Attack path prediction method, attack path prediction device, and program

Abstract

The attack path prediction method is a method for predicting an attack path by a network attacker, and includes: acquiring event information on a network attack on a vehicle (40) to be monitored from a monitor that monitors the vehicle (40) to be monitored; acquiring, on the basis of the acquired event information, one or more pieces of threat information relating to a past network attack on the vehicle (S202); acquiring, for each of the one or more pieces of threat information acquired, trend information indicating the degree of popularity of a network attack on the threat information (S204); on the basis of the one or more pieces of threat information and the trend information for each of the one or more pieces of threat information, an attack path of a network attack on the vehicle (40) to be monitored is predicted (S205).

Description

Technical Field

[0001] The present disclosure relates to an attack path prediction method, an attack path prediction apparatus, and a program. Background Art

[0002] In recent years, in order to cope with the rapidly increasing cyber attacks on IoT (Internet of Things) devices, it has become common to set up an organization called SOC (Security Operation Center), which monitors networks and device equipment 24 hours a day, 365 days a year, detects and analyzes cyber attacks, and provides countermeasure suggestions.

[0003] A database that collects and accumulates a large amount of information on cyber attacks (open source information, vulnerability information, analysis results of malware, information on unauthorized IPs and domains, etc.) for analyzing cyber attacks is called CTI (Cyber Threat Intelligence).

[0004] As a current method of using CTI, it is common for SOC operators to manually create a search query and obtain information related to matching cyber attacks. Creating a search query and selecting and choosing the required information requires advanced security knowledge and a large amount of man-hours. Non-Patent Documents 1 and 2 disclose methods for determining which data the input cyber attack is most relevant to based on pre-defined data. However, cyber attacks are diverse and often do not match the pre-defined data.

[0005] Prior Art Documents

[0006] Non-Patent Documents

[0007] Non-Patent Document 1: MITRE Corporation, Threat Report ATT&CK Mapping (TRAM), 2021.9.30 [searched on April 20, 2023], Internet <URL: https: / / ctid.mitre-engenuity.org / our-work / tram / >

[0008] Non-Patent Document 2: MITRE Corporation, Threat Report ATT&CK Mapping (TRAM), 2021.9.30 [searched on April 20, 2023], Internet <URL: https: / / github.com / center-for-threat-informed-defense / tram> Summary of the Invention

[0009] Problems to be Solved by the Invention

[0010] The use of SOC requires advanced security knowledge and a large amount of operating costs. In addition, there are cases where multiple SOC operators respectively present different analysis results.

[0011] It is considered that when a cyber-attack occurs, if an operator can know information such as how the attacker carried out the cyber-attack, to what extent the current system has been invaded or damaged, and what actions the attacker will take next, etc., the deviation of the analysis results between different operators can be reduced, but the current situation is that there is no way to obtain such information.

[0012] Therefore, the present disclosure provides an attack path prediction method, an attack path prediction device, and a program that can predict the attack path of a cyber-attack.

[0013] Technical Solutions for Solving the Problems

[0014] An attack path prediction method according to an aspect of the present disclosure is a method for predicting the attack path of a cyber-attacker, including: obtaining event information about a cyber-attack on a monitored vehicle from a monitor who monitors the monitored vehicle; based on the obtained event information, obtaining one or more threat information related to past cyber-attacks on vehicles; for each of the obtained one or more threat information, obtaining trend information indicating the prevalence of cyber-attacks against the threat information; and predicting the attack path of the cyber-attack on the monitored vehicle based on the one or more threat information and the respective trend information of the one or more threat information.

[0015] An attack path prediction device according to an aspect of the present disclosure is a device for predicting the attack path of a cyber-attacker, including: a first acquisition unit that obtains event information about a cyber-attack on a monitored vehicle from a monitor who monitors the monitored vehicle; a second acquisition unit that obtains one or more threat information related to past cyber-attacks on vehicles based on the obtained event information; a third acquisition unit that obtains, for each of the obtained one or more threat information, trend information indicating the prevalence of cyber-attacks against the threat information; and a prediction unit that predicts the attack path of the cyber-attack on the monitored vehicle based on the one or more threat information and the respective trend information of the one or more threat information.

[0016] A program according to an aspect of the present disclosure is a program for causing a computer to execute the above-described attack path prediction method.

[0017] Advantages of the Invention

[0018] According to one aspect of the present disclosure, an attack path prediction method and the like capable of predicting an attack path of a cyber attack can be implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 FIG. is a diagram showing the overall configuration of the attack path prediction system according to the embodiment.

[0020] Figure 2 FIG. is a block diagram showing the functional configuration of the cyber attack path prediction device according to the embodiment.

[0021] Figure 3 FIG. is an example diagram showing event information input by an analyst to the cyber attack path prediction device according to the embodiment.

[0022] Figure 4 FIG. is an example diagram showing threat information stored in the threat information collection server and the threat information sharing server according to the embodiment.

[0023] Figure 5 FIG. is an example diagram showing trend information for the cyber attack path prediction device according to the embodiment to perform trend information analysis.

[0024] Figure 6 FIG. is a timing diagram showing the operation (work) of collecting threat information by the threat information collection server and the threat information sharing server according to the embodiment.

[0025] Figure 7 FIG. is a timing diagram showing the operation of attack path prediction performed by the attack path prediction device according to the embodiment.

[0026] Figure 8 FIG. is a flowchart showing the operation of input information analysis performed by the input information analysis unit according to the embodiment.

[0027] Figure 9 FIG. is a flowchart showing the operation of trend information analysis performed by the trend information analysis unit according to the embodiment.

[0028] Figure 10 FIG. is a flowchart showing the operation of attack path prediction performed by the attack path prediction unit according to the embodiment.

[0029] Figure 11 FIG. is a diagram showing a list screen of the analysis results according to the embodiment.

[0030] Figure 12 FIG. is a diagram showing a detailed screen of the analysis results according to the embodiment. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0031] The attack path prediction method according to the first aspect of the present disclosure is a method for predicting the attack path of a network attacker, including: obtaining event information about a network attack on a monitored vehicle from a monitor who monitors the monitored vehicle; obtaining one or more threat information related to past network attacks on vehicles based on the obtained event information; predicting the attack path of the network attack on the monitored vehicle based on the obtained one or more threat information. In obtaining the threat information, a first search query for obtaining the one or more threat information is generated based on the event information. When the number of obtained threat information is less than a predetermined number, a second search query with a looser search condition than the first search query is further generated based on the event information, and the one or more threat information is obtained using the generated second search query.

[0032] Thus, when the amount of threat information whose content is consistent with the event information is less than a predetermined number, the search condition of the search query for obtaining threat information is relaxed, so that the search range of threat information can be expanded. That is to say, threat information can be obtained more reliably. Therefore, according to the attack path prediction method, even when the amount of threat information whose content is consistent with the event information is small (for example, non-existent), threat information whose content is similar to the event information can be obtained, so that the attack path of the network attack can also be predicted.

[0033] In addition, for example, the attack path prediction method according to the second aspect of the present disclosure may, on the basis of the attack path prediction method according to the first aspect, also extract one or more named entities included in the event information in obtaining the threat information, and generate the first search query based on the extracted one or more named entities.

[0034] Thus, a search query can be automatically generated using named entities.

[0035] In addition, for example, the attack path prediction method according to the third aspect of the present disclosure may, on the basis of the attack path prediction method according to the second aspect, also have the event information include two or more classification items and string information. In obtaining the threat information, extract the one or more named entities included in the string information of the event information, weight each of the two or more classification items based on the one or more named entities, and generate the second search query based on the weighting values of the two or more classification items respectively.

[0036] Thus, a search query corresponding to the weighting value is generated, so that threat information including information about network attacks and more similar to the event information can be obtained. By using this threat information, a more appropriate attack path can be predicted. Therefore, the attack path of a more appropriate network attack can be predicted.

[0037] In addition, for example, the attack path prediction method according to the fourth aspect of the present disclosure can also, based on the attack path prediction method according to the third aspect, extract, from among the two or more classification items obtained, one or more classification items other than the classification item with the lowest weighted value, and generate the second search query based on the one or more extracted classification items.

[0038] Thereby, when relaxing the search conditions of the search query, the item with the lowest weighted value is excluded. Therefore, even when the search range of the threat information is expanded, threat information more similar to the event information can be obtained. Thus, the attack path of a more appropriate cyber attack can be predicted.

[0039] In addition, for example, the attack path prediction method according to the fifth aspect of the present disclosure can also, based on the attack path prediction method according to the third aspect or the fourth aspect, generate the first search query based on a preset weighted value when the string information does not include named entities.

[0040] Thereby, even when the event information does not include named entities, a search query can be automatically generated.

[0041] In addition, for example, the attack path prediction method according to the sixth aspect of the present disclosure can also, based on the attack path prediction method according to any one of the first to fifth aspects, include at least two of the vehicle type of the monitored vehicle, the current attack path of the cyber attack on the monitored vehicle, the interface that is the entry point of the cyber attack, and the device that is the target of the cyber attack among the two or more classification items.

[0042] Thereby, threat information in which at least two of the vehicle type, the attack path, the interface, and the target are the same can be obtained. By using such threat information, the attack path of a more appropriate cyber attack can be predicted.

[0043] In addition, for example, the attack path prediction method according to the seventh aspect of the present disclosure can also, based on the attack path prediction method according to any one of the first to sixth aspects, obtain trend information indicating the prevalence of the cyber attack on each of the one or more obtained threat information, and further predict the attack path of the cyber attack on the monitored vehicle based on the trend information in the prediction of the attack path of the cyber attack.

[0044] Accordingly, it is possible to predict an attack path in consideration of the prevalence of a cyber-attack. Thus, for example, in a case where a cyber-attack on a monitored vehicle is a prevalent cyber-attack, it is possible to more accurately predict the attack path of the cyber-attack.

[0045] The attack path prediction device according to the eighth aspect of the present disclosure is a device that predicts an attack path of a cyber attacker, and includes: a first acquisition unit that acquires event information regarding a cyber-attack on the monitored vehicle from a monitor who monitors the monitored vehicle; a second acquisition unit that acquires one or more threat information related to past cyber-attacks on vehicles based on the acquired event information; and a prediction unit that predicts an attack path of a cyber-attack on the monitored vehicle based on the acquired one or more threat information. The second acquisition unit generates a first search query for acquiring the one or more threat information based on the event information, and in a case where the number of acquired threat information is less than a predetermined number, further generates a second search query whose search conditions are looser than the first search query based on the event information, and acquires the one or more threat information using the generated second search query. In addition, the program according to the ninth aspect of the present disclosure is a program for causing a computer to execute the attack path prediction method shown in any one of the first aspect to the seventh aspect described above.

[0046] Accordingly, the same effect as the above-described attack path prediction method is achieved.

[0047] The attack path prediction method according to the tenth aspect of the present disclosure is a method for predicting an attack path of a cyber attacker, and includes: acquiring event information regarding a cyber-attack on the monitored vehicle from a monitor who monitors the monitored vehicle; acquiring one or more threat information related to past cyber-attacks on vehicles based on the acquired event information; for each of the acquired one or more threat information, acquiring trend information indicating the prevalence of a cyber-attack on the threat information; and predicting an attack path of a cyber-attack on the monitored vehicle based on the one or more threat information and the respective trend information of the one or more threat information.

[0048] Accordingly, it is possible to predict an attack path in consideration of the prevalence of a cyber-attack. Thus, according to the attack path prediction method, it is possible to predict an attack path of a cyber-attack that takes into account the prevalence of the cyber-attack.

[0049] In addition, for example, the attack path prediction method according to the 11th aspect of the present disclosure can also, on the basis of the attack path prediction method according to the 10th aspect, in obtaining the trend information, extract one or more named entities included in the threat information, obtain the unique trend information of each of the extracted one or more named entities, and obtain the trend information for the threat information based on the unique trend information of each of the one or more named entities.

[0050] Thereby, it is possible to obtain the trend information of the threat information by using the unique trend information of the named entity.

[0051] In addition, for example, the attack path prediction method according to the 12th aspect of the present disclosure can also, on the basis of the attack path prediction method according to the 11th aspect, in obtaining the unique trend information, obtain the history of the unique trend information of the named entity within a predetermined period, and obtain the unique trend information for the named entity based on the obtained history of the unique trend information.

[0052] Thereby, it is possible to obtain the trend information of the threat information by using the unique trend information of the named entity within a predetermined period.

[0053] In addition, for example, the attack path prediction method according to the 13th aspect of the present disclosure can also, on the basis of the attack path prediction method according to the 11th aspect or the 12th aspect, for the unique trend information of the named entity, include the number of searches in which the named entity is searched.

[0054] Thereby, it is possible to obtain threat information including named entities that are more frequently searched. That is, it is possible to obtain threat information that is more similar to the event information. By using such threat information, it is possible to predict the attack path of a more appropriate cyber attack.

[0055] In addition, for example, the attack path prediction method according to the 14th aspect of the present disclosure can also, on the basis of the attack path prediction method according to any one of the 10th aspect to the 13th aspect, in predicting the attack path, extract a predetermined number of threat information from the one or more threat information based on the trend information of each of the one or more threat information, and predict the attack path based on the extracted predetermined number of threat information.

[0056] Thereby, the threat information used for predicting the attack path is selected in consideration of popularity. Therefore, for example, in the case where a cyber attack on a monitored vehicle is a popular cyber attack, it is possible to predict the attack path of a more appropriate cyber attack.

[0057] In addition, for example, the attack path prediction method according to the 15th aspect of the present disclosure can also, based on the attack path prediction method according to the 14th aspect, for each of the extracted predetermined number of threat information, determine whether the threat information contains attack continuation information indicating a next (subsequent) cyber attack on the monitored vehicle, and predict the attack path based on at least one of the threat information determined to contain the attack continuation information and the threat information determined not to contain the attack continuation information.

[0058] Thereby, by using the threat information determined to contain the attack continuation information, the attack path (e.g., the next attack) can be predicted more appropriately. In addition, by using the threat information determined not to contain the attack continuation information, it can be predicted that there is no next attack on the monitored vehicle or the cyber attack has ended.

[0059] The attack path prediction device according to the 16th aspect of the present disclosure is a device that predicts the attack path of a cyber attacker, and includes: a first acquisition unit that acquires event information about a cyber attack on the monitored vehicle from a monitor who monitors the monitored vehicle; a second acquisition unit that acquires one or more threat information related to past cyber attacks on the vehicle based on the acquired event information; a third acquisition unit that acquires trend information indicating the prevalence of the cyber attack on each of the acquired one or more threat information; and a prediction unit that predicts the attack path of the cyber attack on the monitored vehicle based on the one or more threat information and the trend information of each of the one or more threat information. In addition, the program according to the 17th aspect of the present disclosure is a program for causing a computer to execute the attack path prediction method shown in any one of the 10th to 15th aspects described above.

[0060] Thereby, the same effect as the above attack path prediction method is achieved.

[0061] In addition, these general or specific technical solutions can be implemented by a system, a method, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM, or can be implemented by any combination of a system, a method, an integrated circuit, a computer program, or a recording medium. The program can be pre-stored in the recording medium or can be supplied to the recording medium via a wide-area communication network including the Internet.

[0062] Hereinafter, the embodiments will be specifically described with reference to the drawings.

[0063] In addition, the embodiments described below represent general or specific examples. The numerical values, shapes, constituent elements, arrangement positions and connection forms of the constituent elements, steps, order of steps, etc. shown in the following embodiments are examples and are not intended to limit the present disclosure. In addition, among the constituent elements in the following embodiments, the constituent elements not described in the independent claims are described as optional constituent elements.

[0064] In addition, in this specification, numerical values and numerical ranges are not expressions that only represent strict meanings, but mean substantially equivalent ranges, for example, expressions that also include differences of about a few percent (or about 10%).

[0065] In addition, in this specification, unless otherwise specified, ordinal numbers such as "first" and "second" do not mean the number or order of constituent elements, but are used for the purpose of avoiding confusion of the same kind of constituent elements.

[0066] (Embodiment)

[0067] Hereinafter, with reference to Figures 1 to 12 , the attack path prediction method and the like related to this embodiment will be described.

[0068] [1. Structure of Attack Path Prediction System]

[0069] First, with reference to Figures 1 to 5 , the structure of the attack path prediction system including the network attack path prediction device related to this embodiment will be described. Figure 1 is a diagram showing the overall structure of the attack path prediction system 1 related to this embodiment. Figure 2 is a block diagram showing the functional structure of the network attack path prediction device 10 related to this embodiment.

[0070] As Figure 1 shown, the attack path prediction system 1 includes a network attack path prediction device 10, a threat information collection server 20, and a threat information sharing server 30. The attack path prediction system 1 may also include one or more monitored vehicles 40. The attack path prediction system 1 is an information processing system that predicts the attack path of a network attack to be implemented in the monitored vehicle 40 in the future when a network attack occurs in the monitored vehicle 40 that is currently the monitoring object of the analyst 50. In addition, the threat information collection server 20, the threat information sharing server 30, and the monitored vehicle 40 are communicably connected via an external network (for example, the Internet). The analyst 50 is, for example, a SOC operator. In addition, the analyst 50 is an example of a monitor.

[0071] The network attack path prediction device 10 is connected to the threat information collection server 20 and performs processing to predict the attack path of a network attack based on the information input by the analyst 50. The network attack path prediction device 10 is an example of an attack path prediction device.

[0072] As Figure 2 shown, the network attack path prediction device 10 includes an event information input unit 110, a communication unit 120, an input information analysis unit 130, an analysis result screen output unit 140, a trend information analysis unit 150, and an attack path prediction unit 160. The network attack path prediction device 10 has a CPU (Central Processing Unit) and a memory, etc., and each function of the network attack path prediction device 10 is implemented by the CPU executing a program stored in the memory.

[0073] The event information input unit 110 accepts data input from the analyst 50, saves each data in a buffer, and outputs it to the input information analysis unit 130. The event information input unit 110 obtains event information about a network attack on the monitored vehicle 40 from the analyst 50 who monitors the monitored vehicle 40 (refer to Figure 3 described later). The event information input unit 110 is constituted by, for example, a user interface such as a button and a mouse. The event information input unit 110 can also accept data input using, for example, voice and gestures. The event information input unit 110 is an example of a first acquisition unit.

[0074] The communication unit 120 is constituted by a communication circuit (communication module) for communicating with the threat information collection server 20.

[0075] The input information analysis unit 130 obtains data from the event information input unit 110, performs named entity extraction, generates a search query based on the extracted named entity, and sends the generated search query to the threat information collection server 20 via the communication unit 120. That is, the input information analysis unit 130 can automatically generate a search query based on the event information. In addition, the input information analysis unit 130 obtains the search result of threat information (refer to Figure 4 described later) from the threat information collection server 20 via the communication unit 120, and outputs the obtained search result to the trend information analysis unit 150. The threat information includes, for example, information about past network attacks on vehicles that can communicate with the threat information sharing server 30. The threat information can also include, for example, information indicating the history of network attacks.

[0076] Thus, based on the event information obtained by the event information input unit 110, the input information analysis unit 130 obtains one or more threat information related to past cyberattacks on one or more vehicles as search results. The one or more vehicles are the vehicles that are the objects of threat information collection by the threat information collection server 20 or the threat information sharing server 30. The monitored vehicle 40 may also be included in the one or more vehicles. Additionally, the one or more vehicles are, for example, multiple vehicles.

[0077] For example, the input information analysis unit 130 generates a first search query for obtaining one or more threat information based on the event information (e.g., each of the multiple items (e.g., classification items) included in the event information). When the number of the one or more threat information obtained is less than a predetermined number, the input information analysis unit 130 further generates a second search query with search conditions looser than the first search query based on the event information, and uses the generated second search query to obtain one or more threat information. Thus, the input information analysis unit 130 may also have a function of relaxing the conditions of the search query for obtaining threat information from the threat information collection server 20. The input information analysis unit 130 is an example of the second acquisition unit.

[0078] The analysis result screen output unit 140 obtains the analysis result from the attack path prediction unit 160, generates an analysis result screen, and presents it to the analyst 50. The analysis result screen output unit 140 is implemented by a display device such as a liquid crystal display, but may also be implemented by a sound generating device that presents the analysis result using voice or the like.

[0079] The trend information analysis unit 150 obtains the search result of the threat information from the input information analysis unit 130, and obtains the corresponding trend information from the trend information service via the communication unit 120 (refer to Figure 5 described later), and outputs the obtained information to the attack path prediction unit 160. The trend information service is, for example, a service provided by an information search website such as Google Trends, but is not limited thereto. The trend information indicates the popularity of cyberattacks on the threat information. The analysis result of the trend information includes the result obtained by calculating the popularity indicating to what extent the threat information is popular. The trend information analysis unit 150 is an example of the third acquisition unit.

[0080] The attack path prediction unit 160 obtains the search result of threat information and the analysis result of trend information from the trend information analysis unit 150, and predicts the attack path of the cyber attack on the monitored vehicle 40 based on the obtained search result of threat information and the analysis result of trend information. The attack path prediction unit 160 predicts the attack path based on a predetermined number of threat information with relatively high scores (e.g., trend values) in the threat information included in the search result during the trend information analysis. In addition, the attack path prediction unit 160 outputs, for example, the information based on the predetermined number of threat information with relatively high scores as the analysis result of the predicted path to the analysis result screen output unit 140. The attack path prediction unit 160 may also output, for example, at most three threat information with the highest scores and recording the next attack path information as the analysis result of the predicted path to the analysis result screen output unit 140 preferentially. In addition, the attack path prediction unit 160 only needs to predict the attack path based on at least the search result of threat information. The attack path prediction unit 160 is an example of a prediction unit.

[0081] In addition, the next attack predicted by the cyber attack path prediction device 10 may also be, for example, an attack assumed to be executed several hours to several days after the last attack.

[0082] Refer again to Figure 1 , the threat information collection server 20 stores information such as threat information used in the processing of the cyber attack path prediction device 10. The threat information collection server 20 obtains this information from the threat information sharing server 30. The threat information collection server 20 may also be, for example, a server managed by an operator who manufactures or sells the cyber attack path prediction device 10.

[0083] The threat information collection server 20 includes: a storage unit such as a hard disk and a semiconductor memory; a control unit such as a CPU that controls the writing of information to the storage unit and the reading of information from the storage unit; and a communication unit having a communication circuit (communication module) for communicating with the cyber attack path prediction device 10 and the threat information sharing server 30.

[0084] The threat information sharing server 30 obtains and stores log information, vulnerability information, etc. from the monitored vehicle 40. The threat information sharing server 30 is a server that discloses information on the Internet, etc. The threat information sharing server 30 is also called CTI. In Figure 1In [the figure], an example is shown where there is one threat information sharing server 30. However, there may sometimes be multiple threat information sharing servers 30 set up. In the attack path prediction system 1, for example, there are cases where multiple threat information sharing servers 30 managed by different carriers are set up. In such a case, for example, the information of the monitored vehicle 40 stored in each of the multiple threat information sharing servers 30 may be partly common or may be different from each other.

[0085] The threat information sharing server 30 includes: a storage unit such as a hard disk and a semiconductor memory; a control unit such as a CPU that controls writing information to the storage unit and reading information from the storage unit; and a communication unit having a communication circuit (communication module) for communicating with the threat information collection server 20 and the monitored vehicle 40.

[0086] The monitored vehicle 40 is a vehicle that is the object of monitoring by the analyst 50. The monitored vehicle 40 is an automobile, a bus, a motorcycle, etc., but may also be a train, etc. In addition, the monitored vehicle 40 may be a vehicle capable of autonomous driving or a vehicle capable of manual driving.

[0087] Here, with reference to Figures 3 to 5 , various information will be described. Figure 3 This is a diagram showing an example of the event information input by the analyst 50 related to the present embodiment to the network attack path prediction device 10.

[0088] As Figure 3 shown, the event information includes vehicle type, attack path, interface, target, and attack content. In addition, as items, these are not limited, as long as the information expressing the event is described. Also, vehicle type, attack path, interface, and target are examples of classification items, and attack content is an example of string information. The event information includes: two or more classification items including at least two of vehicle type, attack path, interface, and target; and one or more string information.

[0089] The vehicle type refers to the vehicle type of the vehicle that is the object of the network attack. In Figure 3 , the vehicle type exemplifies Model X of Company A, but is not limited thereto. For example, the vehicle type may also be Model Y of Company B, etc.

[0090] The attack path refers to the order in which the vehicle architecture (system structure) is invaded or damaged in a cyber attack. The attack path here represents the order of cyber attacks up to the current moment, and in the future, it may be possible to further continue cyber attacks on other ECUs (Electronic Control Units) from ADAS (Advanced Driver-Assistance Systems). In Figure 3 it, as the order of invasion or damage, the order of WiFi (registered trademark, the same below), GW (gateway), ADAS is exemplified, but it is not limited to this. As other examples of the order of invasion or damage, there may also be cases such as WiFi, GW, the ECU that functions as an OBD (On-Board Diagnostics), and other ECUs.

[0091] The interface refers to the vehicle architecture that serves as the entry point for a cyber attack. The interface is the entry point (invasion point) of cyber attacks in the monitored vehicle 40 and corresponds to, for example, any one of the multiple ECUs installed in the monitored vehicle 40. As such an ECU, for example, an ECU for external communication used to communicate with the outside of the vehicle, an ECU with a gateway function, etc. are assumed. In Figure 3 it, an ECU that communicates according to the communication standard of WiFi is exemplified, but it is not limited to this. As other examples of the interface, an ECU that communicates according to the communication standard of Bluetooth (registered trademark), an EV (EV = Electric Vehicle), an on-board diagnostic device, etc. can be exemplified.

[0092] The target refers to the vehicle architecture that is the purpose of a cyber attack. The target is the result predicted by the analyst 50. In Figure 3 it, ADAS is exemplified, but it is not limited to this. As other examples of the target, IVI (In-Vehicle Infotainment), the ECU of the body system, the ECU of the autonomous driving system, etc. can be exemplified. In addition, the target is based on the prediction of the analyst 50, and there may be cases where the prediction of the analyst 50 is incorrect. Also, the analyst 50 may not input to the target column in cases where it is difficult to predict the target.

[0093] The attack content refers to any string that represents a cyber attack. The attack content is, for example, a string input by the analyst 50.

[0094] The classification items are information for obtaining threat information from the threat information collection server 20, and the attack content is information for setting a weight coefficient for each of the multiple classification items. In addition, the classification items may also include, for example, attack tools indicating the tools used in a cyber attack.

[0095] Figure 4 It is a diagram showing an example of the threat information stored in the threat information collection server 20 and the threat information sharing server 30 according to the present embodiment.

[0096] The threat information is text that describes the impact and cause of an attack parsed by an analyst based on the logs and communication information of the attacked vehicle after a cyber attack loss on the vehicle is discovered. The threat information is described, for example, in the description format of the Structured Threat Information eXpression (STIX).

[0097] As Figure 4 shown, in the Structured Threat Information eXpression (STIX), for example, information including the method of attack, the countermeasure method of attack, the vulnerability of the attack target, the severity of the vulnerability, the date when the attack was discovered, information about the attacked vehicle, the tools used in the attack, the IP address of the attacker, the domain name, etc. in a cyber attack is recorded.

[0098] In Figure 4 , the threat information records the method of attack, the IP address of the attacker, and the domain name of the attacker. By pre-recording the item of the cyber kill chain (kill_chain_phases) in the method of attack, the method of the next attack can be predicted. For example, the attack path among the cyber kill chains can be predicted.

[0099] Figure 5 It is a diagram showing an example of the trend information for the network attack path prediction device 10 according to the present embodiment to perform trend information analysis.

[0100] As Figure 5 shown, the so-called trend value indicates how many times a specific keyword is searched on the Internet during a corresponding period or time range. The higher the value, the more actively the keyword is searched. The trend value may also include the number of searches for the named entity in a search website or the like. The number of searches can be either the number of searches worldwide or the number of searches in a predetermined country or region.

[0101] Figure 5 It is a chart showing the trend value for a specific keyword, obtained by specifying a specific country and period. In Figure 5This is an example of obtaining the trend values of specific malware in Japan from 2018 to 2022.

[0102] Figure 5 The chart shown includes the trend values (search counts) of the named entity at multiple time points during a predetermined period. In addition, based on the trend values at multiple time points, the trend value for the named entity is obtained. The trend value of the named entity is obtained by averaging the trend values at multiple time points, etc. The trend value of the named entity is an example of specific trend information.

[0103] [2. Operation of the Attack Path Prediction System]

[0104] Next, refer to Figures 6 to 12 to explain the operation (operation) of the attack path prediction system configured as described above. First, refer to Figure 6 to explain the operation of collecting threat information. Figure 6 is a timing chart showing the operation (attack path prediction method) of the threat information collection server 20 and the threat information sharing server 30 involved in this embodiment for collecting threat information.

[0105] (S101) The threat information sharing server 30 collects the information (threat information) parsed from the vehicle's logs, communication information, etc. for the monitored vehicle 40, and converts it into a structured threat information expression STIX for storage. For example, the threat information sharing server 30 obtains threat information from the vehicle by outputting a threat information collection request to the monitored vehicle 40, but the obtaining method is not limited to this. For example, it can also be that the threat information is periodically sent from the monitored vehicle 40 to the threat information sharing server 30.

[0106] (S102) The threat information collection server 20 sends a sharing request for the structured threat information expression STIX collected from the monitored vehicle 40 to the threat information sharing server 30 ( Figure 6 the threat information sharing request in

[0107] ), and performs format conversion such as adding tags to the threat information as necessary, and stores it. The threat information collection server 20 obtains threat information from one or more threat information sharing servers 30 that store the desired information among the multiple threat information sharing servers 30. The process of step S102 can be executed regularly or according to the input of the analyst 50, etc. Figure 7 Next, refer to Figure 7 to explain the operation of predicting the attack path of a network attack.

[0108] (S201) The input information analysis unit 130 obtains data (event information) from the event information input unit 110, and performs named entity extraction using the obtained data. In step S201, one or more named entities included in the event information are extracted. In Figure 3 the example of Figure 3 , the input information analysis unit 130 extracts, for example, "Company A Model X" shown in the attack content as a named entity corresponding to the vehicle model, extracts "WiFi", "GW", and "ADAS" as named entities for the attack path, and extracts "WiFi" as a named entity corresponding to the interface.

[0109] In addition, the method of named entity extraction is not particularly limited. For example, general learning models such as the BERT (Bidirectional Encoder Representations from Transformers) model can be used, or a model created independently can also be used.

[0110] (S202) The input information analysis unit 130 uses the named entities extracted in step S201 to search for threat information. The input information analysis unit 130 automatically generates a search query (an example of the first search query) using the named entities. The input information analysis unit 130 sends the generated search query to the threat information collection server 20 via the communication unit 120, and receives matching threat information. The received threat information is output to the trend information analysis unit 150. The received threat information is an example of one or more threat information. In this way, according to the network attack path prediction device 10, a search query is automatically generated, so that threat information and the like can be collected even when the analyst 50 does not have advanced security knowledge.

[0111] (S203) The trend information analysis unit 150 connects to the trend information service in order to obtain trend information for the threat information obtained from the input information analysis unit 130. The trend information analysis unit 150 communicates with a server or the like that provides the trend information service via the communication unit 120.

[0112] (S204) The trend information analysis unit 150 obtains trend information (for example, a trend value) for the threat information obtained from the input information analysis unit 130 from the trend information service. The trend information analysis unit 150 outputs the threat information and the trend information to the attack path prediction unit 160.

[0113] (S205) The attack path prediction unit 160 obtains threat information and trend information from the trend information analysis unit 150, and predicts the attack path with reference to the obtained threat information and trend information. In step S205, the attack path prediction unit 160, for example, preferentially selects, as the analysis result of the predicted path, at most three pieces of threat information with the highest score of the analysis result of the trend information among the threat information and records the next attack path information, and outputs it to the analysis result screen output unit 140. The attack path prediction unit 160 outputs the threat information, the trend value, and the information indicating the attack path as the information to be displayed by the analysis result screen output unit 140.

[0114] In this way, according to the network attack path prediction device 10, by simply inputting (event information) the characteristics of the network attack occurring in the monitored vehicle 40 by the analyst 50 alone, the network attack can be classified by pattern, and relevant threat information can be automatically searched from the threat information collection server 20, and the attack path and the actions that the attacker is likely to take next can be predicted. As a result, for example, even an analyst 50 without security knowledge can perform advanced event analysis aware of the attacker's actions in a short time, and the network attack path prediction device 10 can help reduce the operation cost of the SOC and improve the accuracy of event analysis. For example, it can also help reduce the deviation of the analysis results of each analyst 50.

[0115] Next, with reference to Figure 8 , the processing performed by the input information analysis unit 130 will be described. Figure 8 It is a flowchart showing the operation (attack path prediction method) of the input information analysis performed by the input information analysis unit 130 according to the present embodiment. In Figure 8 It shows Figure 7 the details of the processing in steps S201 and S202 shown.

[0116] (S300) The event information input unit 110 obtains event information such as Figure 3 as input data from the event information input unit 110.

[0117] (S301) The input information analysis unit 130 performs named entity extraction using, for example, the BERT model on the event information, and sets the number of items of the extracted named entities to n. The input information analysis unit 130 extracts named entities from the string information included in the event information. For example, when extracting from the event information entities related to the vehicle model, the attack target ( Figure 3In the case where the number of items n = 3 when there are named entities that match the target shown, the attack tool. The number of items n is the number of classification items for which named entities are extracted. In addition, a table that establishes a correspondence between named entities and the classification items corresponding to the named entities is stored in advance in a storage unit (not shown), and the input information analysis unit 130 can also use this table to calculate the number of items n.

[0118] (S302) The input information analysis unit 130 determines whether the number of extracted items n is greater than 0. When the number of items n is greater than 0 (step S302: Yes), the input information analysis unit 130 executes step S303. When the number of items n is 0 or less (for example, 0) (step S302: No), the input information analysis unit 130 executes step S304. In addition, the case where the number of items n is greater than 0 means that the event information contains information for generating a search query for searching threat information.

[0119] (S303) The input information analysis unit 130 calculates a weight coefficient (weight value) for each of the n classification items. As a calculation method, for example, a method of calculating based on the proportion of each classification item in the string (for example, Figure 3 the attack content shown) included in the event information can be exemplified. In this calculation method, for example, the number of named entities corresponding to the vehicle model, attack target, and attack tool in the string is counted, and the number of named entities included in the classification item in all named entities is calculated as the proportion. For example, the weight coefficient of a classification item with a high proportion is set to a higher weight than that of a classification item with a low proportion. When named entities that match the vehicle model, attack target, and attack tool are extracted from the event information, and the respective proportions are 0.1, 0.2, and 0.3, these values can also be used as the weight coefficients as they are. In addition, the process of step S303 can also be executed, for example, after it is determined as "No" in step S307. In addition, the calculation method is not limited to the above method.

[0120] (S304) When the input event information does not contain named entities, the input information analysis unit 130 uses a statically defined search query to search for threat information on the threat information collection server 20. Here, the statically generated query is a query generated using pre-defined initial weight coefficients. In this way, the input information analysis unit 130 automatically generates a search query even when the event information does not contain named entities for generating a search query. The input information analysis unit 130 can also be said to generate a first search query based on pre-set weight coefficients when the string information does not contain named entities. In addition, the pre-defined initial weight coefficients are stored in a storage unit (not shown). The initial weight coefficients include the weight coefficients of each classification item included in the event information.

[0121] (S305) The input information analysis unit 130 generates a search query (first search query) for threat information based on n weight coefficients. For example, the input information analysis unit 130 automatically generates a search query by connecting all n classification items with an AND (logical "and") condition. For example, when the vehicle type = A, the attack target = B, and the attack tool = C, the search query is as follows.

[0122] Vehicle type = A AND Attack target = B AND Attack tool = C

[0123] (S306) The input information analysis unit 130 uses the search query generated in step S305 to search for threat information on the threat information collection server 20, and sets the number of hit items to m. For example, when the threat information collection server 20 stores threat information that satisfies each of the vehicle type = A, the attack target = B, and the attack tool = C, the number of items m = 3. When the threat information collection server 20 stores threat information that satisfies two of the vehicle type = A, the attack target = B, and the attack tool = C, the number of items m = 2.

[0124] (S307) The input information analysis unit 130 determines whether the number of items n = m. When n = m (S307: Yes), the input information analysis unit 130 executes step S309. When n ≠ m (S307: No), the input information analysis unit 130 executes step S308.

[0125] (S308) The input information analysis unit 130 excludes the classification item with the lowest priority from the search conditions, and decrements the value of the number of items n by 1 (n = n - 1). Then, it proceeds to step S305. The input information analysis unit 130 newly generates a search query (second search query) based on the classification items (one or more classification items) after decrementing the number of items n and the weight coefficients of these classification items. For example, the input information analysis unit 130 generates a search query based on two classification items other than the classification item with the lowest weight coefficient among the three classification items and the weight coefficients of these two classification items. In this way, the input information analysis unit 130 generates the second search query based on the weight coefficients of two or more classification items included in the event information. As a result, the conditions for threat information search will be relaxed.

[0126] In addition, although an example of decrementing the value of the number of items n by 1 in step S308 has been described, it is not limited to this. For example, it is also possible to subtract the value obtained by subtracting the number of items m hit in step S306 from the current number of items n from the number of items n (n = n - (n - m)). That is to say, in step S308, the number of items n can also be set to the number of items m hit in step S306.

[0127] (S309) The input information analysis unit 130 obtains threat information that matches the search conditions from the threat information collection server 20 via the communication unit 120, and outputs the obtained threat information (threat information that matches the search query) to the attack path prediction unit 160.

[0128] Next, refer to Figure 9 , and the processing performed by the trend information analysis unit 150 will be described. Figure 9 It is a flowchart showing the operation (attack path prediction method) of the trend information analysis performed by the trend information analysis unit 150 according to the present embodiment.

[0129] (S400) The trend information analysis unit 150 obtains the threat information output from the input information analysis unit 130. In addition, the trend information analysis unit 150 performs named entity extraction on the obtained threat information. The method of named entity extraction may be the same as that for named entity extraction in event information.

[0130] (S401) The trend information analysis unit 150 connects to the trend information service via the external network. The trend information analysis unit 150 communicates with the server that provides the trend information service, etc. via the communication unit 120.

[0131] (S402) The trend information analysis unit 150 averages the trend values of the threat information over a certain period to obtain T. For example, when the threat information records three items: malware name, vehicle model name, and the name of the attacked system (or the attacked ECU), the respective trend values are obtained. If the respective trend values are 50, 60, and 70, then the trend value T of the threat information is 60. In this way, the trend information analysis unit 150 obtains the respective trend information of one or more named entities included in the threat information, and based on the respective trend information (unique trend information) of the one or more named entities, obtains the trend information (trend value) for the threat information. The trend information for the threat information includes the trend value, but is not limited thereto, as long as it includes information indicating the degree of the trend.

[0132] (S403) The trend information analysis unit 150 outputs the trend value T obtained in step S402 to the attack path prediction unit 160.

[0133] Next, refer to Figure 10 , and the processing performed by the attack path prediction unit 160 will be described. Figure 10 It is a flowchart showing the operation (attack path prediction method) of the attack path prediction performed by the attack path prediction unit 160 according to the present embodiment. In addition, the processing of steps S501 to S505 is performed on all threat information.

[0134] (S500) The attack path prediction unit 160 obtains the threat information that is a search hit and its respective trend value T output from the trend information analysis unit 150. In step S500, it can also be said that the threat information and its respective trend value T are input to the attack path prediction unit 160.

[0135] (S501) The attack path prediction unit 160 selects one of the threat information that is a search hit.

[0136] (S502) The attack path prediction unit 160 refers to the trend value T of the threat information selected in step S501, and determines whether the value of the trend value T is within the top 3 among the trend values T of all the threat information that is a search hit. If it is determined that the size is within the top 3 (S502: Yes), step S503 is executed. If it is determined that the size is not within the top 3 (S502: No), it returns to step S501. In addition, the third place is an example and can be appropriately set by the analyst 50 or the like. Step S503 is an example of extracting a predetermined number of threat information from one or more threat information based on the trend information.

[0137] (S503) The attack path prediction unit 160 refers to a certain cyber kill chain recorded in the threat information and confirms whether there is a next attack (next attack information (an example of attack continuation information)) in the corresponding threat information. The attack path prediction unit 160 can also be said to determine in step S503 whether the threat information contains attack continuation information indicating that there is a next cyber attack on the monitored vehicle 40, for example.

[0138] When there is a next attack (S503: Yes), the attack path prediction unit 160 executes step S504. When there is no next attack (S503: No), it executes step S505. For example, when the cyber kill chain of the threat information is reconnaissance, the attack path prediction unit 160 searches for cyber kill chains such as weaponization and distribution after the reconnaissance activity associated with the threat information. If it can be found, it is considered that there is a next attack.

[0139] (S504) The attack path prediction unit 160 appends and saves the threat information to buffer A (not shown) provided in the network attack path prediction device 10. The threat information saved in buffer A is an example of the threat information determined to contain attack continuation information.

[0140] (S505) The attack path prediction unit 160 appends and saves the threat information to buffer B (not shown) provided in the network attack path prediction device 10. The threat information saved in buffer B is an example of the threat information determined not to contain attack continuation information.

[0141] If the attack path prediction unit 160 deems that there is a next attack, it predicts that the next attack will be carried out on the monitored vehicle 40. For example, when there are 3 threat messages stored in buffer A, the attack path prediction unit 160 may also predict the next attack included in the 3 threat messages as the next attack to be carried out on the monitored vehicle 40. In addition, when there are 3 threat messages stored in buffer B, the attack path prediction unit 160 may also predict that there is no next attack on the monitored vehicle 40. Thus, the attack path prediction unit 160 predicts the attack path of a cyber attack on the monitored vehicle 40 based on a predetermined number of threat messages.

[0142] In addition, the attack path prediction unit 160 only needs to predict the attack path based on the threat messages stored in at least one of buffer A and B.

[0143] (S506) The attack path prediction unit 160 preferentially outputs threat messages from buffer A to the analysis result screen output unit 140. When there is data stored in buffer B, after outputting the threat messages in buffer A, the threat messages in buffer B are output to the analysis result screen output unit 140. The threat messages stored in buffer A and B are used for the display part 2400 of the attack steps, the display part 2500 of the vehicle architecture, and the display part 2800 of the threat messages described later. Figure 12

[0144] In addition, the attack path prediction unit 160 is not limited to preferentially outputting threat messages from buffer A to the analysis result screen output unit 140. For example, it may also preferentially output threat messages from the buffer with the larger number of data among buffer A and B to the analysis result screen output unit 140. In addition, the attack path prediction unit 160 may also not perform the determination in step S503. The attack path prediction unit 160 may, for example, output threat messages to the analysis result screen output unit 140 in descending order of trend values, or may randomly output the top three threat messages to the analysis result screen output unit 140.

[0145] Next, with reference to Figure 11 and Figure 12 , the information displayed on the analysis result screen output unit 140 will be described. Figure 11 is a diagram showing the overview screen 1100 of the analysis result related to this embodiment.

[0146] As Figure 11As shown, the overview screen 1100 of the analysis result is, for example, a web page displayed on a web application, and includes a filtering section 1200, a selection section 1300, a saving section 1400, a deleting section 1500, a checkbox section 1600, a sorting section 1700, a trend value display section 1800, and a page display section 1900.

[0147] The filtering section 1200 is a part (a part of the screen) for filtering so as to display only the analysis results containing the input arbitrary string when the arbitrary string is input.

[0148] The selection section 1300 is a part for filtering each item by selecting the corresponding string.

[0149] The saving section 1400 is a part for saving the overview screen 1100 of the analysis result as a CSV file or the like by pressing.

[0150] The deleting section 1500 is a part for deleting the events selected in the checkbox section 1600 by pressing.

[0151] The checkbox section 1600 is a part for saving or deleting the selected information together by pressing the saving section 1400 or the deleting section 1500 after selecting an event.

[0152] The sorting section 1700 is a part for switching between ascending order and descending order by pressing.

[0153] The trend value display section 1800 is a part for displaying the analysis results of the trend information of the corresponding event.

[0154] The page display section 1900 is a part for displaying the analysis results of the next predetermined number of items (for example, the next 10 items) by pressing.

[0155] Figure 12 It is a diagram showing the detailed screen 2100 of the analysis result according to the present embodiment.

[0156] As Figure 12 shown, the detailed screen 2100 of the analysis result is, for example, a web page displayed on a web application, and includes a home display section 2200, an analysis result display section 2300, an attack step display section 2400, a vehicle architecture display section 2500, object display sections 2600 and 2700, and a threat information display section 2800.

[0157] The home display section 2200 is a part for returning to the overview screen 1100 of the analysis result by pressing.

[0158] The display section 2300 of the analysis result is a section for initially selecting "1" which is the threat information with the highest relevance (e.g., weight coefficient or trend value) as the analysis result, and displaying the respective analysis results by pressing "1", "2", or "3".

[0159] The display section 2400 of the attack steps is a section for displaying threat information for each attack step.

[0160] The display section 2500 of the vehicle architecture is a section for displaying threat information for each vehicle architecture.

[0161] The object display sections 2600 and 2700 are sections for representing each object of the threat information, and when pressed, causing the display section 2800 of the threat information to display the threat information. The bold - displayed object represents the current attack progress.

[0162] The display section 2800 of the threat information displays the corresponding threat information when the object display section 2600 or 2700 is pressed.

[0163] In Figure 12 it is shown that the attack step is step 2, and as the vehicle architecture in step 2, the cyber - attack progresses to ADAS. From this threat information, it can be known that there is no next attack in step 2. In this case, the first object of the vehicle architecture in step 3 becomes the next attack object.

[0164] By displaying the Figure 11 or Figure 12 information shown to the analyst 50, it is possible to assist the analyst 50 in path prediction. It is considered that such a display is particularly effective for an inexperienced analyst 50.

[0165] (Other embodiments)

[0166] Above, based on the embodiments, the cyber - attack path prediction device 10 etc. related to one or more embodiments have been described, but the present disclosure is not limited to this embodiment. As long as it does not deviate from the gist of the present disclosure, the embodiments obtained by making various modifications that those skilled in the art can think of to this embodiment, and the embodiments constructed by combining the constituent elements in different embodiments can also be included in the present disclosure.

[0167] For example, in the above - mentioned embodiment, an example in which the attack path prediction system 1 includes two servers, namely the threat information collection server 20 and the threat information sharing server 30, has been described. However, as long as at least one of the threat information collection server 20 and the threat information sharing server 30 is included in the attack path prediction system 1, it is sufficient.

[0168] In addition, in the above-described embodiment, an example of obtaining a trend value (numerical value) as the popularity of a named entity has been described, but it is not limited thereto. For example, it is also possible to obtain whether it is currently popular (judgment result), the degree of popularity such as low, medium, or high, etc. as the popularity.

[0169] In addition, the cyber attack in the above-described embodiment refers to an attack on a device mounted on a vehicle (e.g., ECU, etc.) that takes advantage of a security vulnerability to leak or tamper with information, etc., thereby causing an abnormality in the operation of the device. The cyber attack can also be either an attack via a network or an attack not via a network. Examples of an attack not via a network include data writing using a USB (Universal Serial Bus) memory, etc., but it is not limited thereto.

[0170] In addition, in the above-described embodiment, each component can be configured by dedicated hardware or can be implemented by executing a software program suitable for each component. Each component can also be implemented by a program execution unit such as a CPU or a processor reading and executing a software program recorded on a recording medium such as a hard disk or a semiconductor memory.

[0171] In addition, the order in which the steps in the flowchart are executed is illustrated for specifically explaining the present disclosure and can also be an order other than the above. In addition, a part of the above steps can also be executed simultaneously (in parallel) with other steps, and a part of the above steps can also not be executed.

[0172] In addition, the division of the functional blocks in the block diagram is an example, and multiple functional blocks can also be implemented as one functional block, one functional block can be divided into multiple, or a part of the function can be transferred to other functional blocks. In addition, it is also possible that a single piece of hardware or software processes the functions of multiple functional blocks having similar functions in parallel or in a time-division manner.

[0173] In addition, the cyber attack path prediction device according to the above-described embodiment can be implemented as a single device or can be implemented by multiple devices. In the case where the cyber attack path prediction device is implemented by multiple devices, each component included in the cyber attack path prediction device can be distributed among the multiple devices in an arbitrary manner. In the case where the cyber attack path prediction device is implemented by multiple devices, the communication method between the multiple devices is not particularly limited and can be wireless communication or can be wired communication. In addition, between the devices, wireless communication and wired communication can also be combined.

[0174] In addition, each component described in the above embodiments can also be implemented as software, and typically, it can also be implemented as an LSI which is an integrated circuit. They can be individually monolithicized or monolithicized in a manner that includes a part or all of them. Although it is assumed to be a system LSI here, depending on the degree of integration, it is sometimes also referred to as an IC, system LSI, super large LSI, or extra large LSI. In addition, the method of integrating into an integrated circuit is not limited to LSI, and it can also be implemented by a dedicated circuit (a general-purpose circuit that executes a dedicated program) or a general-purpose processor. An FPGA (Field Programmable Gate Array, field programmable gate array) that can be programmed after the LSI is manufactured, or a reconfigurable processor that can reconstruct the connection or setting of circuit cells inside the LSI can also be used. Furthermore, if, due to the progress of semiconductor technology or other derived technologies, a technology for integrating into an integrated circuit that replaces the LSI appears, then of course, that technology can also be used for integrating the components.

[0175] A system LSI is a super multifunctional LSI manufactured by integrating multiple processing units onto one chip. Specifically, it is a computer system that includes a microprocessor, ROM (Read Only Memory, read-only memory), RAM (Random Access Memory, random access memory), etc. A computer program is stored in the ROM. The microprocessor operates according to the computer program, and thereby, the system LSI realizes its functions.

[0176] In addition, one aspect of the present disclosure can also be a computer program that causes a computer to execute Figures 6 to 10 each of the characteristic steps included in the method (for example, the attack path prediction method) shown in

[0177] In addition, for example, the program can also be a program for causing a computer to execute. In addition, one aspect of the present disclosure can also be a computer-readable non-transitory recording medium on which such a program is recorded. For example, such a program can also be recorded on a recording medium for distribution or circulation. For example, by installing the distributed program on another device having a processor and causing the processor to execute the program, the device can perform the above various processes.

[0178] Industrial Applicability

[0179] The present disclosure is useful for a prediction device for predicting an attack path of a network attack, etc.

[0180] Explanation of Reference Numerals

[0181] 1: Attack path prediction system

[0182] 10: Network attack path prediction device (attack path prediction device)

[0183] 20: Threat information collection server

[0184] 30: Threat information sharing server

[0185] 40: Monitored vehicle

[0186] 50: Analyst (monitor)

[0187] 110: Event information input section (First acquisition section)

[0188] 120: Communication section

[0189] 130: Input information analysis section (Second acquisition section)

[0190] 140: Analysis result screen output section

[0191] 150: Trend information analysis section (Third acquisition section)

[0192] 160: Attack path prediction section (Prediction section)

[0193] 1100: Overview screen of analysis results

[0194] 1200: Filtering section

[0195] 1300: Selection section

[0196] 1400: Saving section

[0197] 1500: Deletion section

[0198] 1600: Checkbox section

[0199] 1700: Sorting section

[0200] 1800: Trend value display section

[0201] 1900: Page display section

[0202] 2100: Detailed screen of analysis results

[0203] 2200: Home page display section

[0204] 2300: Display section of analysis results

[0205] 2400: Display section of attack steps

[0206] 2500: Display section of vehicle architecture

[0207] 2600, 2700: Object display section

[0208] 2800: Display section of threat information

Claims

1. An attack path prediction method, which is a method for predicting the attack path of a network attacker, includes: Obtaining event information about a cyber attack on the monitored vehicle from a monitor who monitors the monitored vehicle; Based on the obtained event information, obtaining one or more threat information related to past cyber attacks on vehicles; For each of the one or more threat information obtained, obtaining trend information indicating the prevalence of cyber attacks on the threat information; Based on the one or more threat information and the respective trend information of the one or more threat information, predicting the attack path of the cyber attack on the monitored vehicle.

2. The attack path prediction method according to claim 1, In the acquisition of the trend information, Extracting one or more named entities included in the threat information, Obtaining the respective specific trend information of the one or more named entities extracted, Based on the respective specific trend information of the one or more named entities, obtaining the trend information for the threat information.

3. The attack path prediction method according to claim 2, In the acquisition of the specific trend information, Obtaining the historical record of the specific trend information of the named entity within a predetermined period, Based on the obtained historical record of the specific trend information, obtaining the specific trend information for the named entity.

4. The attack path prediction method according to claim 2, The specific trend information for the named entity includes the number of search times the named entity is searched.

5. The attack path prediction method according to any one of claims 1 to 4, In the prediction of the attack path, Based on the respective trend information of the one or more threat information, extracting a predetermined number of threat information from the one or more threat information, Based on the extracted predetermined number of threat information, predicting the attack path.

6. The attack path prediction method according to claim 5, For each of the predetermined number of threat information extracted, determining whether the threat information contains attack duration information indicating the existence of a next cyber attack on the monitored vehicle, Based on at least one of the threat information determined to contain the attack duration information and the threat information determined not to contain the attack duration information, predicting the attack path.

7. An attack path prediction device, which is a device for predicting the attack path of a network attacker, includes: A first acquisition unit that obtains event information about a cyber attack on the monitored vehicle from a monitor who monitors the monitored vehicle; A second acquisition unit that obtains one or more threat information related to past cyber attacks on vehicles based on the obtained event information; A third acquisition unit that, for each of the one or more threat information obtained, obtains trend information indicating the prevalence of cyber attacks on the threat information; and A prediction unit that predicts the attack path of the cyber attack on the monitored vehicle based on the one or more threat information and the respective trend information of the one or more threat information.

8. A program for causing a computer to execute the attack path prediction method according to any one of claims 1 to 4.

Images