ANALYSIS DEVICE, ANALYSIS METHOD AND PROGRAM

Abstract

A first analysis device (120) is an analysis device that sends report information based on an analysis result of a log relating to a vehicle (V) and includes: an acquirer (121) that acquires a first anonymized log, which is the log containing first anonymized data of the vehicle (V); a link resolution unit (125b) that performs link resolution, which is processing to determine, from second anonymized data included in each of a plurality of second anonymized logs included in a second system (200), second anonymized data corresponding to the first anonymized data as specific second anonymized data; a system collaborator (125c) that acquires, from the second system (200), a second anonymized log containing the specific second anonymized data as a second anonymized log to be integrated;and an integrated analyzer (125d) that performs an analysis of a log group containing the first anonymized log and the second anonymized log to be integrated as an integrated analysis;

Description

[Technical field]

[0001] The present disclosure relates to an analysis device and the like that analyze a log. [General state of the art]

[0002] For example, Patent Literature (PTL) 1 discloses a log analysis device as an analysis device. This log analysis device issues a warning when a log message to be monitored meets a predetermined condition and extracts a related log related to the warning from the log message. The log analysis device then outputs information corresponding to the related log for each equal time slot. Accordingly, even with a large number of logs, it is possible to narrow down the logs to be checked. [List of cited documents][Patent literature]

[0003] [PTL 1] Japanese Patent No. JP 7078114 [Summary of the invention][Technical problem]

[0004] However, since the logs to be analyzed in PTL 1 described above are limited, there is a problem that it is difficult to improve the analysis accuracy. That is, although the log analysis device in PTL 1 described above integrates and analyzes the extracted related logs, these related logs were limited, and not many logs were used. For example, there are cases where the possibility of improving the analysis device can be increased by integrating and analyzing the logs acquired by two or more systems, rather than having these systems collect and analyze the logs of a vehicle to be monitored according to the tasks of each system. However, if the anonymization of logs in each of these systems is performed in a different mode, it is difficult to integrate the logs of the vehicle to be monitored.Accordingly, a large number of protocols cannot be used for analysis, making it difficult to improve analysis accuracy.

[0005] In view of this, the present disclosure provides an analysis apparatus and the like that can improve the analysis accuracy. [Solution to the problem]

[0006] An analysis device according to one aspect of the present disclosure is an analysis device that sends report information based on an analysis result of a log related to a device to be monitored. The analysis device includes: an acquirer that acquires a first anonymized log, which is the log containing first anonymized data of the device to be monitored; a link resolution unit that performs link resolution, which is processing to determine, from second anonymized data included in each of a plurality of second anonymized logs included in a cooperative monitoring system, second anonymized data corresponding to the first anonymized data as specific second anonymized data;a system collaborator that obtains a second anonymized log containing the specific second anonymized data from the cooperative monitoring system as a second anonymized log to be integrated; and an integrated analyzer that performs an analysis of a log group containing the first anonymized log and the second anonymized log to be integrated as an integrated analysis.

[0007] It should be noted that these general or specific aspects may be implemented using a system, apparatus, method, integrated circuit, computer program, or computer-readable recording medium, such as a compact disc read-only memory (CD-ROM), or any combination of systems, apparatus, methods, integrated circuits, computer programs, or recording media. Furthermore, the recording medium may be a non-volatile recording medium. [Advantageous effects of the invention]

[0008] The analysis apparatus of the present disclosure can improve the analysis accuracy.

[0009] It should be noted that further advantages and effects in one aspect of the present disclosure will become apparent from the description and the drawings. Although such advantages and / or effects are provided by the configurations described in one or more embodiments, the description, and the drawings, not all of these configurations are necessarily required. [Brief description of the drawings] [ Fig. 1] Fig. 1 is a general configuration diagram of an analysis system in one embodiment. [ Fig. 2] Fig. 2 is a block diagram illustrating an example of the functional configuration of a first analysis device in the embodiment. [ Fig. 3] Fig. 3 is a diagram for describing processing operations related to an integrated processing unit of a first system and a second system. [ Fig. 4] Fig. 4 is a flowchart showing an example of processing operations of the first analysis device in the embodiment. [ Fig. 5] Fig. 5 is a diagram for describing processing operations related to the integrated processing unit of processing a first system and a second system in variation 1 of the embodiment. [ Fig. 6] Fig. 6 is a flowchart showing an example of processing operations of a first analysis device in variation 1 of the embodiment. [ Fig. 7] Fig. 7 is a diagram for describing processing operations related to an integrated processing unit of processing a first system and a second system in variation 2 of the embodiment. [ Fig. 8] Fig. Figure 8 is a diagram showing an example of reanonymization in variant 2 of the embodiment. [ Fig. 9] Fig. 9 is a flowchart showing an example of the processing operations of a first analysis device in variant 2. [ Fig. 10] Fig. 10 is a diagram for describing processing operations related to a second analysis device of the processing of a first system and a second system in variation 3 of the embodiment. [ Fig. 11] Fig. 11 is a flowchart showing an example of processing operations of a first analysis device in variation 3 of the embodiment. [ Fig. 12] Fig. 12 is a diagram for describing processing operations related to an integrated processing unit of processing a first system and a second system in variation 4 of the embodiment. [ Fig. 13] Fig. 13 is a diagram showing an example of information linking in variant 4 of the embodiment. [ Fig. 14] Fig. 14 is a flowchart showing an example of the processing operations of a first analysis device in variation 4 of the embodiment. [ Fig. 15] Fig. 15 is a flowchart showing an example of the processing operations of a second analysis device in variation 4 of the embodiment. [Description of the embodiments]

[0010] An analysis device according to a first aspect of the present disclosure is an analysis device that transmits report information based on an analysis result of a log relating to a device to be monitored. The analysis device includes: an acquirer that acquires a first anonymized log, which is the log containing first anonymized data of the device to be monitored; a link resolution unit that performs link resolution, which is processing to determine, from second anonymized data included in each of a plurality of second anonymized logs included in a cooperative monitoring system, second anonymized data corresponding to the first anonymized data as specific second anonymized data; a system collaborator that acquires a second anonymized log from the cooperative monitoring system,that contains the specific second anonymized data as a second anonymized log to be integrated; and an integrated analyzer that performs an analysis of a log group containing the first anonymized log and the second anonymized log to be integrated as an integrated analysis. For example, when a system containing the analysis device and the cooperative monitoring system each obtain a log with respect to one or more devices, the systems anonymize their logs in different modes. An example of the devices is a vehicle. In addition, when anonymizing a log, the identification data used to identify a device and a user registered in the log, such as a VIN (Vehicle Identification Number) or IP (Internet Protocol) address,contained in the log are anonymized into anonymization data. In the system containing the analysis device, a log relating to a device to be monitored is managed as a first anonymized log containing the first anonymized data. Furthermore, in the cooperative monitoring system, a log for each device, including the device to be monitored, is managed as a second anonymized log containing the second anonymized data.

[0011] Here, in the analysis device according to the above-described first aspect of the present disclosure, the second anonymized data corresponding to the first anonymized data is determined as specific second anonymized data through link resolution. That is, the second anonymized data corresponding to the same device to be monitored as the first anonymized data is determined as specific second anonymized data and linked to the first anonymized data. Accordingly, the second anonymized log relating to the same device to be monitored as the first anonymized log can be acquired by the cooperative monitoring system as a second anonymized log to be integrated.Since integrated analysis can be performed on the first anonymized log and the second anonymized log to be integrated with respect to the same device to be monitored, the analysis accuracy can be improved even more than when analyzing only the first anonymized log. That is, even if anonymization is performed on logs in different modes in the system including the analysis device and the cooperative monitoring system, the logs can be integrated and analyzed with respect to the same device to be monitored, thereby improving the analysis accuracy.

[0012] Moreover, according to a second aspect depending on the first aspect, the analysis device may further include: an integrated determiner that determines whether the integrated analysis is required or not, and when it is determined by the integrated determiner that the integrated analysis is required, the link resolution unit may perform the link resolution.

[0013] Accordingly, since link resolution is performed when it is determined that integrated analysis is required, it is possible to prevent link resolution from being performed even in cases where integrated analysis is not required, and the processing burden can be reduced. Furthermore, when integrated analysis is not required, the analysis of the first anonymized log can be performed without using the second anonymized log, and the processing burden can be reduced. Note that whether integrated analysis is required can be determined based on the analysis result of the first anonymized log.

[0014] Moreover, according to a third aspect depending on the first or second aspect, the analysis device may further include: a transmission destination determiner that determines a transmission destination according to a result of the integrated analysis; and a transmitter that transmits the report information indicating the result of the integrated analysis to the transmission destination determined by the transmission destination determiner.

[0015] Since the report information is sent to the transmission destination according to the integrated analysis result, the integrated analysis result can be transmitted to an appropriate transmission destination. That is, depending on the area affected by the situation of a device being monitored, the integrated analysis result can be transmitted to a SIRT (Security Incident Response Team) corresponding to that area.

[0016] Furthermore, in the analysis device according to a fourth aspect dependent on any one of the first to third aspects, the system collaborator may obtain the second anonymized protocol to be integrated from one or more second anonymized protocols from the plurality of second anonymized protocols that correspond to at least one type or time window determined according to the first anonymized protocol. Alternatively, in the analysis device according to a fifth aspect dependent on any one of the first to third aspects, the system collaborator may specify a second anonymized protocol from the plurality of second anonymized protocols that corresponds to a condition determined according to the first anonymized protocol by using at least one type or time window to obtain the second anonymized protocol as the second anonymized protocol to be integrated.

[0017] Accordingly, the type and time window of the acquired second anonymized log to be integrated can be limited to the type and time window determined according to the first anonymized log. For example, if the device to be monitored is a vehicle, the second anonymized log to be integrated can be of a type related to a congestion prediction or the second anonymized log to be integrated corresponding to a time window of the congestion. Since the type and time window of the second anonymized log to be integrated are limited, it is possible to prevent the acquisition of a second anonymized log that makes little contribution to the integrated analysis and to realize efficient integrated analysis.

[0018] Furthermore, in the analysis device according to the sixth aspect depending on any one of the first to fifth aspects, the system collaborator may further anonymize the specific second anonymized data contained in the acquired second anonymized protocol to be integrated.

[0019] This means that the second anonymized protocol to be integrated or the specific second anonymized data are re-anonymized. Accordingly, the confidentiality of these protocols and data can be increased. This is because it is possible to prevent the cooperative monitoring system from detecting a device corresponding to the protocol from these re-anonymized protocols or data. This can increase the security of the second anonymized protocol to be integrated.

[0020] Furthermore, in the analysis device according to a seventh aspect depending on any one of the first to sixth aspects, the system collaborator may further send the first anonymized log to the cooperative monitoring system according to a request of the cooperative monitoring system.

[0021] Accordingly, not only the analysis device but also the cooperative monitoring system can obtain the first anonymized log and the second anonymized log corresponding to the same device to be monitored and can perform integrated analysis. That is, mutual cooperation between the system containing the analysis device and the cooperative monitoring system can be realized, and effective analysis of the logs can be performed.

[0022] Furthermore, in the analysis device according to an eighth aspect depending on any one of the first to seventh aspects, the link resolution unit may further: store, in a recording medium, link information indicating a correspondence between the first anonymized data and the specific second anonymized data; and, when repeatedly performing the link resolution for the first anonymized data, perform the link resolution by referring to the link information stored in the recording medium.

[0023] Accordingly, when link resolution is performed repeatedly, since link resolution is performed by referring to the link information, the time and effort required for the analysis device to communicate with another device or the like to perform link resolution can be saved. This allows efficient link resolution and integrated analysis to be realized.

[0024] Furthermore, in the analysis device according to a ninth aspect depending on the eighth aspect, the link resolution unit may further: set an expiration date for the link information, and, when a time of repeatedly performing the link resolution for the first anonymized data has not exceeded the expiration date, perform the link resolution with reference to the link information stored in the recording medium.

[0025] Accordingly, since the expiration date is set for the linking information, the corresponding relationship between the first anonymized data and the second anonymized data can be guaranteed until the expiration date, and the corresponding relationship can be changed after the expiration date. That is, after the expiration date, the respective anonymization modes of the system containing the analysis device and the cooperative monitoring system can be changed. This can increase the flexibility of the overall processing operations of these systems.

[0026] Furthermore, in the analysis device according to a tenth aspect depending on the eighth or ninth aspect, the system collaborator may further send the linking information stored on the recording medium to the cooperative monitoring system.

[0027] Since the linking information is sent to the cooperative monitoring system, the cooperative monitoring system can perform link resolution using the linking information. This also allows the cooperative monitoring system to perform integrated analysis similar to that performed in the analysis device.

[0028] Furthermore, in the analysis device according to an eleventh aspect depending on the tenth aspect, when the linkage information stored in the recording medium is updated by the linkage resolution unit, the system collaborator may send the updated linkage information to the cooperative monitoring system.

[0029] Accordingly, the analysis device and the cooperative monitoring system can synchronize and manage common linking information. This makes it possible to improve the efficiency of the integrated analysis performed by the analysis device and the cooperative monitoring system.

[0030] Furthermore, in the analysis device according to a twelfth aspect depending on any one of the first to eleventh aspects, the retriever can retrieve the first anonymized log from a first server. The first server can, when a first log relating to the device to be monitored is retrieved, anonymize the first identification data of the device to be monitored contained in the first log to generate the first anonymized log containing the first anonymized data. A second server included in the cooperative monitoring system can, when a second log relating to the device to be monitored is retrieved, anonymize the second identification data contained in the second log to generate the second anonymized log containing the second anonymized data.and the link resolution unit may perform the link resolution by sending the first anonymized data to the first server and making a request to the second server via the first server for second anonymized data corresponding to the first anonymized data.

[0031] Since the first server and the second server each perform anonymization and the link resolution is performed by the request to the second server via the first server, an accurate link resolution can be realized accordingly.

[0032] An embodiment will be described in detail below with reference to the drawings.

[0033] Please note that the embodiment described below represents a general or specific example. Therefore, the numerical values, shapes, materials, structural elements, the arrangement and connection of structural elements, steps, the order of steps, etc. shown in the following embodiment are merely examples and are not intended to limit the scope of the present disclosure.

[0034] Please note that the figures are schematic representations and are not necessarily accurate. Furthermore, structural elements that are essentially the same are designated by the same reference numerals. [Embodiment]

[0035] Fig. 1 is a general configuration diagram of an analysis system in the present embodiment.

[0036] The analysis system 1 in the present embodiment is a system that analyzes and monitors processing operations in the vehicle V, which is a device to be monitored, and includes the vehicle V, the base station R, the first system 100, and the second system 200. Note that the base station R does not need to be included in the analysis system 1.

[0037] The vehicle V includes devices that receive telematics services, such as devices used for a car navigation system, and perform vehicle control, such as steering and vehicle speed. Furthermore, the vehicle V transmits a plurality of protocols to the first system 100 and the second system 200 via the base station R. These protocols include a protocol related to telematics, a protocol related to vehicle control, and the like. Furthermore, each protocol includes privacy information. The privacy information is, for example, identification data for identifying the vehicle V, and is, for example, an address of a VIN (Vehicle Identification Number), an IP (Internet Protocol), and the like. Note that these protocols may also be referred to as vehicle data.

[0038] The first system 100 is also referred to, for example, as a vehicle monitoring system and monitors the vehicle control of each vehicle, including vehicle V. Such a first system 100 includes a first server 110 and a first analysis device 120.

[0039] The first server 110 is also called a vehicle log server, for example, and receives a first log according to the analysis purpose of the first system 100 from among the logs sent from each vehicle, including vehicle V. The first log is, for example, a log related to the vehicle control of vehicle V. The first server 110 generates a first anonymized log by anonymizing the first log and outputs the first anonymized log to the first analysis device 120. Specifically, when anonymizing the first log, the first server 110 generates first anonymized data by anonymizing the first identification data included in the first log. It can be said that the first anonymized log is the first log that includes the first anonymized data instead of the first identification data.The first identification data is, for example, a vehicle identification number (VIN) for identifying vehicle V. Note that, since anonymization is performed in the present embodiment, devices other than the first server 110 cannot identify vehicle V based on the first anonymized data and the first anonymized log. Such anonymization is performed for data protection reasons required by the General Data Protection Regulation (GDPR) and the like.

[0040] The first analysis device 120 is a device used in a SOC (Security Operation Center) for vehicle control. When one or more first anonymized logs are obtained from the first server 110, the first analysis device 120 analyzes these first anonymized logs. For example, by analyzing these first anonymized logs, the first analysis device 120 determines whether or not an attack has occurred on a vehicle corresponding to the first anonymized data and the like.

[0041] The second system 200 is also referred to, for example, as an IT (information technology) system and monitors the telematics service of each vehicle, including vehicle V. Such a second system 200 comprises a second server 210 and a second analysis device 220.

[0042] The second server 210 is also referred to, for example, as a telematics server, and receives a second log among the logs sent from each vehicle, including vehicle V, according to the analysis purpose of the second system 200. The second log is, for example, a log related to a telematics system such as a car navigation system. The second server 210 generates a second anonymized log by anonymizing the second log and outputs the second anonymized log to the second analysis device 220. Specifically, when anonymizing the second log, the second server 210 generates second anonymized data by anonymizing the second identification data included in the second log. It can be said that the second anonymized log is the second log that includes the second anonymized data instead of the second identification data.The second identification data is, for example, an IP address for identifying vehicle V. Note that since anonymization is performed in the present embodiment, devices other than the second server 210 cannot identify vehicle V based on the second anonymized data and the second anonymized log. Such anonymization, like the first server 110, is performed for data protection reasons required by the GDPR and the like.

[0043] The second analysis device 220 is a device used in an IT SOC. When one or more second anonymized logs are obtained from the second server 210, the second analysis device 220 analyzes these second anonymized logs. For example, the second analysis device 220 predicts a traffic jam on a road on which the vehicle corresponding to the second anonymized data is scheduled to travel by analyzing these second anonymized logs.

[0044] It should be noted that although the first identification data and the second identification data are included in the first protocol and the second protocol, respectively, the data obtained by anonymizing the second identification data may or may not be included in the first anonymized protocol. Likewise, data obtained by anonymizing the first identification data may or may not be included in the second anonymized protocol. Furthermore, the first server 110 and the second server 210 are devices operated by, for example, a vehicle manufacturer, and the first analysis device 120 and the second analysis device 220 are devices operated by an organization that provides services or the like.

[0045] In this embodiment, when integrated analysis is required, the first analysis device 120 acquires one or more second anonymized logs of the vehicle V from the second analysis device 220 and integrates the one or more second anonymized logs of the vehicle V into one or more first anonymized logs of the vehicle V. Then, the first analysis device 120 performs analysis on the integrated one or more first anonymized logs and the one or more second anonymized logs as integrated analysis. Furthermore, when performing this integrated analysis, the first analysis device 120 performs link resolution, which is processing for linking the first anonymized log and the second anonymized log with respect to the vehicle V.

[0046] It should be noted that although in the present embodiment, the first server 110 and the second server 210 acquire the logs of vehicle V from the vehicle V via the base station R, they may acquire the logs of vehicle V from a device or server other than the vehicle V. That is, the logs of vehicle V in the present embodiment are logs related to the vehicle V and are not limited to the logs generated by the vehicle V or the logs acquired by the vehicle V. Accordingly, the logs of vehicle V may also include a log generated by another device or server, such as a communication protocol between the vehicle V and an external network, or a log acquired by another device or server.

[0047] Fig. 2 is a block diagram illustrating an example of the functional configuration of the first analysis device 120 in the present embodiment.

[0048] The first analysis device 120 in the present embodiment is a device that transmits report information based on an analysis result of a protocol about the monitored vehicle V. Such a first analysis device 120 includes the acquirer 121, the protocol analyzer 122, the transmission destination determiner 123, the transmitter 124, the integrated processing unit 125, the control unit 126, the memory 127, and the communicator 128.

[0049] The communicator 128 communicates with each of the first server 110 and the second analysis device 220 via a telecommunications line, such as the Internet.

[0050] The retriever 121 retrieves the first anonymized log of vehicle V from the first server 110 via the communicator 128. That is, the retriever 121 retrieves the first anonymized log from the first server 110, which is the log containing the first anonymized data of vehicle V, which is the device to be monitored. The retriever 121 then stores the first anonymized log in memory 127.

[0051] The protocol analyzer 122 analyzes one or more first anonymized protocols that were obtained by the collector 121 and stored in the memory 127.

[0052] The transmission destination determiner 123 determines a transmission destination for report information indicating an analysis result of one or more logs of vehicle V. That is, the transmission destination determiner 123 determines the transmission destination of the report information indicating the result of the analysis of the one or more first anonymized logs by the log analyzer 122. Alternatively, the transmission destination determiner 123 determines the transmission destination of the report information indicating the result of the integrated analysis by the integrated processing unit 125. For example, the transmission destination determiner 123 determines the transmission destination of the report information according to the result of the integrated analysis. The transmission destination is, for example, at least one SIRT (Security Incident Response Team) among a plurality of SIRTs.In particular, the majority of SIRTs include a first SIRT responsible for vehicle control and a second SIRT responsible for vehicle control and telematics.

[0053] The transmitter 124 transmits the report information via the communicator 128 to the transmission destination determined by the transmission destination determiner 123. For example, when the integrated analysis is performed, the transmitter 124 transmits the report information indicating the result of the integrated analysis to the transmission destination according to the result of the integrated analysis, that is, to the transmission destination determined by the transmission destination determiner 123. Note that the transmission destination is the SIRT described above, and specifically, a device or system included in the SIRT.

[0054] The integrated processing unit 125 performs the integrated analysis described above. Specifically, this integrated processing unit 125 includes the integrated determiner 125a, the link resolution unit 125b, the system collaborator 125c, and the integrated analyzer 125d.

[0055] The integrated determiner 125a determines whether or not an integrated analysis is required based on the analysis result of the log analyzer 122, that is, the analysis result of the one or more first anonymized logs.

[0056] The link resolution unit 125b performs link resolution when the integrated determiner 125a determines that integrated analysis is required. Link resolution is processing for linking the first anonymized log and the second anonymized log, each relating to the same vehicle V. Specifically, the second analysis device 220 of the second system 200 includes a plurality of second anonymized logs acquired from each vehicle, including vehicle V. The plurality of second anonymized logs includes not only the second anonymized log from vehicle V but also second anonymized logs from other vehicles.Therefore, the link resolution unit 125b performs link resolution to link the second anonymized log, which is a log of vehicle V similar to the first anonymized log, to the first anonymized log, among the plurality of second anonymized logs. That is, the link resolution unit 125b performs link resolution, which is processing to determine the second anonymized data corresponding to the first anonymized data as specific second anonymized data from the second anonymized data included in each of the plurality of second anonymized logs in the second system 200, which is the cooperative monitoring system.Accordingly, the first anonymised data and the specific second anonymised data are linked to each other, and as a result, the first anonymised log containing the first anonymised data and the second anonymised log containing the specific second anonymised data are linked to each other.

[0057] The system collaborator 125c requests and retrieves the second anonymized log linked to the first anonymized log from the second analysis device 220 via the communicator 128. The second anonymized log is the log used for integration with the first anonymized log. That is, the system collaborator 125c retrieves the second anonymized log containing the specific second anonymized data described above from the second system 200 (i.e., the cooperative monitoring system) as the second anonymized log to be integrated.

[0058] The integrated analyzer 125d integrates the one or more first anonymized logs and the one or more second anonymized logs to be integrated, and performs an analysis of the integrated one or more first anonymized logs and the one or more second anonymized logs to be integrated. That is, the integrated analyzer 125d performs the analysis of a log group containing the first anonymized logs and the second anonymized logs to be integrated as an integrated analysis.

[0059] The control unit 126 controls each component included in the first analysis device 120. That is, the control unit 126 controls the acquirer 121, the protocol analyzer 122, the transmission destination determiner 123, the transmitter 124, the integrated processing unit 125, the memory 127, and the communicator 128.

[0060] Memory 127 is a recording medium for storing data, information, and the like generated by the components described above. Memory 127 is, for example, a hard disk drive, RAM (Random Access Memory), ROM (Read Only Memory), a semiconductor memory, or the like. Note that such memory 127 may be volatile or non-volatile.

[0061] Fig. 3 is a diagram for describing processing operations related to the integrated processing unit 125 of the first system 100 and the second system 200.

[0062] When it is determined by the integrated determination unit 125a that an integrated analysis is required, the link resolution unit 125b of the integrated processing unit 125 performs a request from the communicator 128 to the second server 210 via the first server 110 as in the processing (1) in Fig. 3. The request is a request for the second anonymized data corresponding to the first anonymized data. At this time, the link resolution unit 125b sends the first anonymized data to the first server 110 via the communicator 128.

[0063] If, as in processing (2) in Fig. 3, the first anonymized data is obtained from the link resolution unit 125b, the first server 110 identifies the first identification data corresponding to the first anonymized data. It should be noted that when the first server 110 sends the above-described first protocol to the first analysis device 120, since the first server 110 has generated the first anonymized data by anonymizing the first identification data included in the first protocol, the first server 110 can identify the first identification data corresponding to the first anonymized data. Then, the first server 110 sends, as in processing (3) in Fig. 3, the identified first identification data to the second server 210 and requests the second anonymized data corresponding to the first identification data.

[0064] When the second server 210 retrieves the first identification data from the first server 110 and accepts the query described above, the second server 210 identifies the second anonymized data corresponding to the first identification data, as in processing (4) in Fig. 3. It should be noted that when the second server 210 first sends the above-described second log to the second analysis device 220, the second server 210 acquires the second log containing the first identification data and the second identification data, and generates the second anonymized data by anonymizing the second identification data. Accordingly, the second server 210 can identify the second anonymized data corresponding to the first identification data. As in processing (5) in Fig. 3, the second server 210 then responds to the request from the first server 110 by sending the identified second anonymized data to the first server 110. Note that the second server 210 may separately include data for identifying the second identification data corresponding to the first identification data, identifying the second identification data corresponding to the first identification data, and further identifying the second anonymized data corresponding to the second identification data.

[0065] When the first server 110 receives the second anonymized data from the second server 210, the first server 110 sends the second anonymized data to the first analysis device 120 as described in processing (6) in Fig. 3. Accordingly, the link resolution unit 125b receives the second anonymized data, for example via the communicator 128, as the response to the request in the processing (1) in Fig. 3. This second anonymized data is the data corresponding to the first anonymized data and the data identifying the same vehicle V as the first anonymized data. The link resolution unit 125b outputs the second anonymized data to the system collaborator 125c.

[0066] When the system collaborator 125c obtains the second anonymized data from the link resolution unit 125b, the system collaborator 125c sends the second anonymized data to the second analysis device 220 to request the second anonymized log containing the second anonymized data from the second analysis device 220, as described in processing (7) in Fig. 3.

[0067] When the second analysis device 220 receives the second anonymized data from the system collaborator 125c and further accepts the request described above, the second analysis device 220 sends the second anonymized log containing the second anonymized data to the first analysis device 120 as a second anonymized log to be integrated, as described in processing (8) in Fig. 3.

[0068] When the system collaborator 125c of the first analysis device 120 obtains the second anonymized protocol to be integrated from the second analysis device 220 via the communicator 128, the system collaborator 125c stores the second anonymized protocol to be integrated in the memory 127.

[0069] Then, the integrated analyzer 125d of the first analysis device 120 integrates one or more first anonymized logs and one or more second anonymized logs to be integrated, which are stored in the memory 127, to generate a log group including the one or more first anonymized logs and the one or more second anonymized logs to be integrated. Furthermore, the integrated analyzer 125d performs analysis of the log group as an integrated analysis, generates report information indicating a result of the integrated analysis, and stores the report information in the memory 127. This report information is transmitted via the transmitter 124 to the transmission destination determined by the transmission destination determiner 123.

[0070] In this way, in the present embodiment, the first analysis device 120 performs the link resolution by executing the request. Specifically, in the present embodiment, the acquirer 121 of the first analysis device 120 acquires the first anonymized log from vehicle V via the first server 110 and the communicator 128. Note that vehicle V is the device to be monitored. When the first server 110 acquires the first log from vehicle V, the first server 110 generates the first anonymized log containing the first anonymized data by anonymizing the first identification data of vehicle V included in the first log.When the second server 210 included in the cooperative monitoring system, the second system 200, obtains the second log related to the vehicle V, the second server 210 generates the second anonymized log containing the second anonymized data by anonymizing the second identification data included in the second log. Then, the link resolution unit 125b of the first analysis device 120 sends the first anonymized data to the first server 110 via the communicator 128. Furthermore, the link resolution unit 125b performs link resolution by requesting the second anonymized data corresponding to the first anonymized data to the second server 210 via the communicator 128 and the first server 110.

[0071] Since both the first server 110 and the second server 210 perform anonymization and the link resolution is performed by the request to the second server 210 via the first server 110, an accurate link resolution can be realized.

[0072] Fig. 4 is a flowchart illustrating an example of the processing operations of the first analysis device 120 in the present embodiment.

[0073] First, the retriever 121 of the first analysis device 120 retrieves one or more first anonymized logs from the first server 110 (step S1). Then, the log analyzer 122 analyzes the one or more first anonymized logs (step S2).

[0074] The integrated determiner 125a of the integrated processing unit 125 determines whether integrated analysis is required or not based on an analysis result of the one or more first anonymized logs (step S3). For example, if the analysis result indicates an attack relevant to a network outside of vehicle V, the integrated determiner 125a determines that integrated analysis is required. An example of an attack is an attack on vehicle V via an out-car system to be monitored. Alternatively, an example of an attack is an attack from vehicle V to another device via the out-car system to be monitored. Alternatively, an example of the attack may also be an attack whose source or target is vehicle V when viewed from the out-car system.

[0075] If the integrated determination unit 125a determines that integrated analysis is required (Yes in step S3), the link resolution unit 125b performs a query using the first anonymized data (step S4). Note that in step S4, the link resolution unit 125b may also use information used as parameters for anonymization processing in addition to the first anonymized data. That is, not only the first anonymized data but also the information may be used, or the information may be used instead of the first anonymized data. Anonymization processing is processing for obtaining the first anonymized data by anonymizing the first identification data (a specific example is a VIN).The information used as parameters for such anonymization processing may be time information indicating the time at which the first anonymized log containing the first anonymized data is generated, or it may be position information indicating the position of the vehicle V at that time.

[0076] On the other hand, if the integrated determiner 125a determines that integrated analysis is not required (No in step S3), the log analyzer 122 stores the analysis result of the one or more first anonymized logs obtained by the processing in step S2 in the memory 127 (step S9). That is, the log analyzer 122 stores the report information indicating the analysis result in the memory 127.

[0077] After the processing in step S4, the link resolution unit 125b receives the second anonymized data (that is, the specific second anonymized data) corresponding to the first anonymized data as a result of the request, that is, the processing in step S4 (step S5).

[0078] The system collaborator 125c retrieves from the second analysis device 220 the second anonymized protocol containing the second anonymized data received in step S5 as the second anonymized protocol to be integrated (step S6). The second anonymized protocol to be integrated is stored in memory 127.

[0079] Next, the integrated analyzer 125d generates a log group by integrating the one or more first anonymized logs and the one or more second anonymized logs to be integrated, and performs analysis of the log group as an integrated analysis (step S7). Then, the integrated analyzer 125d stores an integrated analysis result obtained by the processing in step S7 in the memory 127 (step S8). That is, the integrated analyzer 125d stores the report information indicating the integrated analysis result in the memory 127.

[0080] When the report information is stored in the memory 127 through the processing in step S8 or the processing in step S9, the transmission destination determiner 123 determines whether the transmission destination of the report information is the first SIRT (step S10). Specifically, the transmission destination determiner 123 determines whether the analysis result indicated by the report information relates only to the vehicle or also to IT or telematics. If the transmission destination determiner 123 determines that the analysis result relates only to the vehicle, the transmission destination determiner 123 determines the first SIRT as the transmission destination of the report information, and if the transmission destination determiner 123 determines that the analysis result relates to the vehicle and IT or telematics, the transmission destination determiner 123 determines the second SIRT as the transmission destination of the report information.That is, depending on the area affected by the situation of the device to be monitored, which is the vehicle V, a SIRT corresponding to that area is designated as the transmission destination. If the affected area is limited to the vehicle only, the first SIRT, which is responsible for a limited area, is designated as the transmission destination. If the affected area is not limited to the vehicle but also affects IT or telematics, the second SIRT, which is responsible for a larger area, is designated as the transmission destination.

[0081] If the transmission destination determiner 123 determines that the transmission destination of the report information is the first SIRT (Yes in step S10), the transmitter 124 transmits the report information to the first SIRT via the communicator 128 (step S11). On the other hand, if the transmission destination determiner 123 determines that the transmission destination of the report information is not the first SIRT (No in step S10), the transmitter 124 transmits the report information to the second SIRT via the communicator 128 (step S12).

[0082] As described above, in the first analysis device 120 in the present embodiment, the second anonymized data corresponding to the first anonymized data is determined as the specific second anonymized data through link resolution. That is, the second anonymized data corresponding to the same vehicle V as the first anonymized data is determined as the specific second anonymized data and linked to the first anonymized data. Accordingly, the second anonymized log related to the vehicle V, like the first anonymized log, can be acquired by the second system 200 as the second anonymized log to be integrated.Since the integrated analysis can be performed on the first anonymized log and the second anonymized log to be integrated with respect to the same vehicle V, the accuracy of the analysis can be further improved than the analysis using only the first anonymized log. That is, even if anonymization is performed on logs in different modes in the first system 100 and the second system 200, the logs can be integrated and analyzed with respect to the same vehicle V, and as a result, the analysis accuracy can be improved.

[0083] Furthermore, since the link resolution is performed in the present embodiment when it is determined that integrated analysis is required, it is possible to prevent the execution of link resolution even in a case where integrated analysis is not required, and the processing burden can be reduced. Furthermore, when integrated analysis is not required, the analysis of the first anonymized log can be performed without using the second anonymized log, and the processing burden can be reduced.

[0084] In addition, since the report information is sent to the transmission destination according to the integrated analysis result in the present embodiment, the integrated analysis result can be transmitted to an appropriate transmission destination. That is, depending on the area affected by the situation of the vehicle V, the integrated analysis result can be transmitted to an SIRT corresponding to the area.

[0085] Note that although in the present embodiment, the transmission destination determiner 123 determines whether the transmission destination of the report information is the first SIRT or the second SIRT in step S10, both the first SIRT and the second SIRT may be determined as transmission destinations according to the analysis result indicated in the report information. In this case, the transmitter 124 transmits the report information to both the first SIRT and the second SIRT. [Variant 1]

[0086] In the embodiment described above, the system cooperator 125c sends, as in processing (7) in Fig. 3, the second anonymized data to the second analysis device 220 to request the second anonymized protocol containing the second anonymized data from the second analysis device 220. In the present variant, the system collaborator 125c sends not only the second anonymized data but also protocol condition information to the second analysis device 220 at this time.

[0087] Fig. 5 is a diagram for describing processing operations related to the integrated processing unit 125 of the first system 100 and the second system 200.

[0088] Also in the present variant, the first system 100 and the second system 200 carry out the processing steps (1) to (6) in Fig. 5 in a similar manner to the processing operations (1) to (6) in Fig. 3. If the system cooperator 125c then receives the second anonymized data from the first server 110 via the communicator 128 by processing (6) in Fig. 5, the system cooperator 125c determines the protocol condition information as described in processing (6.1) in Fig. 5. The protocol condition information is information indicating the condition of the second anonymized protocol. For example, the system collaborator 125c may determine the protocol condition information based on the result of the analysis of the one or more first anonymized protocols by the protocol analyzer 122. The condition indicated by the protocol condition information may specifically be the type (hereinafter also referred to as protocol type) of the second anonymized protocol to be integrated, or may be a time window of the second anonymized protocol to be integrated. Furthermore, the protocol condition information may specify a timestamp as a condition.

[0089] Then, the system operator 125c sends not only the second anonymized data but also the protocol condition information to the second analysis device 220 via the communicator 128, as in the processing (7) in Fig. 5. That is, the system collaborator 125c requests from the second analysis device 220 the second anonymized log containing the second anonymized data and satisfying the condition specified by the log condition information. As a result, the system collaborator 125c obtains the second anonymized log from the second analysis device 220 via the communicator 128 in response to the request as the second anonymized log to be integrated, as described in processing (8) in Fig. 5.

[0090] Fig. 6 is a flowchart showing an example of the processing operations of the first analysis device 120 in the present embodiment.

[0091] The first analysis device 120 in the present variant performs the processing in steps S1 to S5, similar to that in Fig. 4 of the above-described embodiment. After the processing in step S5, the system collaborator 125c determines the protocol condition information (step S21). Then, the system collaborator 125c obtains from the second analysis device 220 the second anonymized protocol that includes the second anonymized data received in step S5 and that satisfies the condition specified in the protocol condition information as the second anonymized protocol to be integrated (step S6a).

[0092] Then, the first analysis device 120 performs the processing in steps S7 to S12, similar to the one shown in Fig. 4 of the above-described embodiment.

[0093] In this way, in the present variant, the system collaborator 125c retrieves the second anonymized protocol to be integrated from one or more second anonymized protocols that satisfy the condition determined according to the first anonymized protocol, from a plurality of second anonymized protocols available to the second analysis device 220. In particular, the system collaborator 125c retrieves the second anonymized protocol to be integrated from the one or more second anonymized protocols from the plurality of second anonymized protocols that correspond to at least one of the protocol types or the time window determined according to the first anonymized protocol.In other words, the system operator 125c determines the second anonymized log that satisfies the condition determined according to the first anonymized log from the plurality of second anonymized logs by using at least the type or the time window to obtain the second anonymized log as the second anonymized log to be integrated.

[0094] Accordingly, the log type and time window of the second anonymized log to be integrated can be limited to the type and time window determined according to the first anonymized log. For example, the second anonymized log to be integrated can be a log type related to congestion prediction or the second anonymized log to be integrated corresponding to a time window of the congestion. Since the log type and time window of the second anonymized log to be integrated are limited, it is possible to prevent the acquisition of a second anonymized log that makes little contribution to the integrated analysis and to realize efficient integrated analysis.

[0095] Although in the present variant, the transmission destination determiner 123 determines the first SIRT or the second SIRT as the transmission destination for the report information in step S10, the transmission destination determiner 123 may also determine both the first SIRT and the second SIRT as transmission destinations according to the analysis result specified in the report information. In this case, the transmitter 124 transmits the report information to both the first SIRT and the second SIRT. [Variant 2]

[0096] In the present variant, the first analysis device 120 further anonymizes the second anonymized protocol to be integrated. In other words, the first analysis device 120 re-anonymizes the second anonymized protocol to be integrated. This means that the anonymization of the second anonymized protocol to be integrated is performed twice. Accordingly, the security of the second anonymized protocol to be integrated can be improved.

[0097] Fig. 7 is a diagram for describing processing operations related to the integrated processing unit 125 of the first system 100 and the second system 200.

[0098] Also in the present variant, the first system 100 and the second system 200 carry out the processing (1) to (8) in Fig. 7 similar to the processing (1) to (8) in Fig. 3. When the system collaborator 125c then retrieves the second anonymized protocol to be integrated from the second analysis device 220 through processing (8) in FIG. 7, the system collaborator 125c re-anonymizes the second anonymized protocol to be integrated, as in processing (9) in Fig. 7. That is, the system collaborator 125c further anonymizes the second anonymized data contained in the second anonymized protocol to be integrated (that is, the specific second anonymized data) or, in other words, re-anonymizes the second anonymized data. Accordingly, the system collaborator 125c generates the second anonymized protocol to be integrated with the re-anonymized second anonymized data. The second anonymized data is data obtained by anonymizing the second identification data, such as an IP address. Accordingly, in the present variant, the anonymization of the second identification data contained in the second protocol to be integrated is performed twice.

[0099] Fig. Figure 8 is a diagram showing an example of reanonymization.

[0100] For example, the first analysis device 120 receives from the first server 110 the second anonymized data corresponding to the first anonymized data "07b1f9f9," which is an anonymized VIN or the like, through the request described above. The second anonymized data is an anonymized IP address "a2.0e.42.98" or the like.

[0101] The system collaborator 125c sends the second anonymized data "a2.0e.42.98" to the second analysis device 220 and requests from the second analysis device 220 a second anonymized protocol to be integrated that contains the second anonymized data. When the system collaborator 125c then retrieves the second anonymized protocol to be integrated from the second analysis device 220, the system collaborator 125c re-anonymizes the second anonymized data "a2.0e.42.98" contained in the second anonymized protocol to be integrated. In a specific example, the system collaborator 125c re-anonymizes the second anonymized data "a2.0e.42.98" to "4a.6e.4f.88." The system operator 125c stores in memory 127 the second anonymized protocol to be integrated, which contains the second anonymized data that has been re-anonymized in this way.

[0102] Fig. 9 is a flowchart showing an example of the processing operations of the first analysis device 120 in the present embodiment.

[0103] The first analysis device 120 in the present variant performs the processing in steps S1 to S6, similar to the one shown in Fig. 4 of the above-described embodiment. After the processing in step S6, the system collaborator 125c re-anonymizes the second anonymized log to be integrated and stores it in memory 127 (step S22). Next, the integrated analyzer 125d generates a log group by integrating the one or more first anonymized logs and the one or more re-anonymized second anonymized logs to be integrated, and performs analysis of the log group as an integrated analysis (step S7).

[0104] Then, the first analysis device 120 performs the processing in steps S8 to S12, similar to the one shown in Fig. 4 of the above-described embodiment.

[0105] In this way, in the present variant, the system operator 125c anonymizes the specific second anonymized data contained in the obtained anonymized second protocol to be integrated. Accordingly, the confidentiality of the second anonymized protocol to be integrated and the specific second anonymized data can be increased. This is because it is possible to prevent the second system 200 from recognizing the vehicle V corresponding to the protocol from this re-anonymized protocol or the data. This can increase the security of the second anonymized protocol to be integrated.

[0106] Note that although the transmission destination determiner 123 determines the first SIRT or the second SIRT as the transmission destination of the report information in step S10 in the present variant, the transmission destination determiner 123 may determine both the first SIRT and the second SIRT as transmission destinations according to the analysis result specified in the report information. In this case, the transmitter 124 transmits the report information to both the first SIRT and the second SIRT. [Variant 3]

[0107] In the present variant, the second analysis device 220 further performs processing operations similar to those of the first analysis device 120. Accordingly, in the present variant, the first analysis device 120 sends the first anonymized log to the second analysis device 220 in response to a request from the second analysis device 220. That is, in the present variant, mutual cooperation is performed between the first system 100 and the second system 200.

[0108] Fig. 10 is a diagram for describing the processing operations related to the second analysis device 220 of the processing of the first system 100 and the second system 200.

[0109] The second analysis device 220 performs a request to the first server 110 via the second server 210 as in the processing (1) of Fig. 10. The request is a request for the first anonymized data corresponding to the second anonymized data. At this point, the second analysis device 220 sends the second anonymized data to the second server 210.

[0110] When the second server 210 retrieves the second anonymized data from the second analysis device 220, the second server 210 identifies, as in processing (2) in Fig. 10, the second identification data corresponding to the second anonymized data. It should be noted that when the second server 210 first sends the above-described second protocol to the second analysis device 220, since the second server 210 generates the second anonymized data by anonymizing the second identification data included in the second protocol, the second server 210 can identify the second identification data corresponding to the second anonymized data. Then, the second server 210 sends the identified second identification data to the first server 110 and retrieves the first anonymized data corresponding to the second identification data, as in processing (3) in Fig. 10.

[0111] When the first server 110 obtains the second identification data from the second server 210 and accepts the request described above, the first server 110 identifies the first anonymized data corresponding to the second identification data as in the processing (4) in Fig. 10. It should be noted that when the first server 110 sends the above-described first log to the first analysis device 120, the first server 110 acquires the first log containing the first identification data and the second identification data and generates the first anonymized data by anonymizing the first identification data. Accordingly, the first server 110 can identify the first anonymized data corresponding to the second identification data. Then, the first server 110 responds to the request of the second server 210 by sending the identified first anonymized data to the second server 210, as in the processing (5) of Fig. 10. It should be noted that the first server 110 may separately include data for identifying the first identification data corresponding to the second identification data, identifying the first identification data corresponding to the second identification data, and further identifying the first anonymized data corresponding to the first identification data.

[0112] When the second server 210 receives the first anonymized data from the first server 110, the second server 210 sends the first anonymized data to the second analysis device 220 as described in processing (6) in Fig. 10. Accordingly, the second analysis device 220 receives the first anonymized data as a response to the request in the processing (1) in Fig. 10. These first anonymised data are data corresponding to the second anonymised data and used to identify the same vehicle V as the second anonymised data.

[0113] The second analysis device 220 sends the first anonymized data to the first analysis device 120 to request the first anonymized protocol containing the first anonymized data from the first analysis device 120, as described in processing (7) in Fig. 3.

[0114] When the first analysis device 120 receives the first anonymized data from the second analysis device 220 and further accepts the request described above, the first analysis device 120 sends the first anonymized log containing the first anonymized data as the first anonymized log to be integrated to the second analysis device 220, as in the processing (8) in Fig. 10. That is, the system operator 125c of the first analysis device 120 receives the first anonymized data from the second analysis device 220 via the communicator 128 and sends the first anonymized protocol to be integrated to the second analysis device 220.

[0115] The second analysis device 220 obtains the first anonymized log to be integrated from the first analysis device 120. Then, the second analysis device 220 integrates the one or more first anonymized logs to be integrated and the one or more second anonymized logs to generate a log group including the one or more first anonymized logs to be integrated and the one or more second anonymized logs. Then, the second analysis device 220 performs the analysis of the log group as the integrated analysis and generates the report information indicating a result of the integrated analysis.

[0116] Fig. 11 is a flowchart showing an example of the processing operations of the first analysis device 120 in the present embodiment.

[0117] The first analysis device 120 in the present variant further carries out the Fig. 11. Specifically, the control unit 126 of the first analysis device 120 accepts a request for the first anonymized log using the first anonymized data from the second analysis device 220, for example, via the acquirer 121 (step S31). That is, the control unit 126 acquires the first anonymized data from the second analysis device 220 and accepts the request for the first anonymized log containing the first anonymized data from the second analysis device 220. Then, the system collaborator 125c extracts one or more first anonymized logs, each containing the first anonymized data, from the plurality of first anonymized logs stored in the memory 127, under the control of the control unit 126.Then, the system collaborator 125c sends the one or more extracted first anonymized logs to the second analysis device 220, for example, via the communicator 128. That is, the system collaborator 125c sends the first anonymized log in response to the request from the second analysis device 220 (step S32). Such a first anonymized log is treated as the first anonymized log to be integrated into the second analysis device 220 and is integrated into the second anonymized log and analyzed.

[0118] In this way, in the present variant, the system operator 125c sends the first anonymized log to the second system 200 in response to the request from the second system 200, which is the cooperative monitoring system. Accordingly, not only the first analysis device 120 but also the second analysis device 220 of the second system 200 can obtain the first anonymized log and the second anonymized log corresponding to the same vehicle V for both to perform the integrated analysis. That is, mutual cooperation between the first system 100 and the second system 200 can be realized, and effective analysis of the logs can be performed.

[0119] It should be noted that in the present variant, instead of the one or more first anonymized logs, the first analysis device 120 may send the report information indicating the result of the analysis of the one or more first anonymized logs to the second analysis device 220 in response to the request of the second analysis device 220. [Variant 4]

[0120] In the above-described embodiment, whenever the first analysis device 120 determines that integrated analysis is required, the first analysis device 120 executes the above-described request to perform link resolution. In the present variant, the first analysis device 120 stores a result of the past link resolution. In addition, in a case where the first analysis device 120 determines that integrated analysis is required, if the result of the past link resolution is stored, the first analysis device 120 uses the result of the past link resolution without performing a request.

[0121] Fig. 12 is a diagram for describing processing operations related to the integrated processing unit 125 of the first system 100 and the second system 200.

[0122] Also in the present variant, the first system 100 and the second system 200 carry out the processing (1) to (6) in Fig. 12 in a similar manner as the processing (1) to (6) in Fig. 3. If the link resolution unit 125b receives the second anonymized data from the first server 110 by processing (6) in Fig. 12, the link resolution unit 125b also records the second anonymized data (that is, the specific second anonymized data) by linking them with the first anonymized data, as described in the processing (6.1) in Fig. 12. That is, the link resolution unit 125b assigns the second anonymized data to the first anonymized data contained in the request in the processing (1) in Fig. 12. Then, the link resolution unit 125b generates and stores link information in memory 127 indicating the associated first anonymized data and second anonymized data. Note that such storage of the link information in memory 127 may be referred to as caching.

[0123] Then, the first analysis device 120 performs the processing (7) and the processing (8) in Fig. 12. The processing (7) and the processing (8) in Fig. 12 are similar to processing (7) and processing (8) in Fig. 3.

[0124] Thereafter, if the integrated determiner 125a determines again that integrated analysis is required, the link resolution unit 125b of the first analysis device 120 determines whether the link information is stored in the memory 127. That is, the link resolution unit 125b determines whether the link information indicating the first anonymized data included in the first anonymized log, which is the target of the integrated analysis, is stored in the memory 127. If the link resolution unit 125b determines that the link information is stored in the memory 127, the link resolution unit 125b performs link resolution using the link information without performing a query. Accordingly, the number of queries can be reduced.

[0125] Fig. Figure 13 is a diagram showing an example of the linking information.

[0126] The linking information a1 stored in memory 127 indicates, for example, for each of the one or more pieces of first anonymized data, the second anonymized data associated with the first anonymized data and the expiration date of the link. For example, the linking information a1 associates and displays the first anonymized data "07b1f9f9" with the second anonymized data "a2.0e.42.98" and the expiration date "2022 / 07 / 14 17:50." If the first anonymized data in the first anonymized log that is the target of the integrated analysis is "07b1f9f9," the link resolution unit 125b determines whether the linking information a1 indicating the first anonymized data is stored in memory 127.

[0127] Then, when the link resolution unit 125b determines that the link information a1 is stored in the memory 127, the link resolution unit 125b checks the expiration date "2022 / 07 / 14 17:50" associated with the first anonymized data "07b1f9f9" in this link information a1. For example, the link resolution unit 125b determines whether the current time at which the link resolution is to be performed has passed the expiration date "2022 / 07 / 14 17:50". That is, the link resolution unit 125b determines whether the link with the first anonymized data "07b1f9f9" has passed the expiration date. When the link resolution unit 125b determines that the current time does not exceed the expiration date, that is, that the link has not exceeded the expiration date, the link resolution unit 125b performs the link resolution without performing a request.In particular, the link resolution unit 125b retrieves from the memory 127 the second anonymized data "a2.0e.42.98" associated with the first anonymized data "07b1f9f9" in the link information a1. The link resolution is performed accordingly.

[0128] Please note that the expiration date described above is the expiration date of the linking information a1. Furthermore, in this variant, the expiration date does not need to be specified, although it is specified in the linking information a1.

[0129] Fig. 14 is a flowchart showing an example of the processing operations of the first analysis device 120 in the present embodiment.

[0130] The first analysis device 120 in the present variant carries out the processing of the Fig. 14 during a period from which it is determined that the integrated analysis is required until the integrated analysis is carried out, ie, during a period since “Yes” in step S3 to step S7 in Fig. 4.

[0131] Specifically, when the integrated determination unit 125a determines that integrated analysis is required, the link resolution unit 125b determines whether the link information a1 is stored in the memory 127 (step S41). That is, the link resolution unit 125b determines whether the link information a1 indicating the first anonymized data in the first anonymized log, which is the target of the integrated analysis, is stored in the memory 127. Here, if the link resolution unit 125b determines that the link information a1 is not stored (No in step S41), the link resolution unit 125b performs the processing in steps S4 and S5 as in the above-described embodiment. The link resolution is performed by the processing in steps S4 and S5.

[0132] The link resolution unit 125b then generates link information a1 that associates and specifies the second anonymized data with the first anonymized data, and stores the link information a1 in the memory 127 (step S43). Note that if the link information a1 is already stored in the memory 127 and the first anonymized data is not specified in the link information a1, the link resolution unit 125b updates this link information a1. That is, the link resolution unit 125b updates the link information a1 by associating the first anonymized data and the second anonymized data with each other and writing them into the link information a1. Accordingly, updated link information a1 is generated. Note that such an update of the link information a1 may also be referred to as updating the cache.Furthermore, the link resolution unit 125b transmits the latest updated or generated link information a1 to the second analysis device 220 via the transmitter 124 (step S46). Accordingly, the latest link information a1 is transmitted to the second analysis device 220 and shared by the first analysis device 120 and the second analysis device 220. As a result, when the second analysis device 220 also performs link resolution for integrated analysis, the second analysis device 220 can perform link resolution without request by referring to the latest shared link information a1.

[0133] Thereafter, the system operator 125c retrieves the second anonymized protocol to be integrated from the second analysis device 220 using the second anonymized data received in step S5 (step S6).

[0134] On the other hand, if the link resolution unit 125b determines in step S41 that the link information a1 is stored in the memory 127 (Yes in step S41), the link resolution unit 125b determines whether the expiration date specified in this link information a1 has passed or not (step S42). That is, the link resolution unit 125b identifies the expiration date associated with the first anonymized data in the link information a1. Note that the first anonymized data is data included in the first anonymized log, which is the target of the integrated analysis. Then, the link resolution unit 125b determines whether the current time at which the link resolution is to be performed has passed the expiration date or not.

[0135] If the link resolution 125b determines that the current time has not passed the expiration date, i.e., that the expiration date has not been exceeded (No in step S42), the link resolution 125b reads the second anonymized data associated with the first anonymized data in the link information a1 (step S45). That is, the second anonymized data is read from the memory 127. The link resolution is performed without request through such processing in step S45. Then, the system collaborator 125c performs the processing in step S6.

[0136] If the link resolution unit 125b determines in step S42 that the current time is beyond the expiration date, that is, the expiration date has been exceeded, the link resolution unit 125b performs the acquisition of the second anonymized data by request (that is, the processing of steps S4 and S5). Then, the link resolution unit 125b sets an expiration date again (step S44). That is, the link resolution unit 125b updates the expiration date specified in the link information a1 to a new expiration date that is later than the current time. Then, the link resolution unit 125b performs the processing in step S46. Note that when updating the expiration date, the link resolution unit 125b may update the expiration date specified in the link information a1 to an expiration date determined by the first server 110.

[0137] Fig. 15 is a flowchart showing an example of the processing operations of the second analysis device 220 in the present embodiment.

[0138] The second analysis device 220 receives the link information a1 sent from the first analysis device 120 (step S51). Then, the second analysis device 220 stores this link information a1 in a recording medium included in the second analysis device 220. At this time, if the existing link information a1 is stored in the recording medium, the second analysis device 220 updates this existing link information a1 with the new link information a1 received in step S51 (step S52). That is, the cache update is performed in the second analysis device 220.

[0139] In this way, in the present variant, the link resolution unit 125b stores the link information a1 indicating the association between the first anonymized data and the specific second anonymized data in the memory 127. Furthermore, when the link resolution unit 125b repeatedly performs the link resolution for the first anonymized data, the link resolution unit 125b performs the link resolution by referring to the link information a1 stored in the memory 127. Accordingly, since the link resolution is performed by referring to the link information a1 when the link resolution is repeatedly performed, the time and effort required by the first analysis device 120 to communicate with the first server 110 or the like to perform the link resolution can be saved.This enables efficient link resolution and integrated analysis, and can also reduce the number of queries.

[0140] Furthermore, the link resolution unit 125b sets an expiration date for the link resolution information a1, and when the time for repeatedly performing the link resolution for the first anonymized data has not passed the expiration date, the link resolution unit 125b performs the link resolution by referring to the link information a1 stored in the storage 127. Accordingly, since the expiration date for the link resolution information a1 is set, the corresponding relationship between the first anonymized data and the second anonymized data can be guaranteed until the expiration date, and the corresponding relationship can be changed after the expiration date. That is, after the expiration date, the anonymization mode of the first system 100 and the second system 200 can be changed, respectively. This can increase the flexibility of the overall processing operations of these systems.

[0141] Furthermore, the system collaborator 125c sends the link information a1 stored in the memory 127 to the second analysis device 220 of the second system 200, which is the cooperative monitoring system. Accordingly, since the link information a1 is sent to the second system 200, the second system 200 can perform the link resolution using this link information a1. This also allows the second system 200 (specifically, the second analysis device 220) to perform the integrated analysis, as in the first analysis device 120.

[0142] When the linking information a1 stored in the memory 127 is updated by the linking resolution unit 125b, the system operator 125c also sends the updated linking information a1 to the second analysis device 220 of the second system 200, which is the cooperative monitoring system.

[0143] Accordingly, the first analysis device 120 and the second analysis device 220 can synchronize and manage common linking information a1. This makes it possible to improve the efficiency of the integrated analysis performed by the first analysis device 120 and the second analysis device 220.

[0144] Although the analysis device and the analysis method according to the present disclosure have been described above based on the above-described embodiment and variants, the present disclosure is not limited to the above-described embodiment and variants. Various modifications of the above-described embodiment according to the present disclosure that are conceivable to those skilled in the art can also be included within the scope of the present disclosure, provided that these modifications do not deviate from the spirit of the present disclosure.

[0145] For example, although the VIN is used as an example of the first identification data and the IP address is used as an example of the second identification data in the above-described embodiment and each of the variants, the first identification data and the second identification data are not limited to the VIN or the IP address. The first identification data and the second identification data may each be private information such as location information or a personal name. In addition, although the first identification data and the second identification data are used in the above-described embodiment and each of the variants, when anonymization is performed in different modes in two or more different systems, only the first identification data or the second identification data may be used.

[0146] In addition, although the vehicle V is used as an example of the device to be monitored in the above-described embodiment and each of the variants, the device to be monitored is not limited to the vehicle V and may be another device. Likewise, the first system and the second system are not limited to systems for vehicles, but may be any systems as long as they are compatible with a device to be monitored.

[0147] In addition, although in the above-described embodiment and each of the variants, the system that cooperates with the first system 100 is only a single second system 200, the first system 100 may cooperate with a plurality of second systems 200. That is, the number of cooperative monitoring systems that cooperate with the first system 100 is not limited to one, but may be more than one.

[0148] Furthermore, the anonymization technique used in the embodiment described above and any of the variants may be any technique.

[0149] It should be noted that each of the structural elements according to the above-described embodiment may be configured in the form of dedicated hardware or implemented by executing a software program suitable for each of the structural elements. Alternatively, the structural elements may each be implemented by a program executor such as a central processing unit (CPU) and a processor that reads and executes the software program recorded on a recording medium such as a hard disk or a semiconductor memory. Here, the software program that implements the analysis device and so on according to the above-described embodiment is a computer program that causes a computer to execute each step of the Fig. 4, Fig. 6, Fig. 9, Fig. 11, Fig. 14 and Fig. 15 flowcharts shown.

[0150] It should be noted that the following cases are also included in the present disclosure.

[0151] (1) At least one of the devices described above may be, in particular, a computer system including, for example, a microprocessor, ROM, RAM, a hard disk unit, a display unit, a keyboard, and a mouse. The RAM or hard disk stores computer programs. At least one of the devices described above achieves its function by the microprocessor operating in accordance with the computer programs. The computer programs as used herein are configured by a combination of a plurality of instruction codes that specify commands issued to the computer to achieve predetermined functions.

[0152] (2) One or more or all of the structural elements included in at least one of the devices described above can be configured as a single system LSI (Large Scale Integration). The system LSI is an ultra-multifunctional LSI constructed by integrating a plurality of components onto a single chip, and in particular, a computer system that may include, for example, a microprocessor, ROM, and RAM. The RAM stores computer programs. The system LSI achieves its function by having the microprocessor operate in accordance with the computer programs.

[0153] (3) One or more or all of the structural elements included in at least one of the devices described above may each include an IC card or a standalone module that can be detached from the devices. The IC card or module may be a computer system that may include, for example, a microprocessor, ROM, and RAM. The IC card or module may include the above-mentioned ultra-multifunctional LSI. The IC card or module achieves its function by having the microprocessor operate in accordance with the computer programs. The IC card or module may be tamper-proof.

[0154] (4) The present disclosure can be implemented as the methods described above. The present disclosure can also be implemented as a computer program that realizes these methods by a computer, or it can be implemented as digital signals generated by the computer program.

[0155] Furthermore, the present disclosure may also be a computer program or digital signals recorded on a computer-readable recording medium, such as a floppy disk, a hard disk, a compact disc (CD)-ROM, a digital versatile disc (DVD), a DVD-ROM, a DVD-RAM, a Blu-ray Disc (BD: registered trademark), or a semiconductor memory. The present disclosure may also be implemented as digital signals recorded on such a recording medium.

[0156] Furthermore, the present disclosure may be implemented by sending computer programs or digital signals over, for example, telecommunications lines, wireless or wired communications lines, networks such as the Internet, or through data communications.

[0157] Furthermore, the present disclosure may also be implemented as another independent computer system by transmitting programs or digital signals recorded on a recording medium or by transmitting programs or digital signals via a network, for example. [Industrial applicability]

[0158] The analysis device in the present disclosure is applicable, for example, to a system that monitors vehicle control and the like. [Reference symbol list] 1 analysis system 100 first system 110 first server 120 first analysis device 121 Retrievers 122 protocol analyzers 123 Send destination determiner 124 channels 125 integrated processing unit 125a integrated determiner 125b Link resolution unit 125c system operator 125d integrated analyzer 126 Control unit 127 storage 128 Communicator 200 second system 210 second server 220 second analysis device a1 Linking information R base station V vehicle QUOTES CONTAINED IN THE DESCRIPTION

[0000] This list of documents submitted by the applicant was generated automatically and is included solely for the convenience of the reader. This list is not part of the German patent or utility model application. The DPMA assumes no liability for any errors or omissions. Cited patent literature

[0000] JP 7078114

[0003]

Claims

[1] An analysis device that sends report information based on an analysis result of a protocol relating to a device to be monitored, the analysis device comprising: a collector who collects a first anonymised log, which is the log containing the first anonymised data of the device to be monitored; a link resolution unit that performs link resolution, which is processing to determine, from second anonymized data included in each of a plurality of second anonymized logs included in a cooperative monitoring system, second anonymized data corresponding to the first anonymized data as specific second anonymized data; a system collaborator who obtains from the cooperative monitoring system a second anonymised log containing the specific second anonymised data as a second anonymised log to be integrated; and an integrated analyzer that performs an analysis of a log group containing the first anonymized log and the second anonymized log to be integrated as an integrated analysis. [2] The analysis device according to claim 1, further comprising: an integrated determiner that determines whether the integrated analysis is required or not, wherein, if the integrated determiner determines that the integrated analysis is required, the link resolution unit performs the link resolution. [3] The analysis device according to claim 1, further comprising: a transmission destination determiner that determines a transmission destination according to a result of the integrated analysis; and a sender that sends the report information indicating the result of the integrated analysis to the sending destination specified by the sending destination determiner. [4] The analysis device according to claim 1, wherein the system operator obtains the second anonymized protocol to be integrated from one or more second anonymized protocols from the plurality of second anonymized protocols corresponding to at least one type or time window determined according to the first anonymized protocol. [5] The analysis device according to claim 1, wherein the system collaborator determines, from the plurality of second anonymized logs, a second anonymized log that satisfies a condition determined according to the first anonymized log by using at least one of a type and a time window, so as to acquire the second anonymized log as the second anonymized log to be integrated. [6] The analysis device according to claim 1, wherein the system collaborator further anonymizes the specific second anonymized data included in the second anonymized protocol to be integrated that has been obtained. [7] The analysis device according to claim 1, wherein the system collaborator further sends the first anonymized log to the cooperative monitoring system in accordance with a request from the cooperative monitoring system. [8] The analysis device according to claim 1, wherein the link resolution unit further comprises: stores in a recording medium linking information indicating an association between the first anonymised data and the specific second anonymised data; and when the link resolution is carried out repeatedly for the first anonymised data, the link resolution is carried out by reference to the link information stored in the recording medium. [9] The analysis device according to claim 8, wherein the link resolution unit further comprises: sets an expiration date for the linking information; and if a point in time at which the link resolution is repeatedly carried out for the first anonymised data has not exceeded the expiry date, the link resolution is carried out by reference to the link information stored in the recording medium. [10] The analysis device according to claim 8, wherein the system collaborator further sends the link information stored in the recording medium to the cooperative monitoring system. [11] The analysis device according to claim 10, wherein, when the link information stored in the recording medium is updated by the link resolution unit, the system collaborator further sends the updated link information to the cooperative monitoring system. [12] Analysis device according to one of claims 1 to 11, wherein the collector retrieves the first anonymized log from a first server, the first server, when obtaining a first log relating to the device to be monitored, anonymises first identification data of the device to be monitored contained in the first log to generate the first anonymised log containing the first anonymised data, a second server included in the cooperative monitoring system, when a second log is obtained with respect to the device to be monitored, anonymizes the second identification data included in the second log to generate the second anonymized log containing the second anonymized data, and the link resolution unit performs the link resolution by sending the first anonymized data to the first server and making a request to the second server via the first server for second anonymized data corresponding to the first anonymized data. [13] An analysis method for sending report information based on an analysis result of a protocol relating to a device to be monitored, the analysis method comprising: Obtaining a first anonymised log, which is the log containing the first anonymised data of the device to be monitored; performing link resolution, which is processing to determine, from second anonymized data included in each of a plurality of second anonymized logs included in a cooperative monitoring system, second anonymized data corresponding to the first anonymized data as specific second anonymized data; Obtaining, from the cooperative monitoring system, a second anonymised log containing the specific second anonymised data as a second anonymised log to be integrated; and Performing an analysis of a log group containing the first anonymized log and the second anonymized log to be integrated as an integrated analysis. [14] A program for sending report information based on an analysis result of a protocol relating to a device to be monitored, the program causing a computer to execute: Obtaining a first anonymised log, which is the log containing the first anonymised data of the device to be monitored; performing link resolution, which is processing to determine, from second anonymized data included in each of a plurality of second anonymized logs included in a cooperative monitoring system, second anonymized data corresponding to the first anonymized data as specific second anonymized data; Obtaining, from the cooperative monitoring system, a second anonymised log containing the specific second anonymised data as a second anonymised log to be integrated; and Performing an analysis of a log group containing the first anonymized log and the second anonymized log to be integrated as an integrated analysis.

Images