the priority of a permanent response. For example, a SIRT that receives a notification can execute a temporary response or a permanent response as soon as possible, and can easily determine the implementation judgment of a temporary response and the implementation priority of a permanent response. Thus, even with limited personnel, it is possible to give priority to responding to events that have a great impact on security.

[0090] In addition, these general or specific methods can also be implemented through systems, devices, integrated circuits, computer programs, or non-transitory recording media such as computer-readable CD-ROMs, or can also be implemented through any combination of systems, methods, integrated circuits, computer programs, and non-transitory recording media.

[0091] Hereinafter, an information notification method and an information processing device according to one embodiment of the present disclosure will be described in detail with reference to the drawings.

[0092] In addition, the embodiments described below all illustrate a specific example of the present disclosure. The numerical values, shapes, materials, constituent elements, configuration positions of constituent elements, connection methods, steps, and the order of steps shown in the following embodiments are examples and are not intended to limit the present disclosure. In addition, the constituent elements of the following embodiments that are not recorded in the independent claims representing the highest concept are described as arbitrary constituent elements.

[0093] (Implementation Method)

[0094] Next, use Figures 1 to 10 The implementation method will be described.

[0095] [structure]

[0096] Figure 1 This is a schematic diagram of an information notification system according to an embodiment of the present invention.

[0097] Specifically, in Figure 1 , a safety monitoring device 100, an information notification device 200, a vehicle 400, a communication network 300, and a base station 310 of a mobile communication network are shown. The safety monitoring device 100, the information notification device 200, and the vehicle 400 are connected in a communicative manner via the communication network 300 so that information can be sent and received to each other.

[0098] The security monitoring device 100 is a device for monitoring the status of the vehicle 400, and may also have the functions of a monitoring center (SOC (Security Operation Center) and SIRT, for example. As a function of a monitoring center, the security monitoring device 100 periodically obtains log information from the vehicle 400, and monitors the status of the vehicle 400 based on the obtained log information. Specifically, the security monitoring device 100 determines whether there is a security attack on the vehicle 400 based on the log information. The security monitoring device 100 can determine whether there is a security attack on the vehicle 400 in almost real time by shortening the period from the next acquisition of log information from the vehicle 400. When the security monitoring device 100 determines that there is a security attack on the vehicle 400, it sends the event information obtained by the determination to the information notification device 200.

[0099] In addition, as a function of SIRT, the safety monitoring device 100 obtains notification information indicating the predicted occurrence trend and priority from the information notification device 200, and presents the notification information to the SIRT personnel. The safety monitoring device 100 receives input of response information generated by the SIRT personnel through research with reference to the notification information, and sends the response information to the vehicle 400.

[0100] In addition, the function of the monitoring center and the function of the SIRT of the safety monitoring device 100 may also be implemented by different devices. That is, in this case, the first device having the function of the monitoring center obtains log information from the vehicle 400 and outputs the generated event information to the information notification device 200. The second device having the function of the SIRT obtains notification information from the information notification device 200 and outputs the generated response information to the vehicle 400.

[0101] In addition, Figure 1 , one vehicle 400 is shown, but the information notification system 1 may also include a plurality of vehicles 400. That is, the security monitoring device 100 may periodically obtain log information from the plurality of vehicles 400, respectively, and determine whether there is a security attack on each vehicle 400, and send the event information obtained for each vehicle 400 to the information notification device 200. The security monitoring device 100 generates event information when it is determined that there is a security attack on the vehicle 400, and does not generate event information when it is determined that there is no security attack on the vehicle 400. The security monitoring device 100 is composed of a computer such as a server.

[0102] The information notification device 200 is a device that determines the occurrence trend of event information of the category in the future and the priority of temporary or permanent response to the event information of the category for each category of event information based on a plurality of past event information, and notifies the determined occurrence trend and priority. The information notification device 200 acquires event information from the security monitoring device 100, and estimates the occurrence trend of event information in the future for each category of event information based on the acquired event information. The information notification device 200 is composed of a computer such as a server.

[0103] Vehicle 400 is an autonomous driving vehicle capable of autonomous driving. Vehicle 400 has a presentation unit for presenting information. Vehicle 400 controls the movement of vehicle 400 in response to the received instructions. Specifically, vehicle 400 may present information in the presentation unit in response to the instructions, or may control the movement related to the movement of vehicle 400 (hereinafter referred to as the movement movement). Vehicle 400 may be, for example, a vehicle for a car sharing service or a vehicle for a taxi service. Vehicle 400 is not limited to an autonomous driving vehicle capable of autonomous driving, but may also be a car with driving assistance functions such as ADAS functions.

[0104] In addition, in the present embodiment, the security monitoring device 100 and the information notification device 200 are configured as separate bodies, but the present invention is not limited thereto and they may be configured as an integrated body. In other words, the security monitoring device 100 may also have the function of the information notification device 200.

[0105] Figure 2 This is a block diagram showing an example of the hardware configuration of the information notification device according to the embodiment.

[0106] like Figure 2 As shown, the information notification device 200 includes a CPU (Central Processing Unit) 21, a main memory 22, a storage device 23, and a communication IF (Interface) 24 as a hardware configuration.

[0107] The CPU 21 is a processor that executes a program stored in the storage device 23 or the like.

[0108] The main memory 22 is a volatile storage area used as a work area when the CPU 21 executes a program.

[0109] The storage device 23 is a nonvolatile storage area for storing programs, event information, and the like.

[0110] The communication IF 24 is a communication interface for communicating with the security monitoring device 100 via the communication network 300. The communication IF 24 is, for example, a wired local area network (LAN) interface. In addition, the communication IF 24 may also be a wireless LAN interface. In addition, the communication IF 24 is not limited to a LAN interface, and may be any communication interface as long as it is a communication interface that can establish a communication connection with a communication network.

[0111] Figure 3 This is a block diagram showing an example of the hardware configuration of the vehicle according to the embodiment.

[0112] like Figure 3 As shown, the vehicle 400 includes a TCU (Telematics Control Unit) 41 , a plurality of ECUs 42 , and a storage device 43 as a hardware configuration.

[0113] The TCU 41 is a communication unit for wireless communication between the vehicle 400 and the communication network 300. The TCU 41 is a communication unit including a cellular module that complies with the standard of the mobile communication network.

[0114] The plurality of ECUs 42 are control circuits for controlling the devices provided in the vehicle 400. The devices provided in the vehicle 400 include, for example, an engine, a motor, a meter, a transmission, a brake, a steering device, a power window, an air conditioner, etc. In addition, at least one of the plurality of ECUs 42 is a control circuit for controlling the autonomous driving of the vehicle 400. The plurality of ECUs 42 may also be provided corresponding to these various devices, respectively. The plurality of ECUs 42 may also respectively include a storage unit (non-volatile storage area) storing a program executed by each ECU 42, but this is not shown in the figure. The storage unit is, for example, a non-volatile memory.

[0115] The storage device 43 is a nonvolatile storage area for storing control programs, etc. The storage device 43 is implemented by, for example, a HDD (Hard Disk Drive) or an SSD (Solid State Drive).

[0116] Next, the functional configurations of the information notification device 200 and the vehicle 400 of the information notification system 1 will be described. Figure 4 is a block diagram showing an example of the functional structure of the information notification system involved in the embodiment. Figure 4 The communication network 300 is omitted.

[0117] First, the functional structure of the information notification device 200 will be described.

[0118] The information notification device 200 includes a communication unit 210 , an acquisition unit 220 , a determination unit 230 , a notification unit 240 , and a storage unit 250 .

[0119] The communication unit 210 transmits and receives information to and from the security monitoring device 100 via the communication network 300. Specifically, the communication unit 210 receives event information from the security monitoring device 100. The event information received by the communication unit 210 is accumulated in the storage unit 250. In addition, the communication unit 210 transmits notification information to the security monitoring device 100. In addition, the communication unit 210 is implemented by the communication IF 24.

[0120] Figure 5 This is a table showing a specific example of event statistical information.

[0121] The event statistics information is information generated based on event information generated during the past first period due to a security attack on the vehicle 400 being the monitoring target. Figure 5 As shown, the event statistical information accumulated in the storage unit 250 includes an ID, a date, an event category, and a number of occurrences. The event statistical information is statistical information related to the event information generated based on the accumulated multiple event information. The ID is, for example, information for identifying events of the same category that occur on the same day. The date indicates the date on which the event occurs. The event category indicates the category of the event that occurs, for example, by a number. The number of occurrences indicates the number of events of the same category that occur on the same day.

[0122] Figure 6 This is a table showing another example of information included in the event statistical information.

[0123] exist Figure 5 In , the event statistics information is set to include the date of the event as the information related to the time of the event, but it can also be replaced by Figure 6 Contains the date and time when the event occurred as shown.

[0124] Figure 7 This is a table showing another example of information included in the event statistical information.

[0125] Set as Figure 5 The event category is represented by a number representing the event category, but is not limited to this. Figure 7 As shown, the event is represented by information indicating the characteristics of the event, such as the attack method and its impact, and the availability of the attack.

[0126] Figure 8 This is a table showing another example of information included in the event statistical information.

[0127] exist Figure 5In the example, the event statistics information includes the number of occurrences of the same category of events occurring on the same day, but is not limited to this. Figure 8 The frequency of occurrence is included as shown. The frequency of occurrence is defined in a step-by-step manner according to the number of occurrences in one day, for example, and can be classified into five levels of frequency: "very rare", "rare", "normal", "many" and "very many". The number of levels of frequency is not limited to 5, and can also be 2 to 4, or 6 or more.

[0128] In addition, the vehicle 400 that is the target of the security attack is an example of a monitoring object. In addition, the monitoring object is not limited to the vehicle 400, as long as it is a device equipped with a computer and having a function of communicating with an external network. In other words, it is not limited to vehicle monitoring, and can also be applied to IoT monitoring, server monitoring, building monitoring, factory monitoring, monitoring of mobile objects such as aircraft and ships, etc.

[0129] Return to use Figure 4 Description.

[0130] The acquisition unit 220 acquires a plurality of event information generated during the past first period due to the security attack on the vehicle 400 from the storage unit 250. In addition, the acquisition unit 220 is not limited to acquiring a plurality of event information generated during the first period from the storage unit 250, and may also acquire a plurality of event information from the security monitoring device 100, or may also acquire event statistical information.

[0131] The decision unit 230 determines, for each category of event information, the occurrence trend of event information of the category of vehicle 400 in the second period in the future, and the priority of temporary or permanent response to the event information of the category based on the acquired multiple event information or event statistical information. Specifically, the decision unit 230 first determines the occurrence trend of event information of the category in the second period in the future (hereinafter referred to as "predicted occurrence trend"), and then determines the priority of temporary or permanent response to the event information of the category. The predicted occurrence trend is related to the change over time in the number of occurrences of each category of event information.

[0132] Fig. 9 It is a graph showing the change over time in the number of occurrences of event information.

[0133] For example, the predicted occurrence trend is the slope of the time-varying number of occurrences of each category of event information at the first moment t1 in the second period. That is, the predicted occurrence trend is the slope of the tangent at the first moment t1 in the time-varying curve. In addition, for example, the predicted occurrence trend may also be a curve (chart) showing the time-varying number of occurrences of events in the second period. In addition, for example, the predicted occurrence trend may also be the total number of occurrences of event information in the second period. That is, the predicted occurrence trend may also be Fig. 9 The area between the curve representing the number of occurrences in the second period and the straight line representing 0 (i.e., Fig. 9 The area of ​​the oblique hatched area in the figure).

[0134] The predicted occurrence trend may also be determined using machine learning, for example. In this case, the predicted occurrence trend is determined using a machine learning model that is generated using machine learning that takes as input a plurality of first event information generated in a past third period and takes as correct answer data the actual situation of the occurrence trend based on a plurality of second event information generated in a past fourth period after the third period.

[0135] In addition, the predicted occurrence trend may also be determined using a rule-based model, for example. In this case, the predicted occurrence trend is determined using the correlation between a plurality of first event information generated in the past third period and the actual situation of the occurrence trend based on a plurality of second event information generated in the past fourth period after the third period.

[0136] After determining the predicted occurrence trend, the decision unit 230 determines the priority of each category based on the occurrence trend of the event information of each category, so that the greater the damage caused by the security attack in the future, the higher the priority. The priority indicates that the higher the priority, the earlier the temporary response or permanent response is performed. The priority can also be determined as follows: the greater the slope of the predicted occurrence trend, the higher the priority. The priority can also be determined as follows: the greater the maximum value of the curve as the predicted occurrence trend, the higher the priority. The priority can also be determined as follows: the longer the period in the curve as the predicted occurrence trend is greater than the specified number of occurrences, the higher the priority. The priority can also be determined as follows: the greater the total number of occurrences of event information within the second period as the predicted occurrence trend, the higher the priority.

[0137] Return to use Figure 4 Description.

[0138] The notification unit 240 notifies the predicted occurrence trend and priority determined for each type of event information. Specifically, the notification unit 240 transmits notification information indicating the predicted occurrence trend and priority to the security monitoring device 100 via the communication unit 210 .

[0139] The acquisition unit 220 , the determination unit 230 , and the notification unit 240 are implemented by the CPU 21 , the main memory 22 , etc. The storage unit 250 is implemented by the storage device 23 .

[0140] [action]

[0141] Fig.10 This is a sequence diagram showing an example of an information notification method of the information notification system according to the embodiment.

[0142] The vehicle 400 transmits log information to the safety monitoring device 100 (S11). The log information includes, for example, the control state of the vehicle 400 and the detection value of the sensor provided in the vehicle 400.

[0143] The security monitoring device 100 detects a security attack on the vehicle 400 based on the log information ( S12 ).

[0144] The security monitoring device 100 generates the above-mentioned event information based on the security attack, and transmits the event information to the information notification device 200 (S13).

[0145] The information notifying device 200 receives the event information (S14).

[0146] The information notification device 200 stores the received event information in the storage unit 250 ( S15 ).

[0147] The information notification apparatus 200 cyclically executes step S16 and step S17 for each category of events.

[0148] The information notification device 200 reads out event information of the type of the processing target from the storage unit 250 (S16). The event information read out here is a plurality of event information generated due to the security attack that occurred in the past first period.

[0149] The information notification device 200 determines a predicted occurrence trend based on a plurality of event information generated due to security attacks that occurred in the past first period ( S17 ).

[0150] The information notification device 200 determines the priority of each category of the event based on the predicted occurrence tendency ( S18 ).

[0151] The information notification device 200 notifies the security monitoring device 100 of the predicted occurrence trend and priority ( S19 ).

[0152] The safety monitoring device 100 uses the acquired predicted occurrence trend and priority information as a reference to determine whether to implement a temporary response, determine the response content, or assign a priority to a permanent response for each event category. The safety monitoring device 100 receives input of response information generated by SIRT personnel for causing the vehicle 400 to perform a temporary response or a permanent response for each category of events, and transmits the received response information to the vehicle 400 (S20).

[0153] Furthermore, the priority may be a relative priority among a plurality of event categories, or may be an absolute priority calculated by comparison with a predetermined reference.

[0154] The temporary response is, for example, to stop the function containing the weakness leading to the security attack and the function affected by it. In addition, when there are multiple temporary response methods corresponding to the event categories that become the object, the priority of each category of the event is used to determine the temporary response method.

[0155] The permanent countermeasure is, for example, a countermeasure of executing a software update for overcoming a weakness that leads to a security attack.

[0156] [Effects, etc.]

[0157] The information notification method involved in this embodiment obtains multiple event information generated by security attacks on vehicle 400 (monitoring object) in the past first period, and based on the multiple event information obtained, determines the occurrence trend (predicted occurrence trend) of event information of this category of vehicle 400 (monitoring object) in the future second period for each category of event information, as well as the priority of temporary or permanent response to the event information of this category, and notifies the predicted occurrence trend and priority determined for each category of event information.

[0158] Therefore, it is possible to provide judgment materials for easily and accurately judging whether a temporary response can be implemented and the priority of a permanent response. For example, a SIRT that receives a notification can easily determine the implementation judgment of a temporary response and the priority of a permanent response, and can execute a temporary response or a permanent response as quickly as possible. Thus, even with limited personnel, it is possible to prioritize responses to events that have a great impact on security.

[0159] In addition, in the information notification method according to the present embodiment, the priority indicates that the higher the priority, the earlier the temporary response or permanent response is performed, and the priority is determined based on the occurrence trend: the greater the damage caused by the future security attack, the higher the priority. Thus, even with limited personnel, it is possible to preferentially respond to events that cause greater damage due to future security attacks.

[0160] In addition, in the information notification method involved in this embodiment, the predicted occurrence trend is related to the time-dependent change in the number of occurrences of each category of event information. Therefore, for example, the SOC and SIRT that receive the notification can easily grasp the occurrence trend of future event information. As a result, efficient monitoring and response such as changing personnel configuration can be carried out.

[0161] In addition, in the information notification method involved in this embodiment, the predicted occurrence trend is the slope of the first moment in the second period in the temporal change. In addition, the priority is determined as follows: the larger the slope, the higher the priority. Accordingly, the event with a larger slope and an increasing trend is determined to have a higher priority to be dealt with, so that the event with a large slope and an increasing trend can be dealt with more preferentially.

[0162] In addition, in the information notification method according to the present embodiment, the predicted occurrence trend is a curve indicating the change over time in the second period. In addition, the priority is determined such that the larger the maximum value of the curve, the higher the priority. Accordingly, an event with a larger maximum value of the curve is determined to have a higher priority to be dealt with, so that an event with a large maximum value of the curve can be dealt with with higher priority.

[0163] In addition, in the information notification method involved in this embodiment, the priority is determined as follows: the longer the period in the curve is greater than the specified number of occurrences, the higher the priority. Accordingly, the longer the period is greater than the specified number of occurrences, the higher the priority is determined to be, so that the event with a longer period than the specified number of occurrences can be handled with higher priority.

[0164] In addition, in the information notification method involved in this embodiment, the predicted occurrence trend is the total number of occurrences of event information in the second period. In addition, the priority is determined as follows: the larger the total number, the higher the priority. Accordingly, the larger the total number of occurrences in the second period, the higher the priority of the event to be dealt with, so that the event with a large total number of occurrences in the second period can be dealt with more preferentially.

[0165] In addition, in the information notification method according to the present embodiment, the predicted occurrence trend is determined using a machine learning model, which is generated by machine learning using a plurality of first event information generated in the past third period as input and using the actual situation of the occurrence trend of a plurality of second event information generated in the past fourth period after the third period as correct answer data. Therefore, the occurrence trend of future event information can be predicted using the machine learning model.

[0166] In addition, in the information notification method involved in this embodiment, the correlation between the plurality of first event information generated in the past third period and the actual situation based on the occurrence trend of the plurality of second event information generated in the past fourth period after the third period is used to determine. Therefore, the occurrence trend can be predicted based on the actual situation in the past.

[0167] [Modifications]

[0168] (1) Modification 1

[0169] In the above-described embodiment, the event information is read ( S16 ) and the predicted occurrence trend is determined ( S17 ) for each type of event, and the priority is determined for each type of event, but the present invention is not limited thereto.

[0170] Fig.11 is a sequence diagram showing an example of an information notification method of an information notification system according to Modification Example 1. Fig.11 In the case of the same processing as in the implementation mode, the same as Fig.10 The same reference numerals are used and the description thereof is omitted.

[0171] For example, Fig.11 As shown, it is also possible to further read out event information (S16) and determine the predicted occurrence trend (S17) for each model of vehicle 400 (i.e., monitored object) and for each category of event, and determine the priority for each category of event. In other words, it is also possible to determine the predicted occurrence trend and priority for each model and each category of event. In addition, it is also possible to determine the predicted occurrence trend and priority for each category and each model of event.

[0172] (2) Modification 2

[0173] In the above-described embodiment, the priority is determined based on the predicted occurrence trend, but it may be determined based on the total amount of damage further calculated based on the predicted occurrence trend.

[0174] Fig.12 is a sequence diagram showing an example of an information notification method of an information notification system according to Modification Example 2. Fig.12 In the case of the same processing as in the implementation mode, the same as Fig.10 The same reference numerals are used and the description thereof is omitted.

[0175] After step S17, the information notification device 200 determines the total damage amount for each category of the event. For example, the information notification device 200 calculates the total damage amount (total damage impact) by multiplying the total number of event information of the category by the damage amount (damage impact) caused by the occurrence of one event information of the category.

[0176] In addition, the total amount of damage can also be calculated using a machine learning model, which is generated by machine learning using multiple first event information generated in the past third period as input and the actual situation of the total amount of damage based on multiple second event information generated in the past fourth period after the third period as correct answer data.

[0177] Alternatively, the total amount of damage may be determined using a correlation between a plurality of first event information items generated in a past third period and actual amounts of damage based on a plurality of second event information items generated in a past fourth period after the third period.

[0178] The information notification device 200 determines the priority level so that the greater the total amount of damage (total damage impact), the higher the priority level (S18a).

[0179] The information notification device 200 notifies the security monitoring device 100 of the predicted occurrence trend, priority, and total damage influence (S19a).

[0180] According to this, an event with a larger total damage amount is determined to have a higher priority for response, and thus it is possible to encourage a higher priority response to an event with a large total damage amount.

[0181] (3) Modification 3

[0182] Fig.13 is a sequence diagram showing an example of an information notification method of an information notification system according to Modification Example 3. Fig.13 In the case of the same processing as in the implementation mode, the same as Fig.10 The same reference numerals are used and the description thereof is omitted.

[0183] After step 17, the information notification device 200 determines whether the future occurrence count is greater than a reference value (S17b).

[0184] If the number of future occurrences is greater than the reference value (YES in S17b), the information notification device 200 notifies the security monitoring device 100 of a recommendation to implement temporary measures (S17c), otherwise (NO in S17b), the next process is performed.

[0185] In addition, it is not limited to determining whether the number of occurrences in the future is greater than the reference value, and it is also possible to determine whether the probability of occurrence obtained by dividing the number of occurrences of the event by the number of models is greater than the threshold. In this case, if the probability of occurrence is greater than the threshold, step S17c is performed, otherwise the next process is performed. In addition, it is not limited to determining whether the number of occurrences in the future is greater than the reference value, and it is also possible to determine whether the total amount of damage in the future is greater than the threshold by calculating the total amount of damage for each category of the event. In this case, if the total amount of damage is greater than the threshold, step S17c is performed, otherwise the next process is performed.

[0186] In this way, the information notification device 200 calculates an index value related to the number of occurrences of the event category during the second period based on the occurrence trend of the event category determined for each event category. As described above, the index value is the future number of occurrences, the future probability of occurrence, the future total amount of damage, etc.

[0187] (4) Modification 4

[0188] In variant 4, the occurrence trend of event information of one category may also be included in the distribution of multiple indicator values ​​that may be determined in the indicator representing the occurrence trend. Specifically, the indicator representing the occurrence trend is any one of (i) the slope of the time-varying number of occurrences of each category of event information at the first moment t1 in the second period, (ii) the maximum value of the curve (graph) representing the time-varying number of occurrences of events in the second period, (iii) a period greater than a prescribed number of occurrences in the curve (graph) representing the time-varying number of occurrences of events in the second period, and (iv) the total number of occurrences of event information in the second period.

[0189] The distribution of multiple indicator values ​​can also be Fig.14 As shown, it is represented by a probability density function in which an indicator representing the occurrence trend corresponding to the distribution is set as a probability variable. Fig.14 This is a diagram showing an example of a probability density function in which an indicator representing an occurrence trend is set as a probability variable. The horizontal axis of the probability density function represents the occurrence trend, and the vertical axis represents the occurrence probability of the corresponding occurrence trend. For example, when the occurrence trend is the slope of the first moment t1 in the second period in the time-dependent change of the number of occurrences of event information of each category, the probability density function represents the relationship between the slope and the density of the occurrence probability of the slope.

[0190] In addition, the distribution of multiple indicator values ​​can also be Fig.15 As shown, it is represented by a range including a plurality of index values ​​that the index representing the occurrence trend corresponding to the distribution may take. Fig.15 This is a diagram showing an example of expressing distribution using a range including a plurality of index values ​​that an index indicating an occurrence trend may take. Fig.15 The multiple points in represent multiple index values ​​that the index representing the occurrence trend may take. The range including multiple index values ​​is represented by, for example, a range from the minimum value to the maximum value among the multiple index values.

[0191] In addition, the distribution of multiple indicator values ​​can also be Fig.16 As shown, the distribution of multiple indicator values ​​itself. Fig.16 This is a diagram showing an example of expressing distribution using a plurality of index values ​​that an index representing an occurrence trend may take. Fig.16 The multiple points in the figure represent the multiple indicator values ​​that may be obtained by the indicator indicating the trend.

[0192] Next, a method of determining the priority when the distribution of a plurality of index values ​​is represented by a probability density function will be described.

[0193] Fig.17 1 is a diagram for explaining a first example of a method for determining a priority level in Modification Example 4. Fig.17 In the figure, the expected value E1 of the occurrence trend in the probability density function f1 of the event information of category No. 1, the expected value E2 of the occurrence trend in the probability density function f2 of the event information of category No. 2, and the expected value E3 of the occurrence trend in the probability density function f3 of the event information of category No. 3 are shown. In the first example, the priority can also be determined as follows: the larger the expected value based on the probability density function, the higher the priority.

[0194] exist Fig.17 In the case of the example, the expected value E2 is greater than the expected value E1, and the expected value E1 is greater than the expected value E3. Therefore, it can also be determined that the priority of event information No. 2 is higher than the priority of event information No. 1, and it can be determined that the priority of event information No. 1 is higher than the priority of event information No. 3. In addition, the event information No. 1, the event information No. 2, and the event information No. 3 are event information of different categories. In addition, the priority of event information indicates the priority used for temporary response or permanent response to the event information.

[0195] Fig.18 2 is a diagram for explaining a second example of a method for determining a priority level in Modification Example 4. Fig.18 In the figure, the maximum value MAX1 of the domain of the occurrence trend in the probability density function f1 of the event information No. 1, the maximum value MAX2 of the domain of the occurrence trend in the probability density function f2 of the event information No. 2, and the maximum value MAX3 of the domain of the occurrence trend in the probability density function f3 of the event information No. 3 are shown. In the second example, the priority can also be determined as follows: the larger the maximum value of the domain of the occurrence trend in the probability density function, the higher the priority.

[0196] exist Fig.18 In the example, the maximum value MAX1 is greater than the maximum value MAX2, and the maximum value MAX2 is greater than the maximum value MAX1. Therefore, it can be determined that the priority of event information No. 1 is higher than the priority of event information No. 2, and it can be determined that the priority of event information No. 2 is higher than the priority of event information No. 3.

[0197] Fig.19 3 is a diagram for explaining a third example of a method for determining a priority level in Modification Example 4. Fig.19 , the variance V1 of the occurrence trend in the probability density function f1 of the event information No. 1, the variance V2 of the occurrence trend in the probability density function f2 of the event information No. 2, and the variance V3 of the occurrence trend in the probability density function f3 of the event information No. 3 are shown. In addition, Fig.19 The variances V1, V2, and V3 in are not strictly diagrams but schematic diagrams. In the third example, the priority may also be determined as follows: the larger the variance based on the probability density function, the higher the priority.

[0198] exist Fig.19 In the case of the example, variance V3 is greater than variance V1, and variance V1 is greater than variance V2. Therefore, it can also be determined that the priority of event information No.3 is higher than the priority of event information No.1, and it can be determined that the priority of event information No.1 is higher than the priority of event information No.2. In this way, by determining the priority in a manner that the larger the variance, the higher the priority, the greater the deviation of the occurrence trend, the higher the priority. In other words, the priority can be determined in a manner that the greater the risk of the occurrence trend, the higher the priority.

[0199] Fig. 20 4 is a diagram for explaining a fourth example of a method for determining a priority level in Modification Example 4. Fig. 20 In the example, the probability density function f1 of event information No. 1 shows the probability of occurrence trend being above threshold Th1 (e.g. 15%), the probability density function f2 of event information No. 2 shows the probability of occurrence trend being above threshold Th1 (e.g. 30%), and the probability density function f3 of event information No. 3 shows the probability of occurrence trend being above threshold Th1 (e.g. 5%). In the fourth example, the priority may also be determined as follows: the greater the probability of occurrence of the probability variable above threshold Th1 in the probability density function, the higher the priority.

[0200] Fig.21This is a diagram of the fifth example of the method for determining the priority of variant example 4. The fifth example is an example of a method for determining the priority using a machine learning model. The machine learning model is generated by machine learning by taking as input a plurality of occurrence trends corresponding to a plurality of first event information generated in the past third period, and using evaluation values ​​determined for the plurality of occurrence trends as correct answer data. The evaluation value in the correct answer data is an example of a first evaluation value. The evaluation value in the correct answer data can be, for example, a value determined by a person evaluating each occurrence trend, or a score based on at least one of the expected value, maximum value, and variance for calculating the priority determined based on the above-mentioned probability density function. The evaluation value corresponding to the event information is calculated by inputting the occurrence trend corresponding to the event information into the machine learning model. In the fifth example, the priority is determined as follows: the larger the calculated evaluation value, the higher the priority.

[0201] Fig. 22 This is a diagram of the sixth example of the priority determination method for explaining variant example 4. The sixth example is another example of a priority determination method using a machine learning model. The machine learning model is generated by machine learning using multiple occurrence trends corresponding to multiple first event information of different categories generated in the past third period as input, and using the priority rankings determined for the multiple occurrence trends as correct answer data. The priority ranking in the correct answer data can be, for example, the ranking determined by a person for the multiple occurrence trends, or it can be the priority ranking determined based on the priority determined based on the above-mentioned probability density function. In the latter case, the priority ranking is determined as follows: the higher the priority, the higher the ranking. By inputting multiple occurrence trends corresponding to multiple event information of different categories into the machine learning model, the priority ranking corresponding to each event information is determined. The higher the priority ranking of the event information, the higher the priority of temporary or permanent response to the event information.

[0202] Fig.23 : is a diagram of the seventh example for explaining the priority determination method of the modification example 4. In the seventh example, the evaluation value corresponding to each value of the expected value, the maximum value, and the variance determined in the first to third examples is calculated. This evaluation value is an example of the second evaluation value. For example, Fig.23As shown, for the event information No. 1, since the expected value E1 is the second largest value among the expected values ​​E1 to E3, the evaluation value of the expected value E1 is calculated as 2 points, and since the maximum value MAX1 is the first largest value among the maximum values ​​MAX1 to MAX3, the evaluation value of the maximum value MAX1 is calculated as 3 points, and since the variance V1 is the second largest value among the variances V1 to V3, the evaluation value of the variance V1 is calculated as 2 points. Similarly, the expected value E2, the maximum value MAX2, and the variance V2 of the event information No. 2 are also calculated for each evaluation value, and the expected value E3, the maximum value MAX3, and the variance V3 of the event information No. 3 are also calculated for each evaluation value. In this way, by sorting multiple event information by the expected value, the maximum value, and the variance, the evaluation value corresponding to each value is calculated. For example, the higher the rank, the greater the calculated evaluation value.

[0203] Then, the expected value, maximum value, and variance values ​​calculated for each category of event information are added together to calculate a score for each category. The score is an example of the third evaluation value. Thus, the score of event information No. 1 is calculated as 7 points, the score of event information No. 2 is calculated as 6 points, and the score of event information No. 3 is calculated as 5 points.

[0204] In addition, in the seventh example, an example of calculating the evaluation values ​​corresponding to the expected value, maximum value, and variance determined in the first to third examples is described, but in addition to the expected value, maximum value, and variance, the evaluation values ​​corresponding to the at least two values ​​can also be calculated based on the proportion of the distribution of indicator values ​​above the threshold Th1 calculated based on the distribution of the fourth to sixth examples and at least two of the evaluation values ​​determined using the machine learning model.

[0205] As such, in determining the priority, the information notification device 200 calculates the second evaluation value by sorting the multiple events by the size of the expected value based on the probability density function, the maximum value of the domain of the probability variable, the variance in the probability density function, the proportion, and the evaluation value determined using the machine learning model. Then, the information notification device 200 calculates the third evaluation value for each event by adding the at least two second evaluation values ​​calculated for the multiple events. In addition, here, the priority is determined as follows: the larger the third evaluation value, the higher the priority.

[0206] Fig.24: is a diagram of the eighth example for explaining the priority determination method of variant example 4. In the eighth example, the evaluation value corresponding to each value of the expected value, the maximum value, and the variance determined in the first to third examples is calculated. This evaluation value is an example of the fourth evaluation value. Each value of the expected value, the maximum value, and the variance is classified into a plurality of levels according to the size of the value, and the evaluation value corresponding to the classified level is calculated as the evaluation value corresponding to the value. For example, in Fig.24 In the example, the expected value, maximum value, and variance are classified into three levels: large, medium, and small according to the size of the value. In the event information of No. 1, since the expected value E1 is classified as medium, the evaluation value of the expected value E1 is calculated as 2 points. Similarly, since the maximum value MAX1 is classified as large, the evaluation value of the maximum value MAX1 is calculated as 5 points. Similarly, since the variance V1 is classified as medium, the evaluation value of the variance V1 is calculated as 2 points.

[0207] Then, the evaluation value of the expected value E1, the evaluation value of the maximum value MAX1, and the evaluation value of the variance V1 calculated for the event information of category No. 1 are added together to calculate the score. Thus, the score of the event information of No. 1 is calculated as 9 points. Fig.24 Although the calculation method of the score of the event information of the category No. 1 is illustrated in FIG, the score is calculated similarly for the event information of other categories. The score is an example of the fourth evaluation value.

[0208] In addition, in the eighth example, an example of calculating the evaluation values ​​corresponding to the expected value, maximum value, and variance determined in the first to third examples is described, but in addition to the expected value, maximum value, and variance, the evaluation values ​​corresponding to the at least two values ​​can also be calculated based on the proportion of the distribution of indicator values ​​above the threshold Th1 calculated based on the distribution of the fourth to sixth examples and at least two of the evaluation values ​​determined using the machine learning model.

[0209] As such, in determining the priority, the information notification device 200 calculates the fourth evaluation value for each of the multiple events. In calculating the fourth evaluation value, for the event to be dealt with, (i) a fifth evaluation value corresponding to the magnitude of the value is determined for each of at least two of the expected value based on the probability density function, the maximum value of the domain of the probability variable in the probability density function, the variance in the probability density function, the proportion of the distribution of the index value above the first threshold value in the index calculated based on the distribution, and the evaluation value determined based on multiple occurrence trends corresponding to multiple first event information generated in the past third period using a machine learning model, and (ii) the fourth evaluation value is calculated by adding at least two fifth evaluation values.

[0210] In addition, the trend is used as Fig.14The above explanations have been given of the method of determining the priority in the first to eighth examples, using the case where the probability density distribution function is used as an example, but the same can be applied to the case where the occurrence trend is expressed as Fig.15 In the case of multiple indicator values, the range is expressed as follows, and the trend is expressed as follows Fig.16 Such multiple indicator values ​​themselves represent the situation.

[0211] For example, when the priority determination method in the first example is applied to a distribution represented by a range, the central value representing the entire range of the distribution may be calculated as the expected value. In addition, when the priority determination method in the first example is applied to a distribution represented by a plurality of indicator values ​​themselves, the average of the plurality of indicator values ​​may be calculated as the expected value. That is, in the first example, the priority is determined such that the larger the expected value of the distribution based on the plurality of indicator values ​​that may be determined in the indicator representing the occurrence trend, the higher the priority.

[0212] For example, when the priority determination method in the second example is applied to a distribution represented by a range, the maximum value of the range representing the distribution may be calculated as the maximum value. In addition, when the priority determination method in the second example is applied to a distribution represented by a plurality of indicator values ​​themselves, the maximum value among the plurality of indicator values ​​may be calculated as the maximum value. That is, in the second example, the priority is determined such that the larger the maximum value among the plurality of indicator values ​​that may be determined in the indicator representing the occurrence trend, the higher the priority.

[0213] For example, when the priority determination method in the third example is applied to a distribution represented by a range, the size (width) of the range representing the distribution may be calculated as the variance. That is, in the third example, the priority is determined such that the larger the variance of the distribution of the multiple indicator values ​​that may be determined in the indicator representing the occurrence trend, the higher the priority.

[0214] In addition, for example, when the priority determination method in the fourth example is applied to a distribution represented by a range, the proportion of the range that is above the threshold value Th1 in the entire range representing the distribution may be calculated instead of calculating the probability of occurrence that the occurrence trend in the probability density function is above the threshold value Th1. In addition, when the priority determination method in the fourth example is applied to a distribution represented by multiple indicator values ​​themselves, the number of evaluation values ​​that are above the threshold value Th1 among multiple evaluation values ​​may be calculated instead of calculating the probability of occurrence that the occurrence trend in the probability density function is above the threshold value Th1. In this way, the priority is determined as follows: the greater the proportion of the distribution of indicator values ​​above the threshold value Th1 in the indicator calculated based on the distribution of multiple indicator values ​​that may be determined in the indicator representing the occurrence trend, the higher the priority.

[0215] Fig.25 is a sequence diagram showing an example of an information notification method of an information notification system according to Modification Example 4. Fig.25 In the case of the same processing as in the implementation mode, the same as Fig.10 The same reference numerals are used and the description thereof is omitted.

[0216] After step S17, the information notification device 200 determines whether the probability of occurrence exceeding the reference θ is greater than a reference value (N%) (S17d). N is a value greater than 0 and less than 100.

[0217] If the number of future occurrences is greater than the reference value (YES in S17d), the information notification device 200 notifies the security monitoring device 100 of a recommendation to implement temporary measures (S17c), otherwise (NO in S17d), the next process is performed.

[0218] In this way, the information notification device 200 calculates the sixth evaluation value based on the occurrence trend of the category of the event determined for each category of the event. The sixth evaluation value is, for example, the probability of occurrence being above the benchmark θ. In addition, the sixth evaluation value is not limited to the probability of occurrence as described above, but may also be a value related to the priority in the case where the above-mentioned priority is determined based on a probability density function (for example, expected value, maximum value, variance, score (second evaluation value, third evaluation value or fifth evaluation value)). Moreover, the information notification device 200 may also notify the recommendation of temporary response when the sixth evaluation value exceeds the benchmark value (N%), and skip the notification for recommending temporary response when the sixth evaluation value is below the benchmark value.

[0219] In addition, the priority can be expressed not only by a numerical value or a ranking, but also by a level classified based on the numerical value. The priority can also be expressed by a level classified into multiple levels, such as a first level corresponding to a first range, a second level corresponding to a second range, and a third level corresponding to a third range. The priority of the first level is higher than that of the second level, and the priority of the second level is higher than that of the third level. The first range is a range from a first value to a second value smaller than the first value, the second range is a range from a third value smaller than the second value to a fourth value smaller than the third value, and the third range is a range from a fifth value smaller than the fourth value to a sixth value smaller than the fifth value.

[0220] (5) Modification 5

[0221] In addition, in each of the above-mentioned embodiments, each component may be formed by dedicated hardware, or implemented by executing a software program suitable for each component. Each component may also be implemented by a program execution unit such as a CPU or a processor reading and executing a software program recorded in a recording medium such as a hard disk or a semiconductor memory. Here, the software that implements the information notification device 200 and the like of each of the above-mentioned embodiments is the following program.

[0222] That is, the program is used to enable a computer to execute an information notification method, which obtains multiple event information generated by security attacks on a monitored object in a first period in the past, and based on the multiple event information obtained, determines, for each category of event information, an occurrence trend of event information of that category of the monitored object in a second period in the future, as well as a priority of temporary or permanent response to event information of that category, and notifies the occurrence trend and the priority determined for each category of event information.

[0223] The above is an explanation of the information processing method involved in one or more embodiments of the present disclosure based on the implementation mode, but the present disclosure is not limited to the implementation mode. As long as it does not depart from the main purpose of the present disclosure, the implementation mode obtained by implementing various modifications thought of by those skilled in the art, and the mode constructed by combining the constituent elements in different implementation modes are also included in the scope of the present disclosure.

[0224] Industrial Applicability

[0225] The present disclosure is useful as an information notification method or the like that can provide determination materials for easily and accurately determining whether temporary measures can be implemented and the priority of permanent measures.

[0226] Description of Reference Numerals

[0227] 1: information notification system; 21: CPU; 22: main memory; 23: storage device; 24: communication IF; 41: TCU; 42: ECU; 43: storage device; 100: safety monitoring device; 200: information notification device; 210: communication unit; 220: acquisition unit; 230: determination unit; 240: notification unit; 250: storage unit; 300: communication network; 310: base station; 400: vehicle.

Claims

1. An information notification method, performing the following processing: Acquire event information of a plurality of events that occurred due to a security attack on a monitored object during a first past period; Based on the acquired event information, determining, for each event category, the occurrence trend of events of the category occurring in the monitored object within a second future period, and the priority of temporary or permanent response to the events of the category; as well as The occurrence trend and the priority determined for each category of events are presented.

2. The information notification method according to claim 1, wherein: The priority indicates that the higher the priority, the earlier the temporary response or the permanent response is performed, and the priority is determined based on the occurrence trend: the greater the damage caused by the security attack in the future, the higher the priority.

3. The information notification method according to claim 2, wherein: The occurrence trend is related to the change over time in the number of occurrences of events of each category.

4. The information notification method according to claim 3, wherein: The occurrence trend is the slope of the temporal change at the first moment in the second period, The priority is determined such that the greater the slope, the higher the priority.

5. The information notification method according to claim 3, wherein: The occurrence trend is a curve showing the change over time in the second period, The priority is determined such that the greater the maximum value of the curve is, the higher the priority is.

6. The information notification method according to claim 3, wherein: The occurrence trend is a curve showing the change over time in the second period, The priority is determined so that the longer the period in the curve in which the number of occurrences is greater than a predetermined number, the higher the priority.

7. The information notification method according to claim 3, wherein: The occurrence trend is the total number of occurrences of the event in the second period, The priority is determined such that the larger the total number is, the higher the priority is.

8. The information notification method according to claim 3, wherein: The occurrence trend is the total number of occurrences of the event in the second period, The priority is determined such that the greater the total amount of damage calculated by multiplying the total amount by the amount of damage caused by one incident, the higher the priority.

9. The information notification method according to any one of claims 1 to 3, wherein: The occurrence trend includes, among the indicators representing the occurrence trend, distribution of a plurality of index values ​​that may be determined in the determination.

10. The information notification method according to claim 9, wherein: The distribution is represented by a probability density function in which an indicator representing the occurrence tendency is set as a probability variable.

11. The information notification method according to claim 9, wherein: The distribution is represented by a first range including the plurality of index values.

12. The information notification method according to claim 9, wherein: The priority is determined such that the greater the expected value based on the distribution, the higher the priority.

13. The information notification method according to claim 9, wherein: The priority is determined such that the larger the maximum value among the plurality of index values ​​is, the higher the priority is.

14. The information notification method according to claim 9, wherein: The priority is determined such that the greater the variance of the distribution is, the higher the priority is.

15. The information notification method according to claim 9, wherein: The priority is determined such that the greater the proportion of the distribution of the index values ​​calculated based on the distribution and being equal to or greater than the first threshold value in the index, the higher the priority.

16. The information notification method according to claim 9, wherein: The priority is determined using a machine learning model, which is generated by machine learning by taking as input multiple occurrence trends corresponding to multiple first event information generated in the past third period, and using first evaluation values ​​determined respectively for the multiple occurrence trends as correct answer data.

17. The information notification method according to claim 9, wherein: The priority ranking based on the priority is determined using a machine learning model, which is generated by machine learning by taking as input a plurality of occurrence trends corresponding to a plurality of first event information generated in a past third period, and using the priority rankings respectively determined for the plurality of occurrence trends as correct answer data.

18. The information notification method according to claim 9, wherein: In the said decision, the following processing is also carried out: Calculating a second evaluation value by sorting the plurality of events according to the magnitude of the values ​​for at least two of an expected value based on the distribution, a maximum value among the plurality of indicator values, a variance of the distribution, a proportion of the indicator value distribution above a first threshold value in the indicator calculated based on the distribution, and an evaluation value determined based on a plurality of occurrence trends corresponding to a plurality of first event information generated in a third period in the past using a machine learning model; as well as calculating a third evaluation value for each event by adding at least two second evaluation values ​​respectively calculated for the plurality of events, The priority is determined such that the larger the third evaluation value is, the higher the priority is.

19. The information notification method according to claim 9, wherein: In the said decision, the following further processing is carried out: calculating fourth evaluation values ​​for each of the plurality of events, In the calculation of the fourth evaluation value, the following processing is performed for the event to be dealt with: Determine a fifth evaluation value corresponding to the magnitude of at least two of an expected value based on the distribution, a maximum value among the plurality of indicator values, a variance of the distribution, a proportion of indicator value distribution above a first threshold value in the indicator calculated based on the distribution, and an evaluation value determined based on a plurality of occurrence trends corresponding to a plurality of first event information generated within a third period in the past using a machine learning model; as well as The fourth evaluation value is calculated by adding at least two of the fifth evaluation values, and the priority is determined such that the larger the fourth evaluation value is, the higher the priority is.

20. The information notification method according to any one of claims 1 to 8, wherein: In the decision, for each category of the event and each model of the monitored object, the occurrence trend of events of this category and this model of the monitored object in the second period in the future and the priority of temporary or permanent response to events of this category and this model are determined.

21. The information notification method according to any one of claims 1 to 8, wherein: In the decision, further, for each category of the event, the total amount of damages is calculated by multiplying the total number of event information generated for the category by the amount of damages incurred by generating the event information for the category, The priority is determined such that the greater the total amount of damage is, the higher the priority is.

22. The information notification method according to any one of claims 1 to 8, wherein: Further processing is performed as follows: calculating an index value related to the number of occurrences of the event category within the second period based on an occurrence trend of the event category determined for each event category; as well as When the index value exceeds a reference value, a notification is given to recommend the temporary measures.

23. The information notification method according to claim 10, wherein: Further processing is performed as follows: calculating a sixth evaluation value based on an occurrence trend of a category of the event determined for each category of the event; and When the sixth evaluation value exceeds a reference value, a notification is made that the temporary measure is recommended.

24. The information notification method according to any one of claims 1 to 8, wherein: The occurrence trend is determined using a machine learning model, which is generated by machine learning using a plurality of first event information generated in a past third period as input and using the actual situation of the occurrence trend of a plurality of second event information generated in a past fourth period after the third period as correct answer data.

25. The information notification method according to any one of claims 1 to 8, wherein: The following processing is further performed: a machine learning model is used to determine the total amount of damage caused by the security attack within the second period, wherein the machine learning model is generated by machine learning using a plurality of first event information generated within a past third period as input and the total amount of damage based on a plurality of second event information generated within a past fourth period after the third period as correct answer data.

26. The information notification method according to any one of claims 1 to 8, wherein: The occurrence trend is determined using a correlation between a plurality of first event information generated in a past third period and actual conditions based on an occurrence trend of a plurality of second event information generated in a past fourth period after the third period.

27. The information notification method according to any one of claims 1 to 8, wherein: The following processing is further performed: the total amount of damage caused by the security attack in the second period is determined by using the correlation between multiple first event information generated in the past third period and the actual amount of damage based on multiple second event information generated in the past fourth period after the third period.

28. An information notification device comprising: an acquisition unit that acquires event information of a plurality of events that occurred due to a security attack on a monitored object during a past first period; a decision unit that determines, for each event category, a tendency of events of that category occurring in the monitored object within a second future period, and a priority of a temporary response or a permanent response to events of that category based on the acquired event information; and A presentation unit presents the occurrence trend and the priority determined for each category of events.

Images