Log determination device, log determination method, log determination program, log determination assisting device, log determination assisting method, and log determination assisting program

Abstract

To provide a log determination device, method, and program which perform attack detection processing corresponding to the situation of a vehicle by dynamically changing a determination reference used in detection processing of cyber attack.SOLUTION: A log determination device 100 includes a risk level determination part, a determination reference setting part, a log acquisition part, an attack determination part, and a determination result transmission part. The risk level determination part determines a risk level that an electronic control system mounted on a mobile body receives an attack on the basis of the state of a mobile body. The determination reference setting part sets a determination reference which is a reference to determine whether or not the electronic control system has received the attack on the basis of the risk level. The log acquisition part acquires an abnormal log generated by a sensor possessed by the electronic control system when the sensor has detected abnormality. The attack determination part determines whether or not the electronic control system has received the attack, using the determination reference and the abnormal log set by the reference setting part. The determination result transmission part transmits a determination result by the attack determination part to outside the mobile body.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present invention relates to a log judgment device that judges logs indicating abnormalities that have occurred in electronic control systems installed in mobile objects such as automobiles, a method and program executed by the log judgment device, a log judgment auxiliary device that assists in log judgment in the log judgment device, and a method and program executed by the log judgment auxiliary device. [Background technology]

[0002] In recent years, technologies for driving assistance and autonomous driving control, including V2X (vehicle-to-vehicle communication and vehicle-to-infrastructure communication), have been attracting attention. As a result, vehicles are equipped with communication functions, and so-called connected vehicles are becoming more common. As a result, the possibility of vehicles being subject to cyber attacks such as unauthorized access is increasing. Therefore, it is necessary to analyze cyber attacks against vehicles and develop countermeasures.

[0003] There are various methods for detecting abnormalities that occur in a vehicle and analyzing cyber attacks based on the detected abnormalities. For example, Patent Document 1 describes a method for collecting detected abnormality data and identifying the type of attack corresponding to the abnormality by comparing a combination of items in which an abnormality was detected with an abnormality detection pattern that is specified in advance for each attack. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2020-123307 A Summary of the Invention [Problem to be solved by the invention]

[0005] Here, the present inventors have found the following problem as a result of detailed investigation. Conventional methods uniformly perform cyber-attack detection processing based on abnormal data. However, depending on the vehicle's condition, the vehicle may be more or less susceptible to cyber-attacks, or may have a greater or lesser impact when it is attacked. In particular, when the vehicle is in a condition where the impact of an attack is greater, it is desirable to detect the attack with high sensitivity and respond to the attack. Therefore, it is necessary to reliably perform cyber-attack detection processing according to the vehicle's condition.

[0006] Therefore, the present invention aims to perform attack detection processing according to the vehicle's situation by dynamically changing the judgment criteria used in the cyber-attack detection processing. [Means for solving the problem]

[0007] A log judgment device according to one aspect of the present disclosure is a log judgment device (100, 200) mounted on a moving body, and includes a risk determination unit (102) that determines a risk level of an electronic control system mounted on the moving body being attacked based on the state of the moving body, a judgment criterion setting unit (103) that sets a judgment criterion that serves as a standard for determining whether or not the electronic control system has been attacked based on the risk level, a log acquisition unit (104) that acquires an abnormality log generated by a sensor possessed by the electronic control system when the sensor detects an abnormality, an attack judgment unit (108) that determines whether or not the electronic control system has been attacked using the judgment criterion and the abnormality log set by the judgment criterion setting unit, and a judgment result transmission unit (109) that transmits the judgment result by the attack judgment unit to an outside of the moving body.

[0008] A log judgment auxiliary device according to another aspect of the present disclosure is a log judgment auxiliary device (350) provided outside a moving body and connected to a log judgment device (300) mounted on the moving body, and includes a moving body information receiving unit (351) that receives moving body information indicating the state of the moving body from the log judgment device, a risk determination unit (356) that determines a risk level of an electronic control system mounted on the moving body being attacked based on the moving body information, a judgment criterion determination unit (354) that determines a judgment criterion that serves as a standard for determining whether or not the electronic control system has been attacked based on the risk level, and a judgment criterion transmission unit (355) that transmits the judgment criterion determined by the judgment criterion determination unit to the log judgment device, and the log judgment device determines whether or not the electronic control system has been attacked using the judgment criterion transmitted from the log judgment auxiliary device and an abnormality log generated by a sensor possessed by the electronic control system when the sensor detects an abnormality.

[0009] In addition, the claims and the numbers in parentheses attached to the constituent elements of the invention described in this section indicate the correspondence between the present invention and the embodiments described below, and are not intended to limit the present invention. Effect of the Invention

[0010] With the above-described configuration, the log judgment device, etc. disclosed herein makes it possible to dynamically set judgment criteria for determining whether or not a vehicle has been attacked based on the risk of the vehicle being attacked, thereby performing attack detection processing according to the risk of the vehicle being attacked by a cyber attack. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is an explanatory diagram illustrating the arrangement of a log judgment device and a log judgment auxiliary device according to each embodiment and the relationship with related devices. [Diagram 2] FIG. 2 is an explanatory diagram illustrating the relationship between the log determination device and an electronic control system according to each embodiment. [Diagram 3] FIG. 2 is an explanatory diagram illustrating an example of the configuration of an electronic control system according to each embodiment. [Figure 4]FIG. 1 is a block diagram showing an example of the configuration of a log determination device according to a first embodiment. [Diagram 5] FIG. 1 is a diagram for explaining a risk map according to the first embodiment; [Figure 6] FIG. 1 is a diagram for explaining an example of a prediction table according to the first embodiment. [Figure 7] FIG. 1 is a diagram for explaining an example of a prediction table according to the first embodiment. [Figure 8] FIG. 1 is a diagram for explaining an example of a prediction table according to the first embodiment. [Figure 9] FIG. 1 is a diagram for explaining the operation of the log determination device according to the first embodiment. [Figure 10] FIG. 1 is a diagram for explaining the operation of the log determination device according to the first embodiment. [Figure 11] FIG. 11 is a block diagram showing a configuration example of a log determination device according to a second embodiment. [Figure 12] FIG. 11 is a block diagram showing a configuration example of a log judgment assistance device according to a second embodiment. [Figure 13] FIG. 11 is a diagram for explaining the operation of the log judgment device and the log judgment assistant device according to the second embodiment. [Figure 14] FIG. 11 is a block diagram showing a configuration example of a log determination device according to a third embodiment. [Figure 15] FIG. 11 is a block diagram showing a configuration example of a log judgment assistance device according to a third embodiment. [Figure 16] FIG. 11 is a diagram for explaining the operation of the log judgment device and the log judgment assistant device according to the third embodiment. [Figure 17] FIG. 13 is a diagram for explaining a configuration example of a log judgment assistance device according to a modification of the third embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0013] The present invention means the invention described in the claims or in the Summary of the Invention section, and is not limited to the following embodiments. Furthermore, at least the words in quotation marks mean the words described in the claims or in the Summary of the Invention section, and are not limited to the following embodiments.

[0014] The configurations and methods described in the dependent claims are optional configurations and methods in the invention described in the independent claims. The configurations and methods of the embodiments corresponding to the configurations and methods described in the dependent claims, and the configurations and methods described only in the embodiments without being described in the claims, are optional configurations and methods in the present invention. The configurations and methods described in the embodiments when the description of the claims is broader than the description of the embodiments are also optional configurations and methods in the present invention in the sense that they are examples of the configurations and methods of the present invention. In either case, by being described in the independent claims, they become essential configurations and methods of the present invention.

[0015] The effects described in the embodiments are effects obtained when the configurations of the embodiments are provided as examples of the present invention, and are not necessarily effects that the present invention possesses.

[0016] When there are multiple embodiments, the configurations disclosed in each embodiment are not limited to each embodiment, but can be combined across the embodiments. For example, a configuration disclosed in one embodiment may be combined with another embodiment. Also, configurations disclosed in each of the multiple embodiments may be collected and combined.

[0017] The problem described in the section on problems that the invention is intended to solve is not a publicly known problem, but was discovered independently by the inventor, and this, together with the configuration and method of the present invention, is a fact that affirms the inventive step of the invention.

[0018] 1. Configuration underlying each embodiment (1) Location of the log determination device and its relationship with related devices Fig. 1 is a diagram for explaining the arrangement of the log determination device of each embodiment. As shown in Fig. 1, the log determination device 100, the log determination device 200, or the log determination device 300 (hereinafter, these are collectively referred to as the log determination device 100, etc.) is "mounted" on a vehicle, which is a "moving body."

[0019] Here, the term "mobile body" refers to an object that can move and can move at any speed. It also includes cases where the moving body is stationary. For example, it includes, but is not limited to, automobiles, motorcycles, bicycles, pedestrians, ships, aircraft, and objects mounted on these vehicles. "Mounted" includes not only the case where the device is directly fixed to the vehicle, but also the case where the device is not fixed to the vehicle but moves with the vehicle, such as when the device is carried by a person in the vehicle or when the device is mounted on cargo placed on the vehicle.

[0020] The log determination device 100 and the like are connected to an external device 20 provided outside the vehicle via a communication network. The external device 20 is a device that acquires the log determination results by the log determination device 100 and the like and performs detailed analysis of cyber attacks, and is realized by, for example, a server device or a Security Operation Center (SOC).

[0021] The log determination device 100 and the external device 20 are connected via a communication network such as a wireless communication method such as IEEE802.11 (Wi-Fi (registered trademark)), IEEE802.16 (WiMAX (registered trademark)), W-CDMA (Wideband Code Division Multiple Access), HSPA (High Speed ​​Packet Access), LTE (Long Term Evolution), LTE-A (Long Term Evolution Advanced), 4G, or 5G. Alternatively, DSRC (Dedicated Short Range Communication) can be used. When the vehicle is parked in a parking lot or housed in a repair shop, a wired communication method can be used instead of a wireless communication method. For example, a LAN (Local Area Network), the Internet, or a fixed telephone line can be used.

[0022] The log determination device 100, etc. is further connected to the log determination assistant device 250, the log determination assistant device 350, or the log determination assistant device 450 (hereinafter collectively referred to as the log determination assistant device 250, etc.). The log determination assistant device 250, etc. is a device for assisting the log determination of the log determination device in the second embodiment, the third embodiment, or a modified example thereof, which will be described later. The log determination device 100, etc. and the log determination assistant device 250, etc. are connected using a communication method similar to the communication method between the log determination device 100, etc. and the external device 20.

[0023] In each embodiment described later, the external device 20 and the log judgment assistant device 250 etc. are shown as separate devices, but the external device 20 and the log judgment assistant device 250 etc. may be the same device.

[0024] 2 is a diagram illustrating the arrangement of the log determination device 100 and the electronic control system S of each embodiment. The log determination device 100 and the like of each embodiment are connected to a plurality of electronic control devices 10 (hereinafter referred to as ECUs (Electronic Control Units)) constituting the electronic control system S.

[0025] 2(a) shows a case where the log determination device 100 and the like are provided inside the electronic control system S, and FIG. 2(b) shows a case where the log determination device 100 and the like are provided outside the electronic control system S. In both cases of FIG. 2(a) and FIG. 2(b), the log determination device 100 and the like and the multiple ECUs 10 are connected via an in-vehicle communication network such as a Controller Area Network (CAN) or a Local Interconnect Network (LIN). Alternatively, they may be connected using any communication method, whether wired or wireless, such as Ethernet (registered trademark), Wi-Fi (registered trademark), Bluetooth (registered trademark), and the like.

[0026] (2) Configuration of electronic control system S Fig. 3 is a diagram showing an example of the configuration of an electronic control system S. The electronic control system S is made up of a plurality of ECUs 10 and an in-vehicle network connecting these. Fig. 3 shows eight ECUs (ECU10a to ECU10h) as an example, but the electronic control system S is naturally made up of any number of ECUs. In the following explanation, when describing a single or a plurality of electronic control devices as a whole, they will be referred to as ECU10 or each ECU10, and when describing each individual electronic control device specifically, they will be referred to as ECU10a, ECU10b, ECU10c, ....

[0027] 3 includes an integrated ECU 10a, an external communication ECU 10b, zone ECUs (10c, 10d), and individual ECUs (10e to 10h). The ECUs 10 are connected to each other via an in-vehicle communication network that is the same as the communication system between the log determination device 100 and the multiple ECUs 10.

[0028] The integrated ECU 10a is an ECU that has a function of controlling the entire electronic control system S and also has a gateway function of mediating communication between the ECUs. The integrated ECU 10a is also called a gateway ECU (G-ECU) or a mobility computer (MC). The integrated ECU 10a may also be a relay device or a gateway device.

[0029] The external communication ECU 10b is an ECU having a communication unit that communicates with an external device 20 provided outside the vehicle, a log determination auxiliary device 250, and the like. The communication method used by the external communication ECU 10b is the wireless communication method or wired communication method described above. Note that a plurality of external communication ECUs 10b may be provided to realize a plurality of communication methods. Also, instead of providing the external communication ECU 10b, the integrated ECU 10a may include the function of the external communication ECUb.

[0030] The zone ECUs (10c, 10d) are ECUs equipped with a gateway function that is appropriately arranged based on the location and function of the individual ECU. For example, the zone ECU 10c is an ECU having a gateway function that mediates communication between the individual ECUs 10e and 10f arranged at the front of the vehicle and other ECUs 10, and the zone ECU 10d is an ECU having a gateway function that mediates communication between the individual ECUs 10g and 10h arranged at the rear of the vehicle and other ECUs 10.

[0031] The individual ECUs (10e to 10h) can be configured with ECUs having any desired functions. For example, they can be drive system electronic control devices that control the engine, steering, brakes, etc., vehicle body electronic control devices that control meters, power windows, etc., information system electronic control devices such as navigation devices, or safety control system electronic control devices that perform control to prevent collisions with obstacles or pedestrians. Also, the ECUs may not be parallel to each other, but may be classified as master and slave.

[0032] In the electronic control system S of FIG. 3, each ECU 10 other than the ECU 10h is equipped with a security sensor (abbreviated as SS in the figure). In this way, it is not necessary for all ECUs 10 constituting the electronic control system S to be equipped with a security sensor. The security sensor monitors the operation of the ECUs and the communication between the ECUs, and generates a log when any abnormality is detected. In FIG. 3, each ECU is illustrated as being equipped with one security sensor, but each ECU may be equipped with multiple security sensors as described later. Hereinafter, the log generated by the security sensor is referred to as an abnormality log. The abnormality log generated by the security sensor is transmitted to the log determination device 100, etc. via the in-vehicle network.

[0033] In each embodiment, the log determination device 100 and the like are provided in the integrated ECU 10a inside the electronic control system S. However, the log determination device 100 and the like may be provided in the external communication ECU 10b, the zone ECU (10c, 10d), or the individual ECU (10e to 10h). When provided in one of the individual ECUs (10e to 10h), it is preferable to use a dedicated ECU for realizing the log determination device 100 and the like.

[0034] In addition, among the ECUs 10 constituting the electronic control system S, if an ECU 10 other than the external communication ECU 10b includes functions of the log judgment device 100, etc., the receiving unit and transmitting unit of the log judgment device, etc. described later, communicate with the external device 20, the log judgment auxiliary device 250, etc. via the external communication ECU 10b.

[0035] 2. Embodiment 1 (1) Configuration of the log determination device 100 The configuration of the log determination device 100 of this embodiment will be described with reference to Fig. 4. The log determination device 100 includes a control unit 101, a log acquisition unit 104, a log storage unit 105, a prediction table storage unit 107, and a determination result transmission unit 109. The control unit 101 realizes a risk level determination unit 102, a determination criterion setting unit 103, a memory control unit 106, and an attack determination unit 108 by hardware and / or software.

[0036] The risk determination unit 102 determines the "risk" of an attack on the electronic control system S mounted on the vehicle based on the "state of the moving body" that is the vehicle.

[0037] Here, the "state of the moving body" includes both the internal state of the moving body and the external state of the moving body. "Danger level" is a qualitative or quantitative indication of the cause, target, or result of a danger. For example, it indicates the probability of an attack occurring or the extent of the damage caused by an attack, and may be indicated by a numerical value, a standardized value, a symbol, or a set.

[0038] The risk level determination unit 102 determines the risk level based on the vehicle's position as the state of the moving body, for example. The incidence rate of cyber attacks may differ depending on the area. Therefore, in an area where the incidence rate of cyber attacks is high, the risk of the electronic control system S being attacked is high, and in an area where the incidence rate is low, the risk of the electronic control system S being attacked is low. Therefore, the risk level determination unit 102 determines the risk level of the electronic control system S being attacked based on the current position of the vehicle. The position of the vehicle can be obtained from a GPS (not shown) mounted on the vehicle, from an IP address used by the external communication ECU 10b for communication, or from outside the vehicle.

[0039] For example, the log judgment device 100 pre-stores a risk map showing the risk level for each area, and the risk determination unit 102 determines the risk level of the electronic control system S to be the risk level shown in the risk level map corresponding to the current position of the vehicle.

[0040] The risk map is a map showing the risk for each country, prefecture, or range of several meters to several kilometers. FIG. 5 shows an example of the risk map. In the example shown in FIG. 5, the risk is classified into three levels: high, medium, and low, but the risk may be further classified. In the example of FIG. 5, areas with low risk are pinpointed. For example, the risk may be set low near dealers and repair shops. In addition, since there are many vehicles in urban areas, the risk is high if the electronic control system S is subjected to a cyber attack and causes a vehicle to malfunction. Therefore, the risk may be set higher in urban areas than in suburban areas. In addition, the risk may be set higher in areas such as near highways and intersections than in other areas.

[0041] In the risk map shown in FIG. 5, there are two high risk areas. One is an area classified as high risk A, and the other is an area classified as high risk B. For example, the area classified as high risk A is an area where many attacks against the drive system ECU have occurred, and the risk to the drive system ECU is high. The area classified as high risk B is an area where many attacks against the vehicle body ECU have occurred, and the risk to the vehicle body ECU is high. In this way, even if the risk is quantitatively the same, if it is qualitatively different, it may be classified into different areas. Note that the risk is qualitatively different includes not only the case where the targets of the attack are different as described above, but also the case where the types of the attacks themselves are different.

[0042] The risk determination unit 102 may determine the risk based on other parameters instead of or in addition to the vehicle position. For example, the risk determination unit 102 may determine the risk based on the moving speed of the vehicle, or whether the vehicle is an autonomous vehicle. If the electronic control system S is attacked by a cyber attack when the vehicle is moving at a high speed, the safety of the vehicle and the occupants is likely to be compromised. Similarly, if the electronic control system S is attacked by a cyber attack when the vehicle is traveling autonomously, the safety of the vehicle and the occupants is likely to be compromised, compared with the case where the vehicle is manually controlled by the driver. Therefore, it can be said that the risk is high when the moving speed of the vehicle is fast or when the vehicle is an autonomous vehicle. Therefore, in such a case, the risk determination unit 102 determines that the risk is high. The risk determination unit 102 may further determine the risk based on the temperature outside the vehicle and the time period when the vehicle is traveling as other parameters.

[0043] An autonomous vehicle refers to a vehicle in which autonomous driving is being performed at a level higher than a predetermined level, for example. Therefore, even if a vehicle has an autonomous driving function, it may not be considered an autonomous vehicle if the occupant is driving it manually. In addition, even if the autonomous driving function of the vehicle is enabled, it may not be considered an autonomous vehicle if the autonomous driving level is low (for example, autonomous driving level 1 that provides driving assistance). Furthermore, the risk determination unit 102 may determine the risk level according to the autonomous driving level.

[0044] The risk determination unit 102 may also determine the risk level based on risk level information acquired from outside the vehicle. For example, the risk level determination unit 102 may receive risk level information from a roadside unit indicating the risk level of the area in which the roadside unit is located. In this case, the risk level determination unit 102 determines the risk level indicated by the risk level information received from the roadside unit as the risk level of the electronic control system S being attacked.

[0045] The judgment criterion setting unit 103 determines a judgment criterion that is a standard for judging whether or not the electronic control system S has been attacked, based on the risk level determined by the risk level determination unit 102, and sets the determined judgment criterion as a judgment criterion used by an attack judgment unit 108, which will be described later, for attack judgment. The judgment criterion set by the judgment criterion setting unit 103 will be described later in detail.

[0046] The log acquisition unit 104 acquires an abnormality log generated by a security sensor mounted in each ECU 10 .

[0047] The log storage unit 105 stores the abnormality log acquired by the log acquisition unit 104. The log storage unit 105 may be either an external storage device (hard disk, USB memory, CD / BD, etc.) or an internal storage device (RAM, etc.).

[0048] The memory control unit 106 controls the log storage unit 105. For example, when the attack determination unit 108 described later determines that an attack has occurred, the memory control unit 106 controls the log storage unit 105 so that the abnormality log acquired by the log acquisition unit 104 within a predetermined time before and after the determination is stored in the log storage unit 105.

[0049] The prediction table storage unit 107 is a memory that stores a prediction table used by the attack determination unit 108 described later for attack determination. Fig. 6 is a diagram showing an example of a prediction table stored in the prediction table storage unit 107. The prediction table shows a correspondence relationship between a combination of multiple predicted abnormality logs that are predicted to be generated by each security sensor when the electronic control system S is subjected to a specific attack, and the attack type of the specific attack (e.g., attack A, attack B, ...). The prediction table shown in Fig. 6 shows, for example, that when the electronic control system S is subjected to attack A, it is predicted that the security sensors 1 to 3 mounted on the ECU 10b will detect an abnormality and generate an abnormality log.

[0050] The attack determination unit 108 uses the abnormality log acquired by the log acquisition unit 104 to determine whether the electronic control system S has been "attacked." The attack determination unit 108 of this embodiment compares the prediction table stored in the prediction table storage unit 107 with the abnormality log acquired by the log acquisition unit 104, and determines that the electronic control system S has been attacked if the prediction table contains a combination of multiple predicted abnormality logs corresponding to the abnormality log. For example, if the log acquisition unit 104 acquires the abnormality log generated by the security sensor 3 of the ECU 10b and the abnormality logs generated by the security sensors 1 and 2 of the ECU 10c, these abnormality logs match the combination of predicted abnormality logs of the attack type (A2). Therefore, the attack determination unit 108 determines that the electronic control system S has been attacked (attack type A2).

[0051] Here, "being attacked" includes not only actual attacks, but also possible attacks and cases where it can be assessed as having been attacked.

[0052] The attack determination unit 108 may determine that an attack has occurred even if the abnormality log does not completely match the combination of multiple predicted abnormality logs included in the prediction table. For example, it may determine that an attack has occurred when the matching rate between the abnormality log and the combination of multiple predicted abnormality logs is equal to or greater than a threshold value.

[0053] The determination result transmission unit 109 transmits the determination result by the attack determination unit 108 to the external device 20 located outside the vehicle. The determination result transmission unit 109 may transmit a determination result indicating whether or not the electronic control system S has been attacked, or, when the attack determination unit 108 determines that the electronic control system S has been attacked, may also transmit the log used in the determination. Moreover, the determination result transmission unit 109 may transmit the determination result to the external device 20 only when the attack determination unit 108 determines that the electronic control system S has been attacked.

[0054] Next, the criterion set by the criterion setting unit 103 will be described.

[0055] The judgment criterion determined and set by the judgment criterion setting unit 103 is, for example, a prediction table used by the attack judgment unit 108 for attack judgment. In this case, the prediction table storage unit 107 stores a plurality of prediction tables corresponding to the risk levels in advance. The judgment criterion setting unit 103 determines and sets one prediction table corresponding to the risk level determined by the risk level determination unit 102, out of the plurality of prediction tables stored in the prediction table storage unit 107, as the prediction table to be used by the attack judgment unit 108, i.e., as the judgment criterion.

[0056] FIG. 7 is a diagram showing an example of a prediction table that differs for each risk level. FIG. 7(a) is a prediction table (corresponding to a "first prediction table") corresponding to a high risk level (corresponding to a "first risk level"), and FIG. 7(b) is a prediction table (corresponding to a "second prediction table") corresponding to a low risk level (corresponding to a "second risk level"). The prediction table shown in FIG. 7(a) shows combinations of predicted abnormality logs for attack types A1 to An+1, while the prediction table shown in FIG. 7(b) shows combinations of predicted abnormality logs for attack types A1 to An. That is, the prediction table corresponding to a high risk level has a correspondence relationship between more attack types and combinations of predicted abnormality logs than the prediction table corresponding to a low risk level.

[0057] When the risk level is high, in order to minimize damage caused by the attack, it is desirable to more reliably determine that the electronic control system S has been attacked without overlooking the attack. Therefore, as shown in Fig. 7, the higher the risk level, the more prediction tables capable of determining a greater number of attack types are used.

[0058] FIG. 8 is a diagram showing another example of a prediction table that differs for each risk level. FIG. 8(a) is a prediction table (corresponding to the "first prediction table") corresponding to a high risk level (corresponding to the "first risk level"), and FIG. 8(b) is a prediction table (corresponding to the "second prediction table") corresponding to a low risk level (corresponding to the "second risk level"). In the example of FIG. 8, the number of attack types that the attack determination unit 108 can determine is the same for each risk level. However, the number of predicted abnormality logs associated with one attack type is different between FIG. 8(a) and FIG. 8(b). For example, in the prediction table of FIG. 8(a), the predicted abnormality logs associated with the attack type A2 are the predicted abnormality logs generated by the security sensor 3 of the ECU 10b and the security sensors 1 and 2 of the ECU 10c. 8(b), the predicted abnormality logs associated with the attack type A2 are the predicted abnormality logs generated by the security sensors 2 and 3 of the ECU 10b and the security sensors 1 and 2 of the ECU 10c. That is, in the prediction table corresponding to a high risk level, the number of predicted abnormality logs associated with the attack type A2 is smaller than the number of predicted abnormality logs associated with the attack type A2 in the prediction table corresponding to a low risk level.

[0059] As in the example of Fig. 7, when the risk level is high, it is desirable to more reliably determine that an attack has occurred. Therefore, when the risk level is high, a prediction table with a small number of predicted abnormality logs associated with attack types is used so that an attack can be detected even if the number of security sensors that detect abnormalities is small.

[0060] 7 and 8, an example in which different prediction tables are used depending on the level of risk has been described. However, even if the level of risk is the same, different prediction tables may be used when the types of risk are different. For example, in the risk map shown in FIG. 5, different prediction tables may be used for areas classified as high risk A and areas classified as high risk B.

[0061] 7 and 8, the judgment criterion set by the judgment criterion setting unit 103 is a prediction table, but the judgment criterion does not have to be a prediction table. For example, a threshold value of the matching rate between an abnormality log and a combination of multiple predicted abnormality logs included in the prediction table may be set as the judgment criterion. The attack judgment unit 108 judges that an attack has occurred when the matching rate between an abnormality log and a combination of multiple predicted abnormality logs included in the prediction table is "greater than" the threshold value. In this case, the judgment criterion setting unit 103 sets the threshold value, which is the judgment criterion, so that the matching rate threshold is lower when the risk level is high (corresponding to the "first risk level") than when the risk level is low (the "second risk level").

[0062] Here, "greater than or equal to" includes both cases where the value is the same as the comparison target and cases where the value is not the same.

[0063] When the threshold for the matching rate is lowered, the attack determination unit 108 determines that an attack has occurred even when the abnormality log and a combination of multiple predicted abnormality logs only partially match, thereby increasing the possibility of more reliably determining that an attack has occurred.

[0064] (2) Operation of the log determination device Next, the operation of the log determination device 100 will be described with reference to Fig. 9 and Fig. 10. Fig. 9 and Fig. 10 not only show the log determination method executed by the log determination device 100, but also show the processing procedure of the log determination program executable by the log determination device 100. The order of these processes is not limited to the order shown in Fig. 9 or Fig. 10. That is, the order may be changed as long as there is no constraint such as a relationship in which a certain step utilizes the result of the previous step. The same applies to Figs. 13 and 16 of other embodiments described later.

[0065] Fig. 9 is a diagram for explaining the operation related to setting the judgment criteria used by the attack judgment unit 108. Fig. 9 explains the case where the judgment criteria is a prediction table as an example, but as described above, the judgment criteria is not limited to a prediction table.

[0066] The risk determination unit 102 determines the risk of the electronic control system S being attacked (S101). The judgment criteria setting unit 103 determines a prediction table that is a criterion for judging whether or not the electronic control system S has been attacked, based on the degree of danger (S102). The judgment criterion setting unit 103 sets the prediction table used by the attack judgment unit 108 to the prediction table determined in S102 (S103).

[0067] Next, the operation of the log determination device 100 for determining an attack will be described with reference to FIG. The log acquisition unit 104 acquires an abnormality log generated by a security sensor included in each ECU 10 of the electronic control system S when the security sensor detects an abnormality (S111). The attack determination unit 108 performs an attack determination as to whether or not the electronic control system S has been attacked, using the determination criteria set in S103 of FIG. 9 and the abnormality log acquired in S111 (S112). Here, if the attack determination unit 108 determines that an attack has occurred (S113: Y), the determination result transmission unit 109 transmits the determination result by the attack determination unit 108 to the external device 20 (S114).

[0068] (3) Summary As described above, according to the present embodiment, it is possible to set a criterion for determining whether or not an attack has occurred based on the degree of risk of a cyber-attack on an electronic control system mounted on a vehicle. This makes it possible to increase the possibility of detecting an attack based on an abnormality log when the degree of risk is high, thereby preventing an attack from being overlooked.

[0069] 3. Variations (1) Variation 1 In the first embodiment, the attack determination unit 108 performs the attack determination using the prediction table. However, the attack determination unit 108 may determine whether the electronic control system S has been attacked by a different method without using the prediction table.

[0070] For example, the attack determination unit 108 may determine that an attack has occurred when the number of times the security sensor has detected an abnormality is equal to or greater than a threshold. In this case, the determination criterion setting unit 103 determines the threshold of the number of times the security sensor has detected an abnormality as the determination criterion based on the degree of danger.

[0071] Specifically, the judgment criterion setting unit 103 determines and sets a threshold value, which is the judgment criterion, so that when the level of risk is high (corresponding to the "first level of risk"), the threshold value for the number of times an abnormality is detected is lower than when the level of risk is low (corresponding to the "second level of risk").

[0072] For example, in high-risk areas, the threshold is set to 10, in medium-risk areas, the threshold is set to 50, and in low-risk areas, the threshold is set to 100. In this case, if the security sensor detects an abnormality 30 times, the attack determination unit 108 will not determine that an attack has occurred in low-risk or medium-risk areas, but will determine that an attack has occurred in high-risk areas.

[0073] As another example, the attack determination unit 108 may determine that an attack has occurred when the number of security sensors that have detected an abnormality is equal to or greater than a threshold. In this case, the determination criterion setting unit 103 determines the threshold for the number of security sensors that have detected an abnormality as the determination criterion based on the degree of risk.

[0074] Specifically, the judgment criterion setting unit 103 determines and sets a threshold value, which is the judgment criterion, so that when the level of risk is high (corresponding to the "first level of risk"), the threshold value for the number of security sensors that detect an abnormality is lower than when the level of risk is low (corresponding to the "second level of risk").

[0075] For example, in high-risk areas, the threshold is set to 2, in medium-risk areas, the threshold is set to 5, and in low-risk areas, the threshold is set to 10. In this case, if the number of security sensors that detect an abnormality is 4, the attack determination unit 108 will not determine that an attack has occurred in low-risk areas, but will determine that an attack has occurred in medium-risk or high-risk areas.

[0076] In all of the above-mentioned modified examples, the judgment criteria are set so that the higher the risk, the lower the threshold. As a result, in all of the modified examples, the higher the risk, the easier it becomes for the attack judgment unit 108 to detect an attack, making it possible to prevent an attack from being overlooked.

[0077] (2) Variation 2 In the above-described embodiment, a configuration has been described in which the determination criteria used by the attack determination unit 108 are set based on the degree of danger. In this modified example, a configuration will be described in which other control is performed based on the degree of danger.

[0078] For example, the attack determination unit 108 may control the frequency with which the attack determination unit 103 determines whether or not an attack has been received, based on the degree of danger determined by the danger level determination unit 102. Specifically, the attack determination unit 108 controls so that when the degree of danger is high, the frequency of attack determination is increased compared to when the degree of danger is low.

[0079] When the attack determination unit 108 periodically performs an attack determination, the time period during which the attack determination is performed is shortened to increase the frequency of the attack determination. Alternatively, when the attack determination unit 108 performs an attack determination every time the log acquisition unit 104 receives a predetermined number of abnormality logs or every time the vehicle travels a predetermined distance, the frequency of the attack determination may be increased by reducing or shortening the predetermined number or the predetermined distance.

[0080] The higher the risk level, the more frequently the log determination device 100 performs the attack determination, so that if the electronic control system S is attacked in a high-risk situation, the attack can be detected immediately. Furthermore, when the risk level is low, the frequency of the attack determination is reduced compared to when the risk level is high, so that the consumption of CPU resources by the log determination device 100 can be suppressed.

[0081] As another example, the memory control unit 106 may control the amount of data of the abnormality log to be stored in the log storage unit 105 based on the degree of risk determined by the degree of risk determination unit 102. Specifically, when the degree of risk is high, the memory control unit 106 controls the log storage unit 105 to store a larger amount of data of the abnormality log compared to when the degree of risk is low.

[0082] In order to use the cyber-attacks on the electronic control system S for analysis, it is desirable to store the abnormality logs generated before and after the attack. By storing more abnormality logs, it is possible to analyze the cyber-attacks in more detail. Therefore, when the risk is high, the amount of data of the abnormality logs stored in the log storage unit 105 is controlled to be increased, and more abnormality logs are accumulated, thereby preventing logs useful for analyzing the cyber-attacks from being discarded.

[0083] (3) Variation 3 In this modified example, in addition to determining whether or not the electronic control system S has been attacked, the attack determination unit 108 is configured to determine the "certainty" of the attack as the degree of possibility that the electronic control system S has been attacked.

[0084] Here, "certainty" is sufficient if it indicates the degree of certainty that an attack has occurred, and includes cases where it is indicated by a numerical value, a normalized value, a symbol, or a set.

[0085] The attack determination unit 108 determines the accuracy of an attack based on, for example, the matching rate between the abnormality log and a combination of multiple predicted abnormality logs included in the prediction table. As an example, the attack determination unit 108 determines the accuracy to be 100% when the matching rate between the abnormality log and a combination of multiple predicted abnormality logs is 100%, and determines the accuracy to be 70% when the matching rate is 70%.

[0086] The attack determination unit 108 can determine the attack accuracy by using other than the coincidence rate between the abnormality log and the combination of the multiple predicted abnormality logs. For example, when performing the attack determination using a prediction table, the attack accuracy may be associated with each attack type included in the prediction table. In this case, the attack determination unit 108 can determine the attack accuracy when determining the attack type. The attack types included in the prediction table include those with a high probability of the occurrence of the attack indicated by the attack type and those with a low probability of the occurrence of the attack indicated by the attack type. Therefore, even if an abnormality log that completely matches the combination of predicted abnormality logs of the attack type A1 is acquired, if the attack of the attack type A1 itself is extremely rare, the possibility of being attacked by the attack indicated by the attack type A1 is low. Therefore, as described above, the attack determination unit 108 may determine the attack accuracy by previously associating the attack accuracy with each attack type and storing it in the prediction table.

[0087] Furthermore, the attack determination unit 108 may determine the attack certainty even when an attack determination is performed using a threshold value of the number of times a security sensor detects an abnormality or a threshold value of the number of security sensors that have detected an abnormality, as in the above-mentioned modified example 1. For example, the attack determination unit 108 determines the attack certainty based on the ratio of the number of times a security sensor detects an abnormality or the number of security sensors that have detected an abnormality to the threshold value.

[0088] The attack probability may be expressed by a numerical value (eg, 70%, 100%, etc.) or may be expressed by a symbol such as high, medium, or low.

[0089] In this modified example, the determination result transmission unit 109 may transmit the attack probability determined by the attack determination unit 108 to the outside of the vehicle in addition to the determination result.

[0090] Although the above description has been given taking as an example the case where Modifications 1 to 3 are applied to the first embodiment, each of the modifications may be applied to the second or third embodiment described later.

[0091] 4. Embodiment 2 In the first embodiment, the prediction table storage unit 107 of the log determination device 100 stores a plurality of prediction tables in advance, and the determination criterion setting unit 103 determines and sets one of the plurality of prediction tables as the determination criterion based on the degree of risk. However, since the prediction table has a large amount of data, if the prediction table storage unit 107 mounted on the vehicle stores a plurality of prediction tables, there is a risk that the capacity of the memory mounted on the vehicle will be strained.

[0092] Therefore, in this embodiment, a configuration will be described in which the risk level is determined in a log determination device mounted on a vehicle, and a prediction table corresponding to the risk level is obtained from a log determination auxiliary device located outside the vehicle.

[0093] (1) Configuration of the log determination device 200 The configuration of the log determination device 200 of this embodiment will be described with reference to Fig. 11. The same components as those in the log determination device 100 of embodiment 1 are denoted by the same reference numerals as in Fig. 4, and the description of embodiment 1 will be cited. The log determination device 200 includes a control unit 101, a log acquisition unit 104, a log storage unit 105, a prediction table storage unit 107, a determination result transmission unit 109, a risk level transmission unit 211, and a prediction table reception unit 212. The control unit 101 realizes the risk level determination unit 102, the determination criterion setting unit 103, the memory control unit 106, and the attack determination unit 108 by hardware and / or software.

[0094] The risk level transmission unit 211 transmits the risk level determined by the risk level determination unit 102 to the log judgment auxiliary device 250 which is an external device. The prediction table receiving unit 212 (corresponding to the “criterion receiving unit”) receives the prediction table (corresponding to the “criterion”) transmitted from the log judgment assistant device 250. The prediction table storage unit 107 stores the prediction table received by the prediction table receiving unit 212 . The judgment criterion setting unit 103 sets the prediction table received by the prediction table receiving unit 212 and stored in the prediction table storage unit 107 as the judgment criterion for the attack judgment unit 108.

[0095] (2) Configuration of the log judgment assistant device 250 The configuration of the log judgment assistant device 250 will be described with reference to Fig. 12. The log judgment assistant device 250 includes a risk level receiving unit 251, a prediction table storage unit 252, a control unit 253, and a prediction table transmission unit 255. The control unit 253 realizes a judgment criterion determination unit 254 by hardware and / or software.

[0096] The risk level receiving unit 251 receives the risk level transmitted from the log judgment device 200 .

[0097] The prediction table storage unit 252 is a memory that stores a plurality of prediction tables corresponding to the risk level. In the first embodiment, the prediction table storage unit 107 of the log judgment device 100 stores a plurality of prediction tables, whereas in the present embodiment, the prediction table storage unit 252 of the log judgment auxiliary device 250 stores a plurality of prediction tables.

[0098] The judgment criterion determination unit 254 of the control unit 253 determines one of the multiple prediction tables stored in the prediction table storage unit 252 that corresponds to the risk level received by the risk level receiving unit 251 as the prediction table to be used by the log judgment device 200 for attack judgment, i.e., the judgment criterion.

[0099] The prediction table transmitting unit 255 transmits the prediction table determined by the determination criterion determining unit 254 to the log determination device 200 .

[0100] (3) Operation of the Log Judgment Device 200 and the Log Judgment Assistant Device 250 Next, the operations of the log judgment device 200 and the log judgment auxiliary device 250 will be described with reference to FIG. 13. Among the operations of the log judgment device 200, those that are the same as those of the log judgment device 100 will be described below. , the same reference numerals as in FIG. 9 are used.

[0101] The risk determination unit 102 determines the risk of the electronic control system S being attacked (S101). The risk level transmitting unit 211 transmits the risk level determined in S101 to the log judgment auxiliary device 250 (S201).

[0102] The risk level receiving unit 251 of the log judgment auxiliary device 250 receives the risk level transmitted from the log judgment device 200 (S251). The judgment criterion determination unit 254 determines a prediction table, which is a judgment criterion to be used to judge whether or not the electronic control system S has been attacked, based on the degree of danger received in S251 (S252). The prediction table transmission unit 255 transmits the prediction table determined in S252 to the log judgment device 200 (S253).

[0103] The prediction table receiving unit 212 of the log judgment device 200 receives the prediction table transmitted in S253 (S202). The prediction table storage unit 107 stores the prediction table received in S202 (S203). Then, the determination criterion setting unit 103 sets the prediction table used by the attack determination unit 108 in the prediction table received in S202 and stored in S203 (S103).

[0104] The series of operations for making an attack determination in the log determination device 200 of this embodiment is the same as that in the log determination device 100 of the first embodiment.

[0105] In the above-described embodiment, the judgment criterion is a prediction table. However, the judgment criterion in this embodiment is not limited to a prediction table, and may be the judgment criterion described in the modified example of the first embodiment.

[0106] (4) Summary As described above, according to this embodiment, the log determination device 200, which is an in-vehicle device, can acquire a prediction table, which is a determination criterion required for attack determination, based on the risk level, without storing multiple prediction tables in the memory of the log determination device 200. This can reduce the load on the log determination device 200.

[0107] 5. Embodiment 3 In the first embodiment, the risk determination unit 102 of the log determination device 100 determines the risk of the electronic control system S being attacked based on the state of the vehicle, and determines the determination criterion to be used for attack determination based on the determined risk. However, when the log determination device determines the risk, a processing load is placed on the log determination device. Also, as described in the second embodiment, since the prediction table has a large amount of data, when the prediction table storage unit 107 mounted on the vehicle stores multiple prediction tables, there is a risk of straining the capacity of the memory mounted on the vehicle.

[0108] In this embodiment, therefore, a configuration will be described in which a log judgment auxiliary device, which is an external device located outside the vehicle, judges the degree of danger and determines a prediction table according to the degree of danger as the judgment criterion.

[0109] (1) Configuration of the log determination device 300 The configuration of the log determination device 300 of this embodiment will be described with reference to Fig. 14. The same components as those in the log determination device 100 of the first embodiment are denoted by the same reference numerals as in Fig. 4, and the description of the first embodiment will be cited.

[0110] The log determination device 300 includes a control unit 101, a log acquisition unit 104, a log storage unit 105, a prediction table storage unit 107, a determination result transmission unit 109, a location information transmission unit 311, and a prediction table reception unit 312. The control unit 101 realizes the determination criterion setting unit 103, the memory control unit 106, and the attack determination unit 108 by hardware and / or software.

[0111] The position information transmission unit 311 transmits position information of the vehicle in which the log determination device 300 is mounted to the log determination auxiliary device 350. For example, the position information transmission unit 311 transmits the vehicle position information acquired by a GPS (not shown) mounted in the vehicle. The position information transmission unit 311 may transmit the vehicle position information periodically, or may transmit the vehicle position information every time the vehicle moves a predetermined distance.

[0112] In this embodiment, the log determination device 300 transmits the vehicle position information to the log determination auxiliary device 350, but instead of or in addition to the vehicle position information, other vehicle information indicating the vehicle state may be transmitted to the log determination auxiliary device 350. The vehicle information is, for example, vehicle speed information and information indicating whether the vehicle is an autonomous vehicle.

[0113] The prediction table receiving unit 312 receives a prediction table transmitted from the log judgment auxiliary device 350, which will be described later. The prediction table storage unit 107 stores the prediction table received by the prediction table receiving unit 312 . Then, the judgment criterion setting unit 103 sets the prediction table received by the prediction table receiving unit 312 and stored in the prediction table storage unit 107 as the judgment criterion by the attack judgment unit 108.

[0114] (2) Configuration of the log judgment assistant device 350 15, the configuration of the log judgment assistant device 350 will be described. The log judgment assistant device 350 includes a location information receiving unit 351, a prediction table storage unit 352, a control unit 353, and a prediction table transmitting unit 355. The control unit 353 realizes a risk determining unit 356 and a judgment criterion determining unit 354.

[0115] The position information receiving unit (corresponding to the “mobile body information receiving unit”) 351 receives the vehicle position information (corresponding to the “mobile body information”) transmitted from the log determination device 200.

[0116] The prediction table storage unit 352 is a memory that stores a plurality of prediction tables corresponding to the risk level. In the first embodiment, the prediction table storage unit 107 of the log judgment device 100 stores a plurality of prediction tables, whereas in the present embodiment, the prediction table storage unit 352 of the log judgment auxiliary device 350 stores a plurality of prediction tables.

[0117] The risk level determination unit 356 of the control unit 353 determines the risk level of an attack on the electronic control system S mounted on the vehicle, based on the vehicle position received by the position information receiving unit 351. Here, the risk level determination unit 356 determines the risk level based on the vehicle position using a method similar to that of the first embodiment. For example, the risk level determination unit 356 determines the risk level using vehicle position information and a risk level map. Note that, similar to the first embodiment, the risk level determination unit 356 may determine the risk level based on vehicle information other than the position information.

[0118] The judgment criterion determination unit 354 determines judgment criteria that are the standard for the log judgment device 300 to judge an attack, based on the risk determined by the risk level determination unit 356. Specifically, among the multiple prediction tables stored in the prediction table storage unit 352, one prediction table that corresponds to the risk level determined by the risk level determination unit 356 is determined as the prediction table that the log judgment device 300 uses to judge an attack, i.e., the judgment criterion.

[0119] The prediction table transmitting unit (corresponding to the “criterion transmitting unit”) 355 transmits the prediction table determined by the criteria determining unit 354 to the log determining device 300 .

[0120] (3) Operation of the Log Judgment Device 300 and the Log Judgment Assistant Device 350 Next, the operations of the log judgment device 300 and the log judgment auxiliary device 350 will be described with reference to Fig. 16. Of the operations of the log judgment device 300, the same operations as those of the log judgment device 100 are denoted by the same reference numerals as in Fig. 9.

[0121] The location information transmission unit 311 of the log determination device 300 transmits vehicle location information to the log determination auxiliary device 350 (S301).

[0122] The location information receiving unit 351 of the log judgment auxiliary device 350 receives the vehicle location information transmitted in S301 (S351). The risk determination unit 356 determines the risk of the electronic control system S being attacked (S352). The judgment criterion determination unit 354 determines a prediction table, which is a judgment criterion used in the log judgment device 300 to determine whether or not the electronic control system S has been attacked, based on the degree of danger determined in S352 (S353). The prediction table transmission unit 355 transmits the prediction table determined in S353 to the log determination device 300 (S354).

[0123] The prediction table receiving unit 312 of the log determination device 300 receives the prediction table transmitted in S354 (S302). The prediction table storage unit 107 stores the prediction table received in S302 (S303). Then, the determination criterion setting unit 103 sets the prediction table used by the attack determination unit 108 in the prediction table received in S302 and stored in S303 (S103).

[0124] The series of operations for making an attack determination in the log determination device 300 of this embodiment is the same as that in the log determination device 100 of the first embodiment.

[0125] In the above-described embodiment, the judgment criterion is a prediction table. However, the judgment criterion in this embodiment is not limited to a prediction table, and may be the judgment criterion described in the modified example of the first embodiment.

[0126] (4) Summary As described above, according to this embodiment, the log judgment auxiliary device 350 located outside the vehicle performs processes with a high processing load, such as determining the risk level for setting the log judgment criteria and determining the prediction table, thereby reducing the load on the log judgment device 300.

[0127] (5) Modifications of the third embodiment (other inventions) In the above-described third embodiment, the log determination auxiliary device 350 determines the risk of an attack on the electronic control system S mounted on the same vehicle as the log determination device 300, based on vehicle position information received from the log determination device 300. In contrast, in this modified example, a configuration will be described in which the log determination auxiliary device transmits a prediction table corresponding to the risk of an area to a log determination device mounted on a vehicle in an area with a predetermined risk level.

[0128] The configuration of the log determination device of this modification is substantially the same as that of the log determination device of the third embodiment, and therefore will be described by citing the log determination device 300 of the third embodiment. However, since the log determination device 300 of this modification does not need to transmit location information to the log determination auxiliary device, it does not necessarily need to include the location information transmission unit 311.

[0129] The configuration of a log judgment assistance device 450 of this modified example will be described with reference to Fig. 17. The log judgment assistance device 450 includes a prediction table storage unit 452, a control unit 453, and a prediction table transmission unit 455. The control unit 453 realizes a judgment criterion determination unit 454 and a target vehicle determination unit 457.

[0130] The prediction table storage unit 451 of this modification stores in advance a plurality of prediction tables according to the degree of risk, similar to the prediction table storage unit of the second or third embodiment.

[0131] The judgment criterion determination unit 454 of the control unit 453 determines a prediction table that is the judgment criterion used by the log judgment device 300 located within a specific area for attack judgment.

[0132] The target vehicle determination unit 457 determines, as a target vehicle, a vehicle that is located within an area using the prediction table determined by the determination criterion determination unit 454, among the vehicles equipped with the log determination device 300. Note that, when the log determination auxiliary device 450 acquires position information from the log determination device 300 equipped in the vehicle, the target vehicle determination unit 457 may determine the target vehicle based on the received position information.

[0133] The prediction table transmission unit 455 transmits the prediction table determined by the judgment criterion determination unit 454 to the target vehicle determined by the target vehicle determination unit 457.

[0134] In the above example, the prediction table transmission unit 455 transmits the prediction table to the target vehicle by unicast. However, the prediction table transmission unit 455 in this modification may transmit the prediction table to the vehicle located within a specific area by broadcast.

[0135] 6. Summary The features of the log judgment device and the log judgment auxiliary device in each embodiment of the present invention have been described above. The terms used in each embodiment are merely examples and may be replaced with synonymous terms or terms having the same functions.

[0136] The block diagrams used to explain the embodiments classify and organize the configuration of the device by function. The blocks showing the respective functions are realized by any combination of hardware or software. In addition, since the block diagrams show the functions, they can also be understood as disclosures of a method invention and a program invention that realizes the method.

[0137] The order of the processes, flows, and blocks that can be understood as methods described in each embodiment may be changed as long as there are no constraints, such as one step utilizing the results of another step prior to it.

[0138] The terms first, second, through Nth (N is an integer) used in each embodiment and in the claims are used to distinguish two or more configurations or methods of the same type, and do not limit the order or superiority or inferiority.

[0139] The log determination device of each embodiment is assumed to be a device for determining logs generated by a sensor of an electronic control system installed in a vehicle, but the log determination device of the present disclosure is applied to a device for determining logs generated by any electronic control system, unless otherwise limited in the claims. The log judgment assistance device in each embodiment is assumed to be a device for assisting log judgment by a log judgment device installed in a vehicle, but the log judgment assistance device of the present invention is applied to a device that assists log judgment by any log judgment device, except as specifically limited in the claims.

[0140] Examples of the form of the device of the present invention include a semiconductor device, an electronic circuit, a communication module, and a microcomputer. Examples of semi-finished products include electronic control units (ECUs (Electric Control Units)) and system boards. Finished product forms include mobile routers, mobile phones, smartphones, tablets, personal computers (PCs), workstations, and servers. Other examples include devices with communication functions, such as car navigation systems.

[0141] Furthermore, necessary functions such as an antenna and a communication interface may be added to each device.

[0142] In addition, the present invention can be realized not only by dedicated hardware having the configuration and functions described in each embodiment, but also as a combination of a program for realizing the present invention recorded on a recording medium such as a memory or a hard disk, and general-purpose hardware having a dedicated or general-purpose CPU and memory capable of executing the program.

[0143] A program for the log judgment device or log judgment assistance device of the present disclosure, which is stored in a non-transitive substantial recording medium (e.g., an external storage device (hard disk, USB memory, CD / BD, etc.) or an internal storage device (RAM, ROM, etc.)) of dedicated or general-purpose hardware, can also be provided to the dedicated or general-purpose hardware via the recording medium, or from a server via a communication line without via a recording medium. This makes it possible to always provide the latest functions through program upgrades. [Industrial Applicability]

[0144] Although the present disclosure has been described primarily as an on-board log judgment device that is installed in an automobile, and a log judgment auxiliary device that assists the log judgment device, it can be applied to all moving objects, such as motorcycles, ships, trains, and aircraft. [Explanation of symbols]

[0145] 100, 200, 300 log judgment device, 102 danger level determination unit, 103 judgment criterion setting unit, 104 log acquisition unit, 105 log storage unit, 106 memory control unit, 107 prediction table storage unit, 108 attack judgment unit, 109 judgment result transmission unit, 211 danger level transmission unit, 212 prediction table receiving unit, 351 location information receiving unit (mobile body information receiving unit), 354 judgment criterion determination unit, 355 prediction table transmitting unit (judgment criterion transmission unit), 356 danger level determination unit

Claims

1. A log determination device (100, 200) mounted on a moving body, a risk determination unit (102) for determining a risk level of an attack on an electronic control system mounted on the mobile body based on a state of the mobile body; a determination criterion setting unit (103) for setting a determination criterion serving as a criterion for determining whether or not the electronic control system has been attacked based on the degree of risk; a log acquisition unit (104) that acquires an abnormality log generated by a sensor when the sensor has detected an abnormality; an attack determination unit (108) that determines whether or not the electronic control system has been attacked by using the determination criterion set by the determination criterion setting unit and the abnormality log; a determination result transmission unit (109) that transmits the determination result by the attack determination unit to an outside of the moving body; A log determination device comprising:

2. The log determination device further includes a prediction table storage unit (107) that stores a prediction table indicating a correspondence between a combination of a plurality of predicted abnormality logs that are predicted to be generated by the sensor when the electronic control system is subjected to a specific attack and an attack type indicating the specific attack, the attack determination unit determines whether or not the attack has been received by using the prediction table; The log determination device according to claim 1.

3. the prediction table storage unit stores a plurality of prediction tables corresponding to the risk levels, the judgment criterion setting unit determines and sets one of the plurality of prediction tables as a judgment criterion to be used by the attack judgment unit based on the risk level; The log determination device (100) according to claim 2.

4. a first prediction table corresponding to a first risk level among the plurality of prediction tables has a greater number of the correspondence relationships than a second prediction table corresponding to a second risk level lower than the first risk level; The log determination device according to claim 3.

5. the number of the plurality of predicted abnormality logs associated with one attack type in a first prediction table corresponding to a first risk level among the plurality of prediction tables is smaller than the number of the plurality of predicted abnormality logs associated with the one attack type in a second prediction table corresponding to a second risk level lower than the first risk level; The log determination device according to claim 3.

6. the attack determination unit determines that the electronic control system is under attack when a matching rate between the abnormality log and a combination of the plurality of predicted abnormality logs is equal to or greater than a threshold; the determination criterion setting unit sets the threshold value, which is the determination criterion, so that when the risk level is a first risk level, the threshold value is lower than when the risk level is a second risk level that is lower than the first risk level. The log determination device according to claim 2.

7. the attack determination unit determines that the electronic control system is under attack when the number of times the sensor detects the abnormality is equal to or greater than a threshold; the determination criterion setting unit sets the threshold value, which is the determination criterion, so that when the risk level is a first risk level, the threshold value is lower than when the risk level is a second risk level that is lower than the first risk level. The log determination device according to claim 1.

8. the attack determination unit determines that the electronic control system is under attack when the number of the sensors that detect the abnormality is equal to or greater than a threshold; the determination criterion setting unit sets the threshold value, which is the determination criterion, so that when the risk level is a first risk level, the threshold value is lower than when the risk level is a second risk level that is lower than the first risk level. The log determination device according to claim 1.

9. The attack determination unit controls a frequency at which the attack determination unit determines whether or not the attack has been received based on the degree of risk. The log determination device according to claim 1.

10. The log determination device further comprises: a log storage unit (105) that stores the abnormality log acquired by the log acquisition unit; a memory control unit (106) that controls the amount of data of the abnormality log to be stored in the log storage unit based on the degree of risk. The log determination device according to claim 1.

11. The risk determination unit determines the risk based on a position of the moving object. The log determination device according to claim 1, 9 or 10.

12. The risk determination unit determines the risk based on a moving speed of the moving object. The log determination device according to claim 1, 9 or 10.

13. the moving object is a vehicle, The risk determination unit determines the risk based on whether the vehicle is an autonomous driving vehicle. The log determination device according to claim 1, 9 or 10.

14. The attack determination unit further calculates a probability that the electronic control system has been subjected to the attack, The determination result output unit outputs the degree of certainty in addition to the determination result. The log determination device according to claim 1.

15. the determination result transmission unit transmits the determination result when the attack determination unit determines that the attack has occurred. The log determination device according to claim 1.

16. The log determination device further comprises: a risk level transmission unit (211) that transmits the risk level determined by the risk level determination unit to an external device located outside the moving body; a criterion receiving unit (212) for receiving, from the external device, a criterion corresponding to the risk level transmitted by the risk level transmitting unit; Equipped with the judgment criterion setting unit sets the judgment criterion used by the attack judgment unit to the judgment criterion received by the judgment criterion receiving unit; The log determination device (200) according to claim 1.

17. A log determination auxiliary device (350) provided outside a moving body and connected to a log determination device (300) mounted on the moving body, A mobile object information receiving unit (351) that receives mobile object information indicating a state of the mobile object from the log determination device; a risk determination unit (356) for determining a risk level of an attack on an electronic control system mounted on the mobile body based on the mobile body information; a criterion determination unit (354) for determining a criterion serving as a criterion for determining whether or not the electronic control system has been attacked based on the degree of risk; a criterion transmission unit (355) that transmits the criterion determined by the criterion determination unit to the log determination device; Equipped with the log determination device determines whether the electronic control system has been attacked by using the determination criterion transmitted from the log determination auxiliary device and an abnormality log generated by a sensor of the electronic control system when the sensor detects an abnormality; Log judgment assistant device.

18. A log determination method executed by a log determination device mounted on a moving object, comprising: determining a risk of an attack on an electronic control system mounted on the mobile body based on the state of the mobile body (S101); Based on the degree of danger, a judgment criterion is set as a criterion for judging whether the electronic control system is under attack (S103, S204); When a sensor of the electronic control system detects an abnormality, an abnormality log generated by the sensor is acquired (S111); Using the set determination criteria and the abnormality log, it is determined whether or not the electronic control system has been attacked (S112); The result of the determination as to whether or not the mobile unit has been attacked is transmitted to an outside of the mobile unit (S114). Log determination method.

19. A log determination program executable by a log determination device mounted on a moving object, A risk level is determined (S101); Based on the degree of danger, a judgment criterion is set as a criterion for judging whether the electronic control system is under attack (S103, S204); When a sensor of the electronic control system detects an abnormality, an abnormality log generated by the sensor is acquired (S111); Using the set determination criteria and the abnormality log, it is determined whether or not the electronic control system has been attacked (S112); The result of the determination as to whether or not the mobile unit has been attacked is transmitted to an outside of the mobile unit (S114). Log judgment program.

20. A log judgment assistance method executed by a log judgment assistance device provided outside a moving body and connected to a log judgment device mounted on the moving body, comprising: receiving, from the log determination device, moving object information indicating the state of the moving object (S351); Based on the mobile object information, a risk of an attack on an electronic control system mounted on the mobile object is determined (S352); determining a criterion for determining whether the electronic control system has been attacked based on the degree of risk (S353); The determined judgment criteria are transmitted to the log judgment device (S354); the log determination device determines whether the electronic control system has been attacked by using the determination criterion transmitted from the log determination auxiliary device and an abnormality log generated by a sensor of the electronic control system when the sensor detects an abnormality; Log-assisted determination method.

21. A log judgment assistance program executable by a log judgment assistance device provided outside a moving body and connected to a log judgment device mounted on the moving body, the log judgment assistance program comprising: receiving, from the log determination device, moving object information indicating the state of the moving object (S351); Based on the mobile object information, a risk of an attack on an electronic control system mounted on the mobile object is determined (S352); determining a criterion for determining whether the electronic control system has been attacked based on the degree of risk (S353); The determined judgment criteria are transmitted to the log judgment device (S354); the log determination device determines whether the electronic control system has been attacked by using the determination criterion transmitted from the log determination auxiliary device and an abnormality log generated by a sensor of the electronic control system when the sensor detects an abnormality; Log judgment assistance program.

Images