Attack analysis device, attack analysis method, and attack analysis program

Abstract

To provide a technique that can analyze cyber-attacks against vehicles with a high degree of accuracy.SOLUTION: An attack analysis device configured to analyze an attack which is an attack against an electronic control system 2 built in a vehicle 10, the attack being via a network, includes an infringement determination unit 472. The infringement determination unit 472 is configured to determine whether correspondence information matches a preset type of attack, and to determine whether a target element is infringed. The correspondence information is information that associates a system log which is a log of the electronic control system 2, with a communication log which is a log of communication between the electronic control system 2 and the outside of the vehicle 10.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to an attack analysis device, an attack analysis method, and an attack analysis program. [Background technology]

[0002] In recent years, technologies for driving assistance and autonomous driving control, including V2X (vehicle-to-vehicle communication and vehicle-to-infrastructure communication), have been attracting attention. As a result, vehicles are equipped with communication functions, and so-called connected vehicles are becoming more common. As a result, the possibility of vehicles being subject to cyber attacks such as unauthorized access is increasing. Therefore, it is necessary to analyze cyber attacks against vehicles and develop countermeasures.

[0003] Patent Document 1 discloses a security device that collects detected anomaly data and compares the combination of items in which an anomaly was detected with anomaly detection pattern that is preset for each attack, thereby identifying the type of attack corresponding to the anomaly. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2020-123307 A Summary of the Invention [Problem to be solved by the invention]

[0005] The inventors of the present application have been actively researching a technology for analyzing cyber attacks against a vehicle based on actual anomaly information indicating an anomaly detected in an electronic control system built in the vehicle and predicted anomaly information indicating an anomaly predicted to occur in the electronic control system when the vehicle is attacked. In this type of technology, it is desirable to be able to analyze cyber attacks against a vehicle with high accuracy.

[0006] One aspect of the present disclosure provides a technology that can analyze cyber attacks against vehicles with high accuracy. [Means for solving the problem]

[0007] One aspect of the present disclosure is an attack analysis device configured to analyze an attack via a network against an electronic control system (2) constructed in a vehicle (10), the attack analysis device including a determination unit (472, S102). The determination unit is configured to determine whether or not the correspondence information matches a preset type of attack, and to determine whether or not a target element has been violated. The correspondence information is information that associates a system log, which is a log of the electronic control system, with a communication log, which is a log of communication between the electronic control system and the outside of the vehicle. In addition, the target element represents at least one of a component of the electronic control system and the electronic control system.

[0008] According to this configuration, whether or not an intrusion has occurred is determined based on whether or not the correspondence information that associates system logs with communication logs matches the type of attack, so that attacks against vehicles via a network can be analyzed with high accuracy. [Brief description of the drawings]

[0009] [Figure 1] 1 is a block diagram showing a configuration of an attack analysis system according to a first embodiment. [Diagram 2] FIG. 2 is a diagram showing an example of an arrangement of an electronic control device in an electronic control system. [Diagram 3] FIG. 4 is a diagram showing an example of data stored in a vehicle log DB. [Figure 4] FIG. 2 is a block diagram showing a configuration of an inspection unit. [Diagram 5] FIG. 5A is a diagram showing an example of data in a communication analysis result table stored in the communication detection log DB of the first embodiment, and FIG. 5B is a diagram showing an example of data in a malware analysis result table stored in the communication detection log DB. [Figure 6]FIG. 2 is a block diagram showing the configuration of an analysis unit according to the first embodiment. [Figure 7] FIG. 11 is a diagram illustrating an example of predicted abnormality information. [Figure 8] FIG. 11 is a diagram illustrating another example of predicted anomaly information. [Figure 9] FIG. 11 is a sequence diagram of an attack analysis process according to the first embodiment. [Figure 10] FIG. 10A is a diagram showing an example of information obtained by a communication data monitoring unit, FIG. 10B is a diagram showing an example of monitoring management information, and FIG. 10C is a diagram showing information inspected by an inspection unit. [Figure 11] FIG. 13 is a block diagram showing a configuration of an attack analysis system according to a second embodiment. [Figure 12] FIG. 11 is a block diagram showing the configuration of an analysis unit according to a second embodiment. [Figure 13] FIG. 11 is a sequence diagram of an attack analysis process according to the second embodiment. [Figure 14] 13 is a flowchart showing a log association process according to the second embodiment. [Figure 15] 13 is a flowchart showing an intermediary communication determination process in the log association process according to the second embodiment. [Figure 16] FIG. 11 is a diagram illustrating an example of a communication intermediation history in the second embodiment. [Figure 17] FIG. 11 is a diagram showing an example of function information (for example, communication-related functions) according to the second embodiment. [Figure 18] 13 is a diagram illustrating an example of data of a communication analysis result table stored in a communication detection log DB according to the second embodiment. FIG. [Figure 19] 13 is a flowchart showing an infringement determination process according to the second embodiment. [Figure 20] 13 is a flowchart showing an intentional communication determination process of the infringement determination process of the second embodiment. [Figure 21] FIG. 13 is a diagram illustrating an example of data of a communication analysis result table stored in a communication detection log DB according to the third embodiment. [Figure 22] 13 is a flowchart showing an intermediary communication determination process in the log association process according to the fourth embodiment. [Figure 23] FIG. 13 is a diagram illustrating an example of a communication intermediation history in the fourth embodiment. [Figure 24] FIG. 13 is a diagram showing an example of function information (for example, communication-related functions) according to the fourth embodiment. [Diagram 25] FIG. 13 illustrates an example of an application log. [Figure 26] 13 is a flowchart showing an intentional communication determination process of the infringement determination process according to the fourth embodiment. [Figure 27] FIG. 13 is a block diagram showing the configuration of an analysis unit according to the fifth embodiment. [Figure 28] FIG. 13 is a sequence diagram of an attack analysis process according to the fifth embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] Hereinafter, exemplary embodiments of the present disclosure will be described with reference to the drawings. [1. First embodiment] [1-1. Configuration] The attack analysis system 1 shown in Fig. 1 is a system that analyzes attacks via a network against an electronic control system 2 built in a vehicle 10. An attack via a network means a so-called cyber attack.

[0011] The attack analysis system 1 includes an electronic control system 2 and an external vehicle device 4. The electronic control system 2 includes a plurality of electronic control units (hereinafter, referred to as ECUs). In the example shown in Fig. 1, the electronic control system 2 includes ECUs 2a to 2f. The ECUs 2a to 2f are connected via an in-vehicle network using CAN (registered trademark) or Ethernet (registered trademark). CAN is an abbreviation for Controller Area Network.

[0012] The ECUs 2a to 2f include monitoring units 3a to 3f, respectively. The monitoring units 3a to 3f are security sensors that monitor the programs executed by the CPUs included in the ECUs and the networks to which the ECUs are connected. The ECUs 2a to 2f generate a system log when executing processing based on the programs. The system log is a log of the electronic control system 2, more specifically, a log related to the electronic control system 2 generated by the electronic control system 2. The system log includes a security log, a communication intermediation history described in detail in the second embodiment and thereafter, an application log described in detail in the fourth embodiment and thereafter, and the like, but does not include a communication log described later. Note that the system log is also called a vehicle log when used away from the vehicle 10. When the monitoring units 3a to 3f detect an abnormality in a program or a network, they generate a security log. The security log records information indicating the abnormality detected in the electronic control system 2, such as the time when the abnormality was detected, the abnormality position indicating the position where the abnormality occurred, and the identification information of the security sensor that detected the abnormality.

[0013] As shown in FIG. 2, the electronic control system 2 employs a multi-layer defense to enhance security against attacks. In the multi-layer defense, security functions against attacks are provided hierarchically and multi-layeredly, so that even if an attack occurs and the first layer is breached, the second layer may be able to defend against the attack. This configuration enhances the defense of the electronic control system 2. In this embodiment, the electronic control system 2 has three defense layers. In FIG. 2, the electronic control system 2 is equipped with a DLC 2g. DLC is an abbreviation for Data Link Connector. ECU 2e, ECU 2f, and DLC 2g belong to the first layer, ECU 2d belongs to the second layer, and ECU 2a and ECU 2b belong to the third layer. In FIG. 2, the ECU 2c is omitted. In addition, the defense layers are not limited to three layers, and the electronic control system 2 may have, for example, four or more defense layers.

[0014] Returning to Fig. 1, the ECU 2d may include, in addition to the monitoring unit 3d, an analysis unit 3g and a transmission unit 3h that transmits data to other ECUs. The analysis unit 3g may manage a security log in the electronic control system 2 and detect certain abnormal behavior before outputting the security log from the vehicle 10 to the external vehicle device 4. The ECU 2e also includes a communication unit 3i, which transmits the security log of each ECU to a communication data monitoring unit 41 described later. The ECU 2f also includes an application 3j and executes any application function.

[0015] The off-vehicle device 4 is a calculation (i.e., computer) device installed outside the vehicle 10, and is mainly composed of a well-known computer having a CPU, ROM, RAM, flash memory, etc. The CPU executes a program stored in a ROM, which is a non-transient tangible recording medium. By executing the program, a method corresponding to the program is performed. The off-vehicle device 4 may include one computer or multiple computers.

[0016] The method of realizing the functions of each unit included in the external device 4 is not limited to software, and some or all of the functions may be realized using one or more pieces of hardware. For example, when the functions are realized by electronic circuits that are hardware, the electronic circuits may be realized by digital circuits, analog circuits, or a combination of these.

[0017] The external vehicle device 4 includes a communication data monitoring unit 41 , a vehicle log receiving unit 42 , a vehicle log DB 43 , a detection condition DB 44 , an inspection unit 45 , a communication detection log DB 46 , and an analysis unit 47 .

[0018] The communication data monitoring unit 41 is configured, for example, as a proxy that proxies access inside and outside the network, or as a full packet capture device that can collect all packets that pass through. The communication data monitoring unit 41 relays and monitors communication between each vehicle 10 and an external site 5 outside the vehicle 10, thereby generating a communication log for the vehicle 10. When the communication data monitoring unit 41 is a proxy and the vehicle 10 also has a proxy function, for example, the communication between the vehicle 10 and the external site 5 can be configured to pass through the communication data monitoring unit 41 by specifying the communication data monitoring unit 41 as the next destination using the proxy function of the vehicle 10. Also, when the communication data monitoring unit 41 is a full packet capture device, for example, the communication between the vehicle 10 and the external site 5 can be configured to pass through the communication data monitoring unit 41 by setting a transfer policy of a firewall provided in the vehicle 10. The communication log is a log generated by the external device 4 and is a log related to communication between the electronic control system 2 and the external site 5 outside the vehicle 10. In the communication log, as shown in FIG. 10A, for example, the communication time, the communication source (including the IP address), the communication destination (including the IP address and the URL), the communication content, and the like are recorded.

[0019] The communication data monitoring unit 41 handles monitoring management information, such as that shown in Fig. 10B, in addition to the communication log. The monitoring management information is stored, for example, in the vehicle log DB 43. The monitoring management information includes, for example, information such as the vehicle ID, the start time and end time of communication, the IP address of the communication source, the device of the communication source, and the like. The monitoring and management information is acquired by actively notifying the external vehicle device 4 from the vehicle 10 when, for example, the ECU 2e is started or the IP address used by the communication unit 3i is changed. If the communication data monitoring unit 41 is a proxy, the monitoring and management information can also be acquired and generated from authentication information at the start of communication or vehicle configuration management information.

[0020] The vehicle log receiving unit 42 receives security logs from each vehicle 10 and registers them in the vehicle log DB 43 . The vehicle log DB 43 is a database that holds security logs collected from each vehicle 10. As shown in Fig. 3, the vehicle log DB 43 stores data in which a vehicle ID, a detection time, a detection location, and a sensor ID are linked together.

[0021] The detection condition DB 44 is a database that holds information used by the structure analysis unit 451 of the inspection unit 45. For example, the detection condition DB 44 stores threat information, signatures, behavior patterns, and the like. Threat information is known malicious communication destinations and file hash values. Signatures are pattern information that indicates malicious communication data, file data, and program functions. Behavior patterns are information that indicates the behavior patterns of malicious files, such as traces of malicious behavior and malware.

[0022] The inspection unit 45 analyzes the communication log and identifies the malicious communication destination and the malicious communication content. The communication log used by the inspection unit 45 for analysis is, for example, information obtained by extracting necessary information from the communication log shown in Fig. 10A and the monitoring management information shown in Fig. 10B, as shown in Fig. 10C. This information may include, for example, a vehicle ID, a communication time, a communication source device, a communication destination (including an IP address and a URL), and the content (type) of the communication data.

[0023] As shown in FIG. 4, the inspection unit 45 includes a structure analysis unit 451, a communication destination analysis unit 452, and a communication content analysis unit 453. The structure analysis unit 451 extracts, from the communication log, information to be analyzed by the structure analysis unit 451 or the communication destination analysis unit 452. Specifically, the structure analysis unit 451 analyzes the structure of a URL and extracts an IP address or a domain name, analyzes the structure of communication contents, and extracts data or files to be analyzed by the communication destination analysis unit 452.

[0024] The communication destination analysis unit 452 identifies a malicious communication destination. Specifically, the communication destination analysis unit 452 judges whether or not a communication destination recorded in a communication log or a communication destination extracted by the structure analysis unit 451 matches a malicious communication destination registered in the detection condition DB 44. For example, an IP address, a domain, a URL, etc. are registered as a malicious communication destination. In addition, the communication destination analysis unit 452 also judges whether or not a communication destination in a communication log matches a communication destination of a file judged to be malicious by the communication content analysis unit 453.

[0025] The communication content analysis unit 453 identifies malicious communication content. Specifically, the communication content analysis unit 453 performs surface analysis, static analysis, and dynamic analysis on the data and files extracted by the structure analysis unit 451, and judges whether the analysis results match the contents registered in the detection condition DB 44.

[0026] Surface analysis involves collecting information about whether the file itself is malicious and meta-information about the file. Static analysis collects information about the functions and characteristic byte sequences in the malware's program code, while dynamic analysis also targets potential functions that do not operate.

[0027] Dynamic analysis involves collecting information on what kind of traces are left behind and what kind of communication occurs when program code is actually run. Program code is actually run and its behavior is analyzed.

[0028] The communication detection log DB 46 is a database that holds communication logs analyzed by the communication destination analysis unit 452 or the communication content analysis unit 453. Hereinafter, a communication log that is determined to match the detection conditions by the communication destination analysis unit 452 or the communication content analysis unit 453 is also referred to as a communication detection log. The communication detection log DB 46 stores a communication analysis result table and a malware analysis result table. As shown in FIG. 5A, the communication analysis result table stores data that is linked to a vehicle ID, communication time, communication source, communication destination, detection reason, communication content, and malware ID. As shown in FIG. 5B, the malware analysis result table stores data that is linked to a malware ID, context type, and context.

[0029] As shown in FIG. 6, the analysis unit 47 includes a log association unit 471 , an infringement determination unit 472 , an attack / anomaly relationship table storage unit 473 , an estimation unit 474 , and an output unit 475 . The log associating unit 471 associates the logs stored in the vehicle log DB 43 with the logs stored in the communication detection log DB 46. In this embodiment, the log associating unit 471 associates the logs with each other by the following process, and outputs association information, which is the associated log, to the infringement determination unit 472.

[0030] First, the log association unit 471 extracts logs whose communication times are within a predetermined time frame T1 from the communication detection log DB 46. The log association unit 471 also extracts logs whose detection times are within a predetermined time frame T1 from the vehicle log DB 43. The time frame T1 is one of a plurality of time ranges separated by a predetermined time.

[0031] Next, the log association unit 471 associates the logs from the following viewpoints. (Perspective a) The vehicle ID in the communication detection log DB 46 and the vehicle ID in the vehicle log DB 43 match.

[0032] (Point b) The communication source and destination in the communication detection log DB 46 match the detection location in the vehicle log DB 43. (Point c) The communication time in the communication detection log DB 46 and the detection time in the vehicle log DB 43 are within a predetermined time frame T2. The time frame T2 is a time range different from the time frame T1, for example, a time range in units of several seconds, and is a value smaller than the time frame T1. As described above, the communication detection log and the security log are associated so as to be synchronized.

[0033] The intrusion determination unit 472 determines whether the corresponding information matches a preset type of attack. The intrusion determination unit 472 performs a determination for each piece of corresponding information. Specifically, the intrusion determination unit 472 identifies the position where an abnormality has occurred in the electronic control system 2 depending on whether the corresponding information matches any of a plurality of attack types. Then, the intrusion determination unit 472 can classify the position where the abnormality has occurred as a position where an intrusion has occurred due to an attack, or a position where there is a high possibility that the intrusion has occurred due to an attack. In other words, the intrusion determination unit 472 analyzes the corresponding information and determines an intrusion probability, which is a probability that the ECU from which the communication originates has been intruded. The intrusion probability includes two types of probabilities: a case where it is determined that there is a high possibility that an intrusion has occurred, and a case where it is determined that an intrusion has occurred.

[0034] The types of attacks may include at least one of an attack type related to a communication destination and an attack type related to communication content. The types of attacks related to a communication destination may include information indicating the communication destination itself, such as an IP address, a domain name, or a URL, or information indicating the type of the communication destination, such as a C&C server. The types of attacks related to communication content may include, for example, information indicating the communication content itself, such as transmitted data or received data, or information indicating the type of communication content, such as downloading malware, as shown in FIG. 5B. In addition, malware functions other than communication may also be included. Examples of malware functions other than communication may include information regarding the operation content of malware harmful to a vehicle, such as disabling the function of a security sensor. In addition, the security sensor may include security software.

[0035] In this embodiment, the intrusion determination unit 472 determines that the communication source ECU has been intruded in the following cases. (i) When communication is occurring that downloads malware from an ECU that does not perform processing in response to user interaction.

[0036] (b) When the data transmitted by the ECU is determined to be malicious. (c) When the corresponding information confirms that the behavior confirmed during dynamic analysis is occurring in the ECU, for example, when communication after malware infection, such as callback communication to a C&C server, is recorded, or when a CAN message specifying a suspicious ID is recorded, this corresponds to the case.

[0037] Furthermore, the intrusion determination unit 472 determines that the ECU that is the source of communication is highly likely to have been intruded into in the following cases. (ii) When the data received by the ECU is determined to be malicious.

[0038] (e) When the ECU communicates with a destination determined to be malicious. In addition, if the ECU from which communication originates corresponds to both the case of being compromised and the case of being highly likely to be compromised, it is determined that it is compromised. Looking at Figures 5A and 5B, for example, since the first row of the communication analysis result table records that ECU-1 is accessing a malicious site, ECU-1 corresponds to the case of being highly likely to be compromised. Also, according to the second and third rows of the communication analysis result table, ECU-1 communicates with communication destination C obtained in the analysis result of malware A, which is recorded in the first row of the malware analysis result table. Therefore, ECU-1 also corresponds to the case of being compromised. In this case, the case of being compromised takes precedence, and ECU-1 is determined to be compromised.

[0039] The attack / anomaly relationship table storage unit 473 holds predicted anomaly information indicating a combination of anomalies predicted to occur in the electronic control system 2 when attacked for each type of attack. In the predicted anomaly information shown in FIG. 7 and FIG. 8, for each type of attack, an anomaly that occurs when the electronic control system 2 is attacked and the position where the anomaly occurs are shown. As shown in FIG. 7 and FIG. 8, when attacked, it is assumed that anomalies will occur at multiple positions. The predicted anomaly information further indicates a correspondence relationship between the type of attack and the assumed starting point and target of the attack when attacked. In FIG. 7 and FIG. 8, the upper diagram shows the predicted anomaly information held in the attack / anomaly relationship table storage unit 473, and the lower diagram shows the predicted anomaly information after being changed by the estimation unit 474.

[0040] For example, when an attack of type A occurs in the electronic control system 2, it is predicted that abnormalities A and C will occur in ECU-1 located in the first layer. The starting point of attack A is the position indicated by 0x00, and the target of attack is the position indicated by 0x01. In addition, for the starting point of attack and the target of attack, 0x00 indicates outside the vehicle, and 0x01 to 0x05 indicate ECU-1 to ECU-5, respectively.

[0041] The estimation unit 474 estimates the type of attack by determining the similarity between the actual anomaly information and the predicted anomaly information. The actual anomaly information is data that indicates a combination of anomalies that are actually detected, generated based on a security log. Specifically, the actual anomaly information has items similar to the contents of anomalies in the predicted anomaly information in Figs. 7 and 8, and is a data string that indicates that an anomaly has actually been detected at the corresponding position as 1, and that indicates that there is no security log indicating that an anomaly has actually been detected at the corresponding position as 0. Estimating the type of attack can also be thought of as estimating the attack path. This is because the "position of an anomaly predicted to occur when attacked" shown in each row of the table of predicted anomaly information can be thought of as constituting an attack path.

[0042] Here, the estimation unit 474 changes the predicted anomaly information by using the correspondence information before determining the similarity between the actually measured anomaly information and the predicted anomaly information. In this embodiment, the estimation unit 474 changes the predicted anomaly information by performing the following processing.

[0043] (b) The coefficient of the table entry corresponding to the ECU determined to have a high possibility of being hacked is increased by a predetermined number. For example, as shown in Fig. 7, if it is determined that ECU-3 has a high possibility of being hacked, the coefficients of abnormalities A and B predicted to occur in ECU-3 are increased by 1, changing them from 1 to 2.

[0044] (b) The coefficient of the table entry corresponding to the ECU determined to be compromised is increased by a predetermined number. Alternatively, the coefficient of the table entry corresponding to the ECU located in the same layer as the ECU determined to be compromised is decreased to a predetermined number. For example, as shown in FIG. 7, when ECU-1 is determined to be compromised, the coefficients of anomalies A and C that were predicted to occur in ECU-2 located in the same layer as ECU-1 are set to zero. This means that ECU-1, not ECU-2, has been identified as the entry point for the attack in the first layer.

[0045] Also, for example, when the predicted anomaly information in FIG. 8 is used, if it is determined that ECU-1 has been compromised, the coefficients of HIDS anomalies and authentication anomalies predicted to occur in ECU-2, which is located in the same layer as ECU-1, are set to zero.

[0046] (a) When a behavior that matches the infected malware is recorded in the security log of an ECU or a network that the ECU is connected to that is determined to be compromised, the coefficient of the table entry of the security sensor that recorded the security log is increased among the corresponding table entries. For example, a case will be described in which the predicted anomaly information of FIG. 8 is changed based on the correspondence information including the communication detection log of FIG. 5A and FIG. 5B. According to the malware analysis result table of FIG. 5B, the malware A has a function of transmitting a CAN message that may be detected by the CAN-IDS. Therefore, in the predicted anomaly information of FIG. 8, among the coefficients of the CAN-IDS anomaly of ECU-3 that detects anomalies in the CAN bus adjacent to ECU-1 determined to be compromised, in the row in which the coefficient of the anomaly related to ECU-1 is greater than zero, the coefficient of the CAN-IDS anomaly of ECU-3 is increased by 1, changing it from 1 to 2.

[0047] The estimation unit 474 performs the above process and estimates the type of attack using the predicted anomaly information with the changed coefficient. In this embodiment, the actual anomaly information is compared with the predicted anomaly information, and the row of the table with the closest combination is identified. Specifically, the inner product of the vector representation of the data string of the actual anomaly information and the vector representation of the data string of the predicted anomaly information is calculated, and the inner product is divided by the number of elements in the vector of the predicted anomaly information that have a value greater than 0 to extract the row of the table of the predicted anomaly information with the highest value.

[0048] The estimation unit 474 may further estimate the starting point and the target of the attack in addition to estimating the type of attack. Since the predicted abnormality information stores the type of attack, the starting point of the attack, and the target of the attack in association with each other, the estimation unit 474 can estimate the starting point and the target of the attack using the predicted abnormality information. Here, the ECU determined to have been hacked by the intrusion determination unit 472 may be regarded as a damaged location regardless of the result of the estimation unit 474. Looking at the example of FIG. 8, for example, if the actual measurement abnormality information has the highest similarity to the row of attack D, it can be estimated that attack D was performed from ECU-1 to ECU-3. In this way, if the starting point of the attack and the target of the attack are estimated, the route of the attack can also be estimated.

[0049] The output unit 475 outputs the type of attack estimated by the estimation unit 474 to an attack countermeasure device (not shown) that takes measures against the attack. [1-2. Processing] The attack analysis process performed by the analysis unit 47 of the external vehicle device 4 will be described with reference to FIG.

[0050] First, in S101, the log association unit 471 acquires a security log from the vehicle log DB 43 and a communication detection log from the communication detection log DB 46. Then, the log association unit 471 associates the security log with the communication detection log, and outputs association information, which is the associated log, to the intrusion determination unit 472.

[0051] Next, in S102, the intrusion determination unit 472 analyzes the corresponding information and determines the intrusion probability of the ECU that is the communication source. The intrusion determination unit 472 outputs the determination result including the intrusion probability to the estimation unit 474.

[0052] Next, in S103, the estimation unit 474 acquires the predicted anomaly information stored in the attack-anomaly relationship table storage unit 473, and updates the predicted anomaly information using the determination result regarding the correspondence information.

[0053] Next, in S104, the estimation unit 474 estimates the type of attack by determining the similarity between the actual anomaly information indicating a combination of anomalies actually detected based on the security log and the predicted anomaly information updated in S103. The estimation unit 474 outputs the estimated type of attack to the output unit 475.

[0054] Next, in S105, the output unit 475 outputs the type of attack to the attack countermeasure device. [1-3. Effects] According to the first embodiment described above in detail, the following effects can be obtained. (1a) The off-vehicle device 4 is configured to analyze an attack via a network against the electronic control system 2 built in the vehicle 10. The off-vehicle device 4 includes an analysis unit 47. The analysis unit 47 is configured to determine whether or not correspondence information that associates a system log with a communication log matches a preset type of attack, and is configured to determine whether or not a target element has been violated. According to this configuration, whether or not the corresponding information has been infringed is determined based on whether or not it matches the type of attack, so that attacks against the vehicle 10 via a network can be analyzed with high accuracy.

[0055] (1b) In the above embodiment, a configuration is exemplified in which it is determined whether the corresponding information matches a preset attack type. The corresponding information is information in which a security log and a communication detection log are associated with each other. With such a configuration, it is possible to determine whether the attack type matches by taking into account not only the security log but also the communication detection log including the characteristics of the attack code or malware that actually caused the abnormality. Therefore, it is possible to analyze cyber attacks against vehicles with high accuracy compared to a configuration in which it is determined whether the attack type matches using only the security log.

[0056] (1c) In the above embodiment, the estimation unit 474 updates the predicted abnormality information using the determination result of the correspondence information determined by the intrusion determination unit 472, and determines the similarity between the updated predicted abnormality information and the actual abnormality information to estimate the type of attack. With this configuration, it is possible to take into account the actual tendency of attacks compared to the case where the predicted abnormality information is used as is without updating it. Therefore, it is possible to analyze cyber attacks against vehicles with high accuracy.

[0057] (1d) In the above embodiment, the inspection unit 45 analyzes the communication log and identifies the malicious communication destination and the malicious communication content. With such a configuration, it is possible to analyze a cyber attack by taking into account the communication destination and the communication content that are the actual cause of the abnormality.

[0058] (1e) In the above embodiment, the intrusion determination unit 472 is configured to classify the intrusion probability of the ECU from which the communication originates, depending on whether the intrusion matches any of a plurality of attack types. With such a configuration, for example, the process of changing the predicted anomaly information can be made different depending on the intrusion probability. Specifically, by making the increase rate of the coefficient of the table entry for an ECU determined to have been intruded different from the increase rate of the coefficient of the table entry for an ECU determined to have a high possibility of being intruded, more reliable predicted anomaly information can be generated.

[0059] (1f) In the above embodiment, a configuration is exemplified in which a communication detection log and a security log are associated so as to be synchronized based on the time when an abnormality occurred, which is included in the security log, and the time of communication, which is included in the communication detection log. With such a configuration, logs with relatively close times can be associated with each other, thereby reducing the possibility that unrelated communication detection logs and security logs are associated with each other.

[0060] (1g) In the above embodiment, the predicted anomaly information is information in which the position where an anomaly is predicted to occur in the electronic control system 2 when attacked is expressed by a coefficient for each type of attack, and a configuration is exemplified in which the combination of predicted anomalies can be changed by changing the coefficient. With such a configuration, the likelihood of the combination of predicted anomalies can be expressed by the coefficient. In addition, the similarity can be easily visualized by vectorizing the coefficient and calculating the similarity.

[0061] (1h) In the above embodiment, the electronic control system 2 has a three-layer structure, and the estimation unit 474 estimates that other ECUs located in the same layer as an ECU in which an abnormality is predicted to occur have not been compromised. With such a configuration, it becomes clearer that an ECU in which an abnormality is predicted to occur is an entry point for an attack, and more reliable predicted anomaly information can be generated.

[0062] (1i) In the above embodiment, a configuration has been exemplified in which the external vehicle device 4 is installed outside the vehicle 10 as an attack analysis device. With such a configuration, the attack analysis device receives security logs via a wireless communication network, so that the processing load on the vehicle 10 can be reduced compared to when the attack analysis device is mounted inside the vehicle 10.

[0063] [2. Second embodiment] [2-1. Differences from the first embodiment] The second and subsequent embodiments have the same basic configuration as the first embodiment, so differences will be described below. Note that the same reference numerals as those in the first embodiment indicate the same configuration, and the preceding description will be referred to.

[0064] The second embodiment differs from the first embodiment in that it further includes communication intermediation units 3m, 3n and a function information DB 48. The communication intermediation units 3m, 3n are configured to intermediate communication within the vehicle. The second embodiment also differs from the first embodiment in that it does not require the attack / anomaly relationship table storage unit 473 and the estimation unit 474. Note that in the second embodiment, the processing executed by the estimation unit 474 is also unnecessary. In the second embodiment, the vehicle log receiving unit 42 of the external vehicle device 4 receives communication intermediation history from each vehicle 10 and registers it in the vehicle log DB 43.

[0065] [2-2. Configuration] In the second embodiment, as shown in Fig. 11, an ECU 2d belonging to the second layer includes a communication intermediate unit 3m, and an ECU 2e belonging to the first layer includes a communication intermediate unit 3n. An ECU 2f belonging to the first layer may further include a communication intermediate unit 3p and may further include an external device 5a. The external device 5a may be configured as a smartphone.

[0066] The communication intermediate units 3m, 3n are configured to intermediate communications desired by the other ECUs, such as the ECUs 2a to 2c, and to implement communications with the outside of the vehicle via the communication unit 3i of the other ECUs, such as the ECU 2e.

[0067] 11, the function information DB 48 is provided in, for example, the external vehicle device 4. The function information DB 48 is a database that stores what functions (for example, function information described later) the ECUs 2a-2f, etc. in the vehicle 10 have as communication-related functions. The communication-related functions may include a communication destination designation function and a communication mediation function described later, as well as information regarding a communication protocol, a communication speed, etc.

[0068] 12, the log association unit 471 associates the logs stored in the vehicle log DB 43, the logs stored in the communication detection log DB 46, and the information stored in the function information DB 48. In this embodiment, the logs stored in the vehicle log DB 43 include a communication mediation history in the vehicle. In this case, the logs stored in the vehicle log DB 43 do not need to include the logs of the security sensors.

[0069] That is, this embodiment is configured not to use the log of the security sensor of the vehicle 10. Therefore, even if an abnormality cannot be detected using the security sensor, if a communication detection log can be acquired, it can be determined from the result that the communication source has been compromised. Note that cases in which an abnormality cannot be detected using the sensor include cases in which the security sensor of the vehicle 10 breaks down, there is a defect in the design of the security sensor, or the attack method has become more sophisticated.

[0070] [2-3. Processing] The attack analysis process performed by the analysis unit 47 of the external device 4 will be described with reference to the sequence shown in FIG. 13 and the flowcharts shown in FIGS.

[0071] First, in S101, the log association unit 471 acquires the communication intermediation history obtained from the vehicle log DB 43, the communication detection log obtained from the communication detection log DB 46, and the function information obtained from the function information DB 48. Then, the log association unit 471 associates the communication intermediation history, the communication detection log, and the function information, and outputs correspondence information, which is an associated log, to the intrusion determination unit 472. Note that, in the first embodiment, the correspondence information related to the abnormality that occurred in the vehicle is output, but in the second embodiment, correspondence information that may not include information related to the abnormality that occurred in the vehicle is output.

[0072] Details of S101 are shown in the flowcharts of Fig. 14 and Fig. 15. Fig. 14 and Fig. 15 are flowcharts showing the log association process performed by the analysis unit 47 of the external vehicle device 4. Note that, in the log association process, although a determination is made on a device-by-device basis as an example, the present invention is not limited to this configuration. For example, recording and determination may be made on an application-by-application basis running on a device.

[0073] In the log association process, as shown in Fig. 14, the analysis unit 47 first acquires logs having the same vehicle ID and within a predetermined time period (e.g., time frame T1) from the DBs 43, 46, 48 in S201, and performs association. In this process, the communication detection log, the communication mediation history shown in Fig. 16, and the function information (e.g., communication-related functions) shown in Fig. 17 are first acquired.

[0074] 16, the communication mediation history includes information such as the ECU identifier, the type of function provided, the start time of mediation, the end time of mediation, the communication source, the communication destination, etc. In other words, the communication mediation history is information indicating what type of communication mediation function was used in the ECU with the corresponding identifier to mediate communication from where (communication source) to where (communication destination), and from when (start time) to when (end time).

[0075] The function information includes information such as an ECU identifier, the presence or absence of a communication destination designation function, and the presence or absence of a communication mediation function, as shown in Fig. 17. The communication destination designation function indicates a function that allows a party other than the vendor (e.g., a user) to designate a communication destination.

[0076] In particular, a vendor includes any of a manufacturer, a supplier, and a seller. In addition, a communication destination designation function includes, for example, an application such as a browser that allows a user to designate a communication destination, and an application such as a mailer that allows a third party to designate a communication destination. If such an application is installed, the function is associated with the device. If this function is present, there is a possibility that communication with a malicious communication destination may occur unintentionally as a result of a user's operation.

[0077] In addition, the communication intermediation function corresponds to, for example, a function that intermediates communication between other devices, such as a Wi-Fi (registered trademark) access point, a function that intermediates communication between other ECUs or applications, such as a proxy, etc. If this function is present, even if communication with a malicious communication destination occurs, it can be determined that there is a high possibility that the cause is communication with another device or another ECU.

[0078] Next, the analysis unit 47 determines whether or not there is an associated log in S203 shown in Fig. 14. The log here is, for example, a communication detection log that is a result of inspecting information such as that shown in Fig. 10C. If there is no associated log, this process ends. If there is an associated log in S203, this process proceeds to S205, and the analysis unit 47 performs an intermediary communication determination process.

[0079] The intermediate communication determination process is a process for determining whether or not the ECU of the communication source has a communication intermediate function, and for identifying the device of the communication source as necessary. In the intermediate communication determination process, as shown in Fig. 15, the analysis unit 47 determines in S221 whether or not the communication source (hereinafter, sometimes referred to as the corresponding communication source) described in the communication detection log (e.g., the log in Fig. 5A) has a communication intermediate function.

[0080] If the corresponding communication source does not have a communication intermediation function, the process proceeds to S227 described later. On the other hand, if the corresponding communication source has a communication intermediation function, the process proceeds to S223. Next, in S223, the analysis unit 47 refers to the communication intermediation history (FIG. 16). Next, in S225, it is determined whether or not there is an intermediation history (hereinafter, sometimes abbreviated as the corresponding intermediation history) in which the corresponding communication source intermediates communication to the same destination as the communication destination described in the communication detection log during the corresponding time period corresponding to the communication time described in the communication detection log.

[0081] If there is no corresponding intermediation history in S225, the process proceeds to S227. In this case, the analysis unit 47 determines in S227 that the communication whose content is described in the communication detection log is not a communication by a device other than the corresponding communication source, that is, is not a communication using the communication intermediation function, and ends the intermediary communication determination process.

[0082] Furthermore, if there is a corresponding intermediation history in S225, the process proceeds to S229. In this case, in S229, the analysis unit 47 determines whether the source of the communication mediated by the corresponding communication source (hereinafter, may be abbreviated as the source of the communication mediated within the vehicle) is another in-vehicle device (i.e., a device within the vehicle 10, which is a device different from the currently recognized communication source). In the example of Fig. 16, the source of the communication mediated by the corresponding communication source ECU1 is ECU6. This is because, in this example, the communication intermediation history indicates that ECU1 mediated the communication mediated by ECU3 and whose source is ECU6.

[0083] If the source of the communication mediated in the vehicle is another in-vehicle device, the process proceeds to S231. In this case, the analysis unit 47 determines in S231 that the communication content described in the communication detection log is communication of another in-vehicle device, and ends the mediated communication determination process. Also, if the source of the communication mediated in the vehicle is not another in-vehicle device in S229, the process proceeds to S233. In this case, the analysis unit 47 determines in S233 whether the source of the communication mediated in the vehicle is an external device (for example, an external device 5a such as a smartphone).

[0084] If the source of the communication mediated within the vehicle is a device outside the vehicle, the process proceeds to S235. In this case, the analysis unit 47 determines in S235 that the communication content described in the communication detection log is communication from a device outside the vehicle, and ends the mediated communication determination process. Also, if the source of the communication mediated within the vehicle is not a device outside the vehicle, the process proceeds to S237. In this case, the analysis unit 47 determines in S237 that the source of the communication content described in the communication detection log is unknown, and ends the mediated communication determination process.

[0085] When the intermediated communication determination process is completed, the process returns to Fig. 14 and proceeds to S207. In S207, the analysis unit 47 determines whether or not the source of the communication mediated in the vehicle is determined to be an external device in the intermediated communication determination process. If the source of the communication mediated in the vehicle is an external device, the process proceeds to S209. In S209, the analysis unit 47 sets the source of the communication of the communication content shown in the communication detection log to the communication source described in the corresponding communication intermediate history, and proceeds to S211.

[0086] Also, if the source of the communication mediated in the vehicle is not an external vehicle device in S207, the process proceeds to S211. In this case, the analysis unit 47 determines whether or not the source of the communication mediated in the vehicle is determined to be another in-vehicle device in the mediated communication determination process in S211. If the source of the communication mediated in the vehicle is another in-vehicle device, the process proceeds to S213. In this case, the analysis unit 47 sets the source of the communication content described in the communication detection log to the source described in the corresponding communication mediation history in S213, and ends the log association process. Also, if the source of the communication mediated in the vehicle is not another in-vehicle device in S211, the mediated communication determination process ends.

[0087] When the process of S209 or S213 is performed in the above communication determination process, the analysis unit 47 rewrites the communication analysis result table (i.e., the communication detection log included in the correspondence information) as shown in Fig. 18, for example. In the communication analysis result table shown in Fig. 18, the notation "ECU1" described as the communication source in the table shown in Fig. 5A is rewritten to "ECU6". In other words, by mediating the communication within the vehicle, the ECU1, which was the apparent communication source, is rewritten to the ECU6, which is the actual communication source.

[0088] 13, in S102, the intrusion determination unit 472 analyzes the correspondence information and determines the intrusion probability of the ECU of the communication source. The intrusion determination unit 472 outputs a determination result including the intrusion probability (for example, the estimated type of attack) to the output unit 475.

[0089] Details of S102 are shown in the flowcharts of FIG. 19 and FIG. 20. FIG. 19 and FIG. 20 are flowcharts showing the infringement determination process performed by the analysis unit 47 (for example, the infringement determination unit 472) of the external device 4. The infringement determination process is performed for each corresponding information. In the infringement determination process, as shown in FIG. 19, the analysis unit 47 performs an infringement determination of the communication source in S261. In this process, an infringement determination is performed for the actual communication source. As in the first embodiment, the infringement determination procedure includes determining whether the correspondence information including the content of the communication of the communication source and the information of the communication destination matches any of a plurality of attack types set in advance, and, if it matches any of the plurality of attack types, determining the infringement probability of the communication source according to which attack type it matches. The infringement probability of the communication source includes two classifications: the communication source is highly likely to have been infringed, and the communication source has been infringed. Since the second embodiment is configured not to use a security log, the intrusion judgment in the second embodiment uses a type of attack that can be judged without using a security log among the multiple attack types exemplified in the first embodiment. Therefore, among the (C) described in the first embodiment, "Confirmation from the correspondence information that the behavior confirmed during dynamic analysis occurs in the ECU", the one that requires confirmation that a CAN message specifying a suspicious ID is recorded is not performed in the second embodiment. In the second embodiment, the ECU in (A) to (E) described in the first embodiment is read as the communication source. The reason is that, as shown by the existence of the judgment in S265 described later, in the second embodiment, the communication source in S261 is premised on the possibility that it is an external device such as a smartphone in addition to the possibility that it is an ECU. Also, in the second embodiment, (A) is defined more broadly than in the first embodiment so as to include the case where communication that downloads malware occurs from the communication source. The reason for such a broad definition is that in the second embodiment, an artificial communication judgment is performed in S267 described later.

[0090] Next, in S263, the analysis unit 47 judges whether or not the communication source may have been compromised. When the communication source may have been compromised, it is judged that the corresponding information matches any one of a plurality of pre-set attack types, and includes a case where the communication source is classified as "compromised" and a case where the communication source is classified as "highly likely to have been compromised." If the communication source may not have been compromised, this process ends. If the communication source may have been compromised, this process proceeds to S265.

[0091] Next, in S265, the analysis unit 47 determines whether the communication source is a device outside the vehicle. If the communication source is a device outside the vehicle, the process proceeds to S273. Then, in S273, the analysis unit 47 determines that the vehicle has not been infringed, and ends the infringement determination process.

[0092] If the analysis unit 47 determines in S265 that the communication source is not an external device, the process proceeds to S267. Then, in S267, the analysis unit 47 performs an intentional communication determination process. The intentional communication determination process is a process for determining whether or not the communication from the communication source is likely to be an intentional communication.

[0093] In the intentional communication determination process, as shown in Fig. 20, in S281, the analysis unit 47 determines whether or not the communication source ECU has a communication destination designation function. If the communication source ECU does not have the communication destination designation function, the process proceeds to S283. Next, in S283, the analysis unit 47 determines that the communication is not intentional, and ends the intentional communication determination process.

[0094] Also, in S281, if there is a communication destination designation function, the process proceeds to S285. Subsequently, in S285, the analysis unit 47 determines that there is a possibility of an intentional communication, and ends the intentional communication determination process.

[0095] When the intentional communication determination process ends, the process returns to Fig. 19 and proceeds to S269. Next, in S269, the analysis unit 47 determines whether or not the communication is determined to be due to an intentional operation (i.e., there is a possibility that the communication is intentional). If it is determined that the communication is due to a human operation, the infringement determination process ends. If it is determined that the communication is not due to a human operation, the process proceeds to S271. Then, in S271, the analysis unit 47 determines that the communication source has been infringed, and the infringement determination process ends.

[0096] 13, in S105, the output unit 475 outputs the type of attack to the attack countermeasure device. Note that in this embodiment, the processes of S103 and S104 shown in FIG.

[0097] [2-4. Effects] According to the second embodiment described above in detail, in addition to the effect (1a) of the first embodiment described above, the following effect is further achieved.

[0098] (2a) In the configuration of the second embodiment, the system log includes a history of communication between the electronic control system 2 and the outside of the electronic control system 2, and the analysis unit 47 identifies the source of the communication in the communication detection log from the history and then determines whether the target element has been infringed. When the ECU that is the source of the communication is an electronic control device whose communication destination cannot be specified by anyone other than the vendor, the analysis unit 47 determines that there is a high probability that the target element such as an ECU has been infringed. For example, when the electronic control system 2 performs communication with the ECU 6 as the ECU 2c shown in FIG. 1 as the transmission source, the ECU 6 accesses an external site via the ECU 2d and the ECU 2e. The content of the communication at this time is monitored by the external device 4, and the log association process described above is performed. In the log association process, as shown in FIG. 18, it is recognized that the transmission source is the ECU 6. Then, in the intrusion determination process shown in FIG. 19, if it is determined that the communication source may have been intruded (YES in S263), the communication source is not an external device (NO in S265), and the communication is not an artificial communication (NO in S269), it is determined that the ECU 6 has been intruded. Therefore, even in a configuration in which communication is mediated, it is possible to satisfactorily determine whether or not the vehicle 100 has been invaded.

[0099] [3. Third embodiment] [3-1. Configuration] The third embodiment provides a configuration in which the electronic control system 2 relays communication from an external vehicle device 5a such as a smartphone, and if there is a possibility that this communication may be malicious, it can appropriately determine whether the vehicle has been hacked.

[0100] In the third embodiment, as shown in Fig. 11, an ECU 2e belonging to the first layer includes a communication intermediation unit 3n, and an ECU 2f includes a communication intermediation unit 3p. Also, an external device 5a configured as a smartphone is provided. Note that an ECU 2d belonging to the second layer may include a communication intermediation unit 3m. Also, in the third embodiment, a vehicle log receiving unit 42 of an external device 4 receives a communication intermediation history from each vehicle 10 and registers it in a vehicle log DB 43, similar to the second embodiment.

[0101] [3-2. Processing] The processing in this embodiment is similar to that in the second embodiment. [3-3. Effects] According to the third embodiment described above in detail, in addition to the effect (1a) of the first embodiment described above, the following effect is further achieved.

[0102] (3a) For example, when the electronic control system 2 performs communication with the off-vehicle device 5a serving as a smartphone shown in FIG. 11 as a transmission source, the off-vehicle device 5a accesses an external site via the ECU 2f and the ECU 2e. The content of the communication at this time is monitored by the off-vehicle device 4, and the above-mentioned log association process is performed. In the log association process, when the analysis unit 47 determines that the communication from the off-vehicle device 5a configured as a smartphone may be malicious communication, it rewrites the communication analysis result table as shown in FIG. 21, for example.

[0103] In the communication analysis result table shown in Fig. 21, the notation "ECU1" described as the communication source in the table shown in Fig. 5A is rewritten as "smartphone A." In other words, by mediating communication, the ECU1, which was the apparent communication source, is rewritten as the smartphone A, which is the actual communication source. As a result, it is recognized that the transmission source is the external vehicle device 5a as a smartphone.

[0104] 19, the process proceeds with the possibility that the communication source may have been compromised (YES in S263) and the communication source is an external device (YES in S265), and in this case, the vehicle is determined not to have been compromised, because the communication source of the malicious communication is a smartphone, not the vehicle or a component of the vehicle.

[0105] That is, in this embodiment, the analysis unit 47 is configured to determine that there is a high possibility that the target element has not been infringed when the communication source of the communication is the external vehicle device 5a. According to this configuration, even if the external vehicle device 5a is present, it is possible to appropriately determine whether or not the vehicle 100 has been intruded into.

[0106] [4. Fourth embodiment] [4-1. Configuration] In the fourth embodiment, the vehicle log includes an application log (see FIG. 25). The application log is a log related to an application running on an ECU (for example, an application 3j of an ECU 2f), and may include a log related to an application having a function of designating a communication destination of a communication source. Note that in this embodiment, the vehicle log does not necessarily need to include a log of a security sensor. In the fourth embodiment, the vehicle log receiving unit 42 of the external vehicle device 4 receives the communication intermediation history and the application log from each vehicle 10, and registers them in the vehicle log DB 43. The fourth embodiment can have a configuration similar to that of the third embodiment (see FIG. 11).

[0107] [4-2. Processing] The communication mediation history in this embodiment is shown, for example, in Fig. 23. Note that "-" in Fig. 23 is not included in the determination of whether or not there is a match. The communication mediation history is used to make it possible to accurately determine whether or not communication mediation was performed by comparing the time, communication source, communication destination, etc. with those recorded in the communication log.

[0108] In this embodiment, as shown in FIG. 24, the communication destination designation function and the communication mediation function for the ECU 2 are set to "Yes". The mediated communication determination process (see S205 in FIG. 14) of the log association process in the fourth embodiment is performed as shown in the flowchart in FIG.

[0109] In the mediated communication determination process, in S223, the analysis unit 47 refers to the communication mediation history (FIG. 16), and then proceeds to S301. In S301, the analysis unit 47 determines whether or not a communication source with a communication destination designation function is included in the communication mediation history. If there is no communication source with a communication destination designation function, the process proceeds to S225 and onwards described above. If there is a communication source with a communication destination designation function, the process proceeds to S303. In the example of FIG. 16, the communication sources included in the communication mediation history are ECU3 and ECU6.

[0110] Next, in S303, the analysis unit 47 refers to the application log. The application log is a log indicating to whom an application of an ECU has communicated. For example, as shown in FIG. 25, the application log includes an ECU identifier for identifying an ECU, the type of application mounted on the ECU, the start time and end time of communication of the application, and the communication destination (e.g., URL), etc. In S303, the analysis unit 47 refers to the application log indicating to whom an application mounted on an ECU having an ECU identifier corresponding to a communication source included in the communication mediation history and having a communication designation function has communicated.

[0111] Next, in S305, the analysis unit 47 judges whether or not there is a communication history to the corresponding communication destination in the application log in the time period corresponding to the communication time described in the communication detection log (hereinafter, referred to as the first judgment in S305). The corresponding communication destination is the communication destination described in the communication detection log, that is, the communication destination included in the communication intermediation history. Note that, like the communication intermediation history of ECU2 in FIG. 23, there may be a communication intermediation history in which the communication destination is not recorded (see communication destination "-" in FIG. 23). In this case, in S305, the analysis unit 47 performs a second judgment in which the communication destination is not judged. More specifically, in S305, the analysis unit 47 performs a second judgment in which it judges whether or not there is an application log in the time period corresponding to the communication time described in the communication detection log. If at least one of the first judgment and the second judgment in S305 is judged as positive, the process proceeds to S307. If at least one of the first judgment and the second judgment in S305 is not judged as positive, the process proceeds to the above-mentioned S225 and subsequent steps. Next, in S307, the analysis unit 47 determines that the communication content described in the communication detection log is communication from an in-vehicle device that is included in the communication intermediation history and has a communication designation function, and terminates the intermediary communication determination process.

[0112] In the manual communication determination process in the log association process in this embodiment, a process as shown in FIG. 26 may be performed. In the intermediate communication determination process, in S321, the analysis unit 47 determines whether the communication source has a communication destination designation function. If the communication source does not have the communication destination designation function, the process proceeds to S283. Next, in S283, the analysis unit 47 determines that the communication is not an artificial communication, and ends the artificial communication determination process.

[0113] Also, in S321, if there is a communication destination designation function, the process proceeds to S285. Subsequently, in S285, the analysis unit 47 determines that there is a possibility of an intentional communication, and ends the intentional communication determination process.

[0114] [4-3. Effects] According to the fourth embodiment described above in detail, in addition to the effect (1a) of the first embodiment described above, the following effect is further achieved.

[0115] (4a) In this embodiment, a communication intermediate unit 3p that intermediates communication whose source is the external vehicle device 5a, which is a smartphone, and an application 3j that performs communication whose source is the ECU 2f operate on the ECU 2f of the electronic control system 2 shown in Fig. 11. Even if the communication destination of the smartphone is not recorded in the communication intermediate unit 3p as shown in Fig. 23, an application log of the application 3j is recorded as shown in Fig. 25. With this configuration, the application log can be used to distinguish the source of communication. This ensures that if the smartphone is the source of malicious communications, the vehicle is not compromised since the smartphone is not a vehicle or a component of the vehicle. In addition, if the application 3j is the source of malicious communication and the communication destination designation function is "None," the vehicle is determined to be compromised. This indicates that malicious communication has occurred even though the communication destination cannot be designated artificially, and there is a high possibility that the communication has occurred due to a compromise caused by an attack.

[0116] [5. Fifth Embodiment] [5-1. Configuration] The basic configuration of the fifth embodiment is a combination of the first and second embodiments. That is, as shown in Figs. 27 and 28, the fifth embodiment includes a function information DB 48, and a log association unit 471 performs log association processing using a communication detection log, a vehicle log (security log, communication intermediation history), and function information. Also, an intrusion determination unit 472 performs intrusion determination processing using response information and function information. Also, in the fifth embodiment, a vehicle log receiving unit 42 of the external vehicle device 4 receives a communication intermediation history and a security log from each vehicle 10, and registers them in a vehicle log DB 43. In this embodiment, the log association unit 471 may associate each log from the following viewpoints in addition to the above-mentioned (viewpoint a) to (viewpoint c).

[0117] (Point d) It is mediated communication. In this case, it is determined whether it is mediated communication or not based on the communication mediation history. If it is mediated communication, the communication source is changed to the communication source described in the corresponding communication mediation history.

[0118] In this embodiment, the infringement determination unit 472 performs the following process on the log received from the log association unit 471, and performs infringement determination on the communication source ECU and VM (Virtual Machine). In the infringement determination, in addition to the determinations already described, for example, the following determination is performed.

[0119] - Determine that ECUs or VMs where communications to download malware are occurring are highly likely to have been compromised. Regarding cases where a breach is highly likely, if the communication is from an ECU or VM for which the communication destination designation function is not provided, the ECU or VM in question will be determined to have been breached. If the communication source is a device outside the vehicle, the vehicle is determined to be uninvaded.

[0120] [5-2. Effects] According to the fifth embodiment described above in detail, in addition to the effect (1a) of the first embodiment described above, the following effect is further achieved. (5a) It is possible to determine with success that the vehicle 100 has been invaded both in cases where communication is mediated and in cases where communication is not mediated.

[0121] [6. Correspondence] In this embodiment, the external vehicle device 4 corresponds to an example of an attack analysis device, the security log corresponds to an example of an abnormality log, and the analysis unit 47 (for example, the intrusion determination unit 472) corresponds to an example of a determination unit.

[0122] 7. Other embodiments Although the embodiments of the present disclosure have been described above, it goes without saying that the present disclosure is not limited to the above-described embodiments and can take various forms.

[0123] (7a) In the above embodiment, a configuration has been exemplified in which the external vehicle device 4 is installed outside the vehicle 10 as the attack analysis device. However, the attack analysis device may be installed inside the vehicle 10. With such a configuration, the attack analysis device can receive security logs more quickly compared to when the attack analysis device is installed outside the vehicle 10.

[0124] (7b) In the above embodiment, the infringement determination unit 472 determines whether an infringement has occurred or whether there is a high possibility of an infringement. However, the infringement probability determined by the infringement determination unit 472 may include other patterns. For example, if the inspection unit 45 determines that there is no abnormality in the communication log, the infringement determination unit 472 may determine that there has been no infringement.

[0125] (7c) In the above embodiment, the communication destination analysis unit 452 of the inspection unit 45 performs communication destination analysis, and the communication content analysis unit 453 of the inspection unit 45 performs communication content analysis to identify malicious communication destinations and malicious communication content. However, the inspection unit 45 may be configured to identify at least one of malicious communication destinations and malicious communication content. In other words, the inspection unit 45 may be configured to perform only one of communication destination analysis and communication content analysis.

[0126] (7d) The function of one component in the above embodiments may be distributed among multiple components, or the functions of multiple components may be integrated into one component. Also, part of the configuration of the above embodiments may be omitted. Also, at least part of the configuration of the above embodiments may be added to or substituted for the configuration of another of the above embodiments. (7e) In the above embodiment, the vehicle log receiving unit 42 receives the communication intermediation history recorded in the vehicle 10 and identifies the communication source. However, if the communication protocol used by the vehicle 10 when communicating with the outside of the vehicle is a protocol that allows the communication intermediation history to be included in the communication data, the communication data monitoring unit 41 may receive the communication intermediation history included in the communication data. For example, if the communication data monitoring unit 41 is a proxy and the vehicle 10 is designed to communicate with the outside of the vehicle using HTTP (Hypertext Transfer Protocol), the communication source may be described in an XFF (X-Forwarded-For) header defined in the HTTP protocol, and the communication data monitoring unit 41 may refer to the XFF header to identify the communication source.

[0127] (7f) The present disclosure may be realized in various forms, including the attack analysis device described above, a system including the attack analysis device as a component, a program for causing a computer to function as the attack analysis device, a medium having this program recorded thereon, and an attack analysis method.

[0128] [Technical idea disclosed in this specification] [Item 1] An attack analysis device (47) configured to analyze an attack against an electronic control system (2) installed in a vehicle (10), the attack being against the electronic control system via a network, a determination unit (472, S102) configured to determine whether or not correspondence information that associates a system log, which is a log of the electronic control system, with a communication log, which is a log of communication between the electronic control system and the outside of the vehicle, matches a preset type of attack, and configured to determine whether or not a target element representing at least one of a component of the electronic control system and the electronic control system has been violated; An attack analysis device comprising: [Item 2] The attack analysis device according to item 1, The system log includes a history of communication between the electronic control system and an external device, The determination unit determines whether the target element is infringed upon identifying a source of the communication in the communication log from the history. An attack analysis device configured as follows. [Item 3] The attack analysis device according to item 1 or 2, The determination unit determines that there is a high probability that the target element has been infringed when the electronic control device that is the source of the communication is an electronic control device whose communication destination cannot be specified by anyone other than the vendor. An attack analysis device configured as follows. [Item 4] An attack analysis device according to any one of items 1 to 3, The determination unit determines that the target element is not likely to be infringed when a communication source of the communication is an external device. An attack analysis device configured as follows. [Item 5] An attack analysis device according to any one of items 1 to 4, the system log includes an abnormality log indicating an abnormality detected in the electronic control system; an estimation unit (474, S103, S104) configured to estimate the type of the attack by determining a similarity between actual anomaly information, which is generated based on the anomaly log and indicates a combination of the anomalies that have actually been detected, and predicted anomaly information, which indicates a combination of anomalies that are predicted to occur in the electronic control system when the electronic control system is attacked, for each type of attack; Further comprising: The attack analysis device is capable of changing a combination of predicted anomalies by using the correspondence information that is determined by the determination unit to match the type of attack. [Item 6] An attack analysis device according to any one of items 1 to 5, An inspection unit (45) configured to analyze the communication log and identify at least one of a malicious communication destination and a malicious communication content, The communication log of the corresponding information includes at least one of a malicious communication destination and a malicious communication content. [Item 7] An attack analysis device according to any one of items 1 to 6, The determination unit is capable of identifying a location in the electronic control system where an abnormality has occurred depending on whether the corresponding information matches any of a plurality of types of attacks, and classifying the location where the abnormality has occurred as either a location that has been compromised by the attack or a location that is highly likely to have been compromised by the attack. [Item 8] An attack analysis device according to any one of items 1 to 7, which cites item 5, The abnormality log and the communication log are associated so as to be synchronized based on the time at which the abnormality occurred, which is included in the abnormality log, and the time of communication, which is included in the communication log. [Item 9] An attack analysis device according to any one of items 1 to 8, which cites item 5, the predicted anomaly information is information in which a position where an anomaly is predicted to occur in the electronic control system when the electronic control system is attacked is expressed by a coefficient for each type of attack; The predicted anomaly information is capable of changing a combination of predicted anomalies by changing the coefficients. [Item 10] An attack analysis device according to any one of items 1 to 9, which cites item 5, the electronic control system includes a plurality of electronic control devices, and has a hierarchical structure in which the plurality of electronic control devices correspond to any one of a plurality of hierarchical levels prepared in advance; The estimation unit estimates that other electronic control devices located at the same hierarchical level as the electronic control device in which an abnormality is predicted to occur, as indicated by the correspondence information determined by the judgment unit to match the type of attack, have not been compromised. [Item 11] An attack analysis method for analyzing an attack via a network against an electronic control system (2) built in a vehicle (10), comprising: The system is configured to determine whether or not correspondence information that associates a system log, which is a log of the electronic control system, with a communication log, which is a log of communication between the electronic control system and the outside of the vehicle, matches a preset type of attack, and determines whether or not a target element that represents at least one of a component of the electronic control system and the electronic control system has been violated (472, S102); An attack analysis method including: [Item 12] A computer configured to analyze an attack via a network against an electronic control system (2) built in a vehicle (10), A function (472, S102) configured to determine whether or not correspondence information that associates a system log, which is a log of the electronic control system, with a communication log, which is a log of communication between the electronic control system and the outside of the vehicle, matches a preset type of attack, and determines whether or not a target element representing at least one of a component of the electronic control system and the electronic control system has been violated; An attack analysis program to achieve this. [Explanation of symbols]

[0129] 1...attack analysis system, 2...electronic control system, 2a to 2f...ECU, 3a to 3f...monitoring unit, 3g...analysis unit, 3h...transmission unit, 3i...communication unit, 3j...application, 4...external vehicle device, 5...external site, 10...vehicle, 41...communication data monitoring unit, 42...vehicle log receiving unit, 43...vehicle log DB, 44...detection condition DB, 45...inspection unit, 46...communication detection log DB, 47...analysis unit, 451...structural analysis unit, 452...communication destination analysis unit, 453...communication content analysis unit, 471...log association unit, 472...intrusion determination unit, 473...attack / anomaly relationship table storage unit, 474...estimation unit, 475...output unit, T1, T2...time frame.

Claims

1. An attack analysis device (47) configured to analyze an attack against an electronic control system (2) built in a vehicle (10), the attack being against the electronic control system via a network, the attack analysis device (47) comprising: a determination unit (472, S102) configured to determine whether or not correspondence information that associates a system log, which is a log of the electronic control system, with a communication log, which is a log of communication between the electronic control system and the outside of the vehicle, matches a preset type of attack, and configured to determine whether or not a target element representing at least one of a component of the electronic control system and the electronic control system has been violated; An attack analysis device comprising:

2. The attack analysis device according to claim 1 , The system log includes a history of communication between the electronic control system and an external device, The determination unit determines whether the target element is infringed upon identifying a source of the communication in the communication log from the history. An attack analysis device configured as follows.

3. The attack analysis device according to claim 1 or 2, The determination unit determines that there is a high probability that the target element has been infringed when the electronic control device that is the source of the communication is an electronic control device whose communication destination cannot be specified by anyone other than the vendor. An attack analysis device configured as follows.

4. The attack analysis device according to claim 1 or 2, The determination unit determines that the target element is not likely to be infringed when a communication source of the communication is an external device. An attack analysis device configured as follows.

5. The attack analysis device according to claim 1 , the system log includes an abnormality log indicating an abnormality detected in the electronic control system; an estimation unit (474, S103, S104) configured to estimate the type of the attack by determining a similarity between actual anomaly information, which is generated based on the anomaly log and indicates a combination of the anomalies that have actually been detected, and predicted anomaly information, which indicates a combination of anomalies that are predicted to occur in the electronic control system when the electronic control system is attacked, for each type of attack; Further comprising: The attack analysis device is capable of changing a combination of predicted anomalies by using the correspondence information that is determined by the determination unit to match the type of attack.

6. The attack analysis device according to claim 5, The method further includes an inspection unit (45) configured to analyze the communication log and identify at least one of a malicious communication destination and a malicious communication content, The communication log of the corresponding information includes at least one of a malicious communication destination and a malicious communication content.

7. The attack analysis device according to claim 5 or 6, The determination unit is capable of identifying a location in the electronic control system where an abnormality has occurred depending on whether the corresponding information matches any of a plurality of types of attacks, and classifying the location where the abnormality has occurred as either a location that has been compromised by the attack or a location that is highly likely to have been compromised by the attack.

8. The attack analysis device according to claim 5 or 6, The abnormality log and the communication log are associated so as to be synchronized based on the time at which the abnormality occurred, which is included in the abnormality log, and the time of communication, which is included in the communication log.

9. The attack analysis device according to claim 5 or 6, the predicted anomaly information is information in which a position where an anomaly is predicted to occur in the electronic control system when the electronic control system is attacked is expressed by a coefficient for each type of attack; The predicted anomaly information is capable of changing a combination of predicted anomalies by changing the coefficients.

10. The attack analysis device according to claim 5 or 6, the electronic control system includes a plurality of electronic control devices, and has a hierarchical structure in which the plurality of electronic control devices correspond to any one of a plurality of hierarchical levels prepared in advance; The estimation unit estimates that other electronic control devices located at the same hierarchical level as the electronic control device in which an abnormality is predicted to occur, as indicated by the correspondence information determined by the judgment unit to match the type of attack, have not been compromised.

11. An attack analysis device according to claim 1 or claim 2, The determination unit is configured to determine whether or not correspondence information that associates a system log, which is a log of the electronic control system, with a communication log, which is a log of communication between the electronic control system and a communication destination outside the vehicle and is generated by an external device (4) outside the vehicle that relays and monitors the communication, matches a preset type of attack, and is configured to determine whether or not a target element representing at least one of a component of the electronic control system and the electronic control system has been violated. Attack analysis device.

12. An attack analysis device according to claim 1 or claim 2, the determination unit is configured to determine whether or not correspondence information that associates a system log, which is a log of the electronic control system, with a communication log, which is a log of communication between the electronic control system and a communication destination outside the vehicle, matches a preset type of attack, and is configured to determine whether or not a target element that represents at least one of a component of the electronic control system and the electronic control system has been violated; The system log includes a history of communication between the electronic control system and a communication destination outside the vehicle, The determination unit is configured to identify a communication source of the communication mediated within the electronic control system as a communication source with a communication destination outside the vehicle in the communication log from the history, and then determine whether the target element is violated. Attack analysis equipment.

13. An attack analysis device according to claim 1 or claim 2, the system log includes an abnormality log indicating an abnormality detected in the electronic control system; an estimation unit (474, S103, S104) configured to estimate the type of the attack by determining a similarity between actual anomaly information, which is generated based on the anomaly log and indicates a combination of the anomalies that have actually been detected, and predicted anomaly information, which indicates a combination of anomalies that are predicted to occur in the electronic control system when the electronic control system is attacked, for each type of attack; The attack analysis device further comprises:

14. An attack analysis method for analyzing an attack via a network against an electronic control system (2) built in a vehicle (10), comprising: The method is configured to determine whether or not correspondence information that associates a system log, which is a log of the electronic control system, with a communication log, which is a log of communication between the electronic control system and the outside of the vehicle, matches a preset type of attack, and determines whether or not a target element that represents at least one of a component of the electronic control system and the electronic control system has been violated (472, S102); An attack analysis method including:

15. A computer configured to analyze an attack via a network against an electronic control system (2) built in a vehicle (10), A function (472, S102) configured to determine whether or not correspondence information that associates a system log, which is a log of the electronic control system, with a communication log, which is a log of communication between the electronic control system and the outside of the vehicle, matches a preset type of attack, and determines whether or not a target element that represents at least one of a component of the electronic control system and the electronic control system has been violated; An attack analysis program to achieve this.

Images