Attack monitoring apparatus, attack monitoring system, and attack monitoring method

Abstract

To provide an attack monitoring apparatus, an attack monitoring system, and an attack monitoring method which enable cyber attack monitoring to be continued with an in-vehicle system with limited resources.SOLUTION: An attack monitoring apparatus 100 mounted on a vehicle V includes: a vehicle-side attack analysis unit 122 which analyzes a log of a first monitoring target 501 based on a threat scenario, to calculate the probability of occurrence of cyberattack; a server-side attack analysis unit 222 which is mounted on a server 200 outside the vehicle V and analyzes a log of a second monitoring target 502 based on the threat scenario, to calculate the probability of occurrence of cyberattack; and an offloading determination unit 124 which determines whether to offload the process of the vehicle-side attack analysis unit 122 to analyze the log of the first monitoring target 501.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to an attack monitoring device, an attack monitoring system, and an attack monitoring method. [Background technology]

[0002] In recent years, in-vehicle systems have been providing various services to users by connecting to devices outside the vehicle via communication networks such as the Internet. For this reason, it is important for recent in-vehicle systems to be prepared for external cyber attacks. For example, Patent Document 1 discloses a monitoring system that includes a monitoring server outside the vehicle and an in-vehicle system implemented in the vehicle, and the monitoring server and the in-vehicle system are connected via an external network. The in-vehicle system includes three or more monitoring units. The three or more monitoring units operate with execution permissions that differ in reliability, and a monitoring unit with a more reliable execution permission monitors the software of a monitoring unit with a less reliable execution permission. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2023-2832 Summary of the Invention [Problem to be solved by the invention]

[0004] However, when detecting a cyber-attack in an in-vehicle system with limited computing resources, such as the monitoring system of Patent Document 1, there is a possibility that the in-vehicle system may run out of computing resources depending on the situation of the cyber-attack, the operating status of the intrusion detection system (IDS), and the operating status of vehicle functions other than security.

[0005] The present invention has been made in consideration of the above points, and aims to provide an attack monitoring device, an attack monitoring system, and an attack monitoring method that can continue to monitor cyber attacks in a lower-resource in-vehicle system. [Means for solving the problem]

[0006] The attack monitoring device of the present invention is an attack monitoring device implemented in a vehicle, and is characterized by having a vehicle-side attack analysis unit that calculates the possibility of a cyber-attack occurring by analyzing the logs of a first monitored target based on a threat scenario, and an offload determination unit that determines whether to offload the process of analyzing the logs of the first monitored target by the vehicle-side attack analysis unit to a server-side attack analysis unit that is implemented in a server outside the vehicle and calculates the possibility of a cyber-attack occurring by analyzing the logs of a second monitored target based on a threat scenario. [Effects of the Invention]

[0007] According to the present invention, it is possible to continue monitoring for cyber attacks using a vehicle system with fewer resources. Further features related to the present invention will become apparent from the description of the present specification and the accompanying drawings. In addition, the problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a schematic diagram illustrating an attack monitoring system according to an embodiment. [Figure 2] FIG. 2 is a functional block diagram of the attack monitoring device of FIG. 1. [Figure 3] A table showing an example of the threat scenario table in Figure 2. [Figure 4] 3 is a table showing an example of the scenario progress management table of FIG. 2. [Figure 5] 3 is a table showing an example of the priority monitoring list of FIG. 2. [Figure 6] 3 is a table showing an example of the offload list of FIG. 2. [Figure 7] Functional block diagram of the server in Figure 1. [Figure 8]8 is a table showing an example of the monitoring status table of FIG. 7; [Figure 9] 8 is a graph showing an example of the processing load graph of FIG. 7; [Figure 10] (A), (B), and (C) are diagrams showing the mapping of security sensors for each cyber attack assumed in the threat scenario. [Figure 11] (A), (B), and (C) are diagrams showing the division of labor in the integrated analysis of logs for each cyber attack assumed in a threat scenario under normal circumstances. [Figure 12] 10 is a flowchart showing the process of executing and stopping intensive monitoring in the attack monitoring device. [Figure 13] 10 is a flowchart showing a process of executing offloading, a process of stopping offloading, and a process of forcibly stopping priority monitoring in an attack monitoring device. [Figure 14] 10 is a flowchart showing the process of executing and stopping offloading in a server. [Figure 15] 10 is a flowchart showing the process of executing intensive monitoring in the attack monitoring device. [Figure 16] 10 is a flowchart showing the process of stopping intensive monitoring in the attack monitoring device. [Figure 17] 10 is a flowchart showing the offload execution process in the attack monitoring device. [Figure 18] 10 is a flowchart showing a process for stopping offloading in the attack monitoring device. [Figure 19] 10 is a flowchart showing the process of forcibly stopping priority monitoring in the attack monitoring device. [Figure 20] (A), (B), and (C) are diagrams showing the division of labor for integrated analysis of logs for each cyber attack assumed in a threat scenario when the attack monitoring device is under high load. [Figure 21] (A), (B), and (C) are diagrams showing the division of responsibilities for integrated analysis of logs for each cyber attack assumed in a threat scenario at the time of an attack. DETAILED DESCRIPTION OF THE INVENTION

[0009] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of an attack monitoring device, an attack monitoring system, and an attack monitoring method according to the present invention will be described with reference to the drawings.

[0010] First, the attack monitoring system 300 of this embodiment will be described. As shown in Fig. 1, the attack monitoring system 300 of this embodiment comprises an attack monitoring device 100 implemented in a vehicle V and a server 200 external to the vehicle V. In the attack monitoring system 300 of this embodiment, the attack monitoring device 100 inside the vehicle V and the server 200 external to the vehicle V work together to analyze cyber-attacks. The attack monitoring device 100 is an integrated ECU (Electronic Control Unit) of the vehicle V, and integrates the detection of attacks in the zone ECUs 103, 104, and 105. The attack monitoring device 100 is a high-performance on-board analysis engine.

[0011] The attack monitoring device 100 is composed of a control device 101 and a database 102. The control device 101 is implemented in, for example, a central gateway that is one of the integrated ECUs that is the attack monitoring device 100, and performs the functions of a system called SIEM (Security Information and Event Management). The control device 101 performs processing as a SIEM by having the CPU (Central Processing Unit) of the control device 101 execute computer programs stored in the ROM (Read Only Memory), RAM (Random Access Memory), and database 102 of the control device 101.

[0012] The SIEM realized by the control device 101 centrally aggregates logs from the zone ECUs 103, 104, and 105 in the vehicle V, combines the data, and performs correlation analysis based on detection rules stored in the database 102, thereby detecting cyber-attacks while reducing false positives. The detection rules stored in the database 102 can be quickly updated to respond to new attacks.

[0013] The zone ECUs 103, 104, and 105 are examples of various ECUs mounted on the vehicle V and controlling various parts of the vehicle V based on information detected by various sensors. The zone ECUs 103, 104, and 105 are, for example, ECUs that play one or more roles in the powertrain system, chassis system, body system, multimedia system, and ADAS system. Examples of the powertrain system ECUs include an engine ECU, a transmission ECU, and a hybrid ECU. Examples of the chassis system ECUs include a power steering ECU and a brake / accelerator ECU.

[0014] Body-related ECUs include, for example, ECUs for wipers, automatic doors, power windows, keyless entry, power door mirrors, interior lighting, headlights, tire pressure monitoring systems, and immobilizers (anti-theft devices).Multimedia-related ECUs include, for example, ECUs for navigation systems, ETC (Electronic Toll Collection Systems), audio systems, and backup monitors.ADAS (Advanced Driver Assistance Systems)-related ECUs include, for example, driving assistance ECUs, stereo camera ECUs, perimeter monitoring ECUs, locator ECUs, and autonomous driving ECUs.

[0015] The zone ECUs 103, 104, and 105 of the vehicle V are each composed of a control device 106, 107, and 108 and a database 109, 110, and 111. The control devices 106, 107, and 108 fulfill the function of a system called an IDS (Intrusion Detection System). The control devices 106, 107, and 108 perform processing as an IDS by the CPU of the control devices 106, 107, and 108 executing computer programs stored in the ROM and RAM of the control devices 106, 107, and 108 and the databases 109, 110, and 111.

[0016] The IDS realized by the control devices 106, 107, and 108 detects attacks on the nodes of each part of the vehicle V based on detection rules stored in databases 109, 110, and 111. Detection logs from the control devices 106, 107, and 108 are sent to the control device 101 of the attack monitoring device 100, where correlation analysis is performed.

[0017] The server 200 is composed of a control device 201 and a database 202. Note that the server 200 is intended as a processing device capable of transmitting and receiving information to and from a communication device via a communication line or the like, and does not refer to hardware such as a personal computer or embedded information device. The control device 201 performs the functions of a system called SIEM in, for example, a VSOC (Vehicle Security Operations Center). The control device 201 performs processing as an SIEM by having the CPU of the control device 201 execute computer programs stored in the ROM, RAM, and database 202 of the control device 201.

[0018] The SIEM realized by the control device 201 centrally aggregates logs from the control device 101 of the attack monitoring device 100 on the server 200, combines the data, and performs correlation analysis based on detection rules stored in the database 202 to detect cyber-attacks. The detection rules stored in the database 202 are reliable and effective detection rules. The detection rules stored in the database 202 have been created using an automotive risk assessment method to address threats stipulated in UNR155, a cybersecurity regulation for automobiles issued by the United Nations Economic Commission for Europe (UNECE).

[0019] The SIEM realized by the control device 201, the SIEM realized by the control device 101, and the control devices 106, 107, and 108 can be optimized for various vehicle V architectures by hierarchically sharing the log analysis.

[0020] The configuration of the attack monitoring device 100 will be described in more detail below. In the attack monitoring device 100, the control device 101 constructs functional blocks as shown in FIG. 2 by having the CPU of the control device 101 execute computer programs stored in the ROM, RAM, and database 102 of the control device 101. The attack monitoring device 100 has, as its functional blocks, a log collection unit 121, a vehicle-side attack analysis unit 122, a priority monitoring determination unit 123, an offload determination unit 124, a processing load measurement unit 125, a communication unit 126, and a memory unit 130. The memory unit 130 includes a threat scenario table 131, a scenario progress management table 132, a priority monitoring list 133, an offload list 134, and a log 135. The contents of the threat scenario table 131, the scenario progress management table 132, the priority monitoring list 133, and the offload list 134 reflect the detection rules stored in the database 102.

[0021] The log collection unit 121 collects logs from the attack monitoring device 100 and the zone ECUs 103, 104, and 105. The log collection unit 121 also collects security events from the security sensors of the server 200.

[0022] The vehicle-side attack analysis unit 122 calculates the likelihood of a cyber-attack occurring by analyzing the logs and security events of the first monitoring target (described later) based on the threat scenarios in the threat scenario table 131. A threat scenario is information summarizing the steps of a cyber-attack, including the critical path and events that will occur, for a possible cyber-attack, and is, for example, in accordance with MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge).

[0023] The vehicle-side attack analysis unit 122 calculates the likelihood of a cyber-attack assumed in each threat scenario by analyzing the logs and security events of the first monitoring target based on the multiple threat scenarios in the scenario progress management table 132. If the likelihood of a cyber-attack calculated by the vehicle-side attack analysis unit 122 exceeds the cyber-attack occurrence threshold assumed in each threat scenario in the threat scenario table 131, the vehicle-side attack analysis unit 122 determines that a cyber-attack assumed in the threat scenario has occurred.

[0024] The priority monitoring determination unit 123 determines whether to perform priority monitoring of a cyber-attack assumed in the threat scenario. The priority monitoring determination unit 123 determines to have the vehicle-side attack analysis unit 122 perform priority monitoring when the likelihood of a cyber-attack assumed in the threat scenario calculated by the vehicle-side attack analysis unit 122 exceeds the likelihood threshold of the priority monitoring list 133. The priority monitoring involves changing either the scope of the first monitoring target for which the vehicle-side attack analysis unit 122 processes the analysis of logs and security events based on the threat scenario, or the content of the analysis of logs and security events of the first monitoring target based on the threat scenario by the vehicle-side attack analysis unit 122.

[0025] The likelihood of a cyber-attack assumed in a threat scenario is, for example, a value indicating how many of the events constituting the threat scenario have been observed. The value indicating how many of the events constituting the threat scenario have been observed is, for example, the ratio of the number of nodes where anomalies have been observed to the number of nodes constituting the critical path in a threat scenario conforming to ATT&CK. The occurrence threshold and the likelihood threshold are both thresholds for the likelihood of a cyber-attack assumed in each threat scenario, but the likelihood threshold for determining the execution of intensive monitoring is set to a lower value than the occurrence threshold for determining the occurrence of a cyber-attack.

[0026] When the likelihood of a cyberattack assumed in a threat scenario exceeds the likelihood threshold, the priority monitoring determination unit 123 determines to cause the vehicle-side attack analysis unit 122 to perform priority monitoring of the cyberattack assumed in the threat scenario. The priority monitoring determination unit 123 performs priority monitoring of the cyberattacks assumed in the threat scenario in order of priority monitoring priority in the priority monitoring list 133, which records the priority monitoring priority for each cyberattack assumed in each threat scenario. Performing priority monitoring in order of priority monitoring priority means, for example, when there are multiple cyberattacks assumed in threat scenarios whose likelihood exceeds the likelihood threshold, first performing priority monitoring of the cyberattack assumed in the threat scenario with the highest priority monitoring priority, and then performing priority monitoring of the cyberattacks assumed in the threat scenarios with the second or subsequent priority monitoring priorities. This is because the likelihood of a cyberattack assumed in a threat scenario increases, making it necessary to strengthen monitoring of cyberattacks.

[0027] On the other hand, when the likelihood of a cyber-attack assumed in a threat scenario for which intensive monitoring is being performed is equal to or less than the likelihood threshold, the intensive monitoring determination unit 123 determines to cause the vehicle-side attack analysis unit 122 to stop intensive monitoring of the cyber-attack assumed in the threat scenario for which intensive monitoring is being performed. This is because the likelihood of a cyber-attack assumed in the threat scenario for which intensive monitoring is being performed decreases, making it unnecessary to strengthen monitoring of the cyber-attack, and making it necessary to reduce the processing load of the attack monitoring device 100. Note that intensive monitoring priority is, for example, a priority based on the ranking of cyber-attacks assumed in the threat scenario for which intensive monitoring is being performed. The higher the intensive monitoring priority of a cyber-attack assumed in a threat scenario, the more important it is to monitor the cyber-attack.

[0028] The offload determination unit 124 determines whether to offload the processing of analyzing the logs and security events of the first monitoring target by the vehicle-side attack analysis unit 122 to a server-side attack analysis unit 222 that is implemented in a server 200 outside the vehicle V (described later) and calculates the likelihood of a cyber-attack occurring by analyzing the logs and security events of the second monitoring target based on a threat scenario. Offloading specifically refers to transferring the processing of analyzing the logs of the first monitoring target by the vehicle-side attack analysis unit 122 to the server-side attack analysis unit 222 of the server 200, i.e., spatial offloading. Stopping offloading (described later) specifically refers to restoring the state in which the processing of analyzing the logs of the first monitoring target by the vehicle-side attack analysis unit 122 was transferred to the server-side attack analysis unit 222 of the server 200, and causing the vehicle-side attack analysis unit 122 to execute the processing of analyzing the logs of the first monitoring target.

[0029] When the processing load measured by the processing load measurement unit 125, which measures the processing load of the attack monitoring device 100, exceeds the processing load threshold for starting offloading (first processing load threshold), the offload determination unit 124 determines to have the server-side attack analysis unit 222 offload the processing of analyzing the logs and security events of the first monitoring target by the vehicle-side attack analysis unit 122.

[0030] When the processing load measured by the processing load measurement unit 125 exceeds the processing load threshold for starting offloading, the offload determination unit 124 determines to have the server-side attack analysis unit 222 execute offloading of the processing of the analysis of the log and security events of the first monitoring target based on the threat scenario by the vehicle-side attack analysis unit 122 in the order of the processing of the analysis of the log of the first monitoring target based on the threat scenario with the highest offload priority in the offload list 134, which records the offload priority for each processing of the analysis of the log of the first monitoring target based on each threat scenario. This is because the processing of the analysis of the log of the first monitoring target based on the threat scenario with the highest offload priority is less important for monitoring cyber attacks, and it is preferable to reduce the processing load of the attack monitoring device 100 by offloading. Note that the offload priority is, for example, a priority based on the ranking of the processing of the analysis of the log of the first monitoring target based on the threat scenario to be offloaded. The higher the offload priority, the less important the cyber attack is to be monitored for a cyber attack assumed in the threat scenario.

[0031] On the other hand, when the processing load measured by the processing load measurement unit 125 is equal to or less than the processing load threshold for stopping offloading (second processing load threshold), the offload determination unit 124 determines to cause the server-side attack analysis unit 222 to stop offloading the processing of analyzing the logs and security events of the first monitoring target based on a threat scenario having a low offload priority in the offload list 134. The processing of analyzing the logs of the first monitoring target based on a threat scenario having a low offload priority is of high importance for monitoring cyber-attacks by the attack monitoring device 100 on the vehicle V. Therefore, it is preferable to return to the original state in which the vehicle-side attack analysis unit 122 executes the processing of analyzing the logs of the first monitoring target by stopping offloading, thereby strengthening the monitoring of cyber-attacks by the attack monitoring device 100 on the vehicle V. The processing load threshold for starting offloading and the processing load threshold for stopping offloading may be different values, and the processing load threshold for starting offloading is equal to or greater than the processing load threshold for stopping offloading.

[0032] The processing load measurement unit 125 measures the processing load of the attack monitoring device 100. The processing load measurement unit 125 measures, for example, the utilization rate of the CPU (Central Processing Unit) of the integrated ECU of the attack monitoring device 100 as the processing load.

[0033] The communication unit 126 communicates with the server 200 and the zone ECUs 103, 104, and 105. The communication unit 126 transmits the processing load measured by the processing load measurement unit 125 to the server 200 outside the vehicle V. The communication unit 126 also transmits to the server 200 an offload execution request including processing for analyzing the log of the first monitoring target based on a threat scenario for performing offloading, offloading details, and detection logic for when offloading is performed. The communication unit 126 also transmits to the server 200 an offload stop request including processing for analyzing the log of the first monitoring target based on a threat scenario for stopping offloading.

[0034] The threat scenario table 131 is a table in which threat scenarios, detection logic for calculating the likelihood of a cyber-attack occurring based on the threat scenario, and the cyber-attack occurrence threshold value assumed in the threat scenario are recorded in association with each other. As shown in FIG. 3, for example, the threat scenario table 131 records a threat scenario ID, a threat scenario name, a monitoring logic, and a cyber-attack occurrence threshold value assumed in each threat scenario in association with each other. In the monitoring logic, f_i() means the logic executed by the attack monitoring device 100 of the vehicle V, and g_j() means the logic executed by the server 200. In the monitoring logic, for example, g_2(log 8, f_2(log 6, log 7)) means that the server 200 analyzes log 8 and the output of the analysis of logs 6 and 7 by the attack monitoring device 100 of the vehicle V.

[0035] The scenario progress management table 132 shown in Fig. 2 is a table in which the likelihood of a cyber-attack occurring assumed in a threat scenario calculated by the vehicle-side attack analysis unit 122 and a list of logs used for the calculation are recorded in association with each other. As shown in Fig. 4, for example, the scenario progress management table 132 records the ID of an ongoing threat scenario in which a cyber-attack is likely to occur, the name of the threat scenario, a log list, and the likelihood of a cyber-attack occurring assumed in the threat scenario in association with each other.

[0036] The priority monitoring list 133 shown in Figure 2 is a table that records threat scenarios and the priority monitoring priorities for each cyber attack assumed in each threat scenario. The priority monitoring list 133 records, in association with each other, the cyber attacks assumed in the threat scenarios for which priority monitoring is required, the priority monitoring details for the cyber attacks assumed in the threat scenarios for which priority monitoring is required, the detection logic for the priority monitoring, the probability threshold for the cyber attacks assumed in the threat scenarios for which priority monitoring is required, the priority monitoring priority, and the priority monitoring status. As shown in Figure 5, for example, the priority monitoring list 133 records, in association with each other, the priority monitoring ID indicating the cyber attacks assumed in the threat scenarios for which priority monitoring is required, the threat scenario name, the priority monitoring details, the priority monitoring logic, the probability threshold for the cyber attacks assumed in the threat scenarios for which priority monitoring is required, the priority monitoring priority, and the priority monitoring status.

[0037] The content of focused monitoring is, for example, a method for focused monitoring of cyber attacks assumed in a threat scenario. The method for focused monitoring of cyber attacks assumed in a threat scenario is, for example, expanding the monitoring range of the logs of the threat scenario and expanding the range of logs for which correlation analysis is performed in the detection logic of the cyber attacks assumed in the threat scenario. The focused monitoring state is, for example, one of three states: "in progress" when focused monitoring is being performed, "stopped" when focused monitoring is not being performed, and "forced stopped" when focused monitoring, which will be described later, is forcibly stopped.

[0038] The offload list 134 shown in Fig. 2 is a table in which the offload priority for each process of analyzing the log of the first monitoring target based on each threat scenario is recorded. The offload list 134 associates and records the process of analyzing the log of the first monitoring target based on the threat scenario to be offloaded, the offload content, the detection logic in the case of offloading, the offload priority, and the offload status. As shown in Fig. 6, for example, the offload list 134 associates and records the offload ID indicating the process of analyzing the log of the first monitoring target based on the threat scenario to be offloaded, the threat scenario name, the offload content indicating the details of the offload, the offload details indicating the detection logic in server 200 in the case of offloading, the offload priority, and the offload status.

[0039] The offloading content may be, for example, moving the analysis of the log of the first monitoring target by the vehicle-side attack analysis unit 122 to the server-side attack analysis unit 222 of the server 200, i.e., spatial offloading, as described above. The offloading content may also include, for example, delaying the analysis of the log of the first monitoring target by the vehicle-side attack analysis unit 122, i.e., temporal offloading. The offloading content may also include, for example, reducing the range of logs that are analyzed by the vehicle-side attack analysis unit 122 for the first monitoring target. The offloading state may be one of two states: "running," in which offloading is being performed, or "stopped," in which offloading is not being performed.

[0040] 2 stores logs and security events collected by the log collection unit 121. The log 135 stores logs output by the vehicle-side attack analysis unit 122, the priority monitoring determination unit 123, the offload determination unit 124, and the processing load measurement unit 125.

[0041] The configuration of the server 200 will be described in further detail below. In the server 200, the control device 201 constructs functional blocks as shown in FIG. 7 by having the CPU of the control device 201 execute computer programs stored in the ROM, RAM, and database 202 of the control device 201 in accordance with detection rules stored in the database 202. As shown in FIG. 7, the server 200 includes a log collection unit 221, a server-side attack analysis unit 222, an offload reception unit 223, a display unit 224, a communication unit 227, and a memory unit 230. The display unit 224 includes a monitoring status table 225 and a processing load graph 226. The memory unit 230 includes a threat scenario table 231, a scenario progress management table 232, an offload list 233, and a log 234. The contents of the threat scenario table 231, the scenario progress management table 232, and the offload list 233 reflect the detection rules stored in the database 202.

[0042] The log collection unit 221 collects logs from the attack monitoring device 100 and the zone ECUs 103, 104, and 105. The log collection unit 221 also collects security events from the security sensors of the server 200.

[0043] The server-side attack analysis unit 222 is implemented in the server 200 outside the vehicle V and calculates the likelihood of a cyber-attack occurring by analyzing the logs and security events of the second monitoring target, which will be described later, based on a threat scenario. The server-side attack analysis unit 222 calculates the likelihood of a cyber-attack assumed in each threat scenario by analyzing the logs and security events of the second monitoring target based on multiple threat scenarios in the threat scenario table 231. If the likelihood of a cyber-attack calculated by the server-side attack analysis unit 222 exceeds the threshold for occurrence of a cyber-attack assumed in each threat scenario in the threat scenario table 231, the server-side attack analysis unit 222 determines that a cyber-attack assumed in the threat scenario has occurred.

[0044] The offload reception unit 223 receives an offload execution request from the attack monitoring device 100. When the offload determination unit 124 of the attack monitoring device 100 determines to have the server-side attack analysis unit 222 offload the process of analyzing the log of the first monitoring target by the vehicle-side attack analysis unit 122, and the offload reception unit 223 receives the offload execution request from the attack monitoring device 100, the server-side attack analysis unit 222 executes at least a part of the process of analyzing the log of the first monitoring target by the vehicle-side attack analysis unit 122. In other words, the server-side attack analysis unit 222 includes at least a part of the first monitoring target by the vehicle-side attack analysis unit 122 in the second monitoring target.

[0045] The server-side attack analysis unit 222 performs processing to analyze the logs and security events of the first monitoring target included in the second monitoring target, in accordance with the offload content and detection logic for offloading included in the offload request from the attack monitoring device 100 received by the offload reception unit 223. The offload reception unit 223 receives an offload stop request from the attack monitoring device 100. When the offload determination unit 124 of the attack monitoring device 100 determines to cause the server-side attack analysis unit 222 to stop offloading the processing of analyzing the logs of the first monitoring target by the vehicle-side attack analysis unit 122, and the offload reception unit 223 receives the offload stop request from the attack monitoring device 100, the server-side attack analysis unit 222 stops the execution of the processing of analyzing the logs of the first monitoring target by the vehicle-side attack analysis unit 122.

[0046] The display unit 224 displays a monitoring status table 225 and a processing load graph 226 on the screen. As shown in Fig. 8, for example, the monitoring status table 225 is a table that displays, for each threat scenario ID, the threat scenario name, the intensive monitoring status, and the offload status. As shown in Fig. 9, for example, the processing load graph 226 displays the CPU usage rate, which is the processing load measured by the processing load measurement unit 125 of the attack monitoring device 100 for each hour. In the example of Fig. 9, the CPU usage rate increases after intensive monitoring is performed, and decreases after offloading is performed.

[0047] 7 communicates with the attack monitoring device 100 and the zone ECUs 103, 104, and 105. The communication unit 227 receives the processing load of the attack monitoring device 100 transmitted by the communication unit 126 of the attack monitoring device 100. The communication unit 227 also receives an offload execution request transmitted by the communication unit 126 of the attack monitoring device 100, the offload execution request including the process of analyzing the log of the first monitoring target based on a threat scenario for offloading, the offload content, and the detection logic for when offloading is performed. The communication unit 227 also receives an offload stop request transmitted by the communication unit 126 of the attack monitoring device 100, the offload stop request including the process of analyzing the log of the first monitoring target based on a threat scenario for stopping offloading.

[0048] The threat scenario table 231, scenario progress management table 232, and offload list 233 in the memory unit 230 correspond to the threat scenario table 131, scenario progress management table 132, and offload list 134 in the memory unit 130 of the attack monitoring device 100, respectively. The log 234 stores logs and security events collected by the log collection unit 221. The log 234 stores logs output by the server-side attack analysis unit 222 and the offload reception unit 223.

[0049] In operations related to the server 200, the priority monitoring judgment unit 123 of the attack monitoring device 100 shown in Figure 2 judges that when the processing load measured by the processing load measurement unit 125 exceeds the processing load threshold for starting offloading and there is no processing of analyzing the logs of the first monitoring target based on a threat scenario that has not caused the server-side attack analysis unit 222 to offload the processing of analyzing the logs of the first monitoring target based on a threat scenario by the vehicle-side attack analysis unit 122, the priority monitoring judgment unit 123 determines that the vehicle-side attack analysis unit 122 should forcibly stop the priority monitoring of the cyber attacks assumed in the threat scenarios, in the order of the cyber attacks assumed in the threat scenarios with the lowest priority monitoring priority in the priority monitoring list 133.

[0050] This is because the processing load on the attack monitoring device 100 is high, there is no processing to analyze the logs of the first monitoring target based on a threat scenario for which offloading is not being performed, and further offloading is not possible, so it is preferable to forcibly stop priority monitoring and reduce the processing load on the attack monitoring device 100.

[0051] The intensive monitoring determination unit 123 determines that the vehicle-side attack analysis unit 122 should not perform intensive monitoring of the cyber-attack assumed in the threat scenario that caused the intensive monitoring to be forcibly stopped, even if the likelihood of the cyber-attack assumed in the threat scenario exceeds the likelihood threshold before the specified time has elapsed. This is because, since the time that has passed since the forced stop is short and there is a high likelihood that the situation will not change much, it is preferable to continue the forced stop and reduce the processing load on the attack monitoring device 100.

[0052] On the other hand, for a cyber-attack assumed in the threat scenario that caused the intensive monitoring to be forcibly stopped, when the likelihood of the cyber-attack assumed in the threat scenario exceeds the likelihood threshold after a specified time has elapsed, the intensive monitoring determination unit 123 determines to cause the vehicle-side attack analysis unit 122 to perform intensive monitoring of the cyber-attack assumed in the threat scenario. Because a long time has passed since the forced stop and there is a high possibility that the situation will change significantly, it is preferable to stop the forced stop and strengthen monitoring against the cyber-attack whose likelihood of occurrence has increased.

[0053] The following explains the division of responsibilities for the integrated analysis of logs against cyber-attacks assumed in the threat scenario. Figure 10(A) shows nodes 401, 402, 403, 404, 411, 412, and 421 that make up the critical path in the case of unauthorized operation of vehicle V by a malicious ECU. Cyber-attacks against nodes 401, 402, 403, and 404 are detected by sensors in control devices 106, 107, and 108 of zone ECUs 103, 104, and 105. Cyber-attacks against nodes 411 and 412 are detected by sensors in the control device 101 of the attack monitoring device 100, i.e., by the vehicle-side attack analysis unit 122. Cyber-attacks against node 421 are detected by sensors in the control device 201 of the server 200, i.e., by the server-side attack analysis unit 222.

[0054] 10(B) shows nodes 405, 406, 413, and 422 that make up the critical path in a vehicle theft caused by a Controller Area Network (CAN) invader. A cyberattack on nodes 405 and 406 is detected by sensors in the control devices 106, 107, and 108 of the zone ECUs 103, 104, and 105. A cyberattack on node 413 is detected by a sensor in the control device 101 of the attack monitoring device 100, i.e., by the vehicle-side attack analysis unit 122. A cyberattack on node 422 is detected by a sensor in the control device 201 of the server 200, i.e., by the server-side attack analysis unit 222.

[0055] 10(C) shows nodes 423, 424, 414, 407, and 408 that make up the critical path in the case of unauthorized remote operation from the server 200. Cyberattacks on nodes 423 and 424 are detected by the sensor of the control device 201 of the server 200, i.e., the server-side attack analysis unit 222. Cyberattacks on node 414 are detected by the sensor of the control device 101 of the attack monitoring device 100, i.e., the vehicle-side attack analysis unit 122. Cyberattacks on nodes 407 and 408 are detected by the sensors of the control devices 106, 107, and 108 of the zone ECUs 103, 104, and 105.

[0056] The integrated analysis of the logs of the nodes that make up the critical path of these cyber-attacks is shared between the vehicle-side attack analysis unit 122 of the attack monitoring device 100 and the server-side attack analysis unit 222 of the server 200. As shown in Figure 11 (A), in the event of unauthorized operation of the vehicle V by a fraudulent ECU, under normal circumstances, the vehicle-side attack analysis unit 122 of the attack monitoring device 100 calculates the possibility of a cyber-attack occurring by analyzing the logs of nodes 401, 402, 403, 404, 411, and 412, which are the first monitoring target 501, based on a threat scenario, and the server-side attack analysis unit 222 of the server 200 calculates the possibility of a cyber-attack occurring by analyzing the logs of nodes 412 and 421, which are the second monitoring target 502, based on the threat scenario.

[0057] As shown in Figure 11(B), in the case of vehicle theft by a CAN invader, under normal circumstances, the vehicle-side attack analysis unit 122 of the attack monitoring device 100 calculates the possibility of a cyber-attack occurring by analyzing the logs of nodes 405, 406, and 413, which are the first monitored target 501, based on the threat scenario, and the server-side attack analysis unit 222 of the server 200 calculates the possibility of a cyber-attack occurring by analyzing the logs of nodes 413 and 422, which are the second monitored target 502, based on the threat scenario.

[0058] As shown in Figure 11 (C), in the case of unauthorized remote operation from server 200, under normal circumstances, the server-side attack analysis unit 222 of server 200 calculates the possibility of a cyber-attack occurring by analyzing the logs of nodes 423, 424, and 414, which are the second monitored target 502, based on the threat scenario, and the vehicle-side attack analysis unit 122 of the attack monitoring device 100 calculates the possibility of a cyber-attack occurring by analyzing the logs of nodes 414, 407, and 408, which are the first monitored target 501, based on the threat scenario.

[0059] For nodes where the first monitoring target 501 and the second monitoring target 502 overlap, the vehicle-side attack analysis unit 122 of the attack monitoring device 100 and the server-side attack analysis unit 222 of the server 200 work together to analyze logs based on threat scenarios. In this embodiment, the execution location of the cyber-attack detection logic is dynamically changed between the attack monitoring device 100 and the server 200 depending on the processing load of the attack monitoring device 100 and the status of the cyber-attack, and the first monitoring target 501 and the second monitoring target 502 of the cyber-attack detection logic are expanded and contracted relative to each other.

[0060]

[0083] Below, an outline of the intensive monitoring and off-loading operations of the attack monitoring device 100 will be described with reference to Figures 12 and 13. The intensive monitoring operation shown in Figure 12 and the off-loading operation shown in Figure 13 are performed in parallel. As shown in Figure 12, in the intensive monitoring operation, the intensive monitoring determination unit 123 of the attack monitoring device 100 determines whether or not there is a cyber-attack predicted in a threat scenario in which the possibility of an attack is increasing (S11). When the intensive monitoring determination unit 123 determines that there is a cyber-attack predicted in a threat scenario in which the possibility of an attack is increasing (S11), the intensive monitoring determination unit 123 determines whether or not to perform intensive monitoring (S12). When the intensive monitoring determination unit 123 determines to perform intensive monitoring, the intensive monitoring determination unit 123 causes the vehicle-side attack analysis unit 122 to perform intensive monitoring (S13).

[0061] When the vehicle-side attack analysis unit 122 is performing intensive monitoring, the intensive monitoring determination unit 123 determines whether to continue the intensive monitoring (S14). When the intensive monitoring determination unit 123 determines to continue the intensive monitoring (S14), the intensive monitoring determination unit 123 causes the vehicle-side attack analysis unit 122 to perform intensive monitoring (S13). When the intensive monitoring determination unit 123 determines not to continue the intensive monitoring (S14), the intensive monitoring determination unit 123 causes the vehicle-side attack analysis unit 122 to stop the intensive monitoring (S15). When the intensive monitoring determination unit 123 determines that there is no cyber-attack assumed in a threat scenario in which the possibility of attack is increasing (S11), the intensive monitoring determination unit 123 ends the processing. When the intensive monitoring determination unit 123 determines not to perform intensive monitoring (S12), the intensive monitoring determination unit 123 ends the processing.

[0062] 13, in the offloading operation, the offloading determination unit 124 determines whether the processing load on the attack monitoring device 100 is increasing (S21). When the offloading determination unit 124 determines that the processing load on the attack monitoring device 100 is increasing (S21), the offloading determination unit 124 determines whether offloading to the server 200 is possible (S22). When the offloading determination unit 124 determines that offloading to the server 200 is possible (S22), the offloading determination unit 124 causes the communication unit 126 to send an offloading execution request to the server 200, causing the server 200 to execute the offloading (S23).

[0063] When the offload determination unit 124 is causing the server 200 to execute offloading (S23), the offload determination unit 124 determines whether the processing load has decreased sufficiently (S24). When the offload determination unit 124 determines that the processing load has not decreased sufficiently (S24), the offload determination unit 124 causes the server 200 to execute offloading (S23). When the offload determination unit 124 determines that the processing load has decreased sufficiently (S24), the offload determination unit 124 causes the communication unit 126 to send an offload stop request to the server 200, causing the server 200 to stop offloading (S25).

[0064] When the offload determination unit 124 determines that the processing load of the attack monitoring device 100 is not increasing (S21), the offload determination unit 124 terminates the processing. When the offload determination unit 124 determines that offloading to the server 200 is not possible (S22), the intensive monitoring determination unit 123 determines whether or not there is a cyber-attack anticipated in the threat scenario for which intensive monitoring is being performed (S26). When the intensive monitoring determination unit 123 determines that there is a cyber-attack anticipated in the threat scenario for which intensive monitoring is being performed (S26), the intensive monitoring determination unit 123 forcibly stops the intensive monitoring by the vehicle-side attack analysis unit 122 (S27). When the intensive monitoring determination unit 123 determines that there is no cyber-attack anticipated in the threat scenario for which intensive monitoring is being performed (S26), the intensive monitoring determination unit 123 terminates the processing.

[0065] The offloading operation of the server 200 will be described below with reference to Fig. 14. The offloading reception unit 223 of the server 200 determines whether the communication unit 227 has received an offloading execution request from the communication unit 126 of the attack monitoring device 100 (S31). When the offloading reception unit 223 determines that the communication unit 227 has received an offloading execution request (S31), the server-side attack analysis unit 222 executes the offloading (S32). The server-side attack analysis unit 222 executes at least a part of the processing of analyzing the log of the first monitoring target by the vehicle-side attack analysis unit 122.

[0066] When the server-side attack analysis unit 222 is executing offloading (S32), the offload reception unit 223 determines whether the communication unit 227 has received an offloading stop request from the communication unit 126 of the attack monitoring device 100 (S33). When the offload reception unit 223 determines that the communication unit 227 has not received an offloading stop request (S33), the server-side attack analysis unit 222 executes offloading (S32). When the offload reception unit 223 determines that the communication unit 227 has received an offloading stop request (S33), the server-side attack analysis unit 222 stops offloading (S34). The server-side attack analysis unit 222 stops the analysis of the log of the first monitoring target by the vehicle-side attack analysis unit 122. When the offload reception unit 223 determines that the communication unit 227 has not received an offloading execution request (S31), the offload reception unit 223 ends the process.

[0067] The above-mentioned priority monitoring operation shown in Fig. 12 and the offload operation shown in Fig. 13 in the attack monitoring device 100 are specifically realized by the integrated ECU, which is the attack monitoring device 100, periodically and repeatedly executing the flowcharts in Figs. 15 to 19, which will be described below. First, the process of executing priority monitoring will be described. As shown in Fig. 15, the priority monitoring determination unit 123 refers to the scenario progress management table 132 and the priority monitoring list 133, and determines whether there is a cyber-attack assumed in a threat scenario whose likelihood of occurrence exceeds the likelihood threshold and whose priority monitoring status is currently suspended (S101).

[0068] When the priority monitoring determination unit 123 determines that there is a cyber-attack assumed in a threat scenario whose likelihood exceeds the likelihood threshold and whose priority monitoring status is currently stopped (S101), the priority monitoring determination unit 123 refers to the scenario progress management table 132 and the priority monitoring list 133, and causes the vehicle-side attack analysis unit 122 to perform priority monitoring of the cyber-attack assumed in the threat scenario with the highest priority monitoring priority among the cyber-attacks assumed in the threat scenarios whose likelihood exceeds the likelihood threshold and whose priority monitoring status is currently stopped, and changes the priority monitoring status of the cyber-attack assumed in that threat scenario in the priority monitoring list 133 to "on hold" (S102). When the priority monitoring determination unit 123 determines that there is no cyber-attack assumed in a threat scenario whose likelihood exceeds the likelihood threshold and whose priority monitoring status is currently stopped (S101), the priority monitoring determination unit 123 ends the processing.

[0069] Next, the process of stopping priority monitoring will be described. As shown in Fig. 16, the priority monitoring determination unit 123 refers to the scenario progress management table 132 and the priority monitoring list 133, and determines whether or not there is a cyber-attack assumed in a threat scenario in which the priority monitoring state is active and the likelihood of occurrence is equal to or less than the likelihood threshold (S201).

[0070] When the priority monitoring determination unit 123 determines that the priority monitoring state is active and that there is a cyber-attack assumed in a threat scenario whose likelihood of occurrence is equal to or less than the likelihood threshold (S201), the priority monitoring determination unit 123 refers to the scenario progress management table 132 and the priority monitoring list 133, and causes the vehicle-side attack analysis unit 122 to stop the corresponding priority monitoring for all threat scenarios for which the priority monitoring state is active and whose likelihood of occurrence is equal to or less than the likelihood threshold, and changes the priority monitoring state of the threat scenario in the priority monitoring list 133 to "stopped" (S202). When the priority monitoring determination unit 123 determines that the priority monitoring state is active and that there is no cyber-attack assumed in a threat scenario whose likelihood of occurrence is equal to or less than the likelihood threshold (S201), the priority monitoring determination unit 123 ends the processing.

[0071] Next, the offload execution process will be described. As shown in Fig. 17, the offload determination unit 124 determines whether the processing load of the attack monitoring device 100 measured by the processing load measurement unit 125 exceeds the processing load threshold for starting offloading (S301). When the offload determination unit 124 determines that the processing load exceeds the processing load threshold for starting offloading (S301), the offload determination unit 124 refers to the offload list 134 and determines whether there is a process for analyzing the log of the first monitoring target 501 based on a threat scenario whose offload status is currently stopped (S302).

[0072] When the offload determination unit 124 determines that there is a process for analyzing the log of the first monitoring target 501 based on a threat scenario in which the offload state is stopped (S302), the offload determination unit 124 refers to the offload list 134, determines to execute offloading of the process for analyzing the log of the first monitoring target 501 based on the threat scenario with the highest offload priority among the processes for analyzing the log of the first monitoring target 501 based on the threat scenario in which the offload state is stopped, and changes the offload state of the process for analyzing the log of the first monitoring target 501 based on the threat scenario in the offload list 134 to "in progress" (S303). The offload determination unit 124 causes the vehicle-side attack analysis unit 122 to change the process for analyzing the log of the first monitoring target 501 based on the threat scenario in accordance with the offload content and offload details in the offload list 134, and causes the communication unit 126 to send an offload execution request to the server 200.

[0073] When the offload determination unit 124 determines that the processing load does not exceed the processing load threshold for starting offloading (S301), the offload determination unit 124 terminates the processing. When the offload determination unit 124 determines that there is no processing of analyzing the log of the first monitoring target 501 based on a threat scenario for which the offload state is stopped (S302), that is, when the offload state of the processing of analyzing the log of the first monitoring target 501 based on all threat scenarios is running, the intensive monitoring determination unit 123 causes the vehicle-side attack analysis unit 122 to execute processing to forcibly stop the intensive monitoring of cyber-attacks assumed in the threat scenarios, as shown in FIG.

[0074] 18, the offload determination unit 124 refers to the offload list 134 and determines whether or not there is a log analysis process for the first monitoring target 501 based on a threat scenario in which the processing load of the attack monitoring device 100 measured by the processing load measurement unit 125 is equal to or less than the processing load threshold for stopping offload and the offload state is active (S401).

[0075] When the offload determination unit 124 determines that the processing load is equal to or less than the processing load threshold for stopping offloading and that there is processing of log analysis of the first monitoring target 501 based on a threat scenario for which the offload status is running (S401), the offload determination unit 124 refers to the offload list 134, determines to stop offloading of the processing of log analysis of the first monitoring target 501 based on the threat scenario with the lowest offload priority, and changes the offload status of the processing of log analysis of the first monitoring target 501 based on that threat scenario in the offload list 134 to stopped (S402). The offload determination unit 124 causes the vehicle-side attack analysis unit 122 to change the processing of log analysis of the first monitoring target 501 to that of normal status, and causes the communication unit 126 to send an offload stop request to the server 200. When the offload determination unit 124 determines that the processing load is below the processing load threshold for stopping offloading and there is no processing of analyzing the log of the first monitoring target 501 based on a threat scenario in which the offload state is running (S401), the offload determination unit 124 terminates the processing.

[0076] Finally, the process of forcibly stopping priority monitoring will be described. When the offload determination unit 124 determines that the processing load exceeds the processing load threshold for starting offloading and that there is no threat scenario in which the offload state is currently stopped, the priority monitoring determination unit 123 refers to the priority monitoring list 133 and determines whether there is a cyber-attack assumed in a threat scenario in which the priority monitoring state is currently being executed in the priority monitoring list 133 (S501), as shown in Fig. 19. When the priority monitoring determination unit 123 determines that there is a cyber-attack assumed in a threat scenario in which the priority monitoring state is currently being executed (S501), the priority monitoring determination unit 123 refers to the priority monitoring list 133 and causes the vehicle-side attack analysis unit 122 to forcibly stop the priority monitoring of the cyber-attack assumed in the threat scenario with the lowest priority monitoring priority among the cyber-attacks assumed in the threat scenario in which the priority monitoring state is currently being executed, and changes the priority monitoring status of the cyber-attack assumed in that threat scenario in the priority monitoring list 133 to "forcefully stopped" (S502).

[0077] After forcibly stopping the intensive monitoring of the cyberattack assumed in the threat scenario, the intensive monitoring determination unit 123 changes the intensive monitoring status of the cyberattack assumed in the threat scenario in the intensive monitoring list 133 to "stopped" after a specified time has elapsed (S503). In other words, for the cyberattack assumed in the threat scenario for which the intensive monitoring was forcibly stopped, the intensive monitoring determination unit 123 determines not to cause the vehicle-side attack analysis unit 122 to perform intensive monitoring of the cyberattack assumed in the threat scenario even if the likelihood of the cyberattack assumed in the threat scenario exceeds the likelihood threshold before the specified time has elapsed. On the other hand, for the cyberattack assumed in the threat scenario for which the intensive monitoring was forcibly stopped, when the likelihood of the cyberattack assumed in the threat scenario exceeds the likelihood threshold after the specified time has elapsed, the intensive monitoring determination unit 123 determines to cause the vehicle-side attack analysis unit 122 to perform intensive monitoring of the cyberattack assumed in the threat scenario.

[0078] When the intensive monitoring determination unit 123 determines that there is no cyber attack assumed in the threat scenario in which the intensive monitoring state is being executed (S501), the intensive monitoring determination unit 123 ends the processing.

[0079] The processes of S11 to S13 in the execution of priority monitoring shown in Fig. 12 are realized by periodic process F1 in the flowchart of Fig. 15. The processes of S14 to S15 in the stop of priority monitoring shown in Fig. 12 are realized by periodic process F2 in the flowchart of Fig. 16. The processes of S21 to S23 in the execution of offloading shown in Fig. 13 are realized by periodic process F3 in the flowchart of Fig. 17. The processes of S24 to S25 in the stop of offloading shown in Fig. 13 are realized by periodic process F4 in the flowchart of Fig. 18. The process of forcibly stopping priority monitoring shown in Fig. 13 is realized by periodic process F5 in the flowchart of Fig. 19.

[0080] The following describes how the first monitoring target 501 and the second monitoring target 502 are changed by the above-mentioned intensive monitoring and offloading processes. In the first monitoring target 501 and the second monitoring target 502 shown in Figures 11(A) to (C), when the processing load of the attack monitoring device 100 exceeds the processing load threshold for starting offloading in a multi-function operating state, part of the processing of log analysis of the first monitoring target 501 by the attack monitoring device 100 is offloaded to the second monitoring target 502 by the server 200, as shown in Figures 20(A) to (C). Comparing Figures 11(A) to (C) with Figures 19(A) to (C), the first monitoring target 501 by the attack monitoring device 100 has been reduced in size, and the second monitoring target 502 by the server 200 has been expanded.

[0081] 11(A) to 11(C), when the likelihood of vehicle theft by a CAN invader in FIG. 11(B) exceeds the likelihood threshold, as shown in FIG. 21(B), for the cyberattack assumed in the threat scenario of vehicle theft by a CAN invader, the attack monitoring device 100 performs focused monitoring of the first monitoring target 501 without changing the first monitoring target 501 and the second monitoring target 502. On the other hand, for the unauthorized operation of the vehicle V by a malicious ECU in FIG. 21(A) and the unauthorized remote operation from the server 200 in FIG. 22(C), the entire process of analyzing the log of the first monitoring target 501 by the attack monitoring device 100 is offloaded to the second monitoring target 502 by the server 200. This makes it possible to strengthen monitoring of cyberattacks with a high likelihood of occurrence while reducing the processing load.

[0082] 21(A) to 21(C), in the case where the attack monitoring device 100 performs intensive monitoring of cyber-attacks assumed in a threat scenario and offloads the processing of log analysis of the first monitoring target 501 based on another threat scenario to the server 200, the cyber-attacks assumed in the threat scenario where the processing is not offloaded to the server 200 but is left to the first monitoring target 501 by the attack monitoring device 100 and intensive monitoring is performed are, for example, cyber-attacks assumed in a threat scenario that are difficult to monitor unless on the side of the vehicle V. Cyber-attacks assumed in a threat scenario that are difficult to monitor unless on the side of the vehicle V are, for example, attacks on the navigation system and tampering with CAN messages.

[0083] According to this embodiment, the attack monitoring device 100 installed in the vehicle V includes a vehicle-side attack analysis unit 122 that calculates the likelihood of a cyber-attack by analyzing the logs of the first monitoring target 501 based on a threat scenario, and an offload determination unit 124 that determines whether to offload the analysis of the logs of the first monitoring target 501 by the vehicle-side attack analysis unit 122 to the server-side attack analysis unit 222 installed in the server 200 outside the vehicle V and that calculates the likelihood of a cyber-attack by analyzing the logs of the second monitoring target 502 based on a threat scenario. That is, in this embodiment, offloading dynamically changes the execution location of the attack detection logic between the attack monitoring device 100 and the server 200, expanding and contracting the first monitoring target 501 and the second monitoring target 502 of the detection logic. This allows for continued cyber-attack monitoring using a resource-constrained in-vehicle system.

[0084] Furthermore, according to this embodiment, the attack monitoring device 100 further includes a processing load measurement unit 125 that measures the processing load of the attack monitoring device 100, and when the processing load measured by the processing load measurement unit 125 exceeds the processing load threshold for starting offloading, the offload determination unit 124 determines to have the server-side attack analysis unit 222 offload the processing of analyzing the logs of the first monitoring target 501 by the vehicle-side attack analysis unit 122. This makes it possible to offload according to the processing load of the attack monitoring device 100.

[0085] Furthermore, according to this embodiment, the vehicle-side attack analysis unit 122 analyzes the logs of the first monitoring target based on multiple threat scenarios to calculate the likelihood of a cyber-attack occurring for each of the threat scenarios, and further includes an offload list 134 in which the offload priority for each process of analyzing the logs of the first monitoring target 501 based on each of the threat scenarios is recorded, and when the processing load measured by the processing load measurement unit 125 exceeds the processing load threshold for starting offloading, the offload determination unit 124 determines to have the server-side attack analysis unit 222 offload the process of analyzing the logs of the first monitoring target 501 based on the threat scenarios by the vehicle-side attack analysis unit 122 in the order of the processes of analyzing the logs of the first monitoring target 501 based on the threat scenarios with the highest offload priority in the offload list 134. This makes it possible to offload according to the offload priority for each process of analyzing the logs of the first monitoring target 501 based on each of the threat scenarios.

[0086] Furthermore, according to this embodiment, when the processing load measured by the processing load measurement unit 125 is equal to or less than the processing load threshold for stopping offloading, the offload determination unit 124 determines to cause the server-side attack analysis unit 222 to stop offloading the processing of analyzing the log of the first monitoring target 501 based on a threat scenario by the vehicle-side attack analysis unit 122, in the order of processing of analyzing the log of the first monitoring target 501 based on a threat scenario with a low offload priority in the offload list. This makes it possible to stop offloading according to the processing load and offload priority.

[0087] Furthermore, according to this embodiment, the system further includes a priority monitoring determination unit 123 that determines whether to perform priority monitoring of a threat scenario, and when the likelihood of a cyber-attack assumed in the threat scenario exceeds an occurrence likelihood threshold, the priority monitoring determination unit 123 determines to cause the vehicle-side attack analysis unit 122 to perform priority monitoring that involves changing either the range of the first monitoring target 501 for which the vehicle-side attack analysis unit 122 will process logs based on the threat scenario or the content of the processing of logs of the first monitoring target 501 based on the threat scenario by the vehicle-side attack analysis unit 122. Therefore, priority monitoring can be performed in accordance with the likelihood of a cyber-attack assumed in the threat scenario, thereby improving the accuracy of detecting cyber-attacks assumed in threat scenarios with increased likelihood.

[0088] Furthermore, according to this embodiment, the system further includes a priority monitoring list 133 that records the priority monitoring priority for each cyber-attack assumed in each threat scenario, and when the likelihood of a cyber-attack assumed in a threat scenario exceeds the likelihood threshold, the priority monitoring determination unit 123 determines to cause the vehicle-side attack analysis unit 122 to perform priority monitoring of the cyber-attacks assumed in the threat scenarios, in descending order of priority monitoring priority in the priority monitoring list 133. Therefore, priority monitoring can be performed according to the likelihood of an attack occurring in a threat scenario and the priority monitoring priority.

[0089] Furthermore, according to this embodiment, when the likelihood of a cyber-attack assumed in a threat scenario for which intensive monitoring has been started is equal to or less than the likelihood threshold, the intensive monitoring determination unit 123 determines to cause the vehicle-side attack analysis unit 122 to stop intensive monitoring of the cyber-attack assumed in the threat scenario for which the likelihood is equal to or less than the likelihood threshold. Therefore, intensive monitoring can be stopped depending on the likelihood of a cyber-attack assumed in the threat scenario.

[0090] Furthermore, according to this embodiment, when the processing load measured by the processing load measurement unit 125 exceeds the processing load threshold for starting offloading and the server-side attack analysis unit 222 is not performing the processing of analyzing the log of the first monitoring target 501 based on a threat scenario that does not involve offloading of the processing of analyzing the log of the first monitoring target 501 by the vehicle-side attack analysis unit 122, the priority monitoring determination unit 123 determines to cause the vehicle-side attack analysis unit 122 to forcibly stop the priority monitoring of the cyber-attacks assumed in the threat scenarios, in the order of the cyber-attacks assumed in the threat scenarios with the lowest priority monitoring in the priority monitoring list 133. Therefore, priority monitoring can be forcibly stopped depending on the processing load and whether offloading is possible.

[0091] Furthermore, according to this embodiment, with regard to a cyber-attack assumed in a threat scenario that caused the intensive monitoring to be forcibly stopped, before a specified time has elapsed, the intensive monitoring determination unit 123 determines not to cause the vehicle-side attack analysis unit 122 to perform intensive monitoring of the cyber-attack assumed in the threat scenario, even if the likelihood of the cyber-attack assumed in the threat scenario exceeds the likelihood threshold, and after the specified time has elapsed, when the likelihood of the cyber-attack assumed in the threat scenario exceeds the likelihood threshold, the intensive monitoring determination unit 123 determines to cause the vehicle-side attack analysis unit 122 to perform intensive monitoring of the cyber-attack assumed in the threat scenario. Therefore, the forced stop can be canceled and intensive monitoring can be performed again depending on the time since the intensive monitoring was forcibly stopped.

[0092] Moreover, according to this embodiment, the vehicle V further includes a communication unit 126 that transmits the processing load measured by the processing load measurement unit 125 to a server 200 external to the vehicle V. This allows the server 200 to grasp the processing load of the attack monitoring device 100. Furthermore, according to this embodiment, the server 200 includes a display unit 224 that includes a monitoring status table 225 and a processing load graph 226, making it easy for the server 200 to monitor the status of the attack monitoring device 100 of the vehicle V.

[0093] According to the present embodiment described above, appropriate offloading allows security monitoring to continue without affecting other functions, even when the integrated ECU of the attack monitoring device 100 is under high load. Furthermore, in this embodiment, appropriate focused monitoring and offloading allow the attack monitoring device 100 to quickly and accurately detect cyber-attacks assumed in threat scenarios that are suspected to occur.

[0094] Furthermore, when the attack monitoring device 100 of this embodiment is applied to a vehicle V, appropriate focused monitoring and offloading can improve the availability of security monitoring and attack detection accuracy without significantly adding resources to the ECU of the attack monitoring device 100, resulting in improved safety for the vehicle V. Furthermore, according to this embodiment, when applied to a vehicle V, it can be implemented as a periodic process suitable for processing by the on-board ECU. Furthermore, according to this embodiment, highly cost-effective cybersecurity measures are possible.

[0095] The present invention is not limited to the above-described embodiments, and various design modifications can be made without departing from the spirit of the present invention as defined in the claims. For example, the above-described embodiments have been described in detail to facilitate understanding of the present invention, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, it is possible to replace part of the configurations of the above-described embodiments with other configurations, and it is also possible to add other configurations to the configurations of the above-described embodiments. Furthermore, it is possible to add, delete, or replace other configurations with part of the configurations of the above-described embodiments. [Explanation of symbols]

[0096] 100 Attack Monitoring Device 101 Control device 102 databases 103, 104, 105 Zone ECU 106, 107, 108 Control device 109,110,111 databases 121 Log Collection Unit 122 Vehicle-Side Attack Analysis Department 123 Priority Monitoring and Judgment Department 124 Off-road Judgment Department 125 Processing Load Measurement Unit 126 Communications Department 130 Storage section 131 Threat Scenario Table 132 Scenario Progress Management Chart 133 Priority Watch List 134 Off-road List 135 Log 200 servers 201 Control device 202 Database 221 Log Collection Unit 222 Server-Side Attack Analysis Unit 223 Off-road Reception 224 Display section 225 Monitoring Status Table 226 Processing Load Graph 300 Attack Monitoring System 401,402,403,404,405,406,407,408 nodes 411,412,413,414 nodes 421,422,423,424 nodes 501 First Surveillance Target 502 Second Surveillance Target F1, F2, F3, F4, F5 processing V vehicle

Claims

1. An attack monitoring device mounted on a vehicle, comprising: a vehicle-side attack analysis unit that calculates the likelihood of a cyber-attack occurring by analyzing the logs of the first monitoring target based on the threat scenario; an offload determination unit that determines whether to offload the analysis of the logs of the first monitoring target from the vehicle-side attack analysis unit to a server-side attack analysis unit that is implemented in a server outside the vehicle and that calculates the likelihood of a cyber-attack occurring by analyzing the logs of a second monitoring target based on the threat scenario; and An attack monitoring device comprising:

2. a processing load measurement unit for measuring a processing load of the attack monitoring device; The attack monitoring device described in claim 1, characterized in that the offload determination unit determines to have the server-side attack analysis unit offload the processing of analyzing the logs of the first monitoring target by the vehicle-side attack analysis unit when the processing load measured by the processing load measurement unit exceeds a first processing load threshold.

3. the vehicle-side attack analysis unit analyzes the log of the first monitoring target based on the plurality of threat scenarios to calculate the likelihood of a cyber-attack occurring assumed in each of the threat scenarios; The method further includes an offload list in which an offload priority for each process of analyzing the log of the first monitoring target based on each of the threat scenarios is recorded, The attack monitoring device described in claim 2, characterized in that when the processing load measured by the processing load measurement unit exceeds the first processing load threshold, the offload determination unit determines to have the server-side attack analysis unit offload the processing of analyzing the logs of the first monitoring target based on the threat scenario by the vehicle-side attack analysis unit in the order of the processing of analyzing the logs of the first monitoring target based on the threat scenario with the highest offload priority in the offload list.

4. The attack monitoring device described in claim 3, characterized in that when the processing load measured by the processing load measurement unit is equal to or less than a second processing load threshold, the offload determination unit determines to stop the offloading of the processing of analyzing the logs of the first monitoring target based on the threat scenario by the vehicle-side attack analysis unit to the server-side attack analysis unit in the order of the processing of analyzing the logs of the first monitoring target based on the threat scenario with a lower offload priority in the offload list.

5. The threat scenario further includes an intensive monitoring determination unit that determines whether to perform intensive monitoring of a cyber attack assumed in the threat scenario, The attack monitoring device described in claim 4, characterized in that when the likelihood of a cyber-attack assumed in the threat scenario exceeds a likelihood threshold, the priority monitoring determination unit determines to cause the vehicle-side attack analysis unit to perform the priority monitoring, which involves changing either the scope of the first monitoring target for which the vehicle-side attack analysis unit processes logs based on the threat scenario, or the content of the processing of the log analysis of the first monitoring target by the vehicle-side attack analysis unit based on the threat scenario.

6. The system further includes a priority monitoring list in which priority monitoring priorities for each cyber attack assumed in each of the threat scenarios are recorded, The attack monitoring device described in claim 5, characterized in that when the likelihood of a cyber-attack assumed in the threat scenario exceeds the likelihood threshold, the priority monitoring determination unit determines to cause the vehicle-side attack analysis unit to perform priority monitoring of the cyber-attacks assumed in the threat scenario in the order of the priority monitoring priority in the priority monitoring list.

7. The attack monitoring device described in claim 6, characterized in that when the likelihood of a cyber-attack assumed in the threat scenario for which the intensive monitoring is being performed is equal to or less than the likelihood threshold, the intensive monitoring determination unit determines to cause the vehicle-side attack analysis unit to stop the intensive monitoring of the cyber-attack assumed in the threat scenario for which the likelihood of the cyber-attack is equal to or less than the likelihood threshold.

8. The attack monitoring device described in claim 7, characterized in that when the processing load measured by the processing load measurement unit exceeds the first processing load threshold and there is no processing of analysis of the logs of the first monitoring target based on the threat scenario that does not cause the server-side attack analysis unit to offload the processing of analysis of the logs of the first monitoring target by the vehicle-side attack analysis unit, the priority monitoring determination unit determines to force the vehicle-side attack analysis unit to stop the priority monitoring of the cyber-attacks assumed in the threat scenarios in order of the priority monitoring priority in the priority monitoring list.

9. The priority monitoring determination unit Regarding the cyberattack assumed in the threat scenario that forced the intensive monitoring to be stopped, determine not to cause the vehicle-side attack analysis unit to perform the intensive monitoring of the cyber-attack assumed in the threat scenario before the specified time has elapsed, even if the likelihood of the cyber-attack assumed in the threat scenario exceeds the likelihood threshold; The attack monitoring device described in claim 8, characterized in that after the specified time has elapsed, when the likelihood of a cyber-attack assumed in the threat scenario exceeds the likelihood threshold, it determines to cause the vehicle-side attack analysis unit to perform the intensive monitoring of the cyber-attack assumed in the threat scenario.

10. 10. The attack monitoring device according to claim 9, further comprising a communication unit that transmits the processing load measured by the processing load measurement unit to the server outside the vehicle.

11. An attack monitoring device according to any one of claims 1 to 10; a server outside the vehicle, the server having the server-side attack analysis unit that calculates the likelihood of a cyber-attack occurring by analyzing the log of the second monitoring target based on the threat scenario; An attack monitoring system comprising: When the offload determination unit determines to offload the process of analyzing the log of the first monitoring target by the vehicle-side attack analysis unit to the server-side attack analysis unit, the server-side attack analysis unit executes at least a part of the process of analyzing the log of the first monitoring target by the vehicle-side attack analysis unit. An attack monitoring system characterized by:

12. A vehicle-side attack analysis unit implemented in the vehicle calculates the likelihood of a cyber-attack occurring by analyzing the log of the first monitoring target based on the threat scenario; a server-side attack analysis unit implemented in a server external to the vehicle calculates the likelihood of a cyber-attack occurring by analyzing the log of the second monitoring target based on the threat scenario; An attack monitoring method characterized in that an offload determination unit implemented in the vehicle determines whether to offload the process of analyzing the logs of the first monitoring target by the vehicle-side attack analysis unit to the server-side attack analysis unit.

Images