Abnormality monitoring system in individual system

Abstract

The invention relates to an anomaly monitoring system in an individual system. The present invention addresses the problem of detecting, in a system in which a server computer can communicate with one or more individual systems via a communication network, an abnormality in which a large number of specific logs are generated in the individual systems in a short time without occupying the resources of the communication network and the server as much as possible. A system that monitors an abnormality in an individual system includes: a mechanism configured to acquire log information generated in the individual system; a means configured to acquire a hash value by inputting log information into a hash function; a means configured to count the number of times each hash value is generated; and a mechanism configured to determine whether or not the number of times of generation of each hash value exceeds a predetermined value, the system being configured to determine that an abnormal state of an individual system has occurred when any one of the number of times of generation of each hash value exceeds a predetermined value, and to execute a treatment corresponding to the abnormal state.

Description

Anomaly monitoring system in individual systems Technical Field

[0001] This invention relates to a technique for monitoring anomalies in a system, and more specifically, to an anomaly monitoring technique for monitoring anomalies in an individual system managed by a server computer via a communication network. Background Technology

[0002] A communication network system has been practically implemented, in which a server computer (hereinafter referred to as "server") comprehensively manages individual systems, such as computer systems (vehicle systems) that control various states in each vehicle, including automobiles. In this structure, as a method for monitoring whether an anomaly occurs in an individual system, logs generated during the operation of that individual system are collected by the server. The server analyzes the collected logs and, based on the analysis results, performs processing for the anomaly when it occurs. As a technique related to log collection for monitoring the individual system, for example, Patent Document 1 proposes a structure that selectively acquires logs corresponding to the sent and received messages of each electronic control unit (individual system) in a communication network connected to multiple electronic control units (individual systems) based on the bandwidth of the communication network. This structure effectively prevents unauthorized processing caused by viruses, etc., without occupying the bandwidth of normal communication messages via the communication network. This structure includes: a system load monitoring unit that monitors the idle bandwidth of the communication network within a processing monitoring unit that performs monitoring of the data communication network; and a virus monitoring unit that collects log information corresponding to communication messages for virus detection. The virus monitoring unit is configured to change the log information collection method based on the idle bandwidth information of the communication network obtained by the system load monitoring unit. Specifically, it is configured to collect only limited log information corresponding to high-priority communication messages when a virus is detected and the idle bandwidth is not above a predetermined threshold. With this structure, by changing the log collection method according to the communication network utilization, efficient virus detection and removal can be expected.

[0003] Patent Document 1: International Publication 2019 / 093098 Summary of the Invention

[0004] In certain systems, the generation of a large number of logs exhibiting specific characteristics—for example, the generation of logs due to a large number of attempts to connect from a source IP address to other destination IP addresses within a short period—is considered an anomaly in that system. Therefore, detecting this anomaly through a server allows for the identification of the system's anomalies. However, if all the logs generated in a short period in a particular system were sent to the server via the communication network, it would consume both network and server resources, potentially causing delays or congestion in normal processing. Therefore, it would be advantageous to have a structure that can detect the generation of specific logs in a short period in a particular system with minimal impact on network and server resources.

[0005] In view of the above, the main objective of this invention is to detect anomalies in which a large number of specific logs are generated in a short period of time in a system in which the server can communicate with one or more individual systems via a communication network, without consuming as much of the resources of the communication network and the server as possible.

[0006] According to the present invention, the above-mentioned problem is achieved by a system that monitors anomalies in individual systems communicatively connected to a server computer via a communication network, comprising:

[0007] A log acquisition mechanism, configured to acquire log information generated in the individual system;

[0008] A hash value acquisition mechanism is configured to input the log information into a hash function to obtain a hash value;

[0009] A hash value generation count mechanism, configured to count the number of times each hash value is generated within a specified period; and

[0010] The determining mechanism is configured to determine whether the number of times each hash value has been generated exceeds a predetermined value.

[0011] The system is configured such that when any of the number of times each hash value is generated exceeds the predetermined value, it is determined that an abnormal state of the individual system has occurred, and the corresponding handling is performed for the abnormal state.

[0012] In the system of the present invention described above, "individual system" can be a vehicle system, as in the example above, or it can be each of one or more individual computer systems in a system (e.g., a web system configured to deploy web applications such as point management on individual computer systems and perform processing distributed by a load balancer). "Communication network" can be a wired or wireless communication network. "Log information" can be the log itself generated corresponding to the operation of the computer device in the individual system, the source IP address, the destination IP address, URI, and other information used to identify the generated log. The hash function is a function that outputs a fixed-length numerical data, i.e., a hash value, that is, a value different for each log message when input log information is received. "Number of times...generated within a specified period" can be the total number of times generated within a period of arbitrarily set length, or it can be the total number of times generated within a specified period starting from a certain point in time. Alternatively, "Number of times...generated within a specified period" can also be the number of times generated if there is another generation within a specified period starting from a point in time.

[0013] In the system of the present invention described above, firstly, when logs are generated in an individual system, a hash function is used to calculate the hash value of the log information corresponding to the generated log. Then, the number of times each hash value is generated is counted. The hash value is a unique value for each log message input to the hash function, and the number of times this value is generated becomes the number of times a specific log is generated. Therefore, if the number of times any hash value is generated exceeds a pre-defined number within a pre-defined period, it can be determined that a large number of logs with that hash value have been generated in a short period of time, thereby determining that an abnormal state has occurred in the individual system, and corresponding processing can be performed. In this structure, instead of sequentially saving or sending log information, including the generated logs and information identifying the logs, to the server, a hash value is calculated based on the log information, and the number of times each hash value is generated is counted. Therefore, the resource usage of the communication network and the server is significantly reduced, thereby enabling the detection of anomalies in the generation of a large number of logs in a short period of time in an individual system with minimal resource consumption. Furthermore, the aforementioned pre-defined period and the pre-defined value for the number of times each hash value is generated are typically set as the period and value during which an anomaly is determined when the number of generation exceeds the pre-defined value within the pre-defined period.

[0014] Regarding the structure described above for counting the number of times each hash value is generated, in an implementation, a variable array can be set in the hash value generation counting mechanism to record the number of times each hash value is generated. Each time a log is generated and a hash value is output, the corresponding variable value is incremented sequentially. Therefore, by referring to this array, the distribution of logs generated to date can be determined.

[0015] In the above structure, when the number of times each hash value is generated exceeds a predetermined value, log information containing hash values ​​whose generation count exceeds the predetermined value is sent to the server computer. This allows the server to analyze the logs generated by the anomaly and perform corresponding processing. Furthermore, according to this structure, since not all logs generated by the anomaly are sent to the server, the usage of communication network and server resources can be reduced. Additionally, when the log information is sent to the server, it is preferable to mask sensitive information in the log information immediately before it is sent.

[0016] Furthermore, in the above structure, it is preferable to prevent log information with hash values ​​that have been sent to the server more than a predetermined number of times from being sent again. This structure, even if the same abnormal logs continue to be generated, prevents the information from being repeatedly sent to the server, thus avoiding the consumption of communication network and server resources.

[0017] In the above structure, as another way to deal with the situation where any of the number of times each hash value is generated exceeds a predetermined value, the individual system can be configured to cut off communication via the communication network. This prevents the impact of the abnormal state from affecting the communication network and the server via the communication network. Furthermore, in another approach, as described in Patent Document 1, the method of collecting log information can be changed based on the detection of the abnormal state, thereby obtaining more logs than usual.

[0018] In a system of one or more individual computer systems communicatively connected to a server via a communication network, to which this invention applies, if the individual systems under the management of the server within the communication network have the same structure, and an anomaly occurs in one individual system—for example, a program error caused by a common structure of all individual systems—the same anomaly may sometimes occur in other individual systems. In this case, when an anomaly is detected in one individual system within the communication network, by making it easier for other individual systems to detect the anomaly, responses to the anomaly can be executed more quickly. Therefore, in this invention, in other individual systems within the communication network, the calculation of the hash value corresponding to the log information using a hash function and the counting of the number of times each hash value is generated can be performed for each log generation. Each individual system has a mechanism for acquiring information about the number of times each hash value is generated in other individual systems connected to the communication network, and the determination mechanism can be configured to adjust a predetermined value based on the information about the number of times each hash value is generated in other individual systems. That is, in this invention, individual systems within the communication network can share log generation status with each other, and the determination mechanism can adjust the predetermined value for the number of times each hash value is generated based on the shared status, thereby making it expected that anomalies can be detected more easily. In addition, individual systems within a communication network can similarly constitute a hash value generation count mechanism. In this case, information such as the generation count of all individual systems within the communication network according to the size of each hash value, summing up each hash value, etc., can be collected, and the specified value for the generation count of each hash value can be adjusted based on the collected information.

[0019] Invention Effects

[0020] Thus, in the system based on the present invention, a hash value is calculated based on the logs generated in the individual system and the information identifying those logs, and the number of times each hash value is generated is counted. The system monitors whether the number of generation exceeds a predetermined value, thereby performing anomaly monitoring for the individual system. According to this structure, since the sequential saving or sending of log information to the server is not performed, even in the case of a large number of identical logs being generated in a short period, it is possible to avoid consuming communication network and server resources due to such occurrences.

[0021] Other objects and advantages of the present invention will become apparent from the following description of preferred embodiments of the invention. Attached Figure Description

[0022] Figure 1(A) is a diagram showing the structure of an anomaly monitoring system in an individual system based on this embodiment, represented by a box. Figure 1(B) is a schematic diagram of the structure of a communication network system assembled with an individual system applicable to this embodiment.

[0023] Figure 2 is a schematic diagram illustrating the operation of the log processing unit and the log count storage unit in the anomaly monitoring system based on this embodiment.

[0024] Figure 3 is a flowchart illustrating the process of detecting the generation of anomalies in the anomaly monitoring system based on this embodiment.

[0025] Figures 4(A) and 4(B) are flowcharts illustrating several ways of handling an anomaly after it is detected in the anomaly monitoring system based on this embodiment.

[0026] Figure 5(A) is a flowchart illustrating the process of sending the anomaly log to the server after an anomaly is detected in the anomaly monitoring system based on this embodiment. Figure 5(B) is a flowchart illustrating the process of aggregating the anomaly occurrence status of other individual systems in the anomaly monitoring system based on this embodiment.

[0027] Symbol Explanation

[0028] 10 - Individual System, 12 - Anomaly Monitoring Unit, 12K - Kernel Unit, 12U - User Unit, 13 - Control Processing Unit, 20 - Log Acquisition Unit (Log Acquisition Mechanism), 21 - Log Processing Unit (Hash Value Acquisition Mechanism, Judgment Mechanism), 22 - Log Count Storage Unit (Hash Value Generation Count Mechanism), 23 - Anomaly Log Processing Unit, 24 - Anomaly Log Sending Unit, 25 - Anomaly Status Storage Unit, 26 - Log Count Aggregation Processing Unit (Other System Information Acquisition Mechanism), 30 - Array for Log Generation Count Count, PS - Server Computer, ISi - Individual System, NM - Server-Individual System Inter-communication Network, NI - Individual System Inter-communication Network. Detailed Implementation

[0029] Hereinafter, several preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the drawings, the same symbols denote the same parts.

[0030] Structure of the anomaly monitoring unit in an individual system

[0031] As mentioned in the Summary of the Invention section, the structure of the anomaly monitoring system based on this embodiment can be assembled into each of one or more individual systems communicatively connected to a server via a communication network as an anomaly monitoring unit. The communication network can be of any type, typically wireless communication, but can also be wired communication. Referring to FIG1(A), in the individual system 10 to which this embodiment is applied, in a simplified description, each system is provided with a control processing unit 13 that performs control processing actions and an anomaly monitoring unit 12 that monitors anomalies of the control processing unit. The anomaly monitoring unit 12 may first be provided with a log acquisition unit 20, a log processing unit 21, a log count storage unit 22, an anomaly log processing unit 23, and an anomaly log sending unit 24, and may further be provided with an anomaly status storage unit 25 and a log count collection processing unit 26.

[0032] More specifically, the log acquisition unit 20 sequentially acquires logs and related information (source IP address, destination IP address, URI, etc.) generated during its operation in the control processing unit 13. Each time a log is acquired, the log processing unit 21 inputs the combination of the log and its related information (log information) into a hash function to calculate the inherent hash value of the log information and sends it to the log counting storage unit 22. As described later, the log counting storage unit 22 counts the number of times each sent hash value is generated according to this value. Then, if the number of times any hash value is generated reaches a predefined value within a predefined period, an exception occurs where a large number of logs corresponding to that hash value are generated within the predefined period. This situation is then relayed to the log processing unit 21, which instructs the log acquisition unit 20 to send information about logs whose hash value generation count exceeds the predefined value—that is, logs generated by exceptions—to the exception log processing unit 23. If the exception log processing unit 23 receives log information related to the exception, it executes any of the actions corresponding to that exception as described later. In one scenario, when sending log information related to an anomaly to a server PS that manages the status of more than one individual system, the anomaly log processing unit 23 performs masking of sensitive information in the received log information and transmits it to the anomaly log sending unit 24. The anomaly log sending unit 24 sends the log information with the masked sensitive information as an anomaly generation log information to the server computer PS via the communication network, and the anomaly status storage unit 25 records that log information related to the anomaly was sent to the server computer PS. This record can be a hash value obtained from the log information.

[0033] Furthermore, as schematically depicted in FIG1(B), the individual system 10 applicable to this embodiment is assembled into a communication network system 100 managed by a server computer PS via a communication network NM. When multiple individual systems IS1, IS2, ... are connected within the communication network system 100, these individual systems with the same specifications and structure as individual system 10 can each generate the same logs. Therefore, individual systems with the same specifications and structure can be communicatively connected to each other via the communication network NM, and can share information about the log generation status. Therefore, in individual system 10, as described above, a log counting collection and processing unit 26 can be provided, configured to send and receive information on the generation counts of each stored log information between the log counting storage units 22 of each other individual system 10 via the communication network NM. As will be described later, the shared information on the generation counts of log information of other individual systems 10 can be used for adjusting predetermined values ​​for the generation counts of each hash value, etc.

[0034] Furthermore, in the structure of the aforementioned individual systems, the anomaly monitoring unit 12 can typically be configured as shown in the figure, using a structure consisting of the eBPF operating system kernel unit 12K and the user unit 12U on which the application runs. In this configuration, to obtain logs, a technique that allows transparent acquisition of application information within the eBPF kernel unit 12K can be utilized. This allows obtaining the required information without changing the application or kernel (by utilizing eBPF, L7-level information (URLs or requested content) encrypted with SSL can also be obtained). The log components used as parameters for the hash function can also be changed without altering the application. Furthermore, while eBPF programs execute within the kernel, thus limiting CPU or memory resources, this is not a problem in this embodiment, as will be described in detail later, as a simple installation that only calculates hash values ​​and holds an array can be implemented.

[0035] A structure that uses hash values ​​to count the number of times logs are generated.

[0036] In this embodiment, as described above, the hash value of the log information—a combination of logs and related information generated in the control processing unit 13 of the individual system 10—is obtained, and the number of times this value is generated is counted. Generally, the hash value obtained by inputting text into the hash function varies depending on the value of the input text; the same hash value is obtained from the same text. Therefore, by referring to the hash value calculated for the generated log information, the generated log information can be identified. Thus, in this embodiment, as one way of the above structure, as schematically depicted in FIG2, an array 30 with variables corresponding to hash values ​​can be set in the log counting storage unit 22. In the log processing unit 21, if log information (which may be data composed of concatenated text of logs and related information) is input into the hash function (Hash) and a hash value HV is calculated, the variable component Ct corresponding to that value HV in the array 30 is incremented. Therefore, even without storing all generated logs, the number of times logs are generated can be counted.

[0037] Furthermore, in this embodiment, anomalies are detected based on the generation of a large number of identical logs within a short period of time. Therefore, the count value of the number of times each hash value has been generated is appropriately reset based on the elapsed time. For example, as one method, the count value can be reset at an appropriately set time. Alternatively, for each hash value, if the count value does not reach a predetermined value after a predetermined time has elapsed since its initial generation, the count value can be reset. Alternatively, for each hash value, it can be set to reset the count value if, after being generated once, no further generation occurs after a predetermined time has elapsed.

[0038] Operation of the Anomaly Monitoring Department

[0039] During operation, referring to Figure 3, firstly, if the log acquisition unit 20 acquires the log generated in the control processing unit 13 (S1), then in the log processing unit 21, the log information is input into a hash function to calculate the inherent hash value of the log information (S2). Next, the count value of the variable related to the hash value in the array 30 of the log count storage unit 22 is acquired (S3), and it is determined whether the count value is lower than a predetermined value (S4). If the count value is lower than the predetermined value, the count value is incremented by 1 (S5). Then, if the above-mentioned count value reset condition is not met (S6), the system waits for the generation of the next log (R). On the other hand, if the above-mentioned count value reset condition is met, the count value is reset (S7). In S4, when the count value reaches the predetermined value, the log reaches the predetermined value within a predetermined period, which can be judged as an anomaly. Therefore, the log information acquired at this time is sent to the anomaly log processing unit 23.

[0040] If the exception log processing unit 23 receives log information, it executes the processing corresponding to the occurrence of the exception. In one mode of this processing, it may execute a process to disconnect the individual system from the communication network (Figure 4(A)S11). This prevents the abnormal state of the individual system from affecting the server computer or other individual systems through the communication network.

[0041] Furthermore, as another way to handle the occurrence of an anomaly, the process of transmitting log information masked with sensitive information to the anomaly log sending unit 24 for transmission to the server can be performed. At this time, a hash value can also be sent (Figure 4(B) S12). Then, if the anomaly log sending unit 24 receives log information masked with sensitive information, it performs a process of checking in the anomaly state storage unit 25 whether a record of the same log information has already been sent to the server computer. Regarding this, as one approach, a flag indicating whether or not a log has been sent can be set in the anomaly state storage unit 25 for each hash value. When a log information is sent to the server computer, the flag of the hash value corresponding to that log information is changed from False to True, thereby storing the log sent to the server in the anomaly state storage unit 25.

[0042] In the specific processing of the exception log sending unit 24, referring to Figure 5(A), after receiving the log information masked with sensitive information and its hash value from the exception log processing unit 23, the flag value of the received hash value is obtained from the exception state storage unit 25 (S20), and the flag value is determined (S21). Here, when the flag value is False, the received log information has not yet been sent to the server, so the log information masked with sensitive information is sent to the server (S22), and the flag value of the hash value in the exception state storage unit 25 is converted to True. On the other hand, when the obtained flag value is True, the received log information has been sent to the server, so no further sending is performed. Thus, it is possible to avoid consuming communication network and server resources by repeatedly sending logs generated by an exception that was sent once to the server. The log information sent to the server can be used for log analysis in any way.

[0043] In addition, as another way for the abnormal log processing unit 23 to respond when it receives log information that has an abnormality, similar to the case in Patent Document 1, the method of collecting log information can be changed to obtain more logs than usual.

[0044] Sharing log generation status with other individual systems

[0045] As described above, the anomaly monitoring unit 12 of the individual system in this embodiment may also include a log count aggregation processing unit 26, configured to communicate with the log count aggregation processing units 26 of other individual systems assembled in the communication network system 100 (FIG. 1(B)) and share information on the number of times each log information is generated, which is stored in each log count storage unit 22. Then, in the anomaly monitoring unit 12, a predetermined value that can be appropriately set for the number of times each hash value is generated can be adjusted based on the generation status of each log information of the other individual systems that are shared.

[0046] Specifically, for example, referring to FIG5(B), the log count aggregation processing unit 26 can communicate sequentially with the log count aggregation processing units 26 of other individual systems via the communication network NI (FIG. 1(B)) to obtain information about the log count storage units 22 of other individual systems (S30). Then, from the obtained information about the log count storage units 22 of other individual systems, an array 30 (S31) is extracted showing the number of times each hash value of the log count storage units 22 of the individual systems with the same structure as itself is extracted, and the value of the number of times each hash value was generated is summed (S32). Thus, it is possible to grasp the log generation status of the entire group of individual systems with the same structure among the individual systems connected to the communication network NM.

[0047] The log generation status of the individual system as a whole obtained as described above can be used in any way. For example, if the hash value of a specific log is generated a lot, it can be determined that an anomaly related to that log is likely to occur. Therefore, in order to detect the anomaly as early as possible, the hash value of that specific log can be processed by reducing the specified value corresponding to the count value in S4 of Figure 3.

[0048] Thus, the system according to this embodiment can detect anomalies without significantly consuming network resources or server resources of individual systems that generate a large number of identical logs in a short period of time. The structure of this embodiment, as described above, is applicable to in-vehicle systems, and also, for example, to web systems.

[0049] The above description relates to the embodiments of the present invention, but those skilled in the art can easily make numerous modifications and changes. The present invention is not limited to the embodiments illustrated above, and can obviously be applied to various devices without departing from the concept of the present invention.

Claims

1. A system for monitoring anomalies in individual systems communicatively connected to a server computer via a communication network, the system characterized by comprising: A log acquisition mechanism, configured to acquire log information generated in the individual system; The system includes a hash value acquisition mechanism, which is configured to input the log information into a hash function to obtain a hash value; a hash value generation count mechanism, which is configured to count the number of times each hash value is generated within a specified period; and a determination mechanism, which is configured to determine whether the number of times each hash value is generated exceeds a specified value. The system is configured such that when any one of the number of times each hash value is generated exceeds the specified value, it is determined that an abnormal state of the individual system has occurred, and corresponding handling is performed for the abnormal state.

2. The system according to claim 1, characterized in that, The system is configured such that when any of the number of times each hash value is generated exceeds the predetermined value, log information of the hash value having been generated more than the predetermined value is sent to the server computer.

3. The system according to claim 2, characterized in that, The system is configured such that, after sending the log information with a hash value having been generated more than the predetermined number of times to the server computer, the same log information is not sent to the server computer again.

4. The system according to claim 1, characterized in that, The system is configured to cut off communication via the communication network in the individual system when any of the number of times each hash value is generated exceeds the predetermined value.

5. The system according to claim 1, characterized in that, It includes: an other system information acquisition mechanism that acquires information on the number of times each hash value is generated by other individual systems connected to the communication network, and the determination mechanism is configured to adjust the predetermined value based on the information on the number of times each hash value is generated by the other individual systems.

Images