Log analysis device, log analysis method, and log analysis program

Abstract

To provide a log analysis device, method, and program which enhance the accuracy of determination of false positives and enhance the accuracy of analysis of cyber attacks using security event logs in analysis in a Security Operations Center.SOLUTION: A log analyzing device 10 includes a log acquiring unit 101 that acquires a log indicating an abnormality detected by a sensor of an ECU in a vehicle, a vehicle-state-information acquiring unit 102 that acquires vehicle-state information indicating an internal state and an external state of the vehicle, a storage unit 104 for storing a false-positive determination rule for determining that an abnormality indicated by the log is a false-positive that is an abnormality not caused by cyber attacks, and a false positive estimation rule for determining the possibility of false positive, a false positive log determination unit 105 for determining whether a log is a determined false positive log or an estimated false positive log based on the log or vehicle state information, and an output unit 107 for outputting the estimated false positive log together with flag information showing the estimated false positive without outputting the determined false positive log.SELECTED DRAWING: Figure 6

Description

[Technical Field]

[0001] The present invention relates to a log analysis device, which is a device for analyzing security event logs that are output when an attack occurs on an electronic control system mounted on a mobile object, such as a car. [Background technology]

[0002] In recent years, technologies for driver assistance and autonomous driving control, including V2X (vehicle-to-vehicle communication) and vehicle-to-infrastructure communication, have been attracting attention. Accordingly, vehicles are increasingly equipped with communication functions, and so-called connected vehicles are becoming more common. As a result, the possibility of vehicles being subject to cyberattacks, such as unauthorized access, is increasing. Therefore, it is necessary to analyze cyberattacks against vehicles and develop countermeasures.

[0003] There are various methods for detecting an abnormality that has occurred in a vehicle and analyzing a cyber attack based on the detected abnormality. For example, Patent Document 1 describes that an attack path analysis unit 203 of a center device 200 analyzes a received abnormality log and estimates the attack path of an attack on the vehicle, and that this abnormality log is generated by a security sensor of each ECU and transmitted to the center device 200. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2022-17873 Summary of the Invention [Problem to be solved by the invention]

[0005] Here, the present inventors have found the following problem. If a security event log indicating anomalies detected by a security sensor in an electronic control device installed in a vehicle contains a false positive security event log, which is an anomaly that is not caused by a cyber attack, this can cause a decrease in the accuracy of estimating attacks and attack routes, etc., when analyzing the security event log. Therefore, it is desirable to determine whether a security event log is a false positive, and if so, not to analyze the security event log. However, determining whether a security event log is a false positive is not easy, and if an important security event log is misjudged as a false positive and excluded, this will again result in a decrease in the accuracy of estimating attacks and attack routes.

[0006] Therefore, an object of the present invention is to provide a technology that can improve the accuracy of analyzing cyber attacks using security event logs by improving the accuracy of false positive determinations. [Means for solving the problem]

[0007] The log analysis device (10, 20, 31, 32) of the present disclosure includes: a log acquisition unit (101) that acquires one or more security event logs indicating abnormalities detected by a security sensor of an electronic control device mounted on a vehicle; a vehicle state information acquisition unit (102) that acquires vehicle state information indicating the internal state and / or external state of the vehicle; a storage unit (104) for storing a false positive determination rule used to determine whether an anomaly indicated by the security event log is a false positive, which is an anomaly not caused by a cyber-attack, and a false positive estimation rule used to determine whether an anomaly indicated by the security event log is likely to be a false positive; a false positive log determination unit (105) that determines, based on the security event log and / or the vehicle state information, whether the security event log is a confirmed false positive log that can be confirmed to be a false positive using the false positive determination rule, and whether the security event log is an estimated false positive log that may be a false positive using the false positive estimation rule; an output unit (107) that does not output the confirmed false positive log, but outputs the estimated false positive log together with flag information indicating an estimated false positive; Equipped with.

[0008] It should be noted that the claims and the numbers in parentheses attached to the constituent elements of the invention described in this section indicate the correspondence between the present invention and the embodiments described below, and are not intended to limit the present invention. [Effects of the Invention]

[0009] With the above-described configuration, the log analysis device of the present disclosure can improve the accuracy of determining false positives, and as a result, can improve the accuracy of analyzing cyber attacks using security event logs in analyses at SOCs, etc. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is an explanatory diagram illustrating the arrangement of a log analysis device 10 according to a first embodiment. [Figure 2] FIG. 10 is an explanatory diagram illustrating the arrangement of a log analysis device 20 according to a second embodiment. [Figure 3] FIG. 10 is an explanatory diagram illustrating the arrangement of the log analysis device 31 and the log analysis device 32 according to the third embodiment. [Figure 4] FIG. 1 is a block diagram illustrating an example of the configuration of an electronic control system according to each embodiment. [Figure 5] FIG. 10 is an explanatory diagram illustrating a security event log output from a security sensor of the electronic control system according to each embodiment. [Figure 6] FIG. 1 is a block diagram illustrating an example of the configuration of a log analysis device according to each embodiment. [Figure 7] FIG. 1 is an explanatory diagram illustrating a false positive determination rule used in each embodiment. [Figure 8] FIG. 1 is an explanatory diagram illustrating a false positive estimation rule used in each embodiment. [Figure 9] FIG. 1 is an explanatory diagram illustrating a false positive determination rule and a false positive estimation rule used in each embodiment. [Figure 10]FIG. 1 is a flowchart illustrating the operation of a log analysis device according to each embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0012] The present invention refers to the inventions described in the claims or in the Summary of the Invention section, and is not limited to the following embodiments. Furthermore, at least the words in quotation marks refer to the words described in the claims or in the Summary of the Invention section, and are not limited to the following embodiments.

[0013] The configurations and methods recited in the dependent claims are optional configurations and methods in the inventions recited in the independent claims. The configurations and methods of the embodiments corresponding to the configurations and methods recited in the dependent claims, as well as the configurations and methods recited only in the embodiments without being recited in the claims, are optional configurations and methods in the present invention. The configurations and methods recited in the embodiments when the recitation of the claims is broader than the recitation of the embodiments are also optional configurations and methods in the present invention, in the sense that they are examples of the configurations and methods of the present invention. In either case, by being recited in the independent claims, they become essential configurations and methods of the present invention.

[0014] The effects described in the embodiments are effects obtained when the configurations of the embodiments are provided as examples of the present invention, and are not necessarily effects that the present invention has.

[0015] When there are multiple embodiments (including variations and examples; the same applies in this paragraph), the configurations disclosed in each embodiment are not limited to each embodiment, but can be combined across the embodiments. For example, a configuration disclosed in one embodiment may be combined with another embodiment. Also, configurations disclosed in multiple embodiments may be collected and combined.

[0016] The problem described in the section on the problem to be solved by the invention is not a publicly known problem, but was discovered independently by the inventor, and this fact, together with the configuration and method of the present invention, affirms the inventive step of the invention.

[0017] 1. Configuration underlying each embodiment (1) Placement of log analysis equipment First, the layout of the log analysis device in each embodiment will be described with reference to FIGS. 1 shows a log analysis device 10 according to a first embodiment. The log analysis device 10 is provided outside a vehicle and is connected to an electronic control system S mounted on the vehicle. The log analysis device 10 is realized, for example, by a security operations center (SOC) or other server device. Here, a "vehicle" refers to a movable object that can move at any speed. It also naturally includes vehicles that are stationary. Examples include, but are not limited to, automobiles, motorcycles, and bicycles.

[0018] The log analysis device 10, the electronic control system S, and the electronic control units (hereinafter referred to as ECUs (Electronic Control Units)) that constitute the electronic control system S are connected via a communication network using a wireless communication method, such as IEEE802.11 (Wi-Fi (registered trademark)), IEEE802.16 (WiMAX (registered trademark)), W-CDMA (Wideband Code Division Multiple Access), HSPA (High Speed ​​Packet Access), LTE (Long Term Evolution), LTE-A (Long Term Evolution Advanced), 4G, or 5G. Alternatively, Dedicated Short Range Communication (DSRC) can be used. When the vehicle is parked in a parking lot or in a repair shop, a wired communication method can be used instead of a wireless communication method. For example, a local area network (LAN) such as Ethernet (registered trademark), the Internet, an optical fiber line, or a fixed telephone line can be used. Alternatively, the line may be a combination of a wireless communication system and a wired communication system. For example, the electronic control system S and a base station device in a cellular system may be connected by a wireless communication system such as 4G, and the base station device and the log analysis device 10 may be connected by a wired communication system such as a trunk line of a telecommunications carrier or the Internet. A gateway device may be provided at the point of contact between the trunk line and the Internet.

[0019] The external device 40 is provided outside the vehicle, similar to the log analysis device 10, and is realized by, for example, a server device etc. The external device 40 is a device that mainly provides various types of information to the log analysis device 10. The external device 40 and the log analysis device 10 are normally connected by wired communication.

[0020] 2 shows a log analysis device 20 of embodiment 2. Unlike embodiment 1, the log analysis device 20 is "mounted" on a "vehicle" and is connected to an electronic control system S also mounted on the "vehicle." Here, "mounted" includes not only cases where the device is directly fixed to the vehicle, but also cases where the device is not fixed to the vehicle but moves with the vehicle, such as when the device is carried by a person in the vehicle or when the device is mounted on cargo placed on the vehicle.

[0021] The log analysis device 20 is connected to the electronic control system S and the ECUs that make up the electronic control system S via an in-vehicle communication network such as a Controller Area Network (CAN) or a Local Interconnect Network (LIN). Alternatively, the connection may be made using any communication method, whether wired or wireless, such as Ethernet (registered trademark), Wi-Fi (registered trademark), or Bluetooth (registered trademark). Although the log analysis device 20 is provided outside the electronic control system S in FIG. 2, the log analysis device 20 may be provided inside the electronic control system S, that is, as one of the components of the electronic control system S. In addition, connection refers to a state in which data can be exchanged, and includes not only cases in which different hardware is connected via a wired or wireless communication network, but also cases in which virtual machines realized on the same hardware are virtually connected to each other.

[0022] The external device 40 and the log analysis device 20 are connected by wireless communication or wired communication. Examples of the wired communication and wireless communication methods are as already described in the description of FIG.

[0023] 3 shows a log analysis device 31 and a log analysis device 32 according to the third embodiment. The log analysis device 31 and the log analysis device 32 are configured such that the functions of the log analysis device 10 according to the first embodiment and the log analysis device 20 according to the second embodiment are allocated to the outside and inside of the vehicle. Of course, this does not preclude the log analysis device 31 and the log analysis device 32 from having the same functions. It should be noted that the log analysis device 31 and the log analysis device 32 each correspond to a "log analysis device," and the log analysis device 31 and the log analysis device 32 together correspond to one "log analysis device."

[0024] For other features of the log analysis device 31, the description of the log analysis device 10 of the first embodiment is cited, and for other features of the log analysis device 32, the description of the log analysis device 20 of the second embodiment is cited.

[0025] The arrangement of the log analysis device of each embodiment has been described above with reference to FIGS. Since the log analysis device 20 and the log analysis device 32 are mounted on the vehicle, they are suitable for acquiring internal state information indicating the internal state of the vehicle from the electronic control system S, etc. Furthermore, since the log analysis device 10 and the log analysis device 31 are provided outside the vehicle, they are suitable for acquiring external state information indicating the external state of the vehicle from the external device 40, etc. The internal state information and the external state information together constitute vehicle state information. However, this does not prevent the log analysis device 10 and the log analysis device 31 from acquiring internal state information, or the log analysis device 20 and the log analysis device 32 from acquiring external state information.

[0026] (2) Configuration of the electronic control system FIG. 4 is a diagram showing an example of the configuration of an electronic control system S. The electronic control system S is composed of multiple ECUs, including an external communication ECU and an integrated ECU, which are connected via the in-vehicle communication network already described. While FIG. 4 illustrates one external communication ECU, one integrated ECU, and four individual ECUs (ECUs A, B, C, and D), the electronic control system S may naturally be composed of any number of ECUs. Hereinafter, the term "ECU" will be used to collectively refer to the external communication ECU, the integrated ECU, and the individual ECUs.

[0027] The external communication ECU is an ECU that communicates with the outside. The communication methods used by the external communication ECU are the wireless communication method and the wired communication method described above. Note that multiple external communication ECUs may be provided to implement multiple communication methods.

[0028] The integrated ECU is an ECU equipped with a gateway function that mediates between the individual ECUs and the external communication ECU. The integrated ECU may also be provided with a function for controlling the entire electronic control system S, such as a security function. The integrated ECU is sometimes called a gateway ECU (G-ECU) or a mobility computer (MC). The integrated ECU may also be a relay device or a gateway device.

[0029] The individual ECUs of the electronic control system S can be configured with ECUs having any desired functions. Examples include drivetrain electronic control units that control the engine, steering, brakes, etc., body electronic control units that control meters, power windows, etc., information system electronic control units such as navigation systems, and safety control system electronic control units that perform control to prevent collisions with obstacles or pedestrians. Furthermore, the ECUs may not be connected in parallel, but may be classified as master and slave.

[0030] Furthermore, the ECU may be a physically independent ECU, or may be a virtually realized virtual ECU (also called a virtual machine).

[0031] In the electronic control system S in Fig. 4, each ECU is equipped with a security sensor. However, it is not necessarily required that all ECUs be equipped with a security sensor.

[0032] When the log analysis device 20 or the log analysis device 32 is provided outside the electronic control system S, the log analysis device 20 or the like can be connected to the electronic control system S in Fig. 2 via an in-vehicle communication network or a network using another communication method. When the log analysis device 20 or the log analysis device 32 is provided inside the electronic control system S, it can be provided inside any ECU, including the integrated ECU.

[0033] Furthermore, when the log analysis device 20 or the log analysis device 32 is provided outside the electronic control system S and communicates with a device external to the vehicle, an independent communication device provided in the log analysis device 20 or the log analysis device 32 may be used, or an external communication ECU of the electronic control system S may be used. When the log analysis device 20 or the log analysis device 32 is provided inside the electronic control system S and communicates with a device external to the vehicle, an external communication ECU can naturally be used.

[0034] (3) Security event log details FIG. 5 is a diagram showing an example of the contents of a security event log generated by a security sensor of an ECU that constitutes the electronic control system S. As shown in FIG.

[0035] The security event log has the following fields: an ECU ID indicating the identification information of the ECU in which the security sensor is installed, a sensor ID indicating the identification information of the security sensor, an event ID indicating the identification information of the security event, a counter indicating the number of times the event has occurred, a timestamp indicating the time when the event occurred, and context data indicating details of the output of the security sensor. The security event log may further have a header storing information indicating the protocol version and the state of each field.

[0036] According to the specifications defined by AUTOSAR (AUTomotive Open System ARchitecture), IdsM Instance ID corresponds to ECUID, Sensor Instance ID corresponds to sensor ID, Event Definition ID corresponds to event ID, Count corresponds to counter, Timestamp corresponds to timestamp, Context Data corresponds to context data, and Protocol Version and Protocol Header correspond to headers.

[0037] While Figure 5 shows an example of an error log indicating an error, a normal log may have the same specifications as Figure 5. In that case, the context data for the normal log can be omitted. Also, by setting a flag in the header indicating the presence or absence of context data, it is possible to distinguish between an error log and a normal log by checking the flag.

[0038] Furthermore, although FIG. 5 shows a security event log generated by a physically independent ECU, it may be a security event log generated by a virtual ECU.

[0039] The security event log generated by the security sensor is called SEv, and the filtered and accurate security event log is called QSEv. For example, the security sensor of the individual ECU in Fig. 4 generates SEv and reports it to an intrusion detection system manager (IdsM) (not shown). If the SEv passes through a certification filter in the IdsM and meets specified criteria, the SEv is transmitted from the intrusion detection reporter to the outside of the vehicle. The security event log in this embodiment is a concept that includes both SEv and QSEv.

[0040] In each of the embodiments described below, the security event log is described as an example of a log generated by the security sensor shown in Fig. 4. However, the security event log may also be a log generated by a function called an in-vehicle SIEM (Security Information and Event Management), which collects and manages information related to events that occur in an electronic control system.

[0041] (4) Relationship between the log analysis device and the attack analysis device An attack analysis device is a device that analyzes cyber attacks against an electronic control system S. The attack analysis device acquires security event logs output from security sensors of the ECUs that make up the electronic control system S, and analyzes the types of cyber attacks and the attack paths of the cyber attacks.

[0042] However, security event logs generated by detecting abnormalities in ECUs or networks are not necessarily caused by cyberattacks. Here, a security event log that is not caused by a cyberattack is called a false positive log, and an event that is not caused by a cyberattack is called a false positive. The log analysis device of each embodiment determines whether an abnormality indicated by a security event log is a false positive and whether there is a possibility that the abnormality indicated by the security event log is a false positive, and reflects the result in the output.

[0043] The log analysis device having such functions in each embodiment may be included in the attack analysis device, or may be provided separately before the processing of the attack analysis device. The log analysis device may be realized by a dedicated hardware device or by a general-purpose hardware device and software.

[0044] 2. Embodiment 1 (1) Configuration of the log analysis device 10 6 is a block diagram showing the configuration of the log analysis device 10 according to this embodiment. The log analysis device 10 includes a log acquisition unit 101, a vehicle state information acquisition unit 102, a log storage unit 103, a rule storage unit 104, a false positive log determination unit 105, a log processing unit 106, and an output unit 107. The log processing unit 106 includes an erasure unit 108 and a flag information assignment unit 109.

[0045] The log acquisition unit 101 acquires one or more security event logs indicating abnormalities detected by a security sensor of an ECU mounted on a vehicle. In this embodiment, the log acquisition unit 101 is included in a log analysis device 10 provided outside the vehicle, and therefore the security event log acquired by the log acquisition unit 101 is, for example, QSEv. It is desirable to acquire security event logs each time a security event log is generated, but it is also possible to receive all security event logs accumulated on the electronic control system S side within a certain period of time in one go.

[0046] The vehicle state information acquisition unit 102 acquires vehicle state information indicating at least one of the internal state and external state of the vehicle. Among the vehicle state information, information indicating the internal state of the vehicle is referred to as internal state information, and among the vehicle state information, information indicating the external state of the vehicle is referred to as external state information. The vehicle state information acquired by the vehicle state information acquisition unit 102 is preferably vehicle state information at the time an abnormality occurred. The time at which the abnormality occurred may be the time when the abnormality occurred, or a time close to the time when the abnormality occurred, such as the time when a security event log indicating the abnormality was generated or the time when the security event log was received. Furthermore, the time range at which the abnormality occurred may be wider depending on the type of abnormality.

[0047] There are various methods for acquiring vehicle state information when an abnormality occurs. For example, the vehicle state information can be acquired by reading the timestamp of the security event log and requesting the ECU or sensor of the electronic control system S to acquire vehicle state information that occurred at the same time as or close to the time indicated by the timestamp. Alternatively, the vehicle state information can be acquired by continuously acquiring and storing the vehicle state information in the log storage unit 103, and reading out vehicle state information that occurred at the same time as or close to the time indicated by the timestamp. Instead of the time indicated by the timestamp, the transmission time or reception time of the security event log can also be used to indicate when an abnormality occurred.

[0048] The external condition information is information provided from sources other than the vehicle, or information about the external environment of the vehicle. Specific examples of the external condition information include information about the location of a vehicle factory or a vehicle test center, the time at the vehicle factory or the vehicle test center, vehicles that have undergone measures at the vehicle factory or the vehicle test center, communication failures of servers, etc., the operating status of external devices that provide services, etc., weather, temperature, etc. These pieces of information can be acquired by receiving them from, for example, an external device 40 that provides such information. Acquisition of the external condition information may be triggered by a request from the log analysis device 10, or may be periodically distributed from the external device 40.

[0049] Internal state information is information relating to the behavior or state of a vehicle or vehicle components. Specific examples of internal state information include vehicle location, vehicle type (VIN), vehicle speed, shift position, number of occupants, battery charge state, vehicle power state (IG-ON, IG-OFF, etc.), communication network state (Run, Ready, Stop, etc.), ECU state (ON, Sleep, OFF, etc.), and vehicle diagnostic state. This information can be acquired by receiving information output from various sensors from the vehicle, for example.

[0050] The vehicle state information may also include the time at which an internal state or an external state occurred, or the duration for which the internal state or the external state continued. Time may indicate a specific point on a time axis, and may include not only time in the strict sense, but also indirect indications of time such as timers and clocks. Time may indicate a temporal length, and may include not only time in the strict sense, but also indirect indications of time such as start and end times, the number of timers and clocks, and cycles.

[0051] The log storage unit 103 stores the security event log acquired by the log acquisition unit 101 and the vehicle state information acquired by the vehicle state information acquisition unit 102 . The log storage unit 103 may be either a volatile memory such as a RAM or a non-volatile memory such as a flash memory or a hard disk, as well as the rule storage unit 104 described below.

[0052] The rule storage unit 104 (corresponding to the "storage unit") stores at least two types of rules used by the false positive log determination unit 105, which will be described later. In this embodiment, the rule storage unit 104 stores a false positive confirmation rule used to determine whether an anomaly indicated by a security event log is a false positive, which is an anomaly not caused by a cyber attack, and a false positive estimation rule used to determine whether an anomaly indicated by a security event log is likely to be a false positive. In this embodiment, one or more false positive confirmation rules and false positive estimation rules are set for one cause of an anomaly.

[0053] False positive confirmation rules are a list of cases where a security event log can be determined to be a definitive false positive. For example, there are rules that uniquely determine the flow from the cause to the result, and rules that have been determined to be false positives by a Security Operation Center (SOC) in the past. Alternatively, these may be sums (or) or products (and).

[0054] A specific example of a false positive determination rule will be explained using Fig. 7. Fig. 7 shows an example of a false positive determination rule that shows the relationship between rules established for each cause of anomaly occurrence and determination methods.

[0055] First, the case where the abnormality occurs due to pre-shipment work, as shown in the first half of FIG. 7, will be described. For example, before a vehicle is shipped, connections to the outside world are disabled, so remote cyber attacks are not possible in the first place. Therefore, if it can be determined from security event logs and vehicle status information that the vehicle is not yet shipped, it can be determined that any security event logs indicating an abnormality that occurred before shipping are false positives.

[0056] In Figure 7, five rules are defined to determine whether a product has been shipped before. In Figure 7, [in] represents internal state information, [out] represents external state information, and [QSEv] represents information contained in the security event log that indicates an abnormality. The same applies to Figure 8. Rule A stipulates that the mileage must be less than 10km. If it is within the normal mileage until delivery to the customer, it is certain that the product has not yet been delivered to the customer and has not yet been shipped. Rule B specifies that the trip counter must be less than 5. This is because if it is a typical value until delivery to the customer, it is certain that the product has not yet been delivered to the customer and has not yet been shipped. Rule C specifies that the vehicle location must be within the range of the manufacturing plant location, because if the vehicle is within the range of the manufacturing plant location, it is certain that the vehicle is still at the plant and has not yet been shipped. Rule D stipulates that the vehicle type and the timestamp of the security event log must be before the shipping date of the vehicle. If the timestamp is before the shipping date of the vehicle, it is certain that the vehicle was shipped before. Rule E stipulates that the vehicle type and the timestamp of the security event log must be before the vehicle's registration date. If the timestamp is before the vehicle's registration date, it is not yet possible to drive on public roads, so it is certain that the vehicle has not yet been shipped.

[0057] 7 defines a method for determining whether a log is a confirmed false positive. In this example, it is defined that if at least one of rules A to E that identify pre-shipment is satisfied, the security event log indicating an abnormality can be determined to be a false positive, that is, the security event log indicating an abnormality can be determined to be a confirmed false positive. This is because any of rules A to E can independently determine that the log is pre-shipment.

[0058] Next, the case where the vehicle test is the cause of the abnormality will be described in the latter part of FIG. For example, during vehicle testing at a proving ground, vehicles may be subjected to unexpected behavior, such as sending messages directly to a communication bus modified for the test. While the possibility of a remote cyberattack is not zero, test vehicles have few options or additional parts, are unlikely to be targets of attack, and have no users to protect, making them a low priority for monitoring. Therefore, a security event log showing an abnormality occurring in a vehicle at a proving ground is highly likely to be a false positive, and it can be confirmed that it is a false positive.

[0059] In Figure 7, two rules are defined to determine whether an abnormality has occurred at the testing site. Rule A stipulates that the vehicle location must be within the range of the testing center's location. This is because if the vehicle location is within the range of the testing center's location, it is certain that the abnormality is at the testing center. In addition, an optional rule stipulates that the timestamp of the security event log must be included in the testing period. This is because if the timestamp is within the testing period, it is more likely to be related to testing at the testing center. Rule B stipulates that the vehicle type must be included in the test vehicle category, as this is certain that the vehicle was used at the testing facility. An optional rule stipulates that the security event log timestamp must be included in the test period category, as this is more likely to be related to testing at the testing facility if it is within the test period.

[0060] It is also stipulated that if at least one of rules A to B, which determine that the product is pre-shipment, is satisfied, the security event log indicating an abnormality can be determined to be a false positive log. This is because any of rules A to B can independently determine that the abnormality occurred at the testing site.

[0061] False positive inference rules are a list of cases where it can be determined that a security event log may be a false positive. For example, there are rules where inference is involved in the flow from cause to effect, and rules where the flow from cause to effect is uniquely determined but where the SOC has never previously determined the rule to be a false positive. Alternatively, it may be the sum (or) or product (and) of these.

[0062] A specific example of a false positive estimation rule will be described with reference to Fig. 8. Fig. 8 shows an example of a false positive estimation rule that shows the relationship between rules determined for each cause of an abnormality and a determination method.

[0063] First, the case in which a malfunction is the cause of the abnormality in FIG. 8 will be described. For example, in a vehicle with a faulty ECU or wiring, abnormal behavior may cause a security event log to be generated indicating an abnormality. Therefore, if a causal relationship with the failure can be inferred, it can be assumed that the security event log indicating an abnormality is a false positive.

[0064] In the first part of FIG. 8, two rules are defined for inferring that a fault has occurred. Rule A stipulates that the vehicle type and security event log timestamp must be from one week before the vehicle was brought into the repair shop to the day it was brought into the shop, because within this period, a security event log indicating an abnormality is likely to be related to a malfunction. Rule B stipulates that the ECU ID in the security event log must be the same as the faulty ECU in the maintenance record, because if the security event log is generated from an ECU that is actually faulty, it is highly likely to be related to the fault.

[0065] 8 defines a method for determining whether a log is a presumed false positive. In this example, it is defined that a security event log indicating an abnormality can be determined to be a presumed false positive log if it satisfies at least one of rules A to B, which presume that a failure has occurred. This is because all of rules A to B are rules that can independently presume a causal relationship with a failure.

[0066] If both rules A and B are satisfied, it can be more strongly inferred that an abnormality has occurred, so in this case it may be determined to be a confirmed false positive log. In other words, if multiple false positive inference rules are set for one cause of abnormality, and a predetermined number or more of rules are satisfied simultaneously, it may be determined to be a confirmed false positive rule. Here, "greater than or equal to" includes both the case where the predetermined number is included (≦) and the case where the predetermined number is not included (<).

[0067] Next, the case where the cause of the abnormality is a software defect, shown in the latter part of FIG. 8, will be described. If there is a software defect, an error may occur in the security event log. If the software related to this security event log error can be identified and a causal relationship with the software defect can be inferred, then the security event log indicating an abnormality can be inferred to be a false positive.

[0068] In the latter part of Figure 8, one rule is defined as a rule for inferring that a software defect has occurred. Rule A stipulates that information indicating a malfunction in a specific piece of software must match the software related to an abnormality in the security event log. This is because if a security event log related to a specific piece of software indicates an abnormality, it is likely related to the software that has the malfunction.

[0069] The information indicating the malfunction of the specific software may be obtained from information published by the automobile manufacturer as external status information, or may be obtained from a list of installed software stored in the vehicle or update information as internal status information. From this information, the software ID, software version, or software release date of the specific software is obtained.

[0070] If the security event log contains the software ID, the software version, or the software release date, this information can be used as information about the software involved in the anomaly.

[0071] It is also defined that if rule A is satisfied, a security event log indicating an abnormality can be determined to be a presumed false positive log.

[0072] The false positive confirmation rules of Fig. 7 and the false positive estimation rules of Fig. 8 may be combined into one table. In this case, for example, as shown in Fig. 9, columns for determination method 1 for determining confirmed false positive logs and determination method 2 for determining estimated false positive logs may be provided, and the respective determination conditions may be entered. In this case, it is possible to provide cases where a log is determined to be a confirmed false positive log and cases where a log is determined to be an estimated false positive log depending on the combination of rules that are satisfied, such as abnormality occurrence cause XXX.

[0073] The false positive confirmation rules and false positive prediction rules may be updated periodically or irregularly. For example, if a SOC analyst discovers a new rule while analyzing a security event log, the rule can be updated each time or periodically. If machine processing is possible, the information may be updated automatically. For example, information regarding the occurrence of a communication failure, information regarding the server being used, or information regarding the fact that a vehicle has been repaired may be acquired as external state information by the vehicle state information acquisition unit 102, and may be reflected in advance in the false positive determination rule and the false positive estimation rule. For example, the time when a communication failure occurred or the time when the server being used was stopped may be periodically distributed from the external device 40 or periodically requested from the external device 40, and the obtained information may be used to apply in advance to a false positive determination rule or a false positive estimation rule.

[0074] Furthermore, depending on the application results, a false positive estimation rule may be changed to a false positive confirmation rule, or conversely, a false positive confirmation rule may be changed to a false positive estimation rule. For example, assume that the application history of false positive estimation rules is stored in the external device 40. The log analysis device 10 periodically accesses the external device 40, and if there is a false positive estimation rule for which the number of security event logs determined to be possibly false positives remains below a predetermined number, for example, less than 1, for a predetermined time since the rule creation, the log analysis device 10 deletes the false positive estimation rule from the rule storage unit 104. Furthermore, if there is a false positive estimation rule that estimates that a security event log is a false positive for which the number of security event logs determined to be possibly false positives is equal to or greater than a predetermined number, for example, 1,000 or more, the log analysis device 10 changes the false positive estimation rule stored in the rule storage unit 104 to a false positive confirmation rule. Here, the application history may be a database that accumulates the results of logs that have been automatically determined to be presumed false positives by the log analysis device 10, but it is preferable to use a database that reflects the results of a human analyst analyzing and verifying the results that have been automatically determined to be presumed false positives by the log analysis device 10. This allows rules to be updated based on more accurate application history, thereby improving the accuracy of the determination. Furthermore, when changing a false positive estimation rule to a false positive confirmation rule or deleting a false positive estimation rule, the false positive estimation rule itself may be changed or deleted, or the external state information and internal state information used in the false positive estimation rule may also be changed or deleted. In this way, of the external state information and internal state information used in the rule, information with a proven track record and high reliability can be used as part of the rule.

[0075] 6, the false positive log determination unit 105 determines whether the security event log acquired by the log acquisition unit 101 is a false positive or has the potential to be a false positive. That is, based on at least one of the security event log and the vehicle state information, it determines whether the security event log is a confirmed false positive log that can be confirmed to be a false positive using a false positive determination rule, and whether the security event log is an estimated false positive log that has the potential to be a false positive using a false positive estimation rule. Here, "based on" includes not only the case where the security event log and / or vehicle status information is directly used, but also the case where the security event log and / or vehicle status information is indirectly used, i.e., the case where intermediate facts are estimated from the security event log and / or vehicle status information and false positive determinations are made using the intermediate facts.

[0076] 7 and 9, information required to determine the success or failure of each rule is read from each field of the security event log stored in the log storage unit 103, and from the external state information and internal state information also stored in the log storage unit 103. Then, the success or failure of each rule is determined using this information, and a determination is made as to whether the security event log acquired by the log acquisition unit 101 is a confirmed false positive log using the determination method of the false positive determination rule. For the presumed false positive log, a similar determination is made using the false positive estimation rules of FIG. 8 and FIG. 9 to determine whether the security event log acquired by the log acquisition unit 101 is a presumed false positive log.

[0077] The false positive log determination unit 105 may first perform a determination using a false positive confirmation rule, and then perform a determination using a false positive estimation rule. That is, first, it is determined whether a security event log is a confirmed false positive log, and then it is determined whether the remaining security event logs, excluding the security event logs determined to be confirmed false positive logs, are estimated false positive logs. For example, consider the case in FIG. 9 where the rule with XXX as the cause of the abnormality occurrence is executed. The false positive log determination unit 105 first determines whether rules A and C are true or false. If both rules A and C are true, it is determined that determination method 1 is true, and therefore determination method 2 is not executed. On the other hand, it determines whether rules A to C are true or false. If only rule B is true, determination method 1 is not true, and therefore determination method 2 is executed.

[0078] In addition, when narrowing down the false positive confirmed rules and false positive estimated rules, a filter may be used to narrow down the rules. For example, the vehicle type (VIN), vehicle location, and time are information used in many rules, so by using this information for narrowing down the rules, it is possible to efficiently narrow down the applicable rules.

[0079] The log processing unit 106 performs processing on the security event log based on the determination result of the false positive log determination unit 105. In this embodiment, a security event log determined to be a confirmed false positive log is deleted by a deletion unit 108 of the log processing unit 106. Furthermore, a security event log determined to be a suspected false positive log has flag information assigned by a flag information assignment unit 109 of the log processing unit 106.

[0080] The flag information is information that indicates that the log is a suspected false positive. The flag information may be added to the outside of the suspected false positive log or may be included inside the suspected false positive log. When the flag information is included inside the suspected false positive log, it may be included in the header or context data area of ​​FIG. 4, for example.

[0081] The flag information may also be accompanied by information indicating the degree of possibility that the log is an estimated false positive. For example, if the cause of the abnormality in Fig. 9 is ZZZ, the flag information may include a numerical value indicating how many of the conditions F, G, H, and I are met. For example, the flag information may include a numerical value such as 1 or 25% if any one of the conditions is met, or 3 or 75% if three conditions are met.

[0082] Furthermore, the erasure unit 108 may generate erasure information indicating that a security event log determined to be a confirmed false positive log has been erased, and output the information to the output unit 107. The erasure information may include information that can identify the erased security event log.

[0083] The output unit 107 outputs the processing result of the log processing unit 106. That is, it does not output confirmed false positive logs, but outputs presumed false positive logs "together" with flag information indicating that they are presumed false positives. The output unit 107 also outputs other security event logs that are not determined to be confirmed false positive logs and are not determined to be presumed false positive logs. The output unit 107 may also output erasure information output from the erasure unit 108. The output destination of the output unit 107 is, for example, an external server that manages the SOC. Here, "both" includes both cases where flag information is added to the outside of the estimated false positive log and where flag information is included inside the estimated false positive log.

[0084] (2) Operation of the log analysis device 10 Next, the operation of the log analysis device 10 will be described with reference to Fig. 10. Fig. 10 not only shows a log analysis method executed by the log analysis device 11, but also shows the processing procedure of a log analysis program that can be executed by the log analysis device 11. The order of these processes is not limited to the order shown in Fig. 10. In other words, the order may be changed as long as there are no constraints, such as a relationship in which a certain step uses the result of the previous step.

[0085] The log acquisition unit 101 acquires one or more security event logs indicating abnormalities detected by a security sensor of an electronic control unit mounted on a vehicle (S101). The vehicle state information acquisition unit 102 acquires vehicle state information indicating the internal state and / or the external state of the vehicle (S102). The false positive log determination unit 105 determines, based on the security event log and / or vehicle status information, whether the security event log is a confirmed false positive log that can be confirmed to be a false positive using a false positive determination rule, and whether the security event log is an estimated false positive log that may be a false positive using a false positive estimation rule (S103).

[0086] If the security event log is determined to be a confirmed false positive log in S103 (S104: Y), the erasure unit 108 of the log processing unit 106 erases the confirmed false positive log (S105). If the security event log is determined to be not a confirmed false positive log in S103 (S104: N), the process proceeds to S106. If the security event log is determined to be a presumed false positive log in S103 (S106: Y), the flag information assigning unit 109 of the log processing unit 106 assigns flag information to the presumed false positive log (S107), and the process proceeds to S108. If the security event log is determined not to be a presumed false positive log in S103 (S106: N), the process proceeds to S108. The output unit 107 does not output the confirmed false positive log that was deleted in S105, but outputs the estimated false positive log to which flag information was added in S107 and other logs (S108).

[0087] (3) Summary As described above, according to the log analysis device 10 of this embodiment, since the false positive determination rule and the false positive estimation rule are used to make a judgment, only security event logs that can be confirmed as false positives are erased, and security event logs that may be false positives can be output to a later step without being erased. As a result, the risk of erasing important security event logs can be reduced. According to the log analysis device 10 of this embodiment, a security event log that may be a false positive is output with flag information attached, so that a determination can be made in a later step that takes into account the possibility of a false positive. According to the log analysis device 10 of this embodiment, multiple rules are set for one cause of an abnormality, so it is possible to reduce the possibility that a false positive or a possible false positive will not be detected even when the cause of the abnormality is present. Furthermore, since a log that satisfies a predetermined number or more of multiple rules simultaneously is determined to be a confirmed false positive log, and a log that satisfies the predetermined number or less is determined to be a suspected false positive log, it is possible to clarify the determination criteria. According to the log analysis device 10 of this embodiment, a judgment is first made using the false positive confirmation rule, and then the remaining security event logs, excluding those judged to be confirmed false positive logs, are judged using the false positive estimation rule. This reduces the number of targets for judgment, thereby reducing the burden on the log analysis device 10.

[0088] 3. Embodiment 2 The log analysis device 10 of the first embodiment is provided outside the vehicle as shown in Fig. 1. The log analysis device 20 of the present embodiment differs from the first embodiment in that it is mounted on the vehicle as shown in Fig. 2. However, since the configuration of the log analysis device 20 is basically the same as that of the log analysis device 10, the configuration and operation of the log analysis device 20 will be described with reference to the first embodiment and the corresponding drawings. In this embodiment, the log acquisition unit 101 is connected to the electronic control system S, and therefore the security event log acquired by the log acquisition unit 101 is, for example, SEv or QSEv.

[0089] 4. Embodiment 3 In this embodiment, a log analysis device 31 is provided outside the vehicle, and a log analysis device 32 is provided inside the vehicle. The configurations of the respective log analysis devices are the same as the configurations of the log analysis device 10 of the first embodiment and the log analysis device 20 of the second embodiment shown in Fig. 6, so the first embodiment and the corresponding drawings will be cited.

[0090] The functions of the log analysis device 10 described in the first embodiment are assigned to the log analysis device 31 and the log analysis device 32 of this embodiment. An example of the assignment will be described below.

[0091] (1) (Example 1) Allocation based on acquired vehicle status information As already mentioned, when the log analysis device is installed inside the vehicle, it is suitable for acquiring internal state information. Therefore, in this embodiment, the vehicle state information acquisition unit 102 of the log analysis device 32 acquires only the internal state information from the vehicle state information. In this case, the rule storage unit 104 of the log analysis device 32 stores false positive confirmation rules and false positive estimation rules that include only rules that use the internal state information and information contained in the security event log.

[0092] In contrast, the vehicle state information acquisition unit 102 of the log analysis device 31 acquires only the external state information from the vehicle state information, and the rule storage unit 104 of the log analysis device 31 stores false positive determination rules and false positive estimation rules that include only rules that use the external state information and information included in the security event log.

[0093] However, some false positive determination rules and false positive estimation rules require both internal state information and external state information. In such cases, the rules may be stored in the rule storage unit 104 of either the log analysis device 31 or the log analysis device 32. When stored in the log analysis device 31, the internal state information required for the determination may be received from the vehicle. When stored in the log analysis device 32, the external state information required for the determination may be received from an external device 40 or the like.

[0094] According to the allocation of this embodiment, it is possible to make a determination using vehicle state information that is easily acquired depending on the location where the log analysis device is installed.

[0095] (2) (Example 2) Classification from the viewpoint of false positive confirmation rules and false positive estimation rules The rule storage unit 104 of the log analysis device 10 of the first embodiment and the log analysis device 20 of the second embodiment stores the false positive confirmation rule and the false positive estimation rule, and the false positive log determination unit 105 makes a determination using the false positive confirmation rule and the false positive estimation rule. In this embodiment, one of these two rules is assigned to the log analysis device 31, and the other is assigned to the log analysis device 32.

[0096] When false positive estimation rules are assigned to a log analysis device 31 (corresponding to a "first log analysis device") installed outside the vehicle and false positive confirmed rules are assigned to a log analysis device 32 (corresponding to a "second log analysis device") installed inside the vehicle, the confirmed false positive logs are deleted on the vehicle side, so the vehicle side does not need to send all security event logs. As a result, the amount of communication can be reduced. In addition, the false positive estimation rules, which require a relatively large amount of calculation, can be processed by a device outside the vehicle that has abundant resources. A portion of the multiple false positive confirmation rules may be assigned to the log analysis device 32 installed inside the vehicle, and a judgment may be made using the false positive confirmation rules. The remaining multiple false positive confirmation rules may be assigned to the log analysis device 31 installed outside the vehicle, and a judgment may be made using the false positive confirmation rules. In this case, the assignment of the false positive estimation rules may be arbitrary. Even in this embodiment, since the confirmed false positive logs are erased on the vehicle side, the vehicle side does not need to transmit all security event logs. As a result, communication volume can be reduced. Furthermore, the false positive confirmation rules assigned to the log analysis device 32 installed inside the vehicle may be redundantly assigned to the log analysis device 31 installed outside the vehicle, and judgments using the false positive confirmation rules may be made both on the vehicle side and on the outside of the vehicle. According to this embodiment, in addition to reducing communication volume by using a mechanism for erasing the confirmed false positive logs on the vehicle side, providing a redundant mechanism for erasing the confirmed false positive logs on the outside of the vehicle allows for more reliable erasure of the confirmed false positive logs. In an aspect in which false positive confirmation rules are assigned to the log analysis device 32 installed inside the vehicle, the assigned false positive confirmation rules may be only rules that use the internal state information and information included in the security event log, as in Example 1. This not only reduces the amount of communication traffic by using a mechanism for deleting confirmed false positive logs on the vehicle side, but also further achieves the effect of Example 1, that is, the vehicle side can make a determination using vehicle state information that is easy to obtain on the vehicle side.

[0097] If false positive confirmation rules are assigned to a log analysis device 31 (corresponding to the "first log analysis device") installed outside the vehicle and false positive estimation rules are assigned to a log analysis device 32 (corresponding to the "second log analysis device") installed inside the vehicle, the important process of deleting security event logs can be performed all at once by a device outside the vehicle. A portion of the multiple false positive estimation rules and false positive confirmation rules may be allocated to a log analysis device 31 installed outside the vehicle, and the remaining false positive estimation rules may be allocated to a log analysis device 32 installed inside the vehicle. The false positive estimation rules allocated to the log analysis device 32 installed inside the vehicle may be false positive confirmation rules that include only rules that use internal state information and information contained in the security event log, as in Example 1. False positive estimation rules may also be redundantly assigned to both the vehicle side and the outside side. Even in this mode, the important process of deleting the security event log can be performed collectively by a device outside the vehicle.

[0098] 5. Summary The features of the log analysis device and the like in each embodiment of the present invention have been described above.

[0099] The terms used in each embodiment are merely examples and may be replaced with synonymous terms or terms having the same functions.

[0100] The block diagrams used to explain the embodiments classify and organize the device configuration by function. The blocks representing each function can be realized by any combination of hardware or software. Furthermore, because they represent functions, the block diagrams can also be understood as disclosures of method inventions and program inventions that realize the methods.

[0101] The order of the functional blocks that can be understood as the processes, flows, and methods described in each embodiment may be changed as long as there are no constraints, such as one step utilizing the results of another step that precedes it.

[0102] The terms first, second, through Nth (N is an integer) used in each embodiment and in the claims are used to distinguish between two or more configurations or methods of the same type, and do not limit the order or superiority or inferiority.

[0103] Furthermore, examples of the configuration of the log analysis device of the present invention include the following. Examples of the component include semiconductor elements, electronic circuits, modules, and microcomputers. Examples of semi-finished products include an electronic control unit (ECU) and a system board. Finished product forms include mobile phones, smartphones, tablets, personal computers (PCs), workstations, and servers. Other examples include devices with communication functions, such as video cameras, still cameras, and car navigation systems.

[0104] Furthermore, necessary functions such as an antenna and a communication interface may be added to the log analysis device.

[0105] The log analysis device of the present invention is expected to be used, particularly on the server side, to provide various services. In providing these services, the log analysis device of the present invention will be used, the method of the present invention will be used, and / or the program of the present invention will be executed.

[0106] In addition, the present invention can be realized not only by dedicated hardware having the configuration and functions described in each embodiment, but also by a combination of a program for realizing the present invention recorded on a recording medium such as a memory or hard disk, and general-purpose hardware having a dedicated or general-purpose CPU and memory that can execute the program.

[0107] A program stored in a non-transitory physical recording medium (for example, an external storage device (hard disk, USB memory, CD / BD, etc.) or an internal storage device (RAM, ROM, etc.)) of dedicated or general-purpose hardware can be provided to the dedicated or general-purpose hardware via a recording medium, or via a communication line from a server without using a recording medium. This makes it possible to always provide the latest functions through program upgrades. [Industrial Applicability]

[0108] The log analysis device of the present invention may be used to analyze security event logs generated by security sensors in electronic control systems other than those installed in vehicles. [Explanation of symbols]

[0109] 10, 20, 31, 32 Log analysis device, 101 Log acquisition unit, 102 Vehicle state information acquisition unit, 103 Log etc. storage unit, 104 Rule storage unit, 105 False positive log determination unit, 106 Log processing unit, 107 Output unit, 108 Deletion unit, 109 Flag information assignment unit, 40 External device

Claims

1. a log acquisition unit (101) that acquires one or more security event logs indicating abnormalities detected by a security sensor of an electronic control device mounted on a vehicle; a vehicle state information acquisition unit (102) that acquires vehicle state information indicating an internal state and / or an external state of the vehicle; a storage unit (104) for storing a false positive determination rule used to determine whether an anomaly indicated by the security event log is a false positive, which is an anomaly not caused by a cyber-attack, and a false positive estimation rule used to determine whether an anomaly indicated by the security event log is likely to be a false positive; a false positive log determination unit (105) that determines, based on the security event log and / or the vehicle state information, whether the security event log is a confirmed false positive log that can be confirmed to be a false positive using the false positive determination rule, and whether the security event log is an estimated false positive log that may be a false positive using the false positive estimation rule; an output unit (107) that does not output the confirmed false positive log, and outputs the estimated false positive log together with flag information indicating an estimated false positive; Log analysis device (10, 20, 31, 32).

2. The false positive determination rule is a rule that uniquely determines the flow from a cause to the occurrence of a result, The false positive inference rule is a rule in which an inference is involved in the flow from a cause to the occurrence of a result. The log analysis device according to claim 1 .

3. The false positive determination rule is a rule that has been determined to be a false positive by a Security Operation Center (SOC) in the past, The false positive estimation rule is a rule that has not previously been used to determine a false positive in the SOC. The log analysis device according to claim 1 .

4. The false positive determination rule and the false positive estimation rule are set to one or more rules for one cause of abnormality occurrence. The log analysis device according to claim 1 .

5. In the case where a plurality of false positive estimation rules are set for one cause of an abnormality, if a predetermined number or more of the rules are satisfied simultaneously, the false positive determination rule is determined. The log analysis device according to claim 4.

6. The false positive determination rule and the false positive estimation rule are updated periodically or irregularly. The log analysis device according to claim 1 .

7. the false positive log determination unit first determines whether the security event log is the confirmed false positive log, and then determines whether the remaining security event logs, excluding the security event log determined to be the confirmed false positive log, are the estimated false positive logs. The log analysis device according to claim 1 .

8. the flag information includes information indicating a degree of possibility that the log is the estimated false positive log; The log analysis device according to claim 1 .

9. The log analysis device is provided outside the vehicle. A log analysis device (10, 31) according to any one of claims 1 to 8.

10. the vehicle state information acquisition unit acquires, as the vehicle state information, external state information indicating an external state of the vehicle; The log analysis device according to claim 9.

11. The log analysis device is mounted on the vehicle. A log analysis device (20, 32) according to any one of claims 1 to 8.

12. the vehicle state information acquisition unit acquires internal state information indicating an internal state of the vehicle as the vehicle state information; The log analysis device according to claim 11.

13. The log analysis device comprises a first log analysis device provided in the vehicle and a second log analysis device provided outside the vehicle. The log analysis device according to claim 1 .

14. A log analysis method executed by a log analysis device (10, 20, 31, 32), The log analysis device has a storage unit (104) that stores a false positive determination rule used to determine whether an anomaly indicated by a security event log is a false positive, which is an anomaly not caused by a cyber-attack, and a false positive estimation rule used to determine whether an anomaly indicated by the security event log is likely to be a false positive, The log analysis method includes: One or more security event logs indicating abnormalities detected by a security sensor of an electronic control unit mounted on a vehicle are acquired (S101); Vehicle state information indicating the internal state and / or external state of the vehicle is acquired (S102); Based on the security event log and / or the vehicle state information, it is determined whether the security event log is a confirmed false positive log that can be confirmed to be a false positive using the false positive determination rule, and whether the security event log is an estimated false positive log that may be a false positive using the false positive estimation rule (S103); The confirmed false positive log is not output, and the estimated false positive log is output together with flag information indicating the estimated false positive (S108). Log analysis methods.

15. A log analysis program executable by a log analysis device (10, 20, 31, 32), The log analysis device has a storage unit (104) that stores a false positive determination rule used to determine whether an anomaly indicated by a security event log is a false positive, which is an anomaly not caused by a cyber-attack, and a false positive estimation rule used to determine whether an anomaly indicated by the security event log is likely to be a false positive, The log analysis method includes: One or more security event logs indicating abnormalities detected by a security sensor of an electronic control unit mounted on a vehicle are acquired (S101); Vehicle state information indicating the internal state and / or external state of the vehicle is acquired (S102); Based on the security event log and / or the vehicle state information, it is determined whether the security event log is a confirmed false positive log that can be confirmed to be a false positive using the false positive determination rule, and whether the security event log is an estimated false positive log that may be a false positive using the false positive estimation rule (S103); The confirmed false positive log is not output, and the estimated false positive log is output together with flag information indicating that it is an estimated false positive (S108), and processing is executed. Log analysis program.

Images