Anomaly monitoring system in individual systems

Abstract

In a system where a server computer PS and one or more individual systems 10 can communicate via a communication network 100, the system makes it possible to detect anomalies in which a large number of specific logs are generated in a short period of time in an individual system, without putting too much strain on the communication network and server resources. [Solution] The system 12 that monitors abnormalities in the individual system 10 includes means 20 configured to acquire log information generated in the individual system, means 21 configured to obtain hash values ​​by providing the log information to a hash function, means 22 configured to count the number of occurrences for each hash value, and means 21 configured to determine whether each of the number of occurrences for each hash value exceeds a predetermined value. When any of the number of occurrences for each hash value exceeds the predetermined value, the system determines that an abnormal state has occurred in the individual system and executes a measure 23 corresponding to the abnormal state.

Description

Technical Field

[0001] The present invention relates to a technique for monitoring abnormalities in a system, and more particularly, to an abnormality monitoring technique for monitoring abnormalities in an individual system managed by a server computer through a communication network.

Background Art

[0002] In a system where individual systems, such as computer systems (in-vehicle systems) that control the individual states of each vehicle, such as automobiles, are centrally managed by a server computer (hereinafter referred to as "server") via a communication network, a configuration of a communication network system has been put into practical use. In such a configuration, as a method for monitoring whether or not abnormalities occur in individual systems, logs generated in conjunction with the operation of each individual system are collected by the server, the server performs analysis of the collected logs, and based on the analysis results, processing is performed when an abnormality occurs. As a technology related to log collection for monitoring such individual systems, for example, Patent Document 1 proposes a configuration in which, in a communication network to which multiple electronic control units (individual systems) are connected, logs corresponding to the transmitted and received messages of each electronic control unit are selectively acquired according to the communication network bandwidth conditions. This configuration is intended to efficiently prevent malicious processing by viruses, etc., without putting pressure on the bandwidth of normal communication messages via the communication network. In this configuration, the processing monitoring unit, which performs data communication network monitoring, is provided with a system load monitoring unit that monitors available bandwidth in the communication network and a virus monitoring unit that collects log information corresponding to communication messages and performs virus detection. The virus monitoring unit is configured to change the log information collection method according to the available bandwidth information of the communication network acquired by the system load monitoring unit. Specifically, if a virus is detected and the available bandwidth is not above a predetermined threshold, the unit is configured to collect only limited log information corresponding to high-priority communication messages. By changing the log collection method according to the communication network usage status in this configuration, efficient virus detection and removal are expected to be achieved. [Prior art documents] [Patent Documents]

[0003] [Patent Document 1] International release 2019 / 093098 [Overview of the project] [Problems that the invention aims to solve]

[0004] Incidentally, if a large number of logs with certain characteristics are generated in an individual system, for example, if logs are generated due to a large number of connections being made from one source IP address to other destination IP addresses in a short period of time, it can be considered that there is some kind of abnormality in the individual system. By detecting this on the server, the abnormality in the individual system can be detected. In this regard, if all of the logs generated in a large number of times in an individual system in a short period of time are sent to the server via the communication network, it will strain the resources of the communication network and the server, potentially causing delays in normal processing and congestion in sending and receiving. Therefore, it is advantageous to have a configuration that can detect the generation of a large number of specific logs in an individual system in a short period of time without straining the resources of the communication network and the server as much as possible.

[0005] In view of the above circumstances, the main object of the present invention is to enable the detection of an anomaly in which a large number of specific logs are generated in a short period of time in an individual system, in a system in which a server and one or more individual systems can communicate via a communication network, without putting too much strain on the resources of the communication network and the server. [Means for solving the problem]

[0006] According to the present invention, the above problem is solved by a system for monitoring abnormalities in individual systems that are communicably connected to a server computer via a communication network, A log acquisition means configured to acquire log information generated in the aforementioned individual system, A hash value acquisition means configured to obtain a hash value by providing the aforementioned log information to a hash function, A hash value occurrence counting means configured to count the number of occurrences of each hash value during a predetermined period, The system includes a determination means configured to determine whether each occurrence count for each hash value exceeds a predetermined value, This is achieved by a system configured to determine that an abnormal state has occurred in the individual system when any of the occurrence counts for each hash value exceeds a predetermined value, and to execute measures corresponding to the abnormal state.

[0007] In the system of the present invention described above, "individual system" may be an in-vehicle system as in the example above, but may also be each of the individual systems in a system in which a server and one or more individual computer systems are connected in a communicative manner via a communication network (for example, a web system in which a web application such as point management is deployed on individual computer systems and configured to execute processing distributed by a load balancer). "Communication network" may be a wired or wireless communication network. "Log information" may be the log itself generated in response to the operation of the computer device in the individual system, or information for identifying the generated log such as the source IP address, destination IP address, URI, etc. The hash function is a function that, given log information, outputs a hash value, which is a single fixed-length numerical data with a different value for each piece of log information. "Number of occurrences in a predetermined period" may be the total number of occurrences in a period of arbitrarily set length, or the total number of occurrences in a predetermined period from a certain point in time. Alternatively, "number of occurrences in a predetermined period" may be the number of occurrences in which the next occurrence occurs within a predetermined period from one point in time.

[0008] In the system of the present invention described above, first, when a log is generated in an individual system, a hash value corresponding to the log information for the generated log is calculated using a hash function. Then, the number of occurrences for each hash value is counted. The hash value is a unique numerical value for each piece of log information given to the hash function, and the number of occurrences of that number is the number of occurrences for a particular log. Therefore, when the number of occurrences of any hash value exceeds a predetermined number that can be set appropriately within a predetermined period, it can be determined that a large number of logs with that hash value have been generated in a short period of time. Consequently, it can be determined that an abnormal state has occurred in the individual system, and corresponding processing can be executed. In this configuration, instead of sequentially saving the generated logs and log information containing information that identifies them, or sending it to the server, a hash value is calculated from the log information, and the number of occurrences for each hash value is counted. As a result, the amount of resources used by the communication network and server is greatly reduced, and this makes it possible to detect an anomaly in which a large number of logs are generated in a short period of time in an individual system without putting too much strain on resources. The predetermined period and predetermined value for the number of occurrences per hash value are typically set to a period and value at which it is determined that an abnormality occurs if the number of occurrences during that predetermined period exceeds that predetermined value.

[0009] Regarding the configuration for counting the number of occurrences for each hash value described above, in the implementation, the hash value occurrence counting means may have a variable array set up to record the number of occurrences for each hash value, and each time a log is generated and a hash value is output, the variable value corresponding to that value may be incremented by 1. Therefore, by referring to the array, the distribution of logs that have occurred up to that point can be grasped.

[0010] In the above configuration, when the occurrence count for any of the hash values ​​exceeds a predetermined value, the system may be configured to send log information containing the hash value whose occurrence count exceeds the predetermined value to the server computer. This allows the server to analyze the abnormally occurring log and perform corresponding processing. Furthermore, with this configuration, not all abnormally occurring logs are sent to the server, thus reducing the use of communication network and server resources. It is preferable that sensitive information in the log information is masked immediately before it is sent to the server.

[0011] Furthermore, in the above configuration, it is preferable that the system is configured not to resend log information with a hash value that has occurred more than a predetermined number of times, which has already been sent to the server, to the server computer. With this configuration, even if the same abnormal log continues to occur, the information will not be repeatedly sent to the server in a configuration that sends log information with a hash value that has occurred more than a predetermined number of times to the server, thereby preventing strain on the communication network and server resources.

[0012] In the above configuration, as an alternative way of dealing with the situation when any of the occurrence counts for each hash value exceeds a predetermined value, the individual system may be configured to block communication via the communication network. This prevents the effects of the abnormal condition from spreading to the communication network and the server via the communication network. Furthermore, in yet another embodiment, as described in Patent Document 1, the log information collection method may be changed so that more logs than usual are acquired in response to the detection of an abnormal condition.

[0013] By the way, in a system to which the present invention is applied, where a server and one or more individual computer systems are connected in a communicable manner via a communication network, if the individual systems under the management of the server in the communication network have the same configuration, then if an abnormality occurs in one individual system, and that abnormality is caused by a configuration common to all individual systems, such as a program bug, then a similar abnormality may occur in other individual systems as well. In such cases, when an abnormality is detected in one individual system within the communication network, it becomes possible to more easily detect that abnormality in other individual systems, thereby enabling quicker action to be taken against the abnormality. Therefore, in the present invention, other individual systems within the communication network may also perform calculation of a hash value corresponding to the log information using a hash function and count the number of occurrences for each hash value each time a log is generated, and each individual system may have means for acquiring other system information to acquire information on the number of occurrences for each hash value of other individual systems connected to the communication network, and the determination means may be configured to adjust a predetermined value based on the information on the number of occurrences for each hash value of other individual systems. In other words, in the present invention, individual systems within a communication network may be able to share log generation status with each other, and the determination means may adjust a predetermined value for the number of occurrences for each hash value according to the shared status, thereby making it easier to detect abnormalities. Individual systems within a communication network may have similar hash value generation counting means, in which case the number of occurrences for each hash value size of all individual systems within the communication network may be aggregated for each hash value, and the predetermined value for the number of occurrences for each hash value may be adjusted based on the aggregated information. [Effects of the Invention]

[0014] Thus, in the system according to the present invention, a hash value is calculated from the log generated in each system and the information that identifies it, the number of occurrences is counted for each hash value, and whether or not the number of occurrences exceeds a predetermined value is monitored, thereby performing monitoring of abnormalities in each system. With this configuration, sequential saving of log information and transmission to the server are not performed, so even in situations where a large number of identical logs are generated in a short period of time, it is possible to avoid the communication network and server resources being strained as a result.

[0015] Other objects and advantages of the present invention will become apparent from the following description of preferred embodiments of the present invention. [Brief explanation of the drawing]

[0016] [Figure 1] Figure 1(A) is a diagram showing the configuration of the anomaly monitoring system in an individual system according to this embodiment in block form. Figure 1(B) is a schematic diagram of the configuration of a communication network system into which the individual system to which this embodiment is applied is incorporated. [Figure 2] Figure 2 is a schematic diagram illustrating the operation of the log processing unit and log count storage unit in the anomaly monitoring system according to this embodiment. [Figure 3] Figure 3 is a flowchart illustrating the process for detecting an anomaly in the anomaly monitoring system according to this embodiment. [Figure 4] Figures 4(A) and 4(B) are flowcharts illustrating several modes of processing after detecting an anomaly in the anomaly monitoring system according to this embodiment. [Figure 5] Figure 5(A) is a flowchart illustrating the process of sending logs of abnormal events to a server after detecting an abnormality in the abnormality monitoring system according to this embodiment. Figure 5(B) is a flowchart illustrating the process of aggregating the abnormality status of other individual systems in the abnormality monitoring system according to this embodiment. [Explanation of Symbols]

[0017] 10... Individual system, 12... Abnormality monitoring unit, 12K... Kernel unit, 12U... User unit, 13... Control processing unit, 20... Log acquisition unit (log acquisition means), 21... Log processing unit (hash value acquisition means, determination means), 22... Log count storage unit (hash value generation count means), 23... Abnormal log processing unit, 24... Abnormal log transmission unit, 25... Abnormal state storage unit, 26... Log count aggregation processing unit (other system information acquisition means), 30... Array for counting log occurrence times, PS... Server computer, ISi... Individual system, NM... Communication network between server and individual system, NI... Communication network between individual systems

Best Mode for Carrying Out the Invention

[0018] With reference to the attached drawings below, the present invention will be described in detail with respect to several preferred embodiments. In the figures, the same reference numerals indicate the same parts.

[0019] Configuration of the anomaly monitoring unit in individual systems As described in the column of the summary of the invention, the configuration of the abnormality monitoring system according to the present embodiment may be incorporated as an abnormality monitoring unit in each of one or more individual systems that are communicably connected to a server via a communication network. The communication network may be of any type, typically a wireless communication type, but may also be a wired communication type. Referring to FIG. 1(A), in the individual system 10 to which the present embodiment is applied, generally speaking, a control processing unit 13 that executes control processing operations in each system and an abnormality monitoring unit 12 that monitors abnormalities in the control processing unit are provided. The abnormality monitoring unit 12 is first provided with a log acquisition unit 20, a log processing unit 21, a log count storage unit 22, an abnormal log processing unit 23, and an abnormal log transmission unit 24. Further, an abnormal state storage unit 25 and a log count aggregation processing unit 26 may be provided.

[0020] More specifically, the log acquisition unit 20 sequentially acquires logs and related information (source IP address, destination IP address, URI, etc.) generated by the control processing unit 13 during its operation. The log processing unit 21 inputs the combination of the log and related information (log information) into a hash function each time a log is acquired to calculate a hash value unique to the log information and sends it to the log count storage unit 22. As described later, the log count storage unit 22 counts the number of occurrences of each transmitted hash value. When the number of occurrences of any hash value reaches a predetermined value that can be set appropriately within a predetermined period that can be set appropriately, it means that an anomaly has occurred in which a large number of logs corresponding to that hash value occurred during the set period. This is communicated to the log processing unit 21, and the log processing unit 21 instructs the log acquisition unit 20 to send information of logs whose hash value occurrence count exceeds the predetermined value, i.e., logs that have occurred abnormally, to the abnormal log processing unit 23. When the abnormal log processing unit 23 receives log information related to an abnormality, it will perform one of the measures corresponding to such abnormality, as will be explained later. In one such measure, if the abnormal log processing unit 23 sends the log information related to the abnormality to a server PS that manages the status of one or more individual systems, the abnormal log processing unit 23 will perform a process to mask sensitive information from the received log information and pass it to the abnormal log transmission unit 24. The abnormal log transmission unit 24 will then send the log information with the sensitive information masked as information about the abnormally occurring log to the server computer PS via the communication network, and will also instruct the abnormal state storage unit 25 to record that it has sent log information related to the abnormality to the server computer PS. The record here may be a hash value obtained from that log information.

[0021] Furthermore, as schematically depicted in Figure 1(B), the individual system 10 to which this embodiment is applied is incorporated into a communication network system 100 which is under the management of a server computer PS via a communication network NM. When multiple individual systems IS1, IS2, ... are connected within the communication network system 100, the same logs may be generated in each of the individual systems that have the same specifications as individual system 10. Therefore, individual systems having similar specifications may be connected to each other via a communication network NI so that they can communicate with each other and share information about the log generation status. For this purpose, individual system 10 is provided with a log count aggregation processing unit 26 as described above, and may be configured to send and receive information on the number of occurrences of each stored log information between the log count storage unit 22 of other individual systems 10 via the communication network NI. The shared information on the number of occurrences of log information from other individual systems 10 may be used to adjust predetermined values ​​that may be set as appropriate for the number of occurrences for each hash value, as will be explained later.

[0022] In the configuration of the individual systems described above, the anomaly monitoring unit 12 may typically consist of a kernel unit 12K of an operating system called eBPF and a user unit 12U that runs applications on it, as shown in the figure. In such a configuration, in order to acquire logs, the eBPF kernel unit 12K may utilize a technology that allows application information to be transparently acquired. This makes it possible to acquire the necessary information without modifying the application or kernel (by utilizing eBPF, it is also possible to acquire SSL-encrypted L7 level information (URLs and request content)). Furthermore, it becomes possible to change the log components used as arguments to the hash function without modifying the application. In addition, since the eBPF program is executed inside the kernel, it cannot use many CPU or memory resources. However, in this embodiment, as will be described in detail later, a simple implementation that only calculates hash values ​​and has a single array is achieved, so this is not a problem.

[0023] Configuration for counting the number of log occurrences using hash values In this embodiment, as described above, the control processing unit 13 of the individual system 10 obtains a hash value of the log information, which is a combination of the log generated and the information related thereto, and counts the number of occurrences for each value. Generally, the hash value obtained by inputting a certain text into a hash function will differ for each input text, and the same hash value will be obtained from the same text. Therefore, by referring to the hash value calculated for the generated log information, it is possible to identify the generated log information. Thus, in this embodiment, as one aspect of the above configuration, as schematically depicted in Figure 2, an array 30 whose components are variables corresponding to the hash value is set in the log count storage unit 22, and in the log processing processing unit 21, when log information (which may be data concatenating the log and the text related thereto) is input into a hash function (Hash) and the hash value HV is calculated, the variable component Ct in the array 30 corresponding to that value hi is incremented. This makes it possible to count the number of log occurrences without having to save all of the generated logs.

[0024] In this embodiment, since an anomaly is detected when a large number of identical logs are generated in a short period of time, the count value for the occurrence count of each hash value may be reset as appropriate based on the elapsed time. For example, in one configuration, the count value may be reset at intervals that are set as appropriate. Alternatively, for each hash value, the count value may be reset if it has not reached a predetermined value after a predetermined time has elapsed since its first occurrence. Alternatively, for each hash value, the count value may be reset if it has occurred once and has not occurred again after a predetermined time has elapsed.

[0025] Operation of the abnormality monitoring unit In operation, referring to Figure 3, first, the log acquisition unit 20 acquires the log generated by the control processing unit 13 (S1). Then, the log processing unit 21 inputs the log information into a hash function and calculates a hash value unique to the log information (S2). Next, the count value of the variable associated with the hash value in the array 30 of the log count storage unit 22 is acquired (S3). It is determined whether the count value is below a predetermined value (S4). If the count value is below the predetermined value, the count value is incremented by 1 (S5). If the above count value reset condition is not met (S6), the system waits until the next log is generated (R). On the other hand, if the above count value reset condition is met, the count value is reset (S7). In S4, if the count value has reached the predetermined value, it means that the log has reached the predetermined value within the predetermined period, and this can be judged as an abnormality. Therefore, the log information acquired at that time is sent to the abnormal log processing unit 23.

[0026] When the abnormality log processing unit 23 receives log information, it executes processing to respond to the occurrence of an abnormality. In one aspect of this processing, processing to isolate the individual system from the communication network may be executed (Figure 4(A)S11). This prevents the abnormal state of the individual system from affecting the server computer or other individual systems through the communication network.

[0027] Furthermore, as another form of processing in response to the occurrence of an anomaly, a process may be executed to pass masked log information, such as sensitive information, to the anomaly log transmission unit 24 for transmission to the server. At that time, the hash value may also be transmitted (Figure 4(B)S12). When the anomaly log transmission unit 24 receives the masked log information, such as sensitive information, a process is executed in the anomaly state storage unit 25 to check whether there is a record of the same log information already being transmitted to the server computer. In this regard, as one form, the anomaly state storage unit 25 may have a flag set for each hash value indicating whether or not it has been transmitted, and when a certain log information is transmitted to the server computer, the flag of the hash value corresponding to that log information is changed from False to True, and as a result the log sent to the server is stored in the anomaly state storage unit 25.

[0028] In the specific processing of the abnormal log transmission unit 24, referring to Figure 5(A), after receiving masked log information such as sensitive information and its hash value from the abnormal log processing unit 23, the flag value of the received hash value is obtained in the abnormal state storage unit 25 (S20), and the flag value is determined (S21). If the flag value is False, it means that the received log information has not yet been sent to the server, so the masked log information such as sensitive information is sent to the server (S22), and the flag value of the hash value in the abnormal state storage unit 25 is converted to True. On the other hand, if the obtained flag value is True, the received log information has been sent to the server, so no further transmission is performed. This avoids strain on the communication network and server resources caused by repeatedly sending abnormal logs that have been sent once to the server. The log information sent to the server may be used for log analysis in any manner.

[0029] Furthermore, as another way for the abnormal log processing unit 23 to handle log information indicating an abnormality to be handled, the log information collection method may be changed so that more logs than usual are acquired, similar to the case in Patent Document 1.

[0030] Sharing of log generation status with other individual systems As described above, the abnormality monitoring unit 12 of the individual system in this embodiment may further have a log count aggregation processing unit 26 and communicate with the log count aggregation processing units 26 of other individual systems incorporated into the communication network system 100 (Figure 1(B)) to share information on the number of occurrences of each log information stored in their respective log count storage units 22. The abnormality monitoring unit 12 may then use the shared occurrence status of each log information of the other individual systems to adjust predetermined values ​​that may be set as appropriate for the number of occurrences of each hash value.

[0031] Specifically, for example, referring to Figure 5(B), the log count aggregation processing unit 26 may sequentially communicate with log count aggregation processing units 26 of other individual systems via the communication network NI (Figure 1(B)) to obtain information from the log count storage units 22 of the other individual systems (S30). Then, from the information from the log count storage units 22 of the other individual systems obtained, an array 30 of the occurrence counts for each hash value of the log count storage unit 22 in individual systems with the same configuration as itself may be extracted (S31), and the values ​​of the occurrence counts for each extracted hash value may be summed up (S32). This makes it possible to grasp the log occurrence status of all individual systems with the same configuration that are connected to the communication network NM.

[0032] The log generation status of the entire individual system obtained as described above may be used in any manner. For example, if the number of occurrences of a particular log's hash value is high, it can be determined that an anomaly related to that log is likely to occur. In order to detect such an anomaly early, a process may be performed to reduce a predetermined value to the count value in S4 of Figure 3 for the hash value of that particular log.

[0033] Thus, with the system according to the above embodiment, anomalies such as the generation of a large number of identical logs in a short period of time in individual systems can be detected without putting excessive strain on the network to which the individual systems are connected or the resources of the servers managing the individual systems. The configuration of this embodiment may be applied to in-vehicle systems as described above, but it may also be applied to other systems, such as web systems.

[0034] While the above description is made in relation to embodiments of the present invention, many modifications and changes are readily possible for those skilled in the art, and it will be clear that the present invention is not limited to the embodiments illustrated above, but can be applied to various devices without departing from the concept of the present invention.

Claims

1. A system for monitoring abnormalities in individual systems that are connected to a server computer via a communication network, A log acquisition means configured to acquire log information generated in the aforementioned individual system, A hash value acquisition means configured to obtain a hash value by providing the aforementioned log information to a hash function, A hash value occurrence counting means configured to count the number of occurrences of each hash value during a predetermined period, The system includes a determination means configured to determine whether each occurrence count for each hash value exceeds a predetermined value, A system configured to determine that an abnormal state has occurred in the individual system when any of the occurrence counts for each hash value size exceeds a predetermined value, and to execute measures corresponding to the abnormal state.

2. A system according to claim 1, wherein when any of the occurrence counts for each hash value exceeds a predetermined value, log information containing the hash value whose occurrence count exceeds the predetermined value is transmitted to the server computer.

3. A system according to claim 2, wherein after sending log information to the server computer for which the number of occurrences exceeds the predetermined value, the system is configured not to send the same log information to the server computer again.

4. A system according to claim 1, wherein when any of the occurrence counts for each hash value exceeds a predetermined value, communication via the communication network in the individual system is blocked.

5. A system according to claim 1, comprising other system information acquisition means for acquiring information on the number of occurrences for each hash value of other individual systems connected to the communication network, wherein the determination means is configured to adjust the predetermined value based on the information on the number of occurrences for each magnitude of the hash value of the other individual systems.

Images