Method for filtering and qualifying security event of intrusion detection system

Abstract

To provide a method for filtering and qualifying a security event of an intrusion detection system.SOLUTION: A method for filtering a security event of an intrusion detection system (10) of a computer system (2) having plural calculation units (6, 7) connected for data communication includes: a step (100) of initializing a counter unique to each event type, in which the intrusion detection system (10) is configured to detect the security event and categorize it according to plural event types; a step (120) of increasing the counter unique to the type corresponding to the detected security event until it reaches a threshold in response to the detection (110) of the security event by the intrusion detection system; and a step (140) of cancelling the detected security event when the counter unique to the type corresponding to the detected security event reaches the threshold.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a method for filtering security events of an intrusion detection system, a method for qualifying security events, and a computer program for implementing same. [Background technology]

[0002] In a computer system or a network of computing units, an Intrusion Detection System (IDS) may be used to detect intrusions into the computer system or into the computing units contained in the computer system. Detected intrusions or intrusion attempts can be stored for later analysis or an attempt can be made to prevent the intrusion, i.e. to initiate measures that prevent the intrusion attempt from succeeding. The latter can be done for example by an Intrusion Prevention System (IPS). [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] The documents "Specification of Intrusion Detection System Protocol", "Requirements on Intrusion Detection System" and "Requirements on Security Extract Template" of the AUTOSAR standard version RS22-11 Summary of the Invention [Means for solving the problem]

[0004] According to the invention, a method for filtering security events of an intrusion detection system, a method for qualifying security events, and a computing unit and a computer program for carrying them out are proposed with the features of the independent claims. Advantageous configurations are the subject of the dependent claims and the following description.

[0005] The present invention relates to an intrusion detection system that classifies intrusions as security events corresponding to multiple event types, using type-specific counters for each event type, incrementing the type-specific counters when a security event of the respective event type is detected, and using means for discarding security events of an event type when the corresponding type-specific counter exceeds a threshold. This makes it possible to prevent frequent occurrences of security events of a particular event type from impeding or preventing further processing, such as storage and / or analysis, of security events of another event type. In particular, it makes it possible to prevent intrusion strategies in which a large number of security events of a particular event type, e.g. of lower risk level, are generated (by a corresponding intrusion) in order to conceal an intrusion that leads to a security event of another event type of higher risk level.

[0006] The method for filtering security events is in particular a computer-implemented method. The method relates to a computer system including a number of computing units connected for data communication. In a machine such as a vehicle, the computer system can be for example a bus system (for example a CAN bus system) including a number of control devices (computing units) and bus lines interconnecting the control devices.

[0007] It is assumed that an intrusion detection system is provided which detects potential intrusions into a computer system ("potential" generally denotes that cases may arise in which the intrusion detection system detects an intrusion even when no real intrusion has occurred (so-called false positive detections), e.g. in the event of a malfunction in the computer system). For example, the intrusion detection system detects events and / or patterns indicative of an intrusion in the data traffic between the computing units and / or in the computing units themselves. For example, a potential intrusion can be detected when a message cannot be authenticated in the framework of a message authentication procedure used in data communication. Voltage fluctuations on the bus lines can also be analyzed to detect that an intruder is physically connected to the bus lines.

[0008] More generally, an intrusion detection system is configured to detect so-called security events and classify them according to a number of event types. Each detected security event thus has a specific event type among the number of event types. A security event may be an event detected as a (potential) intrusion as described above. Additionally or alternatively, a security event may be an event where a security check is successfully performed (i.e. no potential intrusion is detected). This is for example the successful authentication of a message in a message authentication procedure. An intrusion detection system may include a number of security function modules (each of which may be implemented as a computer program module and / or a hardware module), each security function module performing a specific security check and determining or detecting a security event accordingly. The event type of a security event corresponds to the security function module that detected the security event, e.g. each security function module is assigned an event type.

[0009] Such intrusion detection systems and their classification into event types are known to the person skilled in the art. For example, in the AUTOSAR standard (AUTomotive Open System ARchitecture), security functions (so-called "security sensors") are described as part of software components that can detect security events. See for example the documents "Specification of Intrusion Detection System Protocol", "Requirements on Intrusion Detection System" and "Requirements on Security Extract Template" of the AUTOSAR standard version RS22-11. Event types can for example correspond to or be based on the respective security functions. The "Security Event" (abbreviated as "SEv") described in the AUTOSAR specification represents an example for "security event" in the present application.

[0010] The intrusion detection system can be implemented by one or more of the computing units of the computer system by computer program modules and / or hardware modules. Additionally or alternatively, a separate computing unit (e.g. connected to a bus line) can be provided which implements the intrusion detection system or a part of it. In particular, the method for filtering security events according to the invention can be executed by a computing unit of the computer system or by a separate computing unit.

[0011] In one embodiment, the type-specific counters are freshly initialized or reset to an initial value after a predefined period of time, thereby achieving the requirement that a certain frequency or rate be met, rather than all security events being discarded or filtered out forever.

[0012] In one embodiment, the type-specific counter is periodically decremented by a certain value, especially when it is greater than an initial value. The periodicity can especially be defined in terms of time, i.e. the type-specific counter is decremented after a predefined period of time. This can also achieve that not all security events are discarded or excluded forever, but rather a certain frequency or rate is required for this.

[0013] In one embodiment, if operation of the computer system is interrupted, the type-specific counters are stored in non-volatile memory before the interruption and read from memory when operation resumes, allowing security events that occurred before the interruption, e.g., a shutdown, to continue to be taken into account after a restart.

[0014] In one embodiment, the type-specific counters are initialized each time the computer system is started, in which case security events that occurred before an interruption are no longer considered after a reboot.

[0015] In one embodiment, when the operation of the computer system is interrupted, the lapse of the time period is interrupted and a value indicative of the lapsed portion of the time period is stored in memory, and when operation is resumed, the value is read from memory and the lapse of the time period continues, so that the time period that has already lapsed without a security event occurring before the interruption, e.g., shutdown, can continue to be taken into account after reboot, which makes the method more accurate.

[0016] In one embodiment, the period begins anew each time the computer system is started, in which case the period that had already elapsed before the interruption is no longer taken into account after the restart.

[0017] In one embodiment, different thresholds are provided for different event types, which makes the present invention more configurable. In one embodiment, a detected security event is classified as qualifying if a type-specific counter corresponding to the detected security event does not reach or falls below a threshold. A security event classified as qualifying is sent for, among other things, further normal processing, such as, for example, evaluation and / or storage of the detected security event. In particular, in one embodiment, data related to a security event classified as qualifying is stored and / or evaluated.

[0018] According to a further aspect, a method for qualifying security events in a computer system comprising a plurality of computing units connected for data communication is proposed. The computer system is provided with an intrusion detection system configured to detect and classify security events according to one or more event types. In the method for qualifying security events, a security event detected by the intrusion detection system is passed to a filter chain including at least one filter, the filter being configured to discard or classify the detected security event as qualified, respectively, and the qualified security event is passed to the next filter in the filter chain, respectively. Here, the method for filtering security events according to the invention forms the filters of the filter chain. Data of security events classified as qualified after passing through the filter chain is stored and / or analyzed.

[0019] A computing unit according to the invention, for example a control device of a motor vehicle, is designed, in particular from the point of view of programming technology, to carry out the method according to the invention. It is also advantageous to implement the method according to the invention in the form of a computer program or computer program product with program code for executing all the method steps. This is especially because the running control device is also used for further tasks and therefore is particularly cost-effective if it is even present. Finally, a machine-readable storage medium is provided on which a computer program as described above is stored. Suitable storage media or data carriers for providing the computer program are, in particular, magnetic, optical and electrical storage devices such as hard disks, flash memories, EEPROMs, DVDs, etc. Downloading of the program via a computer network (such as the Internet or an intranet) is also possible. Here, such downloading can be done via a wired or cabled connection or wirelessly (e.g., via a WLAN network, a 3G, 4G, 5G or 6G connection, etc.).

[0020] Further advantages and features of the present invention will become apparent from the specification and accompanying drawings. The invention is illustrated diagrammatically in the drawings with reference to exemplary embodiments and will be described hereinafter with reference to the drawings. [Brief description of the drawings]

[0021] [Figure 1] FIG. 1 illustrates an exemplary architecture of a computer system on which the present invention may be implemented. [Diagram 2] 2 is a flowchart of a method for filtering security events according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] 1 shows an exemplary structure of a computer system 2, in particular a bus system based on differential voltage signals, such as for example a CAN bus system, on which an embodiment of the invention can be implemented. The computer system 2 comprises on the one hand lines 4a, 4b, via which voltage signals are transmitted, the bus lines 4a, 4b being connected to one another via termination resistors 5a, 5b, which in the example of a CAN bus system represent the central impedance of the bus system. The computer system 2 comprises on the other hand a number of computing units 6, 7, i.e. bus subscribers, which are connected to the two bus lines 4a, 4b in order to communicate with one another via the bus. For this, the bus subscribers in a CAN bus system use a differential voltage between the two bus lines, which is generated and read, for example, by a transceiver. Examples for the computing units 6, 7 are a control device of a vehicle or machine transmitting control data and / or a sensor transmitting sensor data, for example, to a control device. One of the bus subscribers, or the computing unit 7 of one of the computing units, comprises an intrusion detection system 10 or at least a part of an intrusion detection system (for example a security function module, as described above). More generally, parts of the intrusion detection system (e.g. detection of security events) can also be implemented by other computing units 6 and / or by separate computing units (not shown). For example, an intrusion may result from one of the bus subscribers whose software has been tampered with, or from an external intruder who establishes a physical connection to the bus lines in order to read messages in the bus system and / or send messages himself (neither of which are shown).

[0023] Figure 2 shows a flow chart of a method for filtering security events according to an embodiment of the present invention. With reference to Figure 1, the steps of this method may be performed, for example, by a computing unit 7 implementing an intrusion detection system 10 or a part thereof. A security event may be detected, for example, by the computing unit 7 implementing an intrusion detection system 10 or a part thereof and / or by one of the other computing units 6, insofar as they also implement a partial function of an intrusion detection system (step 110).

[0024] In step 100, type-specific counters are initialized, i.e., each of a number of event types is assigned a (type-specific) counter, and at initialization, all type-specific counters are set to their respective predefined starting values, e.g., set to zero.

[0025] A security event is detected by the intrusion detection system at step 110. At step 120, a type-specific counter assigned to the event type of the detected security event is incremented, for example by one.

[0026] In step 130, it is checked whether the type-specific counter assigned to the event type of the detected security event has reached a predefined threshold, i.e., whether the type-specific counter assigned to the event type of the detected security event is below the threshold or above the threshold. Different event types may have different thresholds.

[0027] If it is determined in step 130 that the type-specific counter assigned to the event type of the detected security event has reached, i.e. is equal to or greater than, the threshold value, the detected security event is discarded or classified as disqualified in step 140, i.e., no further evaluation and / or storage of the detected security event is performed. If the method for filtering security events according to the invention is an element of a filter chain, i.e. one filter of a number of successive filters, the detected security event is not passed on to, for example, a subsequent filter in this case.

[0028] If it is determined in step 130 that the type-specific counter assigned to the event type of the detected security event has not reached, i.e. is less than, the threshold value, the detected security event is classified as eligible in step 150. Here, for example, evaluation and / or storage of the detected security event can take place. If the method for filtering security events according to the invention is an element of a filter chain, the detected security event is then passed on, for example, to a subsequent filter.

[0029] In a preferred step 160, it is checked whether a predetermined period of time has elapsed since the initialization of the type-specific counters, or more generally since the last setting of the type-specific counters to their respective start values. Depending on the application (i.e. depending on the computer system and / or intrusion detection system in particular), the period of time may range, for example, from a few seconds to several days. Once the period of time has elapsed, in step 170, the type-specific counters are reset to their respective start or initial values. The procedure of steps 160 and 170 can also be performed, contrary to what is shown, and independently of the occurrence of a security event, for example in parallel with the execution of steps 110, 120, 130, 140, 150 and 180. Instead of or in addition to resetting the type-specific counters to their respective start values, it may also be envisaged to periodically decrease the type-specific counters by a respective predetermined amount. This decrease is preferably only performed when the type-specific counter has a value greater than the start value, and even more preferably only up to the start value (i.e. the decrease must not fall below the start value).

[0030] In step 180, which may occur after step 140 or step 150, or possibly after step 160 or step 170, the filtering of the detected security event is terminated and filtering of the next security event is continued, i.e., returning to the detection of the security event in step 110.

[0031] If operation of the computer system is interrupted, the current value of the type-specific counter is stored in a non-volatile memory and is read from memory when operation of the computer system is resumed, and the method can continue based on the stored value of the type-specific counter, i.e., without initialization. Similarly, the passage of the period of time can possibly be interrupted, and time information as to how much of the period of time has already elapsed at the time of interruption can be stored in memory, and can be read from memory when operation of the computer system is resumed, and based on the time information the passage of the period of time can be further measured. Alternatively, the initialization (step 100) can be performed each time operation of the computer system is restarted. [Explanation of symbols]

[0032] 2. Computer Systems 4a Bus Line 4b Bus Line 5a terminating resistor 5b terminating resistor 6 Computational Units 7 Computational Units 10 Intrusion Detection Systems

Claims

1. A method for filtering security events in an intrusion detection system (10) of a computer system (2) comprising a plurality of computing units (6, 7) connected for data communication, the intrusion detection system (10) being configured to detect and classify security events according to a plurality of event types, For each event type, a type-specific counter is initialized (100); in response to detection (110) of a security event by the intrusion detection system, The type-specific counter corresponding to the detected security event is incremented (120) until it reaches a threshold value; When the type-specific counter corresponding to the detected security event reaches the threshold, the detected security event is discarded (140). method.

2. 2. The method of claim 1, wherein the type-specific counter is initialized again or reset to an initial value after a predefined period of time (170) and / or the type-specific counter is periodically decremented by a certain value, particularly when the type-specific counter is greater than the initial value.

3. 3. The method of claim 1, wherein if the operation of the computer system (2) is interrupted, the type-specific counter is stored in a non-volatile memory before the interruption and is read from the memory when the operation is resumed.

4. 4. The method of claim 3 when dependent on claim 2, wherein if the operation of the computer system (2) is interrupted, the passage of the period is interrupted and a value indicative of the elapsed portion of the period is stored in the memory, and when the operation is resumed, the value is read from the memory and the passage of the period is continued.

5. 3. The method according to claim 1, wherein the type-specific counter is initialized (100) each time the operation of the computer system (2) is started.

6. 3. The method of claim 2, wherein the period of time begins anew each time the operation of the computer system (2) is started.

7. The method according to any one of claims 1 to 6, wherein different thresholds are provided for different event types.

8. 8. The method of claim 1, wherein the detected security event is determined to be qualified (150) for the detected security event if the type-specific counter corresponding to the detected security event has not reached or is below the threshold, respectively.

9. The method of claim 8 , wherein security events classified as eligible are stored and / or evaluated, and / or data relating to security events classified as eligible is stored and / or evaluated.

10. A method for qualifying security events in a computer system (2) comprising a plurality of computing units (6, 7) connected for data communication, comprising: providing an intrusion detection system (10) configured to detect and classify security events according to one or more event types; 10. The method of claim 1, further comprising forming filters in the filter chain, wherein security events detected by the intrusion detection system (10) are passed to a filter chain including at least one filter, each of the filters being configured to either discard the detected security events or classify them as qualifying, and each qualifying security event being passed to the next filter in the filter chain, Data of security events classified as eligible after passing through the filter chain is stored and / or analyzed. method.

11. A computing unit (7) designed to carry out all the method steps of the method according to any one of the claims 1 to 10.

12. A computer program, when executed on a computing unit (7), causing said computing unit to carry out all the method steps of the method according to any one of claims 1 to 10.

13. A machine-readable storage medium having stored thereon the computer program of claim 12.

Images