Attack analysis device, attack analysis method and attack analysis program

Abstract

To provide an attack analysis device, method and program, which analyze estimated accuracy for a cyber attack received by an electric control system.SOLUTION: An attack analysis device 10 includes: a log acquisition unit 101 that acquires a log indicating an abnormality detected by an electronic control system and a position where the abnormality is detected; an attack / abnormality relation information storage unit 102 that stores information indicating a relation among predicted attack information indicating an attack that the electronic control system may receive, predicted abnormality information indicating an abnormality predicted to occur when the attack is received, and predicted abnormality position information indicating a position where the predicted abnormality occurs; an attack estimation unit 103 that estimates the attack received by the electronic control system on the basis of the log and the attack / abnormality relation information; an attack estimation accuracy analysis unit 104 that analyzes estimated accuracy for the attack on the basis of context data included in the log; and an output unit 107 that outputs attack information indicating the estimated attack and estimated accuracy information indicating the estimated accuracy for the attack.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present disclosure relates to a technique for analyzing attacks against electronic control systems mounted on devices such as mobile objects, mainly automobiles, and relates to an attack analysis device, an attack analysis method, and an attack analysis program. [Background technology]

[0002] In recent years, technologies for driving assistance and autonomous driving control, including V2X (vehicle-to-vehicle communication and vehicle-to-infrastructure communication), have been attracting attention. As a result, vehicles are equipped with communication functions, and so-called connected vehicles are becoming more common. As a result, the possibility of vehicles being subject to cyber attacks such as unauthorized access is increasing. Therefore, it is necessary to analyze cyber attacks against vehicles and develop countermeasures.

[0003] There are various methods for detecting abnormalities that occur in a vehicle and analyzing cyber attacks based on the detected abnormalities. For example, Patent Document 1 describes a method for collecting detected abnormality data and identifying the type of attack corresponding to the abnormality by comparing a combination of items in which an abnormality was detected with an abnormality detection pattern that is specified in advance for each attack. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2020-123307 A Summary of the Invention [Problem to be solved by the invention]

[0005] The present inventors have found the following problems. When estimating an attack on an electronic control system using a security log indicating anomalies detected in the electronic control system and the location in the electronic control system where the anomaly was detected, and attack-anomaly relationship information indicating a combination of anomalies predicted to occur when the electronic control system is subjected to a cyber attack, attack type candidates that are unlikely to occur in an actual attack may be included. In addition, when such attack type candidates are included, if all candidates are evaluated equally, there is a possibility that measures that are not necessarily appropriate as measures against cyber attacks may be selected.

[0006] One aspect of the present disclosure aims to analyze the accuracy of estimating cyber attacks on electronic control systems and make the results of this analysis available. [Means for solving the problem]

[0007] One aspect of the present disclosure is an attack analysis device that analyzes attacks against an electronic control system (S) mounted on a moving object, comprising: a log acquisition unit (101) that acquires a security log indicating an abnormality detected in the electronic control system and a location within the electronic control system where the abnormality was detected; an attack / anomaly relationship information storage unit (102) for storing attack / anomaly relationship information indicating a relationship between predicted attack information indicating an attack that the electronic control system may receive, predicted anomaly information indicating an anomaly that is predicted to occur when the electronic control system receives the attack, and predicted anomaly position information indicating a position in the electronic control system where the predicted anomaly will occur; an attack estimation unit (103) for estimating an attack that the electronic control system has received based on the security log and the attack / anomaly relationship information; an attack estimation accuracy analysis unit (104) that analyzes the estimation accuracy of the attack based on context data included in the security log; and an output unit (105) that outputs attack information indicating the estimated attack and estimated accuracy information indicating the estimated accuracy of the attack.

[0008] With this configuration, the attack analysis device disclosed herein analyzes the estimated accuracy of an attack using context data contained in the security log and outputs the analysis results as estimated accuracy information, making it possible to use the attack estimation results based on the accuracy of the estimated results of a cyber attack.

[0009] In addition, the claims and the numbers in parentheses attached to the constituent elements of the invention described in this section indicate the correspondence between the present invention and the embodiments described below, and are not intended to limit the present invention. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is an explanatory diagram showing the positional relationship between an attack analysis device and an electronic control system according to each embodiment. [Diagram 2] Block diagram showing an example of the configuration of the electronic control system S [Diagram 3] An explanatory diagram showing the contents of the security log [Figure 4] FIG. 1 is a block diagram showing an example of the configuration of an attack analysis device according to an embodiment; [Diagram 5] An explanatory diagram explaining an example of attack / anomaly related information [Figure 6] An explanatory diagram illustrating another example of attack / anomaly related information. [Figure 7] FIG. 1 is an explanatory diagram for explaining the operation of a reference attack element information estimation unit and an attack estimation accuracy analysis unit according to the first embodiment. [Figure 8] FIG. 11 is an explanatory diagram for explaining the operation of a reference attack element information estimation unit and an attack estimation accuracy analysis unit according to the second embodiment. [Figure 9A] FIG. 13 is an explanatory diagram for explaining the operation of a reference attack element information estimation unit and an attack estimation accuracy analysis unit according to the third embodiment. [Figure 9B] FIG. 13 is an explanatory diagram for explaining context data related information used in a modified example of the third embodiment. [Figure 10] FIG. 13 is an explanatory diagram for explaining the operation of a reference attack element information estimation unit and an attack estimation accuracy analysis unit according to the fourth embodiment. [Figure 11A] FIG. 13 is an explanatory diagram for explaining the operation of a reference attack element information estimation unit and an attack estimation accuracy analysis unit according to the fifth embodiment. [Figure 11B]FIG. 13 is an explanatory diagram for explaining the operation of a reference attack element information estimation unit and an attack estimation accuracy analysis unit according to a modification of the fifth embodiment. [Figure 12] FIG. 13 is an explanatory diagram for explaining the operation of a reference attack element information estimation unit and an attack estimation accuracy analysis unit according to the sixth embodiment. [Figure 13] A flowchart for explaining the operation of the attack analysis device according to the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, exemplary embodiments of the present disclosure will be described with reference to the drawings.

[0012] The present invention means the invention described in the claims or in the Summary of the Invention section, and is not limited to the following embodiments. Furthermore, at least the words in quotation marks mean the words described in the claims or in the Summary of the Invention section, and are not limited to the following embodiments.

[0013] The configurations and methods described in the dependent claims are optional configurations and methods in the invention described in the independent claims. The configurations and methods of the embodiments corresponding to the configurations and methods described in the dependent claims, and the configurations and methods described only in the embodiments without being described in the claims, are optional configurations and methods in the present invention. The configurations and methods described in the embodiments when the description of the claims is broader than the description of the embodiments are also optional configurations and methods in the present invention in the sense that they are examples of the configurations and methods of the present invention. In either case, by being described in the independent claims, they become essential configurations and methods of the present invention.

[0014] The effects described in the embodiments are effects obtained when the configurations of the embodiments are provided as examples of the present invention, and are not necessarily effects that the present invention possesses.

[0015] When there are multiple embodiments (including examples, the same applies below), the configurations disclosed in each embodiment are not limited to each embodiment, but can be combined across the embodiments. For example, a configuration disclosed in one embodiment may be combined with another embodiment. Also, the configurations disclosed in each of the multiple embodiments may be collected and combined.

[0016] The problem described in the section on problems to be solved by the invention is not a publicly known problem, but was discovered independently by the inventor, and this, together with the configuration and method of the present invention, is a fact that affirms the inventive step of the invention.

[0017] 1. Configurations and other aspects underlying each embodiment (1) Positional relationship between the attack analysis device 10 and the electronic control system S The positional relationship between the attack analysis device 10 and the electronic control system S in each embodiment will be described with reference to FIG.

[0018] The attack analysis device 10 is a device that analyzes attacks against an electronic control system S. More specifically, the attack analysis device 10 is a device that receives a security log generated by a security sensor of an electronic control device 20 that constitutes the electronic control system S, and analyzes attacks against the electronic control system S based on the security log.

[0019] As shown in Figure 1(a) and Figure 1(b), there are two cases: the attack analysis device 10 is "mounted" in a vehicle, which is a "moving body", together with an electronic control device 20 constituting an electronic control system S, and as shown in Figure 1(c), there is a case in which the electronic control device 20 constituting an electronic control system S is "mounted" in a vehicle, which is a "moving body", and the attack analysis device 10 is realized by a server device or SOC (Security Operation Center) or the like provided outside the vehicle. Hereinafter, the electronic control device 20 is abbreviated as ECU (Electronic Control Unit) 20. Where: "Mobile object" refers to an object that can move and can move at any speed. It also includes cases where the mobile object is stationary. For example, it includes, but is not limited to, automobiles, motorcycles, bicycles, pedestrians, ships, aircraft, and objects mounted on these. "Mounted" includes not only the case where the device is directly fixed to the moving body, but also the case where the device is not fixed to the moving body but moves with the moving body, such as the case where the device is carried by a person riding on the moving body, or the case where the device is mounted on cargo placed on the moving body.

[0020] The example shown in Fig. 1(a) is an example in which an independent attack analysis device 10 is provided inside the electronic control system S, or an example in which the functions of the attack analysis device 10 are built into at least one of the ECUs 20 constituting the electronic control system S. The example shown in Fig. 1(b) is an example in which the attack analysis device 10 is provided outside the electronic control system S, but from the viewpoint of the connection form, it is substantially the same as Fig. 1(a). 1(a) and 1(b), the attack analysis device 10 and the ECU 20 are connected via an in-vehicle communication network such as a Controller Area Network (CAN) or a Local Interconnect Network (LIN). Alternatively, the connection may be made using any communication method, whether wired or wireless, such as Ethernet (registered trademark), Wi-Fi (registered trademark), or Bluetooth (registered trademark). Note that a connection refers to a state in which data can be exchanged, and includes not only cases in which different hardware is connected via a wired or wireless communication network, but also cases in which virtual machines realized on the same hardware are virtually connected to each other.

[0021] The example of FIG. 1(c) is an example in which the attack analysis device 10 is provided outside the electronic control system S. However, since the attack analysis device 10 is provided outside the vehicle, the connection form is usually different from that of FIG. 1(a) and FIG. 1(b). The attack analysis device 10 and the electronic control system S are connected via a communication network using a wireless communication method such as IEEE802.11 (Wi-Fi (registered trademark)), IEEE802.16 (WiMAX (registered trademark)), W-CDMA (Wideband Code Division Multiple Access), HSPA (High Speed ​​Packet Access), LTE (Long Term Evolution), LTE-A (Long Term Evolution Advanced), 4G, and 5G. Alternatively, DSRC (Dedicated Short Range Communication) can be used. When the vehicle is parked in a parking lot or housed in a repair shop, a wired communication method can be used instead of a wireless communication method. For example, a LAN (Local Area Network), the Internet, or a fixed telephone line can be used.

[0022] In the cases of Figures 1(a) and 1(b), the cyber-attack can be analyzed without delay within the attacked vehicle without communication with external devices, allowing for a more rapid response to the cyber-attack.

[0023] In contrast, in the case of Fig. 1(c), for example, it is possible to analyze cyber attacks by utilizing the abundant resources of a server device. Furthermore, it is possible to centrally analyze cyber attacks on the server device without installing new devices or programs in existing vehicles.

[0024] In the following embodiments, the explanation will be given on the premise of the arrangement shown in FIG. In each embodiment, the electronic control system S is described as an in-vehicle system mounted on a vehicle, but the electronic control system S is not limited to an in-vehicle system and can be applied to any electronic control system consisting of multiple ECUs. For example, the electronic control system S may be mounted on a stationary or fixed object instead of a moving object. Also, a part of the attack analysis device 10 may be provided in a server device, and the remaining part may be provided in a mobile body or other device.

[0025] In addition, the attack analysis device 10 can determine whether the abnormality indicated in the received security log is an abnormality caused by a cyber-attack or an abnormality caused by a reason other than a cyber-attack, and in the former case, analyze the cyber-attack based on the security log, and in the latter case, not analyze the cyber-attack as it is a false positive log. A part having such a function can be defined as a log determination device.

[0026] The log determination device may be provided in a stage preceding the processing of the attack analysis device 10, or may be included in the attack analysis device 10. Although not shown in Fig. 1, in the cases of Fig. 1(a) and Fig. 1(b), the log determination device is also mounted on the vehicle. In contrast, in the case of Fig. 1(c), the log determination device may be provided in a server device or the like which is the attack analysis device 10, or only the log determination device may be provided on the vehicle.

[0027] (2) Configuration of Electronic Control System S Fig. 2 is a diagram showing an example of the configuration of an electronic control system S. The electronic control system S is made up of a plurality of ECUs 20 and an in-vehicle network (NW1 to NW3) that connects these. Fig. 2 shows eight ECUs (ECU20a to ECU20h) as an example, but the electronic control system S is naturally made up of any number of ECUs. In the following explanation, when describing a single or a plurality of electronic control devices as a whole, they will be described as ECU20 or each ECU20, and when describing each individual electronic control device specifically, they will be described as ECU20a, ECU20b, ECU20c, ....

[0028] In the case of FIG. 2, the ECUs 20 are connected to each other via the in-vehicle communication network or the like described in the explanation of FIG. 1(a) and FIG. 1(b).

[0029] The electronic control system S shown in FIG. 2 includes an integrated ECU 20a, an external communication ECU 20b, zone ECUs (20c, 20d), and individual ECUs (20e to 20h).

[0030] The integrated ECU 20a is an ECU that has a function of controlling the entire electronic control system S and also has a gateway function of mediating communication between the ECUs 20. The integrated ECU 20a is also called a gateway ECU (G-ECU) or a mobility computer (MC). The integrated ECU 20a may also be a relay device or a gateway device.

[0031] The external communication ECU 20b is an ECU having a communication unit that communicates with an external device provided outside the vehicle, for example, in each embodiment, the server device 30. The communication method used by the external communication ECU 20b is the wireless communication method or the wired communication method described in the explanation of FIG. In order to realize a plurality of communication methods, a plurality of external communication ECUs 20b may be provided. Also, instead of providing the external communication ECU 20b, the integrated ECU 20a may include the function of the external communication ECU 20b.

[0032] The zone ECUs (20c, 20d) are ECUs with a gateway function appropriately arranged according to the location and function of the individual ECUs described below. For example, the zone ECU 20c is an ECU having a gateway function that mediates communication between the individual ECUs 20e and 20f arranged at the front of the vehicle and other ECUs 20, and the zone ECU 20d is an ECU having a gateway function that mediates communication between the individual ECUs 20g and 20h arranged at the rear of the vehicle and other ECUs 20. The zone ECUs (20c, 20d) are sometimes called domain computers (DC). The individual ECUs 20e and 20f are connected to the zone ECU 20c via a network 2 (NW2), and the individual ECUs 20g and 20h are connected to the zone ECU 20d via a network 3 (NW3).

[0033] The individual ECUs (20e to 20h) can be configured with ECUs having any desired functions. For example, they can be drive system electronic control devices that control the engine, steering, brakes, etc., vehicle body electronic control devices that control meters, power windows, etc., information system electronic control devices such as navigation devices, or safety control system electronic control devices that perform control to prevent collisions with obstacles or pedestrians. Also, the ECUs may not be parallel to each other, but may be classified as master and slave. Depending on the functions realized by each individual ECU (20e to 20h), necessary sensors may be connected to each individual ECU (20e to 20h). For example, a speed sensor, an acceleration sensor, an angular velocity sensor, a temperature sensor, a seat sensor, and a voltmeter may be included, but are not limited to these. Furthermore, these sensors may be connected to the integrated ECU 20a or the zone ECUs (20c, 20d) instead of to each individual ECU (20e to 20h).

[0034] Each ECU 20 may be a physically independent electronic control device, or a virtualized electronic control device realized using virtualization technology. When each ECU 20 is realized by different hardware, it is sufficient that they are connected via a wired or wireless communication method, and when multiple virtualized electronic control devices are realized on the same hardware, it is sufficient that the virtualized electronic control devices are virtually connected to each other.

[0035] In the case of Fig. 1(a), the attack analysis device 10 is provided inside the electronic control system S, and is realized by an integrated ECU 20a or an individual ECU 20e, for example, as shown in Fig. 2. When realized by an individual ECU 20e, the individual ECU 20e may be an ECU dedicated to the attack analysis device 10. In the case of Fig. 1(c), the attack analysis device 10 is provided outside the electronic control system S, and is realized by a server device 30 as shown in Fig. 2. In this case, the server device 30 receives the security log transmitted via the external communication ECU 20b.

[0036] Each ECU 20 has a security sensor, and the security sensor generates a security log when it detects an abnormality that occurs in the ECU 20 or in the network connected to the ECU 20. Details of the security log will be described in the next section. It is not necessary for all the ECUs 20 to include a security sensor.

[0037] (3)Security log details FIG. 3 is a diagram showing the contents of the security log generated by the security sensor of the ECU 20. As shown in FIG.

[0038] The security log has fields of an ECU ID indicating identification information of an ECU in which a security sensor is mounted, a sensor ID indicating identification information of a target monitored by the security sensor, an event ID indicating identification information of an event related to an abnormality detected by the security sensor, a counter indicating the number of times the event has occurred, a timestamp indicating the time when the event occurred, and context data indicating details of the output of the security sensor. The security log may further have a header storing information indicating the version of a protocol and the state of each field.

[0039] According to the specifications defined by AUTOSAR (AUTomotive Open System ARchitecture), IdsM Instance ID corresponds to ECU ID, Sensor Instance ID corresponds to sensor ID, Event Definition ID corresponds to event ID, Count corresponds to counter, Timestamp corresponds to timestamp, Context Data corresponds to context data, Protocol Version corresponds to Protocol Header corresponds to header.

[0040] The context data in Fig. 3 is data that is collected and stored when an anomaly is detected, such as information related to the frame or network in which the anomaly occurred, or other information related to the anomaly. The counter, timestamp, and header in Fig. 3 are also similar in that they collect and store information related to the anomaly, so they are also included in the "context data".

[0041] An example of data included in the context data in Fig. 3 is communication direction information indicating the source and / or destination of a communication such as a packet in which an abnormality has been detected. The communication direction information does not necessarily need to indicate the very end of the communication, and the source or destination may indicate a relay position. Examples of communication direction information include an IP address, a MAC address, a message ID, a CAN ID, and a port number. Other examples of context data include the sensor rule type, error type, severity, communication content, and identifiers and their contents indicating detected files, processes, software, etc. Other examples include filtering information of output results, mileage, time, power status, vehicle status information, and security sensor version. How each context data is used will be explained in each embodiment.

[0042] Although Fig. 3 shows an example of an abnormality log that is generated when an abnormality occurs (for example, when an event is successful), a normal log that is generated when no abnormality occurs (for example, when an event is successful) may have the same specifications as Fig. 3. In that case, for example, an abnormality log and a normal log can be distinguished by using different event IDs for when an abnormality occurs and when an event is successful. Also, by setting a flag indicating the presence or absence of context data in the header, the abnormality log and the normal log can be distinguished by checking the flag.

[0043] Also, while FIG. 3 shows a security log generated by the physically independent ECU 20, it may be a security log generated by a virtual ECU.

[0044] The security log generated by the security sensor is called SEv, and the narrowed down accurate security log is called QSEv. For example, the security sensor of the individual ECU (20e to 20h) in Fig. 2 generates SEv and reports it to an intrusion detection system manager (IdsM) not shown, and when the SEv passes through a certification filter in the IdsM and satisfies a specified criterion, it is transmitted from the intrusion detection reporter to the outside of the vehicle as QSEv. The security log in this embodiment is a concept that includes both SEv and QSEv.

[0045] In addition, the security log in each embodiment may be a log generated by a function called in-vehicle Security Information and Event Management (SIEM), which collects and manages information regarding events that occur within an electronic control system.

[0046] 2. Embodiment (1) Configuration of Attack Analysis Device 10 The configuration of the attack analysis device 10 will be described with reference to Fig. 4. The attack analysis device 10 includes a log acquisition unit 101, an attack / anomaly relationship information storage unit 102, an attack estimation unit 103, an attack estimation accuracy analysis unit 104, a context data related information storage unit 105, a reference attack element information estimation unit 106, and an output unit 107.

[0047] The log acquisition unit 101 "acquires" a security log indicating an abnormality detected in the electronic control system S and the location within the electronic control system S where the abnormality was detected. For example, when the security log of Fig. 3 is received, the type of abnormality is indicated in the event ID and context data, and the location where the abnormality was detected is indicated in the ECU ID and sensor ID. Note that the sensor ID may be evaluated as indicating the type of abnormality, instead of indicating the location where the abnormality was detected. Here, "obtain" includes not only obtaining by receiving from another device or block, but also obtaining by generating by oneself.

[0048] The attack / anomaly relationship information storage unit 102 stores an attack / anomaly relationship table (corresponding to "attack / anomaly relationship information") that indicates the relationship between cyber attacks and anomalies that occur in the electronic control system S. More specifically, the attack / anomaly relationship table indicates the relationship between predicted attack information that indicates attacks that the electronic control system S may be subjected to, predicted anomaly information that indicates anomalies that are predicted to occur when an attack is received, and predicted anomaly position information that indicates the position in the electronic control system where the predicted anomaly will occur.

[0049] FIG. 5 is a diagram for explaining an attack-anomaly relationship table used in each embodiment. The attack / anomaly relationship table shown in FIG. 5 indicates, for each type of cyber-attack (attacks A to Z) (corresponding to "predicted attack information"), anomalies predicted to occur when the electronic control system S is subjected to a cyber-attack (corresponding to "predicted anomaly information") and the locations where the predicted anomalies will occur (corresponding to "predicted anomaly location information"). When subjected to a cyber-attack, it is expected that, for example, multiple anomalies will occur at one or multiple locations. Therefore, it is preferable that the attack / anomaly relationship table indicates a combination of multiple anomalies that will occur when subjected to an attack and the locations where the anomalies occur.

[0050] In FIG. 5, the predicted attack information includes predicted attack element information consisting of attack stages, weights, and attack paths in addition to the type of cyber attack (attacks A to Z). The attack path is composed of the assumed starting point of the attack, intermediate points, and target points of the attack in the event of the cyber attack. However, this is only one example. For example, it may be only the starting point of the attack, only the target points of the attack, or only the attack path consisting of the starting point of the attack and the target points of the attack. The attack stage indicates the stage of invasion of an attack on the electronic control system S. Specifically, the stages of invasion are classified into the following categories, in order from least to most invasive: investigation, initial intrusion, infrastructure construction, internal intrusion, and goal accomplishment. For goal accomplishment and attack, the content of the purpose, the target of the attack, or the manner in which the attack is carried out may be specified. For example, subcategories such as springboard attack, information exploitation, DoS attack, and unauthorized control may be added. Weights are set for each attack type, and are set based on indicators such as whether the attack type occurs frequently, whether it is an attack that affects important locations, whether it is an attack currently occurring on the own vehicle or another vehicle, etc.

[0051] Since the attack information output by the output unit 107 described below is information estimated corresponding to the predicted attack information in the attack / anomaly relationship table, it is sufficient to use an attack / anomaly relationship table having predicted attack information consisting of element information that is desired to be included in the attack information.

[0052] 5, the predicted anomaly information is shown to include anomalies A to D. The predicted anomaly information is predicted information corresponding to an anomaly indicated by an event ID in the security log.

[0053] 5 further shows sensors a to d and 0x01 to 0x03 immediately below them as predicted abnormality position information. The predicted abnormality position information is prediction information corresponding to the sensor type indicated by the sensor ID in the security log and the ECU type indicated by the ECU ID in the security log.

[0054] In FIG. 5, the predicted abnormality position, the attack starting point position, the relay position, and the attack target position, other than the sensor type, use identifiers indicated by hexadecimal numbers, and each identifier indicates a position. In addition, the position corresponding to the identifier may be a specific position or an abstract position. Examples of specific positions include the type of each ECU 20 and the type of security sensor. Examples of the type of each ECU 20 can be determined as follows: 0x00 is external, 0x01 is external communication ECU 20b, 0x02 is integration ECU 20a, 0x03 is zone ECU 20c, and 0x04 is ECU 20e. Examples of abstract positions include the hierarchy in which each ECU 20 exists, the network to which each ECU 20 is connected, and the functions and characteristics of the ECU 20. Note that 0xFF means null, that is, no match.

[0055] In FIG. 5, for example, in the case of a cyber-attack of attack type A, it is predicted that in the electronic control system S, an abnormality A will occur in the sensor a of the external communication ECU 20b, and an abnormality C and an abnormality D will occur in the external communication ECU 20b. Furthermore, attack A is the initial intrusion stage, the weight is 2, the attack starting point of attack A is outside the electronic control system S, there is no relay position, and the attack target position is the external communication ECU 20b. Note that the attack starting point may be a position inside the electronic control system S, or may be outside the electronic control system S. The attack starting point being outside the electronic control system S refers to a case where a cyber-attack is received from outside the vehicle.

[0056] The attack / anomaly relationship table in Figure 5 has a table format, but any format of database is acceptable. The name of the attack / anomaly relationship table is arbitrary. For example, the attack / anomaly relationship table may be called a pattern matching table (PMT) or anomaly detection pattern.

[0057] The attack / anomaly relationship table can create / generate a pattern of anomaly occurrence by simulating which security sensor of which ECU 20 will detect an anomaly in which order in the event of an attack, based on the arrangement of the ECUs 20 constituting the electronic control system S, the connection relationship of the ECUs 20 (also called network topology), and the arrangement of the security sensors provided in the ECUs 20. Furthermore, the table may be created / generated based on information regarding the monitoring targets of the security sensors and the rules for the monitoring. However, the creation and generation of the attack-anomaly relationship table is not limited to this method. For example, AI or machine learning may be used. Also, the table may be generated using anomaly occurrence patterns of security sensors in past attacks.

[0058] Fig. 6 is another example of the attack-anomaly relationship table. The attack-anomaly relationship table in Fig. 5 shows only the patterns of anomalies that occur when an attack occurs and the positions where the anomalies occur, but may also include further information or conditions. For example, attack A has information on the order in which anomalies occur. The Arabic numbers under the circles indicate the order in which anomalies occur, and in Figure 6, anomalies occur in the order of anomaly A, anomaly C, and anomaly D. For example, attack B is provided with information on the possibility (confidence) and probability of an anomaly occurring. The numbers indicate the probability of an anomaly occurring, and in Figure 6, it is shown that the probability that anomaly A occurs in sensor a is 50%, and the probability that anomaly A occurs in sensors c and d is 100%. For example, information on the number of times an anomaly occurs is provided for attack C. The Roman numerals under the circles indicate the number of times an anomaly occurs, and in Fig. 6, it is shown that anomaly A occurs once in sensor b, once in sensor c, and three times in sensor d. For example, attack D has information on the conditions for anomaly occurrence. Figure 6 shows that anomaly A that satisfies condition 1 occurs in sensor a, anomaly A that satisfies condition 2 occurs in sensor b, and anomaly A that satisfies condition 3 occurs in sensor c. Of course, two or more of these may be combined.

[0059] The attack estimation unit 103 estimates an attack that has been made on the electronic control system S based on the security log acquired by the log acquisition unit 101 and the attack / anomaly relationship table stored in the attack / anomaly relationship information storage unit 102 . For example, in Figure 5, three security logs are obtained. Security log 1: ECU ID=0x01, Sensor ID=a, Event ID=Abnormal A Security log 2: ECU ID=0x01, Sensor ID=null, Event ID=Abnormal C Security log 3: ECU ID=0x01, Sensor ID=null, Event ID=Abnormal D If so, it is presumed that Attack A occurred.

[0060] If there is no perfectly matching pattern in the attack-anomaly relationship table, the closest pattern may be selected and a matching degree indicating the degree of matching may be calculated. The matching degree refers to the degree of matching between the anomaly indicated by the security log and the anomaly indicated by the predicted anomaly information. For example, in FIG. 5, two security logs are acquired, Security log 1: ECU ID=0x02, Sensor ID=a, Event ID=Abnormal A Security log 2: ECU ID=0x02, Sensor ID=b, Event ID=Abnormal A In this case, the matching degree of attacks B and C is 1 / 3, while the matching degree of attack D is 2 / 3, so attack D is the closest pattern. Therefore, in this case, it is assumed that attack D was used, and 2 / 3 is output as the matching degree.

[0061] The attack estimation accuracy analysis unit 104 analyzes the estimation accuracy of the attack estimated by the attack estimation unit 103 "based on" the context data included in the security log acquired by the log acquisition unit 101. Specific context data used and a method for analyzing the estimation accuracy of the attack will be described in each embodiment described later. Here, "based on" includes not only the case where context data is directly used, but also the case where context data is indirectly used, i.e., the case where intermediate facts are inferred (or presumed) from context data and the inferred (or presumed) intermediate facts are used to analyze the accuracy of the attack estimation.

[0062] The context data related information storage unit 105 stores the context data related information. The context data related information is information used to estimate the reference attack element information, which is the attack element information related to the context data, based on the context data in the reference attack element information estimation unit 106 described later. The context data related information may be, for example, a table that links the context data with the reference attack element information, or a formula that uses the context data as an input value. Specific examples of the context data related information will be described in the following embodiments.

[0063] The reference attack element information estimation unit 106 estimates reference attack element information, which is attack element information related to context data, using the context data related information stored in the context data related information storage unit 105 based on the context data of the security log acquired by the log acquisition unit 101. The reference attack element information is information corresponding to element information included in the predicted attack information, for example. The context data and context data related information specifically used in the reference attack element information estimation unit 106 will be described in each embodiment below.

[0064] When the reference attack element information estimation unit 106 is provided, the attack estimation accuracy analysis unit 104 analyzes the estimation accuracy of the attack estimated by the attack estimation unit 103 based on the reference attack element information estimated by the reference attack element information estimation unit 106 .

[0065] In addition, the context data related information storage unit 105 and the reference attack element information estimation unit 106 are optional components in this embodiment. In other words, when the attack estimation accuracy analysis unit 104 directly uses the context data of the security log to analyze the attack estimation accuracy, these components are not required.

[0066] The output unit 107 outputs "attack information" indicating the attack estimated by the attack estimation unit 103, and "estimated accuracy information" indicating the estimated accuracy of the attack analyzed by the attack estimation accuracy analysis unit 104. The attack information may be all or a part of the information contained in the predicted attack information in the attack-anomaly relationship table. In addition, the attack information may be output together with the matching degree and other related information. Where: "Attack information" may be any information related to an attack, such as the type or category of attack, the attack path such as the starting point or target of the attack, or the damage caused by the attack. The "estimated accuracy information" may directly or indirectly indicate the estimated accuracy, and may be expressed in any manner, such as numerical values, symbols, words, sentences, etc.

[0067] (2) Specific examples of analysis by the attack estimation accuracy analysis unit 104 (a) Example 1: Analysis using consistency between communication direction information and attack paths The context data may store information on the source and destination of the frame in which an anomaly was detected. Furthermore, the attack information obtained as a result of the attack estimation may include the attack path consisting of the starting point of the attack and the target of the attack. Since all of this information allows the flow from the source of the attack to the target of the attack to be understood, if this information is consistent and not contradictory, it can be said that the accuracy of the attack estimation is high. This embodiment is an example of analyzing the accuracy of the attack estimation by utilizing this feature. The following will be described with reference to FIG. 7.

[0068] In this embodiment, the attack information output as a result of the attack estimation includes an attack path consisting of the attack starting point and the attack target. For example, when attack D is estimated using the attack-anomaly relationship table in Fig. 5, the attack information includes attack element information such as attack D as the attack type, internal intrusion as the attack stage, 1 as the weight, and attack starting point location 0x01, relay location 0x03, and attack target location 0x02 as the attack path, as shown in Fig. 7(a).

[0069] In this embodiment, the context data includes communication direction information that allows the source and / or destination to be estimated. For example, as shown in Fig. 7(b), the context data of the security log output by the CAN NIDS includes CAN ID=001 and CAN bus=A.

[0070] Here, the CAN ID is identification information that indicates the type of CAN frame in which an abnormality has occurred, so if the CAN ID is known, the ECU that transmitted the CAN frame can be identified. Therefore, in this embodiment, a table that describes the correspondence between the CAN ID and the identifier of the ECU that transmits the CAN ID, as shown in Fig. 7(c), is stored as context data related information in the context data related information storage unit 105. The reference attack element information estimation unit 106 uses this table to estimate the identifier 0x01, which is the reference attack element information, from the context data CAN ID=001.

[0071] The attack estimation accuracy analysis unit 104 analyzes the estimation accuracy of the attack information in Fig. 7(a) based on the identifier 0x01, which is the reference attack element information. Specifically, the attack estimation accuracy analysis unit 104 judges whether the reference attack element information is included in the attack path. In this embodiment, since the identifier 0x01 is included in the attack starting point position of the attack path of the attack information in Fig. 7(a), it is judged that there is no contradiction and the contents of the attack information and the context data are consistent, and the estimation accuracy of the attack is analyzed to be 100% matching. Based on the above, the output unit 107 outputs a match rate of 100% as estimated accuracy information in FIG. 7(d) in addition to the attack information in FIG. 7(a).

[0072] The above example uses one security log, but multiple security logs may be used to analyze the accuracy of attack estimation. For example, if three security logs are used to estimate an attack, reference attack element information is estimated for each of the context data of the three security logs, and it is determined whether each reference attack element information is included in the attack path, and the degree of match is calculated. For example, if there is no contradiction between the attack information and the context data for two security logs and they are consistent, the degree of match can be analyzed as 67%.

[0073] In this embodiment, the CAN ID is used as the context data, but other communication direction information may be used. For example, an IP address or a MAC address may be used. In addition, header information such as a source message ID for MAC authentication, a firewall, TLS verification, and Ethernet-NIDS may be used.

[0074] According to this embodiment, since the communication direction information that can estimate the source and / or destination is used as context data and the consistency with the attack path is analyzed, the side that uses the attack estimation result can use different attack information depending on the estimation accuracy. For example, attack information with high estimation accuracy can be used preferentially.

[0075] (b) Example 2: Analysis using consistency between communication direction information and attack stages The context data may store information on the source and destination of a frame in which an anomaly has been detected. The source and destination information is closely related to the attack stage. Furthermore, the attack information obtained as a result of the attack estimation may include the attack stage. In other words, if the reference attack stage estimated from the context data matches the attack stage obtained as a result of the attack estimation, it can be said that the attack estimation accuracy is high. This embodiment is an example of analyzing the attack estimation accuracy by utilizing this feature. The following will be described with reference to FIG. 8.

[0076] In this embodiment, the attack information output as a result of the attack estimation includes the attack stage. For example, if attack D is estimated using the attack-anomaly relationship table in Fig. 5, the attack information includes attack element information such as attack D as the attack type, internal intrusion as the attack stage, 1 as the weight, and attack origin location 0x01, relay location 0x03, and attack target location 0x02 as the attack path, as shown in Fig. 8(a).

[0077] In this embodiment, the context data includes communication direction information that allows the source and / or destination to be estimated. For example, as shown in Fig. 8(b), the context data of the security log output by the CAN NIDS stores CAN ID=001.

[0078] Here, since the CAN ID is identification information indicating the type of CAN frame in which an abnormality has occurred, if the CAN ID is known, the function of the ECU using the CAN frame can be specified. Also, if the function of the ECU is known, the possible attack stages can be narrowed down in light of the function of the ECU and its location on the network. Therefore, in this embodiment, the context data related information storage unit 105 stores, as context data related information, a table describing the correspondence between the CAN ID as shown in FIG. 8(c), the function of the ECU using the CAN frame of that CAN ID, and the attack stage (corresponding to the "reference attack stage") in which the ECU having that function may be involved. The reference attack element information estimation unit 106 uses this table to estimate that the reference attack stage is an internal intrusion from the context data CAN ID=001.

[0079] The attack estimation accuracy analysis unit 104 analyzes the estimation accuracy of the attack information in Fig. 8(a) based on the reference attack stage, which is the reference attack element information. Specifically, the attack estimation accuracy analysis unit 104 judges whether the attack stage matches the reference attack stage. In this embodiment, since the attack stage in Fig. 8(a) and the reference attack stage in Fig. 8(c) are both internal intrusions and match, it is judged that the contents of the attack stages are consistent without contradictions, and the attack estimation accuracy is analyzed to be 100% consistent. Based on the above, the output unit 107 outputs a match rate of 100% as estimated accuracy information in FIG. 8(d) in addition to the attack information in FIG. 8(a).

[0080] In this case as well, as explained in the first embodiment, the accuracy of attack estimation may be analyzed using multiple security logs.

[0081] In this embodiment, the CAN ID is used as the context data, but other communication direction information may be used. For example, an IP address or a MAC address may be used. In addition, header information such as a source message ID for MAC authentication, a firewall, TLS verification, and Ethernet-NIDS may be used.

[0082] In the above example, when the attack estimation result includes the attack stage, the accuracy of the attack estimation is estimated using the communication direction information of the context data. However, the context data used to estimate the accuracy of the attack estimation including the attack stage is not limited to the communication direction information. For example, the accuracy of the attack estimation including the attack stage may be estimated using an identifier indicating software or a process in which an abnormality such as an error has occurred among various data of the above-mentioned context data. This is based on the assumption that a specific attack stage may be closely related to an abnormality in software or a process of a specific function. For example, it is assumed that an attack stage of unauthorized vehicle control may be closely related to an error in software of a vehicle control function in a control ECU. Therefore, when the attack estimation accuracy analysis unit 104 obtains the result of the attack estimation including the attack stage, the attack estimation accuracy analysis unit 104 may determine whether or not an abnormality in software or a process of a specific function predetermined as related to the attack stage is indicated in the context data. This determination can be performed by comparing the software or process in which the abnormality indicated in the context data occurs with the software or process of the specific function predetermined as related to the attack stage. If an abnormality in the software or process of the specific function is indicated in the context data, the attack estimation accuracy analysis unit 104 estimates that the accuracy of the attack estimation is high. If an abnormality in the software or process of the specific function is not indicated in the context data, the attack estimation accuracy analysis unit 104 does not estimate that the accuracy of the attack estimation is high. For such estimation, a list in which identifiers indicating software or processes of specific functions in a specific ECU are linked to attack stages may be prepared in advance as context data related information. In addition, as the communication direction information, the context data may indicate the execution of a specific software or process. For example, a CAN ID as the communication direction information may indicate the execution of a specific software or process that performs or uses the communication of this CAN ID. In this case, the reference attack element estimation unit 106 can estimate the reference attack stage by using the execution of a specific software or process, the function of the specific software or process, and an attack stage that may be related to the specific software or process having that function as the context data related information.

[0083] According to the first aspect of this embodiment, a reference attack stage is estimated using communication direction information that can estimate the source and / or destination as context data, and the consistency with the attack stage obtained as a result of the attack estimation is analyzed, so that the party using the attack estimation result can use different attack information depending on the estimation accuracy. According to a second aspect of this embodiment, the context data indicates software or a process in the electronic control system where an abnormality has occurred. When the attack estimation accuracy analysis unit 104 acquires attack information including an attack stage obtained by estimating an attack, the attack estimation accuracy analysis unit 104 analyzes the accuracy of the attack estimation based on whether or not an abnormality in software or a process of a specific function that is predetermined as being related to the attack stage is indicated in the context data. Therefore, a party using the attack estimation result can use different attack information depending on the estimation accuracy.

[0084] (c) Example 3: Analysis using consistency between communication volume or error type and attack stage The context data may store anomalies related to communication volume and various types of errors. These pieces of information may indicate anomalies detected by cyber attacks, and in this case are closely related to the attack stage. Furthermore, the attack information obtained as a result of the attack estimation may include the attack stage. In other words, if the reference attack stage estimated from the context data matches the attack stage obtained as a result of the attack estimation, it can be said that the attack estimation accuracy is high. This embodiment is an example of analyzing the attack estimation accuracy by utilizing this feature. The following will be described with reference to FIG. 9A.

[0085] In this embodiment, the attack information output as a result of the attack estimation includes the attack stage. For example, when attack D is estimated using the attack-anomaly relationship table in Fig. 5, the attack information includes attack element information of attack type D, attack stage internal intrusion, weight 1, and attack route starting point location 0x01, relay location 0x03, and attack target location 0x02, as shown in Fig. 9A(a).

[0086] In this embodiment, the context data includes information on the communication volume and the type of error. For example, as shown in FIG. 9A(b), an OTA update error (update not executed) is stored.

[0087] Here, since the OTA update error indicates which stage of the update the error is at, the attack stage can be estimated. Also, abnormalities in communication volume are particularly related to DoS attacks. Therefore, in this embodiment, a table is stored in the context data related information storage unit 105 as context data related information, which describes the correspondence between context data such as that shown in FIG. 9A(c) and the attack stage to which the context data may be related (corresponding to the "reference attack stage"). The reference attack element information estimation unit 106 uses this table to estimate that the reference attack stage is an internal intrusion from the OTA update error (update not executed).

[0088] The attack estimation accuracy analysis unit 104 analyzes the estimation accuracy of the attack information in Fig. 9A(a) based on the reference attack stage, which is the reference attack element information. Specifically, the attack estimation accuracy analysis unit 104 judges whether the attack stage matches the reference attack stage. In this embodiment, since the attack stage in Fig. 9A(a) and the reference attack stage in Fig. 9A(c) are both internal intrusions and match, it is judged that the contents of the attack stages are consistent without contradictions, and the attack estimation accuracy is analyzed to be 100% consistent. Based on the above, the output unit 107 outputs a degree of match of 100% as the estimated accuracy information of FIG. 9A(d) in addition to the attack information of FIG. 9A(d).

[0089] According to this embodiment, the reference attack stage is estimated using anomalies in communication volume and various types of errors as context data, and the consistency with the attack stage obtained as a result of the attack estimation is analyzed, so that the party using the attack estimation result can use different attack information depending on the estimation accuracy.

[0090] In this embodiment, it is determined whether the reference attack stage estimated from the context data matches the attack stage obtained as a result of the attack estimation. However, as a variation of this embodiment, it may be determined whether the reference attack stage estimated from a combination of the security event type and the context data matches the attack stage obtained as a result of the attack estimation.

[0091] The security event type can be identified from the event ID stored in the security log event ID in FIG. Then, for example, as the context data related information of Figure 9A(c), a table is used that describes the relationship between the combination of security event type and context data and the attack stage (corresponding to the "reference attack stage") that may be related to that combination, as shown in Figure 9B.

[0092] According to this modified example, a reference attack stage is estimated from a combination of a security event type and context data, and the estimation accuracy of attack information is analyzed based on the estimated attack stage, so that more accurate estimation accuracy can be obtained.

[0093] (d) Example 4: Analysis using consistency of sensor firing order Context data may store time information related to the time when a security log was generated or transmitted. From the time information, it is possible to estimate the order of anomalies detected by a cyber attack. Further, the attack information obtained as a result of attack estimation may include an attack path consisting of the starting point of the attack and the target of the attack, but the attack path includes the order of occurrence of anomalies, which is information related to the passage of time. That is, when the time information estimated from the context data matches the order of occurrence of anomalies estimated from the attack path obtained as a result of attack estimation, it can be said that the estimation accuracy of the attack is high. This embodiment is an example of analyzing the estimation accuracy of an attack using this feature. This will be described below with reference to FIG. 10.

[0094] In this embodiment, it is assumed that the attack information output as a result of attack estimation includes an attack path consisting of the starting point of the attack and the target of the attack. For example, when attack D is estimated using the attack-anomaly relationship table in FIG. 5, the attack information includes, as shown in FIG. 10(a), attack D as the attack type, internal intrusion as the attack stage, 1 as the weight, and the attack element information of the attack starting point position 0x01, relay position 0x03, and attack target position 0x02 as the attack path.

[0095] In this embodiment, it is assumed that the time stamp of the security log in FIG. 3 includes "time information" related to the time when the security log was generated or transmitted. For example, as shown in FIG. 10(b), it is assumed that t1, t2, t3 (t1 < t2 < t3) are stored in each of the time stamps of three security logs. Also, it is assumed that 0x01, 0x01, and 0x02 are stored in the ECU IDs of the three security logs, respectively. Here, the "time information" may be any information that can estimate the time when the security log was generated or transmitted, and examples include a time stamp, the time when processing was performed, a counter, a travel distance, and the number of startups.

[0096] In these security logs, the information of the ECU in which the abnormality occurred is associated with the time when the abnormality occurred, so by rearranging these security logs in time, it is possible to estimate the reference abnormality occurrence order, which is the order in which the abnormalities indicated in the security logs occurred. Therefore, as shown in Fig. 10(c), the reference attack element information estimation unit 106 of this embodiment can estimate the reference abnormality occurrence order, which indicates which abnormality occurred in which ECU and in what order, by associating the time information with the ECU in which the abnormality occurred and rearranging the logs in the order in which the abnormalities occurred. In the case of Fig. 10(c), the reference abnormality occurrence order is 0x01, 0x01, 0x02.

[0097] The attack estimation accuracy analysis unit 104 analyzes the estimation accuracy of the attack information in FIG. 10(a) based on the reference anomaly occurrence order, which is the reference attack element information. Specifically, the attack estimation accuracy analysis unit 104 compares the anomaly occurrence order estimated from the attack path with the reference anomaly occurrence order estimated from the time information. In this embodiment, the attack path in FIG. 10(a) is compared with the reference anomaly occurrence order in FIG. 10(c). In FIG. 10, an anomaly is not detected at the relay position, but the ECU where the anomaly occurred and the order in which the anomaly occurred at the attack starting point position and the attack target position are consistent, so the estimation accuracy of the attack is analyzed to be 66.7%. Based on the above, the output unit 107 outputs the match rate of 66.7% as the estimated accuracy information of FIG. 10(d) in addition to the attack information of FIG. 10(a).

[0098] In this embodiment, the time stamp of the security log is used, but other information related to time may be used. For example, data that allows estimation of time or the sequence of passage of time, such as the processing time of the monitored object stored in the context data, a counter value, a mileage, or the number of times the vehicle has been started, may be used as time information.

[0099] According to this embodiment, time information is used as context data and the consistency with the attack path obtained as a result of the attack estimation is analyzed, so that the party using the result of the attack estimation can use different attack information depending on the estimation accuracy.

[0100] In this embodiment, it is determined whether the order of anomaly occurrence estimated from the attack path matches the order of reference anomaly occurrence estimated from the context data. However, if information on the order of anomaly occurrence is provided, such as attack A in the attack-anomaly relationship table of FIG. 6, it may be determined whether the order of anomaly occurrence in the attack-anomaly relationship table matches the order of reference anomaly occurrence estimated from the context data.

[0101] For example, if the target of a security sensor monitoring is an input side function of a certain ECU, or an internal function of the same ECU, it is expected that the former will detect an abnormality earlier, taking into account the intrusion path of a cyber attack. Therefore, it is possible to provide information on the order in which an abnormality occurs, such as attack A in the attack-anomaly relationship table.

[0102] Then, the attack estimation accuracy analysis unit 104 may compare the anomaly occurrence order in the attack-anomaly relationship table with the reference anomaly occurrence order estimated from the time information.

[0103] (e) Example 5: Analysis using blacklists / whitelists The context data may store information about the sender of the frame in which an anomaly was detected. However, if this sender is included in a blacklist or not included in a whitelist, there is a high possibility that this sender is being used in a cyber attack, and attack information obtained as a result of an attack estimation including this sender can be said to have high estimation accuracy. This embodiment is an example of analyzing the estimation accuracy of an attack by utilizing this feature. The following will be described with reference to FIG. 11A.

[0104] In this embodiment, the attack information output as a result of the attack estimation includes an attack path consisting of the attack starting point and the attack target. For example, when attack D is estimated using the attack-anomaly relationship table in Fig. 5, the attack information includes attack element information such as attack D as the attack type, internal intrusion as the attack stage, 1 as the weight, and attack starting point location 0x01, relay location 0x03, and attack target location 0x02 as the attack path, as shown in Fig. 11A(a).

[0105] In this embodiment, the context data includes communication direction information that allows the source and / or destination to be estimated. For example, as shown in FIG. 11A(b), the context data of the security log includes IP address=xxx.

[0106] Here, since the IP address is identification information indicating the address of a device where an abnormality has occurred, for example, an ECU, the ECU can be identified by knowing the IP address. Therefore, in this embodiment, a table describing the correspondence between IP addresses and ECU identifiers as shown in Fig. 11A(c) is stored as context data related information in the context data related information storage unit 105. The reference attack element information estimation unit 106 uses this table to estimate the identifier 0x01, which is the reference attack element information, from the context data, IP address=xxx.

[0107] 11A(c), a blacklist, which is information that lists dangerous transmission sources, is stored in the context data related information storage unit 105. The blacklist is downloaded from a server device that periodically supplies the blacklist, for example, and stored.

[0108] The attack estimation accuracy analysis unit 104 analyzes the estimation accuracy of the attack information in FIG. 11A(a) based on the identifier 0x01, which is the reference attack element information. Specifically, the attack estimation accuracy analysis unit 104 judges whether the attack path includes the reference attack element information, and if the attack path includes the reference attack element information, judges whether the source information is included in the blacklist or whitelist. In this embodiment, since the attack path in FIG. 11A(a), specifically the attack starting point position, includes the identifier 0x01, it is judged whether the device with the IP address xxx corresponding to the identifier 0x01, which is the reference attack element information, is included in the blacklist. In FIG. 11A, since it is included in the blacklist, it is analyzed that the estimation accuracy of the attack is high. In view of the above, the output unit 107 outputs information indicating that the estimation accuracy of the attack is high as estimation accuracy information of FIG. 11A(d), in addition to the attack information of FIG. 11A(a).

[0109] Although the above example uses a blacklist, a whitelist may be used instead. In this case, the attack estimation accuracy analysis unit 104 analyzes that the attack estimation accuracy is high if the attack is not included in the whitelist. In addition, the source devices listed on the blacklist or whitelist may be devices installed outside the vehicle, which is a moving body. Examples of such devices include servers at OEM centers and devices brought into the vehicle.

[0110] In this embodiment, the case where the source is included in the blacklist or not included in the whitelist has been described, but the present invention can also be applied to the case where the destination or relay location is included in the blacklist or not included in the whitelist. In other words, the communication direction information may be included in the attack starting point or relay location of the attack path.

[0111] 5 used in this embodiment assumes an attack path from the outside to the inside of the electronic control system S, but may also include a path from the inside to the outside of the electronic control system S that is assumed after the attack objective is partially achieved. For example, when the attack stage is objective achievement (information exploitation), the attack path may be up to the transmission of the exploited information to an external device.

[0112] According to this embodiment, source information that can estimate the source is used as context data, and the consistency with the attack path is analyzed, and the accuracy of the attack estimation is analyzed by determining whether or not the source is included in the blacklist. Therefore, the party using the attack estimation result can use different attack information depending on the estimation accuracy.

[0113] In this embodiment, the estimation accuracy of the attack information is analyzed by comparing the reference attack element information obtained from the context data with the attack path, but the estimation accuracy of the attack information may be analyzed by a method that does not directly compare them. A modified example of this embodiment will be described below.

[0114] In this modified example, for example, when attack X is estimated using the attack-anomaly relationship table of FIG. 5, the attack information includes attack element information, as shown in FIG. 11B(a), such as attack type “attack X,” attack stage “purpose accomplishment (information acquisition),” weight “3,” and attack path “attack starting point location 0x02,” “relay location 0x04,” and “attack target location 0x03.” In this modification, it is assumed that IP address=xxx is stored in the context data in FIG. 11B(b).

[0115] In light of the fact that the attack stage in Fig. 11B(a) includes the accomplishment of a purpose (exploitation of information) and that the IP address indicated in the context data is included in the blacklist, the attack estimation accuracy analysis unit 104 analyzes that the accuracy of the attack estimation is high because the IP address indicated in the context data is consistent with the estimated result of the attack when it is assumed to be a device related to the cause or result of the accomplishment of the purpose. For example, it is possible that the IP address indicates a known malicious site and the security log including the IP address was generated as a result of sending the exploited information to the attacker.

[0116] (f) Example 6: Analysis using consistency between communication direction information and attack paths The context data may store information about the destination of the frame in which an anomaly was detected. However, if the vulnerability of this destination is an issue, it is highly likely that this destination is under cyber-attack, and attack information obtained as a result of attack estimation including this destination can be said to have high estimation accuracy. This embodiment is an example of analyzing the estimation accuracy of an attack by utilizing this feature. The following will be described with reference to FIG. 12.

[0117] In this embodiment, the attack information output as a result of the attack estimation includes an attack path consisting of the attack starting point and the attack target. For example, when attack D is estimated using the attack-anomaly relationship table in Fig. 5, the attack information includes attack element information such as attack D as the attack type, internal intrusion as the attack stage, 1 as the weight, and attack starting point location 0x01, relay location 0x03, and attack target location 0x02 as the attack path, as shown in Fig. 12(a).

[0118] In this embodiment, the context data includes communication direction information that allows the source and / or destination to be estimated. For example, as shown in FIG. 12(b), the context data of the security log includes an IP address of yyy.

[0119] Here, the IP address is identification information indicating the address of a device where an abnormality has occurred, for example, an ECU, so the ECU can be identified by knowing the IP address. Therefore, in this embodiment, a table describing the correspondence between IP addresses and ECU identifiers as shown in Fig. 12(c) is stored as context data related information in the context data related information storage unit 105. The reference attack element information estimation unit 106 uses this table to estimate the identifier 0x02, which is reference attack element information, from the context data IP address=yyy.

[0120] 12(c), a vulnerability information list that is information that lists devices that are vulnerable to cyber attacks is stored in the context data related information storage unit 105. The vulnerability information list is downloaded from a server device that periodically supplies the vulnerability information list and stored.

[0121] The attack estimation accuracy analysis unit 104 analyzes the estimation accuracy of the attack information in FIG. 12(a) based on the identifier 0x02, which is the reference attack element information. Specifically, the attack estimation accuracy analysis unit 104 judges whether the attack path includes the reference attack element information, and if the attack path includes the reference attack element information, judges whether the communication direction information is included in the vulnerability information list. In this embodiment, since the attack path in FIG. 12(a), specifically the attack target position, includes the identifier 0x02, it is judged whether the device with the IP address yyy corresponding to the identifier 0x02, which is the reference attack element information, is included in the vulnerability information list. In FIG. 12, since it is included in the vulnerability information list, it is analyzed that the estimation accuracy of the attack is high. In view of the above, the output unit 107 outputs information indicating that the estimation accuracy of the attack is high as estimation accuracy information of FIG. 12(d) in addition to the attack information of FIG. 12(a).

[0122] In this embodiment, the vulnerability of the destination is the problem, but the present invention can also be applied to the vulnerability of the source or intermediate location. In other words, the communication direction information may be included in the attack origin or intermediate location of the attack path.

[0123] In addition, in this embodiment, an example in which the context data is an IP address has been described, but other communication direction information such as a CAN ID may be used. However, the context data is not limited to communication direction information. For example, among the various data included in the above-mentioned context data, an identifier indicating software or a process in which an abnormality such as an error has occurred may be used. The vulnerability information list may include information listing vulnerable software or processes among software or processes in a vehicle, and devices such as ECUs in which the vulnerable software or processes are executed. These are based on the viewpoint that a cyber attack is assumed to be closely related to the execution of software or processes in a vehicle in which vulnerabilities are a problem. From this viewpoint, the software or process in which an abnormality has occurred indicated in the context data in this embodiment is one in which the occurrence of an abnormality is detected after the software or process is executed. The attack estimation accuracy analysis unit 104 may use the context data to determine whether or not vulnerable software or processes shown in the vulnerability information list have been executed in the estimated attack path. This determination can be performed by comparing the software or process in which an anomaly has occurred, shown in the context data, with the vulnerability information list. If the attack estimation accuracy analysis unit 104 determines that vulnerable software or processes shown in the vulnerability information list have been executed in the estimated attack path, it estimates that the estimation accuracy of the attack path is high. If it determines that they have not been executed in the estimated attack path, it does not estimate that the estimation accuracy of the attack path is high. Furthermore, as communication direction information, the context data may be information indicating the execution of a specific software or process. The vulnerability list described above can be created, for example, by identifying in advance specific software and processes in a vehicle that have been found to be potentially exploitable in attacks based on known vulnerability information, and listing the ECUs that execute the specific software and processes. For an attack path that includes an ECU that executes a specific software or process, if the context data indicates that the specific software or process was executed, the accuracy of the attack estimation is considered to be high. Examples of specific software or processes that are listed in the vulnerability information list include communications using a specific CAN ID if a vulnerability is discovered in communications using a specific CAN ID, or software or processes if a buffer overflow vulnerability is discovered in the software or process. If the vulnerability of the software or process is fixed by a software update or other means, the software or process can be removed from the vulnerability information list.

[0124] According to the first aspect of this embodiment, communication direction information is used as context data to analyze its consistency with the attack path, and the accuracy of the attack estimation is analyzed by determining whether it is included in the vulnerability information list. Therefore, the party using the attack estimation result can use different attack information depending on the estimation accuracy. According to a second aspect of this embodiment, the context data indicates software or a process in which an abnormality has occurred. The attack estimation accuracy analysis unit 104 uses the context data to determine whether vulnerable software or a process included in the vulnerability information list has been executed in the estimated attack path, and analyzes the accuracy of the attack estimation. The user of the attack estimation result can use different attack information depending on the estimation accuracy.

[0125] (g) Other Examples The above embodiment assumes that the estimated accuracy information resulting from the analysis by the attack estimation accuracy analysis unit 104 is output from the output unit 107 together with the attack information, and that the device or the like that receives them uses this as one of the indicators for determining how to use the attack information. However, the estimated accuracy information may be used to select attack information. In other words, when the estimated accuracy information of the attack information, which is the result of an attack being estimated by the attack analysis device 10, is equal to or lower than a predetermined degree of matching, the attack information may be discarded as an erroneous judgment, and the attack information may be output from the output unit 107 only when the estimated accuracy information is equal to or higher than the predetermined degree of matching.

[0126] (3) Operation of the Attack Analysis Device 10 Next, the operation of the attack analysis device 10 will be described with reference to Fig. 13. Fig. 13 not only shows an attack analysis method executed by the attack analysis device 10, but also shows the processing procedure of an attack analysis program that can be executed by the attack analysis device 10. The order of these processes is not limited to the order shown in Fig. 13. In other words, the order may be changed as long as there is no constraint such as a relationship in which a certain step utilizes the result of the previous step.

[0127] The attack analysis device 10 has an attack / anomaly relationship information storage unit 102 that stores an attack / anomaly relationship table that shows the relationship between predicted attack information that indicates attacks that the electronic control system may be subjected to, predicted anomaly information that indicates anomalies that are predicted to occur if the attack is received, and predicted anomaly position information that indicates the position within the electronic control system where the predicted anomaly will occur.

[0128] The log acquisition unit 101 of the attack analysis device 10 acquires a security log indicating an abnormality detected in the electronic control system S and the location within the electronic control system S where the abnormality was detected (S101). The attack estimation unit 103 estimates the attack that has been made on the electronic control system S based on the security log acquired in S101 and the attack / anomaly relationship table stored in the attack / anomaly relationship information storage unit 102 (S102). The attack estimation accuracy analysis unit 104 analyzes the estimation accuracy of the attack estimated in S102 based on the context data included in the security log acquired in S101 (S103). The output unit 107 outputs attack information indicating the attack estimated in S101 and estimated accuracy information indicating the estimated accuracy of the attack analyzed in S103 (S104).

[0129] (4) Summary As described above, according to the attack analysis device 10 of each embodiment, the estimated accuracy of an attack is analyzed using the context data contained in the security log, and the analysis result is output as estimated accuracy information, making it possible to use the results of attack estimation based on the accuracy of the estimated results of a cyber attack. Specifically, for example, the priority of using the results of attack estimation can be determined according to the accuracy of the attack estimation.

[0130] 3. Inventions understood from the present disclosure Based on the above embodiments (including examples and modifications), the present disclosure discloses the following inventions.

[0131] (Invention 1) An attack analysis device for analyzing attacks against an electronic control system (S) mounted on a moving object, a log acquisition unit (101) that acquires a security log indicating an abnormality detected in the electronic control system and a location within the electronic control system where the abnormality was detected; an attack / anomaly relationship information storage unit (102) for storing attack / anomaly relationship information indicating a relationship between predicted attack information indicating an attack that the electronic control system may receive, predicted anomaly information indicating an anomaly that is predicted to occur when the electronic control system receives the attack, and predicted anomaly position information indicating a position in the electronic control system where the predicted anomaly will occur; an attack estimation unit (103) for estimating an attack that the electronic control system has received based on the security log and the attack / anomaly relationship information; an attack estimation accuracy analysis unit (104) that analyzes the estimation accuracy of the attack based on context data included in the security log; and an output unit (107) that outputs attack information indicating the estimated attack and estimated accuracy information indicating the estimated accuracy of the attack. Attack analysis device (10).

[0132] (Invention 2) The method further includes a reference attack element information estimation unit (106) for estimating reference attack element information, which is element information of an attack related to the context data, based on the context data, The attack estimation accuracy analysis unit analyzes the estimation accuracy of the attack based on the reference attack element information. An attack analysis device according to invention 1.

[0133] (Invention 3) The attack information includes an attack path consisting of a starting point of the attack and a target of the attack, The context data is communication direction information that enables a source and / or a destination to be estimated, the attack estimation accuracy analysis unit analyzes the estimation accuracy of the attack based on whether the communication direction information is included in the attack path. An attack analysis device according to Invention 1 or Invention 2.

[0134] (Invention 4) The attack information includes an attack stage indicating an invasion stage of the attack, The context data is communication direction information that enables a source and / or a destination to be estimated, the reference attack element information estimation unit estimates, based on the context data, a reference attack stage indicating an invasion stage of an attack related to the communication direction information, as the reference attack element information; the attack estimation accuracy analysis unit analyzes the estimation accuracy of the attack based on whether the attack stage matches the reference attack stage; An attack analysis device according to any one of Inventions 1 to 3.

[0135] (Invention 5) The attack information includes an attack stage indicating an invasion stage of the attack, the context data is indicative of a software or process within the electronic control system in which the anomaly occurred; When the attack information including the attack stage is acquired, the attack estimation accuracy analysis unit analyzes the estimation accuracy of the attack based on whether or not an abnormality in software or a process of a specific function that is predetermined as being related to the attack stage is indicated in the context data. An attack analysis device according to any one of Inventions 1 to 4.

[0136] (Invention 6) The attack information includes an attack stage indicating an invasion stage of the attack, The context data is a communication amount or an error type, the reference attack element information estimation unit estimates, based on the context data, a reference attack stage indicating an invasion stage of an attack related to the communication volume or the error type, as the reference attack element information; the attack estimation accuracy analysis unit analyzes the estimation accuracy of the attack based on whether the attack stage matches the reference attack stage; An attack analysis device according to any one of Inventions 1 to 5.

[0137] (Invention 7) The attack information includes an attack path consisting of an attack origin and an attack target, the context data being time information relating to a time when the security log was generated or transmitted; The reference attack element information estimation unit estimates, as the reference attack element information, a reference anomaly occurrence order, which is an occurrence order of the anomalies indicated in the security log, based on the context data; the attack estimation accuracy analysis unit analyzes the estimation accuracy of the attack by comparing an anomaly occurrence sequence estimated from the attack path with the reference anomaly occurrence sequence; An attack analysis device according to any one of Inventions 1 to 6.

[0138] (Invention 8) The attack information includes an attack path consisting of a starting point of the attack and a target of the attack, The context data is communication direction information that enables a source and / or a destination to be estimated, the attack estimation accuracy analysis unit, when the communication direction information is included in the attack path, analyzes the estimation accuracy of the attack based on whether the communication direction information is included in a blacklist or a whitelist. An attack analysis device according to any one of Inventions 1 to 7.

[0139] (Invention 9) The context data indicates a communication partner of a communication with an external device when the abnormality detected in the electronic control system is an abnormality caused by communication with an external device of the electronic control system, The attack information includes an attack stage indicating an invasion stage of the attack, When the attack stage matches a predetermined attack stage, the attack estimation accuracy analysis unit analyzes the estimation accuracy of the attack based on whether the communication counterpart is included in a blacklist. An attack analysis device according to any one of Inventions 1 to 8.

[0140] (Invention 10) The attack information includes an attack path consisting of a starting point of the attack and a target of the attack, The context data is communication direction information and destination information that can estimate a source and / or a destination, the attack estimation accuracy analysis unit, when the communication direction information is included in the attack path, analyzes the estimation accuracy of the attack based on whether the communication direction information is included in a vulnerability information list. An attack analysis device according to any one of Inventions 1 to 9.

[0141] (Invention 11) The attack information includes an attack path, the context data is indicative of the software or process in which the anomaly occurred; The analysis of the attack estimation accuracy by the attack estimation accuracy analysis unit includes: determining, using the context data, whether a vulnerable software or process indicated in the vulnerability information list was executed in the attack path; An attack analysis device according to any one of Inventions 1 to 10.

[0142] (Invention 12) The attack analysis device is provided outside the moving body. An attack analysis device according to any one of Inventions 1 to 11.

[0143] (Invention 13) The attack analysis device is mounted on a moving object. An attack analysis device according to any one of Inventions 1 to 11.

[0144] (Invention 14) An attack analysis method executed by an attack analysis device for analyzing attacks against an electronic control system (S) mounted on a moving object, comprising: The attack analysis device includes: an attack / anomaly relationship information storage unit (102) for storing attack / anomaly relationship information indicating a relationship between predicted attack information indicating an attack that the electronic control system may receive, predicted anomaly information indicating an anomaly that is predicted to occur when the electronic control system receives the attack, and predicted anomaly position information indicating a position in the electronic control system where the predicted anomaly will occur; The attack analysis method includes: Obtaining a security log indicating an abnormality detected in the electronic control system and a location within the electronic control system where the abnormality was detected (S101); An attack on the electronic control system is estimated based on the security log and the attack / anomaly related information (S102); Analyzing the accuracy of the attack estimation based on the context data included in the security log (S103); outputting attack information indicating the estimated attack and estimated accuracy information indicating the estimated accuracy of the attack (S104); Attack analysis method.

[0145] (Invention 15) An attack analysis program executable by an attack analysis device for analyzing attacks against an electronic control system (S) mounted on a moving object, The attack analysis device includes: an attack / anomaly relationship information storage unit (102) for storing attack / anomaly relationship information indicating a relationship between predicted attack information indicating an attack that the electronic control system may receive, predicted anomaly information indicating an anomaly that is predicted to occur when the electronic control system receives the attack, and predicted anomaly position information indicating a position in the electronic control system where the predicted anomaly will occur; The attack analysis program Obtaining a security log indicating an abnormality detected in the electronic control system and a location within the electronic control system where the abnormality was detected (S101); An attack on the electronic control system is estimated based on the security log and the attack / anomaly related information (S102); Analyzing the accuracy of the attack estimation based on the context data included in the security log (S103); outputting attack information indicating the estimated attack and estimated accuracy information indicating the estimated accuracy of the attack (S104); The attack analysis program causes the attack analysis device to execute a process including the steps of:

[0146] 4. Summary The features of the attack analysis device and the like in each embodiment (including examples, the same applies below) of the present invention have been described above.

[0147] The terms used in each embodiment are merely examples and may be replaced with synonymous terms or terms having the same functions.

[0148] The block diagrams used to explain the embodiments classify and organize the configuration of the device by function. The blocks showing the respective functions are realized by any combination of hardware or software. In addition, since the block diagrams show the functions, they can also be understood as disclosures of a method invention and a program invention that realizes the method.

[0149] The order of the functional blocks that can be understood as the processes, flows, and methods described in each embodiment may be changed as long as there are no constraints such as a relationship in which one step utilizes the results of another step prior to it.

[0150] The terms first, second, through Nth (N is an integer) used in each embodiment and in the claims are used to distinguish two or more configurations or methods of the same type, and do not limit the order or superiority or inferiority.

[0151] Each embodiment is based on an attack analysis device for analyzing cyber attacks against an electronic control system installed in a vehicle, but the present invention also includes dedicated or general-purpose devices other than for vehicles, unless otherwise limited in the claims.

[0152] Moreover, examples of the form of the attack analysis device of the present invention include the following. Examples of the component form include a semiconductor element, an electronic circuit, a module, and a microcomputer. Examples of semi-finished products include electronic control units (ECUs (Electric Control Units)) and system boards. Finished product forms include mobile phones, smartphones, tablets, personal computers (PCs), workstations, and servers. Other examples include devices with communication functions, such as video cameras, still cameras, and car navigation systems.

[0153] Additionally, necessary functions such as an antenna and a communication interface may be added to the attack analysis device.

[0154] It is assumed that the attack analysis device of the present invention will be used, particularly on the server side, for the purpose of providing various services. In providing such services, the attack analysis device of the present invention will be used, the method of the present invention will be used, and / or the program of the present invention will be executed.

[0155] In addition, the present invention can be realized not only by dedicated hardware having the configuration and functions described in each embodiment, but also as a combination of a program for realizing the present invention recorded on a recording medium such as a memory or a hard disk, and general-purpose hardware having a dedicated or general-purpose CPU and memory capable of executing the program.

[0156] A program stored in a non-transient physical recording medium (for example, an external storage device (hard disk, USB memory, CD / BD, etc.) or an internal storage device (RAM, ROM, etc.)) of dedicated or general-purpose hardware can be provided to the dedicated or general-purpose hardware via a recording medium, or via a communication line from a server without using a recording medium. This makes it possible to always provide the latest functions through program upgrades. [Industrial Applicability]

[0157] The attack analysis device of the present invention is intended primarily for analyzing attacks received by electronic control systems installed in automobiles, but may also be intended for analyzing attacks against normal systems not installed in automobiles. [Explanation of symbols]

[0158] 10 Attack analysis device, 101 Log acquisition unit, 102 Attack / anomaly related information storage unit, 103 Attack estimation unit, 104 Attack estimation accuracy analysis unit, 105 Context data related information storage unit, 106 Reference attack element information estimation unit, 107 Output unit, 20 ECU, 30 Server device

Claims

1. An attack analysis device for analyzing attacks against an electronic control system (S) mounted on a moving object, a log acquisition unit (101) that acquires a security log indicating an abnormality detected in the electronic control system and a position in the electronic control system where the abnormality was detected; an attack / anomaly relationship information storage unit (102) for storing attack / anomaly relationship information indicating the relationship between predicted attack information indicating an attack that the electronic control system may be subjected to, predicted anomaly information indicating an anomaly that is predicted to occur if the electronic control system is subjected to the attack, and predicted anomaly position information indicating a position within the electronic control system where the predicted anomaly will occur; an attack estimation unit (103) that estimates an attack that the electronic control system has received based on the security log and the attack / anomaly relationship information; an attack estimation accuracy analysis unit (104) that analyzes the estimation accuracy of the attack based on context data included in the security log; and an output unit (107) that outputs attack information indicating the estimated attack and estimated accuracy information indicating the estimated accuracy of the attack. Attack analysis device (10).

2. The method further includes a reference attack element information estimation unit (106) for estimating reference attack element information, which is element information of an attack related to the context data, based on the context data, The attack estimation accuracy analysis unit analyzes the estimation accuracy of the attack based on the reference attack element information. The attack analysis device according to claim 1 .

3. The attack information includes an attack path consisting of a starting point of the attack and a target of the attack, The context data is communication direction information that enables a source and / or a destination to be estimated, the attack estimation accuracy analysis unit analyzes the estimation accuracy of the attack based on whether the communication direction information is included in the attack path.

3. An attack analysis device according to claim 1 or 2.

4. The attack information includes an attack stage indicating an invasion stage of the attack, The context data is communication direction information that enables a source and / or a destination to be estimated, the reference attack element information estimation unit estimates, based on the context data, a reference attack stage indicating an invasion stage of an attack related to the communication direction information, as the reference attack element information; the attack estimation accuracy analysis unit analyzes the estimation accuracy of the attack based on whether the attack stage matches the reference attack stage; The attack analysis device according to claim 2.

5. The attack information includes an attack stage indicating an invasion stage of the attack, the context data is indicative of a software or process within the electronic control system in which the anomaly occurred; When the attack information including the attack stage is acquired, the attack estimation accuracy analysis unit analyzes the estimation accuracy of the attack based on whether or not an abnormality in software or a process of a specific function that is predetermined as being related to the attack stage is indicated in the context data.

3. An attack analysis device according to claim 1 or 2.

6. The attack information includes an attack stage indicating an invasion stage of the attack, The context data is a communication amount or an error type, the reference attack element information estimation unit estimates, based on the context data, a reference attack stage indicating an invasion stage of an attack related to the communication volume or the error type, as the reference attack element information; the attack estimation accuracy analysis unit analyzes the estimation accuracy of the attack based on whether the attack stage matches the reference attack stage; The attack analysis device according to claim 2.

7. The attack information includes an attack path consisting of an attack origin and an attack target, the context data being time information relating to a time when the security log was generated or transmitted; The reference attack element information estimation unit estimates, as the reference attack element information, a reference anomaly occurrence order, which is an occurrence order of the anomalies indicated in the security log, based on the context data; the attack estimation accuracy analysis unit analyzes the estimation accuracy of the attack by comparing an anomaly occurrence sequence estimated from the attack path with the reference anomaly occurrence sequence; The attack analysis device according to claim 2.

8. The attack information includes an attack path consisting of a starting point of the attack and a target of the attack, The context data is communication direction information that enables a source and / or a destination to be estimated, the attack estimation accuracy analysis unit, when the communication direction information is included in the attack path, analyzes the estimation accuracy of the attack based on whether the communication direction information is included in a blacklist or a whitelist.

3. An attack analysis device according to claim 1 or 2.

9. The context data indicates a communication partner of a communication with an external device when the abnormality detected in the electronic control system is an abnormality caused by communication with an external device of the electronic control system, The attack information includes an attack stage indicating an invasion stage of the attack, When the attack stage matches a predetermined attack stage, the attack estimation accuracy analysis unit analyzes the estimation accuracy of the attack based on whether the communication counterpart is included in a blacklist.

3. An attack analysis device according to claim 1 or 2.

10. The attack information includes an attack path consisting of a starting point of the attack and a target of the attack, The context data is communication direction information and destination information that can estimate a source and / or a destination, the attack estimation accuracy analysis unit, when the communication direction information is included in the attack path, analyzes the estimation accuracy of the attack based on whether the communication direction information is included in a vulnerability information list.

3. An attack analysis device according to claim 1 or 2.

11. The attack information includes an attack path, the context data is indicative of the software or process in which the anomaly occurred; The analysis of the attack estimation accuracy by the attack estimation accuracy analysis unit includes: determining, using the context data, whether a vulnerable software or process indicated in the vulnerability information list was executed in the attack path; 3. An attack analysis device according to claim 1 or 2.

12. The attack analysis device is provided outside the moving body. The attack analysis device according to claim 1 .

13. The attack analysis device is mounted on a moving object. The attack analysis device according to claim 1 .

14. An attack analysis method executed by an attack analysis device for analyzing an attack against an electronic control system (S) mounted on a moving object, comprising: The attack analysis device includes: an attack / anomaly relationship information storage unit (102) for storing attack / anomaly relationship information indicating a relationship between predicted attack information indicating an attack that the electronic control system may receive, predicted anomaly information indicating an anomaly that is predicted to occur when the electronic control system receives the attack, and predicted anomaly position information indicating a position in the electronic control system where the predicted anomaly will occur; The attack analysis method includes: Obtaining a security log indicating an abnormality detected in the electronic control system and a location within the electronic control system where the abnormality was detected (S101); Based on the security log and the attack / anomaly relationship information, an attack on the electronic control system is estimated (S102); Analyzing the accuracy of the attack estimation based on the context data included in the security log (S103); outputting attack information indicating the estimated attack and estimated accuracy information indicating the estimated accuracy of the attack (S104); Attack analysis method.

15. An attack analysis program executable by an attack analysis device for analyzing attacks against an electronic control system (S) mounted on a moving object, The attack analysis device includes: an attack / anomaly relationship information storage unit (102) for storing attack / anomaly relationship information indicating a relationship between predicted attack information indicating an attack that the electronic control system may receive, predicted anomaly information indicating an anomaly that is predicted to occur when the electronic control system receives the attack, and predicted anomaly position information indicating a position in the electronic control system where the predicted anomaly will occur; The attack analysis program Obtaining a security log indicating an abnormality detected in the electronic control system and a location within the electronic control system where the abnormality was detected (S101); Based on the security log and the attack / anomaly relationship information, an attack on the electronic control system is estimated (S102); Analyzing the accuracy of the attack estimation based on the context data included in the security log (S103); outputting attack information indicating the estimated attack and estimated accuracy information indicating the estimated accuracy of the attack (S104); The attack analysis program causes the attack analysis device to execute a process including the steps of:

Images