Security log output device, security log filtering device, and electronic control system
The security log output device uses dual filtering units to prioritize critical events, ensuring they are not blocked and reducing network load by dynamically adjusting filtering conditions, thus maintaining analysis accuracy.
Patent Information
- Authority / Receiving Office
- JP · JP
- Patent Type
- Applications
- Current Assignee / Owner
- DENSO CORP
- Filing Date
- 2024-12-25
- Publication Date
- 2026-07-07
Smart Images
Figure 2026113025000001_ABST
Abstract
Description
Technical Field
[0001] The present disclosure is mainly a technology for outputting security events detected and aggregated by a security sensor of a security log output device mounted on a moving body such as an automobile as a security log, and relates to a security log output device, a security log filtering device, an electronic control system, and methods and programs executed by these (hereinafter referred to as a security log output device, etc.).
Background Art
[0002] An electronic control system mounted on an automobile is composed of electronic control devices and software installed on them, and malfunctions such as operational failures may occur due to changes in the environment or the like. In addition, since the electronic control system can also communicate with the outside, it can also be a target of cyberattacks such as unauthorized access to the automobile. Accordingly, it has been considered to take measures such that the operation of the automobile can be carried out without problems by detecting and reporting security events, which are incidents occurring in the network and software constituting the electronic control system. In recent years, with the increase in electronic control devices and software constituting the electronic control system, the occurrence of security events also tends to increase. As a result, the communication load of the network can become a problem.
[0003] As a technology for reducing the communication load of the network due to security events, for example, there is Patent Document 1. Patent Document 1 describes that when the same type of security event is acquired multiple times within a certain period, any one piece of information of the same type of security event acquired multiple times is transmitted to another ECU, and thereby the communication load of the network can be suppressed.
Prior Art Documents
Patent Documents
[0004]
Patent Document 1
[0005] The inventors of this invention have identified the following problems. When a security log output device aggregates incidents detected by its security sensors and outputs them as security events, the device may have a filter that determines whether the number of security events that can be sent within a certain period has reached its limit. Since this filter makes its determination based solely on the quantity of security events, there is a possibility that important or high-priority security events may be blocked.
[0006] One aspect of this disclosure is the aim of realizing security log output devices and the like that reduce the possibility of specific security events being blocked by filters. [Means for solving the problem]
[0007] One aspect of this disclosure is, An event information generation unit (101, 105) detects an incident and generates and outputs event information, A filter unit (106) filters the event information to determine which event information to block (blocked event information) and which event information to allow (passed event information), and outputs the passed event information as a security log. A security log output device having a transmission unit (103) that transmits the security log to a communication device (200), The filter unit is A first filtering processing unit (111) that determines the blocking event information and the passing event information based on the first condition, A determination unit (112) determines whether the specific event information included in the blocking event information determined by the first filtering processing unit satisfies the output change conditions, A second filtering processing unit (113) determines the blocking event information and the passing event information based on a second condition different from the first condition when the output change condition is met, The system includes an output unit (114) that outputs the aforementioned transit event information to the transmission unit as the security log.
[0008] With this configuration, the security log output device, etc. of this disclosure can determine whether a specific event information included in the blocked event information satisfies the output change conditions, and if it does, it can change the filtering conditions from the first condition to the second condition, thereby changing the content and type of security log to be output.
[0009] The numbers in parentheses attached to the claims and the constituent elements of the invention described in this section indicate the correspondence between the present invention and the embodiments described later, and are not intended to limit the present invention. [Brief explanation of the drawing]
[0010] [Figure 1] Explanatory diagram illustrating the location of the electronic control system and security log output device in each embodiment. [Figure 2] Block diagram showing an example configuration of the electronic control system S. [Figure 3] Block diagram showing an example of the electronic control system in each embodiment. [Figure 4] Diagram illustrating the contents of the security log. [Figure 5] Block diagram showing an example configuration of the security log output device in each embodiment. [Figure 6] This is an explanatory diagram illustrating the information stored in the storage unit of the security log output device of Embodiment 1. [Figure 7] This diagram illustrates specific examples of the operation of the first filtering processing unit and determination unit of the security log output device in each embodiment. [Figure 8]Explanatory drawing showing a specific example of the operations of the second filtering processing unit and the output unit of the security log output device according to Embodiment 1 [Figure 9] Block diagram showing a configuration example of the communication device according to each embodiment [Figure 10] Flowchart for explaining the operations of the security log output device and the like according to each embodiment [Figure 11] Explanatory drawing for explaining the information stored in the storage unit of the security log output device according to Embodiment 2 [Figure 12] Explanatory drawing showing a specific example of the operations of the second filtering processing unit and the output unit of the security log output device according to Embodiment 2 [Figure 13] Explanatory drawing for explaining the information stored in the storage unit of the security log output device according to Embodiment 3 [Figure 14] Explanatory drawing showing a specific example of the operations of the second filtering processing unit and the output unit of the security log output device according to Embodiment 3
Modes for Carrying Out the Invention
[0011] Hereinafter, exemplary embodiments of the present disclosure will be described with reference to the drawings.
[0012] Note that the present invention means the invention described in the claims or in the section of means for solving the problems, and is not limited to the following embodiments. Also, at least the words in parentheses mean the words described in the claims or in the section of means for solving the problems, and are not limited to the following embodiments either.
[0013] The configurations and methods described in the dependent claims of the claims are arbitrary configurations and methods in the invention described in the independent claim of the claims. The configurations and methods of the embodiments corresponding to the configurations and methods described in the dependent claims, as well as the configurations and methods described only in the embodiments without being described in the claims, are arbitrary configurations and methods in the present invention. Even the configurations and methods described in the embodiments when the scope of the claims is broader than the description of the embodiments are arbitrary configurations and methods in the present invention in the sense that they are examples of the configurations and methods of the present invention. In any case, by being described in the independent claim of the claims, they become the essential configurations and methods of the present invention.
[0014] The effects described in the embodiments are the effects in the case of having the configurations of the embodiments as examples of the present invention, and are not necessarily the effects of the present invention.
[0015] When there are a plurality of embodiments (including examples and variations. The same shall apply hereinafter), the configurations disclosed in each embodiment are not limited to each embodiment alone, and can be combined across embodiments. For example, the configuration disclosed in one embodiment may be combined with another embodiment. Also, the configurations disclosed in each of the plurality of embodiments may be collected and combined.
[0016] The problems described as the problems to be solved by the invention are not publicly known problems, but are those uniquely discovered by the inventor, and are facts that affirm the inventive step together with the configuration and method of the present invention.
[0017] 1. Configurations and the like that are the premise of each embodiment (1) Positions where the electronic control system S and the security log output device 100 are provided Referring to FIG. 1, the positional relationship of the electronic control system S in each embodiment will be described.
[0018] The electronic control system S of each embodiment has a plurality of security log output devices 100 and communication devices 200. The security log output device 100 is a device that generates security logs and outputs them to the communication device 200. The communication device 200 is a device that transmits the security logs received from the security log output device 100 to an external device 30 using an arbitrary communication method. The external device 30 is implemented as, for example, a server device or a SOC (Security Operation Center).
[0019] The security log output device 100 and the electronic control system S in each embodiment are "mounted" on a vehicle, which is a "mobile object," as shown in Figure 1(a). The following embodiments will be described assuming the arrangement shown in Figure 1(a). Here, A "moving object" refers to any object that can move, regardless of its speed. It also includes objects that are stationary. Examples include, but are not limited to, automobiles, motorcycles, bicycles, pedestrians, ships, aircraft, and items carried on them. "To be mounted" includes not only cases where it is directly fixed to the moving object, but also cases where it is not fixed to the moving object but moves with it. Examples include cases where it is carried by a person riding on the moving object, or where it is mounted on cargo placed on the moving object.
[0020] In each embodiment, the electronic control system S is described as an in-vehicle system mounted on a vehicle. However, the electronic control system S is not limited to in-vehicle systems and can be applied to electronic control systems installed in any location, as shown in Figure 1(b). For example, the electronic control system S may be mounted on a stationary or fixed object rather than a moving object. Alternatively, it may be installed in a building.
[0021] (2) Configuration of the electronic control system S Figure 2 shows an example of the configuration of the electronic control system S. The electronic control system S consists of multiple The system consists of an Electronic Control Unit (ECU) ECU20 and an in-vehicle communication network (NW1~NW3) connecting them. Figure 2 shows eight ECUs (ECU20a~ECU20h) as an example, but naturally, the electronic control system S can be composed of any number of ECUs. In the following explanation, when describing one or more ECUs as a whole, we will refer to them as ECU20 or each ECU20, and when describing individual electronic control units, we will refer to them as ECU20a, ECU20b, ECU20c, ...
[0022] In the case of Figure 2, each ECU 20 is connected via an in-vehicle communication network, etc. For example, they are connected via an in-vehicle communication network such as CAN (Controller Area Network) or LIN (Local Interconnect Network). Alternatively, they may be connected using any communication method, whether wired or wireless, such as Ethernet®, Wi-Fi®, or Bluetooth®. Furthermore, multiple of these communication methods may be used. Note that "connection" refers to a state in which data can be exchanged, and includes not only cases where different hardware is connected via a wired or wireless communication network, but also cases where virtual machines implemented on the same hardware are virtually connected to each other.
[0023] The electronic control system S shown in Figure 2 includes an integrated ECU 20a, an external communication ECU 20b, zone ECUs (20c, 20d), and individual ECUs (20e to 20h).
[0024] The integrated ECU 20a is an ECU that has the function of controlling the entire electronic control system S, as well as a gateway function that mediates communication between each ECU 20. The integrated ECU 20a is sometimes called a gateway ECU (G-ECU) or a mobility computer (MC). The integrated ECU 20a may also be a relay device or a gateway device.
[0025] The external communication ECU 20b is an ECU having a communication unit that communicates with an external device located outside the vehicle, for example, an external device 30 in each embodiment. The communication method used by the external communication ECU 20b is either wireless communication or wired communication. For example, it is connected via a communication network using wireless communication methods such as IEEE802.11 (Wi-Fi®), IEEE802.16 (WiMAX®), W-CDMA (Wideband Code Division Multiple Access), HSPA (High Speed Packet Access), LTE (Long Term Evolution), LTE-A (Long Term Evolution Advanced), 4G, 5G, etc. Alternatively, DSRC (Dedicated Short Range Communication) can be used. If the vehicle is parked in a parking lot or housed in a repair shop, a wired communication method can be used instead of wireless communication. For example, a LAN (Local Area Network), the internet, or a fixed telephone line can be used. Furthermore, to implement multiple communication methods, multiple external communication ECUs 20b may be provided. Alternatively, instead of providing external communication ECUs 20b, the integrated ECU 20a may incorporate the functions of the external communication ECUs 20b.
[0026] Zone ECUs (20c, 20d) are gateway-function ECUs appropriately positioned according to the location and function of the individual ECUs described later. For example, Zone ECU 20c is an ECU that has a gateway function to mediate communication between individual ECUs 20e and 20f, located at the front of the vehicle, and other ECUs 20, while Zone ECU 20d is an ECU that has a gateway function to mediate communication between individual ECUs 20g and 20h, located at the rear of the vehicle, and other ECUs 20. Zone ECUs (20c, 20d) are sometimes called domain computers (DCs). Individual ECUs 20e and 20f are connected to Zone ECU 20c via Network 2 (NW2), and individual ECUs 20g and 20h are connected to Zone ECU 20d via Network 3 (NW3).
[0027] Individual ECUs (20e~20h) can be composed of ECUs with any function. Examples include drivetrain electronic control units that control the engine, steering wheel, brakes, etc., vehicle system electronic control units that control meters, power windows, etc., information system electronic control units such as navigation systems, or safety control system electronic control units that prevent collisions with obstacles or pedestrians. Furthermore, the ECUs may not be in parallel, but may be classified as master and slave units. Furthermore, depending on the functions implemented by each individual ECU (20e-20h), necessary sensors may be connected to each individual ECU (20e-20h). Examples include, but are not limited to, speed sensors, acceleration sensors, angular velocity sensors, temperature sensors, sheet sensors, and voltmeters. In addition, these sensors may be connected to the integrated ECU 20a or zone ECUs (20c, 20d) instead of each individual ECU (20e-20h).
[0028] Each ECU 20 may be a physically independent electronic control unit, or a virtualized electronic control unit implemented using virtualization technology. Furthermore, if each ECU 20 is implemented on different hardware, they only need to be connected via wired or wireless communication. If multiple virtualized electronic control units are implemented on the same hardware, they only need to be virtually connected to each other.
[0029] The security log output device 100 in each embodiment can be implemented in an ECU 20 having a security sensor or an ECU 20 to which a security sensor is directly or indirectly connected. Figure 2 shows an example in which an individual ECU 20e, a zone ECU 20c, an integrated ECU 20a, and an external communication ECU 20b are the security log output device 100 in each embodiment. Furthermore, not all ECU20s are necessarily required to be equipped with security sensors.
[0030] The communication device 200 in each embodiment can be any ECU 20 that is capable of communicating with the outside world. Figure 2 shows an example where the external communication ECU 20b is the communication device 200.
[0031] Figure 3 shows an example of the electronic control system S in each embodiment. Figure 3 focuses on the individual ECU 20e, zone ECU 20c, integrated ECU 20a, and external communication ECU 20b in Figure 2. Each of these ECUs has one or more security sensors and corresponds to the security log output device 100 in each embodiment. In other words, security events generated and output by the security sensors of each ECU20 are aggregated by the Intrusion Detection System Manager (IdsM) (corresponding to the "detection unit"), filtered according to the conditions set in the filter (corresponding to the "filter unit") (corresponding to the "first condition" and "second condition"), and only the security events that pass through (corresponding to "passed event information") are output as security logs.
[0032] Security events generated and output by security sensors are sometimes called SEv, and security events aggregated by the Intrusion Detection System Manager (IdsM) are sometimes called QSEv. In each embodiment, these will be referred to as SEv and QSEv. In each embodiment, filtered QSEv (corresponding to the "security log"), obtained by further filtering the QSEv, is output as the security log. Hereafter, filtered QSEv will be referred to as F-QSEv.
[0033] The security logs output from IdsM are forwarded from PduR, a basic software (BSW) module for routing protocol data units (PDUs), to the CAN driver or Ethernet driver, and then from the CAN driver or Ethernet driver to the higher-level ECU20, which is a shallower layer.
[0034] ECU20b transmits security logs to the SOC, which is an external device 30, and therefore corresponds to the communication device 200. In other words, security logs received from ECU20a are sent to the SOC from the Intrusion Detection Reporter (IdsR).
[0035] (3) Details of the security log Figure 4 shows the contents of the security log transmitted by the security log output device 100.
[0036] The security log has the following fields: an ECU ID indicating the identification of the ECU; a sensor ID indicating the identification of the security sensor; an event ID indicating the identification of the event detected by the security sensor; a counter indicating the number of times the event occurred; a timestamp indicating the time the event occurred; context data indicating details of the security sensor output; and signature data indicating information about the signature to be applied. The security log may also have a header that stores information such as the protocol version and the status of each field.
[0037] According to the specifications defined by AUTOSAR (AUTomotive Open System ARchitecture), IdsM Instance ID corresponds to the ECU ID, Sensor Instance ID to the sensor ID, Event Definition ID to the event ID, Count to the counter, Timestamp to the timestamp, Context Data to the context data, Signature Data to the signature data, and Protocol Version and Protocol Header to the header. The IdsM Instance ID is identification information that identifies the intrusion detection manager (IdsM) included in the ECU20. However, since there is usually only one intrusion detection manager per ECU, the IdsM Instance ID is classified as an ECU ID.
[0038] The data size of security logs varies depending on factors such as the inclusion of timestamps, context data, and signature data.
[0039] Figure 4 shows the contents of QSEv and F-QSEv generated by the Intrusion Detection System Manager (IdsM), but the same format can be used for security events (SEv) generated by security sensors.
[0040] Furthermore, while Figure 4 shows an example of an abnormality log, which is a security log generated when an abnormality occurs, the normality log, which is a security log generated when no abnormality occurs (for example, when an event is successful), may have the same specifications as Figure 4. In that case, abnormality logs and normality logs can be distinguished by using different event IDs for when an abnormality occurs and when an event is successful. Alternatively, abnormality logs and normality logs can be distinguished by setting a flag in the header that indicates the presence or absence of context data, and checking this flag.
[0041] 2. Embodiment 1 (1) Configuration of security log output device 100 Referring to Figure 5, the configuration of the security log output device 100 will be explained. The security log output device 100 includes a security sensor 101, a detection unit 102, a transmission unit 103, and a storage unit 104. The detection unit 102 includes an aggregation unit 105 and a filter unit 106. The filter unit 106 includes a first filtering processing unit 111, a determination unit 112, a second filtering processing unit 113, and an output unit 114. In Figure 5, the area enclosed by the dashed line representing these components of the filter unit 106 can be understood as the security log filtering device 110.
[0042] The security log output device 100 and the security log filtering device 110 can be composed of a general-purpose CPU (Central Processing Unit), volatile memory such as RAM, non-volatile memory such as ROM, flash memory, or hard disk, various interfaces, and an internal bus connecting them. By running software on this hardware, the functions of each functional block shown in Figure 5 can be performed. The same applies to the communication device 200 described later.
[0043] The security sensor 101 detects an "incident" and generates and outputs an SEv. For example, the security sensor 101 is a software algorithm that detects an attack and reports it as an SEv to the Intrusion Detection System Manager (IdsM). However, the security sensor 101 is not limited to software; it may also be implemented in hardware. Here, "incident" refers not only to the fact that an abnormal event occurred, but also to the fact that some event occurred, such as the fact that a normal event occurred.
[0044] The detection unit 102 has the function of aggregating SEv to generate and output QSEv, and the function of further filtering QSEv to generate and output F-QSEv. In other words, the output from the detection unit 102 is F-QSEv. The detection unit 102 is, for example, an intrusion detection system manager (IdsM).
[0045] The aggregation unit 105 aggregates the SEv generated by the security sensor 101 to generate QSEv (corresponding to "event information"). The purpose of the aggregation unit 105 is, for example, to select only the SEv necessary for analyzing cyberattacks and generate QSEv according to the format shown in Figure 4. For example, it can output multiple SEv with the same ID as a single QSEv, or discard SEv if the number has not reached a predetermined number, and allow them to pass if it has reached the predetermined number. The functions of the aggregation unit 105 can be performed by appropriately combining, for example, Blockers, Sampling, and Aggregation.
[0046] In this embodiment and other embodiments, the QSEv generated by the aggregation unit 105 corresponds to "event information," and the block combining the security sensor 101 and the aggregation unit 105 corresponds to the "event information generation unit." Modifications of each embodiment will be described later.
[0047] The filter unit 106 filters the QSEv output from the aggregation unit 105 to "determine" blocked QSEv (corresponding to "blocking event information") and passed QSEv (corresponding to "passing event information"), and outputs the passed QSEv as F-QSEv (corresponding to "security log"). For example, the filter unit 106 filters the QSEv aggregated in the ECU 20, which is included in the intrusion detection system manager (IdsM) in Figure 3 and constitutes the security log output device 100, according to the set conditions (corresponding to "first condition" and "second condition"), and outputs only the QSEv that passed as F-QSEv (corresponding to "security log"). The purpose of the filter unit 106 is to reduce the bandwidth load on the network. In other words, although the aggregation unit 105 initially determined that a QSEv was necessary, the purpose of the filter unit 106 is to further reduce the amount of QSEv transmitted in order to reduce the bandwidth load on the network. The detailed configuration of the filter section 106 will be described later. Here, "decision" includes not only cases where blocking event information and passing event information are determined separately, but also cases where only one of the blocking event information or passing event information is determined, and the other event information is identified reflexively.
[0048] The transmitting unit 103 transmits the F-QSEv output from the filtering unit 106 to the communication device 200. For example, the transmitting unit 103 is the PduR and CAN driver or Ethernet driver shown in Figure 3. The transmitting unit 103 may transmit directly to the communication device 200, or it may transmit via another ECU 20.
[0049] The storage unit 104 is a storage device capable of reading or writing various types of information. The storage unit 104 uses an appropriate device depending on its intended use and the content of the information to be stored. In other words, the storage unit 104 may be an external storage device (hard disk, USB memory, CD / BD, etc.) or an internal storage device (ROM, RAM, etc.), and may be volatile or non-volatile.
[0050] In this embodiment, the storage unit 104 stores the first condition, information identifying a specific QSEv, output change conditions, and the second condition, which are then read out and used by the filter unit 106. The storage unit 104 also temporarily stores the blocked QSEv determined by the filter unit 106 in a temporary storage area. Furthermore, the storage unit 104 is provided with transmission queues (1) and (2) for temporarily storing F-QSEv to be transmitted by the transmission unit 103.
[0051] Figure 6 shows the specific contents of the first condition, the information identifying a specific QSEv, the output change condition, and the second condition stored in the storage unit 104 of this embodiment, and these will be referenced in the following description.
[0052] Next, the detailed configuration of the filter unit 106 will be described. The first filtering processing unit 111 reads the first condition from the storage unit 104 for the QSEv output from the aggregation unit 105, and "determines" the blocked QSEv and the passable QSEv based on the read first condition. In this embodiment, the first condition is the maximum "amount" of QSEv to pass through per unit time. The first filtering processing unit 111 is referred to as a limiting filter according to the specifications defined by AUTOSAR. Furthermore, the function of the filtering processing unit 111 is referred to as rate limiting. Here, "quantity" can refer to any quantitative criterion for event information, such as the number or size of event details.
[0053] Figure 7 illustrates a specific example of the operation of the first filtering unit 111. In this example, the first condition is set to a maximum of 3 QSEvs to pass through during an interval period of 100ms (i.e., the number of F-QSEvs that can be transmitted) (Figure 6(a)). In Figure 7, the interval from 0ms to 100ms is designated as interval (1), the interval from 100ms to 200ms as interval (2), and the interval from 200ms to 300ms as interval (3). QSEvs that pass through are not marked with an "x," while QSEvs that are blocked are marked with an "x." The ID of each QSEv corresponds to the sensor ID in Figure 7. In other words, in the example in Figure 7, the QSEv is identified by its sensor ID.
[0054] In Figure 7(a), since the number of QSEv inputs is 3 or less in each interval, all QSEv are determined to be passable QSEv. In contrast, in Figure 7(b), during interval (1), the first three QSEv inputs are determined to be passable QSEvs, and all subsequent QSEvs are determined to be blocked QSEvs. Here, the QSEv with ID=2 at time t4 and the QSEv with ID=2 at time t5 are determined to be blocked QSEvs. Intervals (2) and (3) are similarly determined to determine passable and blocked QSEvs.
[0055] The determination unit 112 determines whether the specific QSEv (corresponding to "specific event information") included in the blocked QSEv determined by the first filtering processing unit 111 satisfies the output change conditions. The information identifying the specific QSEv and the output change conditions are read from the storage unit 104 and used.
[0056] In this embodiment, a specific QSEv is a QSEv identified by at least one of the following: the type of security sensor 101, or the type of incident or QSEv. The type of security sensor 101 can be identified by the sensor ID in Figure 4, and the type of incident or QSEv can be identified by the event ID in Figure 4. In other words, a specific QSEv is a QSEv identified by the sensor ID, event ID, or a combination of the sensor ID and event ID. Note that the ECU ID or a combination of the ECU ID and other IDs may also be used to identify a specific QSEv. In addition, the context data shown in Figure 4, or information stored in a separate field indicating severity, may be used as information to identify a specific QSEv.
[0057] The output change condition is a condition that triggers a change in the filtering conditions of the filter unit 106. In this embodiment, the output modification condition is the number of specific QSEv included in the blocked QSEv determined by the first filtering processing unit 111. The number of specific QSEv can be set to any number.
[0058] As an example of this embodiment, the specific QSEv is defined as the QSEv of sensor ID=2 (Figure 6(b)), and the output change condition is defined as when the specific QSEv is interrupted three times (i.e., when the interrupted QSEv includes the specific QSEv three times) (Figure 6(c)). In the case of Figure 7(b), the specific QSEv is interrupted at times t4 and t5 in interval (1), and the specific QSEv is interrupted at time t10 in interval (2), so the output change condition is met at time t10.
[0059] As another example of this embodiment, the specific QSEv is defined as the QSEv of sensor ID=2 (Figure 6(b)), and the output change condition is defined as when the specific QSEv is interrupted three times in a row (i.e., the interrupted QSEv includes the specific QSEv three times, and the passing QSEv does not include the specific QSEv during that time) (Figure 6(d)). In the case of Figure 7(b), the specific QSEv is interrupted at times t4 and t5 in interval (1), but it is not interrupted at time t8 in interval (2), so it is not interrupted three times in a row. However, after the specific QSEv is interrupted at time t10 in interval (2), the specific QSEv does not become a passing QSEv in interval (3), and the specific QSEv is interrupted at times t14 and t16, so the output change condition is met at time t16.
[0060] It is desirable that the specific QSEv is one that, if blocked by the filter unit 106, could potentially reduce the accuracy of incident and attack analysis. In other words, it is desirable that the specific QSEv in this embodiment be one that is important or has a higher priority than other QSEvs. An example of an important or high-priority QSEv is a QSEv that is generated when the signature verification of communication data or data stored in non-volatile memory fails. By changing the filtering conditions based on the number of specific QSEvs included in the blocked QSEv, the possibility of the specific QSEv being blocked can be reduced, and a decrease in the accuracy of incident and attack analysis can be prevented.
[0061] Furthermore, the number of times a specific QSEv is blocked by the first filtering processing unit 111 can be stored in the storage unit 104. In other words, by incrementing the block count each time a specific QSEv is blocked, the exact number of blocks can be recorded.
[0062] The second filtering processing unit 113, when the determination unit 112 determines that the output change conditions are met, reads a second condition different from the first condition from the storage unit 104 and "determines" the blocked QSEv and the pass-through QSEv based on the read second condition. For example, the second condition defines a specific QSEv as a passing QSEv and also defines the "timing" for outputting that specific QSEv. In this embodiment, this "timing" is defined as the period during which only the specific QSEv is output preferentially. For example, the timing is defined as 200ms from the start of the next interval. Here, "timing" simply means that the time or period for outputting specific event information can be identified. This includes not only cases where the time or period is directly defined, but also cases where the time or period is defined indirectly, such as when a certain condition is met or a period starting from when a certain condition is met.
[0063] Figure 8 illustrates a specific example of the operation of the second filtering processing unit 113. The second condition is defined as allowing only characteristic QSEv to pass through during the period from the start of the next interval up to 200 ms (however, the first condition is used in combination) (Figure 6(e)). When the conditions in Figure 6(d) are used for output modification, in Figure 7(b), the output modification conditions are met at time t16 of interval (3). Therefore, for a period of 200ms (corresponding to "timing"), including intervals (4) and (5), only the specific QSEv is output. This is explained using Figure 8(a). However, in this example, as mentioned above, the second condition is assumed to be used in conjunction with the first condition. In other words, up to three outputs can be produced during the interval period.
[0064] During interval (4), specific QSEv values are output at times t17, t19, and t20. Time t18 is not a specific QSEv value, so it is blocked. Time t21 is a specific QSEv value, but it is blocked due to the first condition. During interval (5), specific QSEv signals are output at times t24 and t25. Since the QSEv signals at times t22, t23, t26, and t27 are not specific QSEv signals, they are blocked. Interval (6) is when the second condition has been met, so the system returns to the first condition and the filtering by the first filtering processing unit 111 resumes.
[0065] Figure 8(b) shows an example where the second condition does not include the first condition. In other words, the second condition specifies that only characteristic QSEvs will be considered passing QSEvs during the period from the start of the next interval up to 200ms (however, the first condition is not used in conjunction) (Figure 6(f)). In this case, any specific QSEv will be output without limit on the number. During interval (4), specific QSEv values are output at times t17, t19, t20, and t21. Time t18 is not a specific QSEv value, so it is blocked. During interval (5), specific QSEv signals are output at times t24 and t25. Since the QSEv signals at times t22, t23, t26, and t27 are not specific QSEv signals, they are blocked. Interval (6) is when the second condition has been met, so the system returns to the first condition and the filtering by the first filtering processing unit 111 resumes.
[0066] In this embodiment, the starting point of the period defined in the second condition was set as the starting point of the next interval; however, the starting point of the period defined in the second condition may be set as the time when the output change condition is met. Furthermore, although the duration is set to 200ms, the length can be determined arbitrarily. For example, two or more specific QSEvs can be set, and a duration can be determined for each specific QSEv. In Figure 5 and the description of this embodiment, the first filtering processing unit 111 and the second filtering processing unit 113 are shown as separate configurations, but they may be combined into a single configuration. In other words, the first and second conditions, which are the conditions to be applied to the same hardware and software, may be switched as appropriate.
[0067] The output unit 114 outputs the pass QSEv (corresponding to "pass event information") determined by the first filtering unit 111 and the second filtering unit 113 as F-QSEv (corresponding to "security log") to the transmission unit 103. Alternatively, instead of directly transmitting the F-QSEv to the transmission unit 103, the output unit 114 may output the F-QSEv to a transmission queue (1) set in the storage unit 104, and then output it from the transmission queue (1) to the transmission unit 103. The storage unit 104 also has a transmission queue (2) set up, which will be explained in the modified example of Embodiment 2.
[0068] The output unit 114 discards the blocked QSEv (corresponding to "blocking event information") determined by the first filtering processing unit 111 and the second filtering processing unit 113 without outputting it to the transmission unit 103 or the transmission queue (1). However, instead of discarding it, it may be stored in a temporary storage area set in the storage unit 104. The blocked QSEv stored in the temporary storage area can be read and used, for example, using a diagnostic tool.
[0069] Furthermore, the filter unit 106 can output any abnormalities it detects as an internal QSEv to the transmission unit 103. The internal QSEv may be output, for example, to notify that the first condition or the output change condition has been met. The internal QSEv does not need to be transmitted to the external device 30. It is desirable that the internal QSEv is not restricted by the first condition or the second condition. The same applies to other embodiments.
[0070] (2) Configuration of the communication device 200 Referring to Figure 9, the configuration of the communication device 200 will be described. The communication device 200 has a receiving unit 201 and a transmitting unit 202.
[0071] The receiving unit 201 receives the F-QSEv (corresponding to the "security log") transmitted from the transmitting unit 103 of the security log output device 100. The transmitting unit 202 transmits the F-QSEv received by the receiving unit 201 to the external device 30. The receiving unit 201 and the transmitting unit 202 correspond to the intrusion detection reporter (IdsR) of the ECU 20b in Figure 3. The configuration of the communication device 200 is common to all embodiments.
[0072] (3) Operation of security log output device 100 etc. Next, the operation of the security log output device 100, etc., will be explained with reference to Figure 10. Figure 10 not only shows the methods executed by the security log output device 100, etc., but also shows the processing steps of a program that can be executed by the security log output device 100, etc. Furthermore, these processes are not limited to the order shown in Figure 10. That is, the order can be changed unless there are constraints such as a relationship where one step utilizes the result of the preceding step.
[0073] The security sensor 101 of the security log output device 100 detects an "incident" and generates and outputs an SEv (S10). The aggregation unit 105 of the detection unit 102 of the security log output device 100 aggregates the SEv generated in S10 to generate and output QSEv (S11). The filter unit 106 of the detection unit 102 of the security log output device 100 filters the QSEv output in S11 (S12) to "determine" the blocked QSEv and the allowed QSEv, and outputs the allowed QSEv as F-QSEv. Details of S12 will be described later. The transmission unit 103 of the security log output device 100 transmits the F-QSEv output by filtering in S12 to the communication device 200 (S13). S11 to S13 correspond to a security log output method executed by the security log output device 100, or a security log output program that can be executed by the security log output device 100.
[0074] The receiving unit 201 of the communication device 200 receives the F-QSEv transmitted from the security log output device 100 in S13 (S21). The transmitting unit 202 of the communication device 200 transmits the F-QSEv received in S21 to the external device 30 (S22). S21 to S22 correspond to a security log transmission method or a security log transmission program that can be executed by the communication device 200. Furthermore, S11 to S13 and S21 to S22 correspond to a security log transmission method executed by the electronic control system S, or a security log transmission program that can be executed by the electronic control system S.
[0075] The details of S12, which describes the operation of the filter unit 106 of the security log output device 100, will be explained. The first filtering processing unit 111 of the filter unit 106 "determines" the blocked QSEv and the pass-through QSEv based on whether the first condition is met or not for the QSEv output in S11 (S101). The determination unit 112 of the filter unit 106 determines whether the specific QSEv included in the blocked QSEv determined in S101 satisfies the output change conditions (S102). The output change conditions in this embodiment are as shown in Figure 6, and the specific determination method has already been described. The second filtering processing unit 113 of the filter unit 106 determines in S102 that the output change condition has been met, and then "determines" the blocked QSEv and the passed QSEv based on whether a second condition different from the first condition is met (S103). The second condition in this embodiment is as shown in Figure 6, and the specific determination method has already been described. The output unit 114 of the filter unit 106 outputs the pass-through QSEv determined in S101 and S103 as F-QSEv to the transmission unit 103 (S104). S12, that is, S101 to S104, corresponds to a security log filtering method or a security log filtering program that can be executed by the security log filtering device 110.
[0076] (4) Summary As described above, the security log output device 100 of this embodiment determines whether a specific QSEv included in the blocked QSEv satisfies the output change condition, and if it does, changes the filtering condition from the first condition to the second condition, thereby changing the content and type of F-QSEv to be output. According to the security log output device 100 of this embodiment, the output change condition is the number of specific QSEVs that are consecutively included in the blocked QSEV determined by the first filtering processing unit, so it is possible to detect when a predetermined amount or more of specific QSEVs are blocked, exceeding the allowable amount. According to the security log output device 100 of this embodiment, the second condition defines a specific QSEv as a passable QSEv and also defines the timing for outputting the specific QSEv. Therefore, a specific QSEv that would normally be blocked can be output at that timing. By avoiding the blocking of the specific QSEv, the accuracy of incident and attack analysis when the specific QSEv is required can be improved. According to the security log output device 100 of this embodiment, the timing for outputting a specific QSEv is set as a period in which only that specific QSEv is output preferentially. Therefore, a specific QSEv that would normally be blocked can be output preferentially over other QSEvs, further improving the accuracy of incident and attack analysis. According to the security log output device 100 of this embodiment, blocked QSEvs are saved without being discarded, so that blocked QSEvs can be used for post-verification using diagnostic tools, etc. According to the security log output device 100 of this embodiment, a specific QSEv is identified by at least one of the type of security sensor or the type of incident or event information. Therefore, whether or not to output QSEvs that would normally be discarded can be set based on the type of security sensor or the type of event information. According to the security log output device 100 of this embodiment, a QSEv with high importance or priority can be designated as a specific QSEv.
[0077] 3. Embodiment 2 (1) Configuration of security log output device 100 The security log output device 100 of this embodiment differs from the security log output device 100 of Embodiment 1 in the second condition. The following will focus on the differences. For the same configuration and operation as the security log output device 100 described in this embodiment, the description and drawings of Embodiment 1 will be referenced as the configuration and operation of this embodiment.
[0078] Figure 11 shows the specific contents of the first condition, the information identifying a specific QSEv, the output change condition, and the second condition stored in the storage unit 104 of this embodiment, and these will be referenced in the following description.
[0079] Since the first filtering processing unit 111 is the same as in Embodiment 1, Figure 7 and the description of the first filtering processing unit 111 in Embodiment 1 will be referenced. The first condition used for determination is also the same as in Embodiment 1 (Figure 11(a)).
[0080] Since the determination unit 112 is the same as in Embodiment 1, the description of the determination unit 112 in Embodiment 1 will be referenced. The information used to identify the specific QSEv and the output change conditions are also the same as in Embodiment 1 (Figures 11(b), (c), and (d)). In other words, if the output change condition is set to when the specific QSEv is interrupted three times (Figure 11(c)), the output change condition is met at time t10. If the output change condition is set to when the specific QSEv is interrupted three times consecutively (Figure 11(d)), the output change condition is met at time t16.
[0081] Since the basic operation of the second filtering processing unit 113 is the same as in Embodiment 1, the description of the second filtering processing unit 113 in Embodiment 1 will be referenced. And, similar to Embodiment 1, in this embodiment, the second condition defines a specific QSEv as a passing QSEv and also defines the "timing" for outputting the specific QSEv. However, in this embodiment, this "timing" is set to output the specific QSEv that is blocked last "immediately" (Figure 11(e)). Here, "immediately" means outputting the result as soon as possible after processing in the second filtering unit is completed.
[0082] Figure 12 illustrates a specific example of the operation of the second filtering processing unit 113. Figure 12(a) shows the operation of the first filtering processing unit 111, which is the same as Figure 7(b).
[0083] In Figure 12(a), when the output change condition is set to when a specific QSEv is interrupted three times (Figure 11(c)), the output change condition is met at time t10. Therefore, as shown in Figure 12(b), the second filtering processing unit 113 immediately outputs a specific QSEv at the time t10 when the signal is finally blocked, in accordance with the second condition.
[0084] Alternatively, in Figure 12(a), if the output change condition is defined as the interruption of a specific QSEv three times in a row (Figure 11(d)), the output change condition is met at time t16. Therefore, as shown in Figure 12(c), the second filtering processing unit 113 immediately outputs a specific QSEv at the time t16 when the signal is finally blocked, in accordance with the second condition.
[0085] As another example of this embodiment, we will explain the case where the second condition is set to output the last blocked specific QSEv at the start of the next interval (Figure 11(f)).
[0086] In Figure 12(a), when the output change condition is set to occur when a specific SEv is interrupted three times (Figure 11(c)), the output change condition is met at time t10. Therefore, as shown in Figure 12(d), the second filtering processing unit 113 outputs the last blocked specific QSEv at the start of the next interval, interval (3), in accordance with the second condition.
[0087] Alternatively, in Figure 12(a), if the output change condition is defined as the interruption of a specific QSEv three times in a row (Figure 11(d)), the output change condition is met at time t16. Therefore, as shown in Figure 12(e), the second filtering processing unit 113 outputs the last blocked specific QSEv at the start of the next interval, interval (4), in accordance with the second condition.
[0088] In all cases shown in Figures 12(b) to (e), after outputting a specific QSEv, the number of times the output change condition is blocked is reset, and the number of blocked signals is counted anew.
[0089] Since the output unit 114 is the same as in Embodiment 1, the description of the output unit 114 in Embodiment 1 will be referenced. In another example of this embodiment, a specific QSEv that has been blocked is output as an F-QSEv to the transmission queue (2) set in the storage unit 104, and at the start of the next interval, the F-QSEv stored in transmission queue (2) is output to the transmission unit 103 prior to the output from transmission queue (1). In other words, F-QSEv input to transmission queue (1) is promptly output to the transmission unit 103, and F-QSEv input to transmission queue (2) is output prior to transmission queue (1) at the start of the interval.
[0090] (2) Operation of security log output device 100 etc. The operation of the security log output device 100, etc., in this embodiment is the same as in Embodiment 1, so Figure 10 and the description thereof will be referenced. In the determination unit 112 and the second filtering processing unit 113 of the filter unit 106, the output change conditions and the second conditions of this embodiment are as shown in Figure 11, and the specific determination method and decision method have already been described.
[0091] (3) Summary As described above, the security log output device 100 of this embodiment outputs the specific QSEv that is blocked last immediately, so it can output specific QSEvs that would normally be blocked, further improving the accuracy of incident and attack analysis. In another example of this embodiment, the security log output device 100 outputs the last blocked specific QSEv at the start of the next interval. This allows for the output of specific QSEvs that would normally be blocked, further improving the accuracy of incident and attack analysis.
[0092] 4. Embodiment 3 (1) Configuration of security log output device 100 The security log output device 100 of this embodiment differs from the security log output device 100 of Embodiment 1 in the second condition, similar to Embodiment 2. The following will focus on the differences. For the same configuration and operation as the security log output device 100 described in this embodiment, the description and drawings of Embodiment 1 will be referenced as the configuration and operation of this embodiment.
[0093] Figure 13 shows the specific contents of the first condition, the information identifying a specific QSEv, the output change condition, and the second condition stored in the storage unit 104 of this embodiment, and these will be referenced in the following description.
[0094] Since the first filtering processing unit 111 is the same as in Embodiment 1, Figure 7 and the description of the first filtering processing unit 111 in Embodiment 1 will be referenced. The first condition used for determination will also be the same as in Embodiment 1 (Figure 13(a)).
[0095] Since the determination unit 112 is the same as in Embodiment 1, the description of the determination unit 112 in Embodiment 1 will be referenced. The information used to identify the specific QSEv and the output change conditions are also the same as in Embodiment 1 (Figures 13(b), (c), and (d)). In other words, if the output change condition is set to when the specific QSEv is interrupted three times (Figure 13(c)), the output change condition is met at time t10. If the output change condition is set to when the specific QSEv is interrupted three times consecutively (Figure 13(d)), the output change condition is met at time t16.
[0096] Since the basic operation of the second filtering processing unit 113 is the same as in Embodiment 1, the description of the second filtering processing unit 113 in Embodiment 1 will be referenced. In this embodiment, the second condition is the maximum "amount" of QSEv to pass through per unit time, and that the "amount" of the second condition is greater than the "amount" defined by the first condition for the same unit time. For example, the second condition is set to an interval period of 150 ms and a maximum of 6 QSEv to pass through (Figure 13(e)). In this case, if the unit time is 100 ms, the maximum number of QSEv to pass through during this period is 3 under the first condition, while it is 4 under the second condition, so the amount of the second condition is greater than the amount defined by the first condition.
[0097] Furthermore, the second condition may include the "period" during which the second condition persists. In this embodiment, this period is set to 300 ms (Figure 13(e)). Here, the "period" can be specified in any way, for example, by a start time and an end time, a start time and a duration, or the number of consecutive occurrences of a certain period.
[0098] Figure 14 illustrates a specific example of the operation of the second filtering processing unit 113. Figure 14(a) shows the operation of the first filtering processing unit 111, which is the same as Figure 7(b).
[0099] In Figure 14(a), when the output change condition is set to occur when a specific SEv is interrupted three times (Figure 13(c)), the output change condition is met at time t10 of interval period (2). Therefore, as shown in Figure 14(b), the second filtering unit 113, in accordance with the second condition, sets the interval period (3) and (4) to 150ms and allows a maximum of 6 QSEv to pass through. Then, from interval period (5) onwards, it returns to the first condition.
[0100] Alternatively, in Figure 14(a), if the output change condition is defined as the interruption of a specific QSEv three times in a row (Figure 13(d)), the output change condition is met at time t16 of the interval period (3). Therefore, as shown in Figure 14(c), the second filtering unit 113, in accordance with the second condition, sets the interval period (4) and (5) to 150 ms and allows a maximum of 6 QSEv to pass through. Then, from interval period (6) onwards, it returns to the first condition.
[0101] Since the output unit 114 is the same as in Embodiment 1, the description of the output unit 114 in Embodiment 1 will be referenced.
[0102] In this embodiment and Embodiment 1, QSEvs that are blocked when the output change conditions are met are discarded. However, as in another example in Embodiment 2, they may be stored in the transmission queue (2) and transmitted at the start of the next interval. This processing ensures that a specific QSEv is reliably output.
[0103] (2) Operation of security log output device 100 etc. The operation of the security log output device 100, etc., in this embodiment is the same as in Embodiment 1, so Figure 10 and the description thereof will be referenced. In the determination unit 112 and the second filtering processing unit 113 of the filter unit 106, the output change conditions and the second conditions of this embodiment are as shown in Figure 13, and the specific determination method and decision method have already been described.
[0104] (3) Summary As described above, with the security log output device 100 of this embodiment, by setting the second condition as the maximum amount of QSEv allowed to pass per unit time, and making the amount of the second condition larger than the amount defined by the first condition per the same unit time, the proportion of QSEv that is blocked becomes relatively smaller compared to the first condition, resulting in improved accuracy in incident and attack analysis.
[0105] 5. Modified Examples of Each Embodiment In each embodiment, the security log output device 100 first aggregates the SEv generated by the security sensor 101 in the aggregation unit 105 to generate QSEv, and then filters the QSEv in the filter unit 106 to generate F-QSEv. Alternatively, the SEv generated by the security sensor 101 may be filtered by the filter unit 106 without using the aggregation unit 105. In this case, the SEv generated and output by the security sensor 101 corresponds to "event information," and the security sensor 101 corresponds to the "event information generation unit."
[0106] 6. Summary The features of the security log output device 100 and the like in each embodiment of the present invention (including examples; the same applies hereinafter) have been described above.
[0107] The terms used in each embodiment are illustrative and may be replaced with synonymous terms or terms that include synonymous functions.
[0108] The block diagram used in describing the embodiment classifies and organizes the device configuration by function. Each block representing a function can be realized by any combination of hardware or software. Furthermore, since it represents a function, such a block diagram can also be understood as a disclosure of a method invention and a program invention that realizes said method.
[0109] The functional blocks that can be understood as processes, flows, and methods described in each embodiment may be reordered, unless there are constraints such as a relationship where one step utilizes the results of other preceding steps.
[0110] The terms "first," "second," through "nth" (where N is an integer) used in each embodiment and in the claims are used to distinguish between two or more configurations or methods of the same kind, and do not imply any order or hierarchy.
[0111] Although each embodiment has been described on the premise that the device disclosed in each embodiment is mounted on a vehicle, the present invention also includes dedicated or general-purpose devices other than those for vehicles, unless otherwise specifically limited by the claims. Furthermore, although each embodiment has been described on the premise that the device disclosed in each embodiment is mounted on a vehicle, it may also be a device carried by a pedestrian.
[0112] Furthermore, the following are examples of the form of the security log output device of the present invention. Examples of component forms include semiconductor elements, electronic circuits, modules, and microcomputers. Examples of semi-finished products include ECUs and system boards. Examples of finished products include mobile phones, smartphones, tablets, personal computers (PCs), workstations, and servers. Other devices with communication capabilities include, for example, video cameras, still cameras, and car navigation systems.
[0113] An example of the form of the security log filtering device of the present invention is that of a component. Examples of the electronic control system of the present invention include semi-finished or finished products.
[0114] In addition, the present invention can be realized not only with dedicated hardware having the configuration and functions described in each embodiment, but also as a combination of a program for realizing the present invention recorded on a recording medium such as memory or a hard disk, and general-purpose hardware having a dedicated or general-purpose CPU and memory capable of executing this program.
[0115] Programs stored on non-transitional physical recording media of dedicated or general-purpose hardware (e.g., external storage devices (hard disks, USB memory, CD / BD, etc.) or internal storage devices (RAM, ROM, etc.)) can also be provided to the dedicated or general-purpose hardware via the recording media, or via a communication line from a server without using the recording media. This allows for the provision of the latest functions at all times through program upgrades. [Industrial applicability]
[0116] The security log output device and the like of the present invention are primarily intended for devices installed in automobiles, but may also be intended for ordinary devices not installed in automobiles. [Explanation of Symbols]
[0117] 100 Security log output device, 101 Security sensor, 102 Detection unit, 103 Transmission unit, 104 Storage unit, 105 Aggregation unit, 106 Filter unit, 110 Security log filtering device, 111 First filtering processing unit, 112 Judgment unit, 113 Second filtering processing unit, 114 Output unit, 200 Communication device, 20 ECU, 30 External device
Claims
1. An event information generation unit (101, 105) detects an incident and generates and outputs event information, A filter unit (106) filters the event information to determine which event information to block (blocked event information) and which event information to allow (passed event information), and outputs the passed event information as a security log. A security log output device having a transmission unit (103) that transmits the security log to a communication device (200), The filter unit is A first filtering processing unit (111) that determines the blocking event information and the passing event information based on the first condition, A determination unit (112) determines whether the specific event information included in the blocking event information determined by the first filtering processing unit satisfies the output change conditions, A second filtering processing unit (113) determines the blocking event information and the passing event information based on a second condition different from the first condition when the output modification condition is met, The system includes an output unit (114) that outputs the aforementioned transit event information to the transmission unit as the security log, Security log output device (100).
2. The first condition is the maximum amount of event information to pass through per unit time. The security log output device according to claim 1.
3. The output modification condition is the number of specific event information items that are consecutively included in the blocked event information determined by the first filtering processing unit. The security log output device according to claim 2.
4. The second condition defines the specific event information as the passing event information and specifies the timing for outputting the specific event information. The security log output device according to claim 3.
5. The aforementioned timing is the period during which only the specific event information is output. The security log output device according to claim 4.
6. The aforementioned timing is to output the specific event information immediately. The security log output device according to claim 4.
7. The aforementioned timing is to output the specific event information at the start of the interval defined by the unit time. The security log output device according to claim 4.
8. The second condition is the maximum amount of event information to pass through per unit time, The second condition is that, per unit time, the amount is greater than the amount defined by the first condition. The security log output device according to claim 3.
9. The second condition includes the period during which the second condition is in effect. The security log output device according to claim 8.
10. The aforementioned blockage event information is not output from the output unit, but is discarded or stored. The security log output device according to claim 1.
11. The specified event information is the event information identified by at least one of the following: the type of security sensor or the type of incident or event information. The security log output device according to claim 1.
12. The aforementioned specific event information is more important or has a higher priority than the other event information. The security log output device according to claim 11.
13. Furthermore, it has a storage unit (104) for storing the first condition, the output change condition, and the second condition. The security log output device according to claim 1.
14. The security log output device is mounted on a mobile device. The security log output device according to claim 1.
15. A security log filtering device (110) that constitutes a security log output device, which filters event information output from event information generation units (101, 105) including security sensors to determine blocked event information and allowed event information, and outputs the allowed event information as a security log, wherein the filtering device (110) filters event information output from event information generation units (101, 105) including security sensors to determine blocked event information and allowed event information, and outputs the allowed event information as a security log, A first filtering processing unit (111) that determines the blocking event information and the passing event information based on the first condition, A determination unit (112) determines whether the specific event information included in the blocking event information determined by the first filtering processing unit satisfies the output change conditions, A second filtering processing unit (113) determines the blocking event information and the passing event information based on a second condition different from the first condition when the output modification condition is met, The system includes an output unit (114) that outputs the aforementioned transit event information as the security log, Security log filtering device (110).
16. An electronic control system (S) having a security log output device (100) and a communication device (200), The security log output device is An event information generation unit (101, 105) detects an incident and generates and outputs event information, A filter unit (106) filters the event information to determine which event information to block (blocked event information) and which event information to allow (passed event information), and outputs the passed event information as a security log. The device includes a transmitting unit (103) that transmits the security log to a communication device (200), The filter unit is A first filtering processing unit (111) that determines the blocking event information and the passing event information based on the first condition, A determination unit (112) determines whether the specific event information included in the blocking event information determined by the first filtering processing unit satisfies the output change conditions, A second filtering processing unit (113) determines the blocking event information and the passing event information based on a second condition different from the first condition when the output modification condition is met, It has an output unit (114) that outputs the aforementioned transit event information to the transmission unit as the security log, The aforementioned communication device is The system includes a transmission unit (202) that transmits the security log received from the security log output device to an external device (30). Electronic control system (S).
17. A security log transmission method performed by an electronic control system (S) having a security log output device (100) and a communication device (200), In the security log output device, The system detects an incident and generates and outputs event information (S10, S11). By filtering the event information (S12), it is determined which event information to block (blocked event information) and which event information to allow (passed event information), and the passed event information is output as a security log. The security log is transmitted to the communication device (200) (S13), The filtering (S12) is performed as follows: Based on the first condition, the blocking event information and the passing event information are determined (S101), It is determined whether the specific event information included in the determined blocking event information satisfies the output change conditions (S102), If the output change condition is met, the blocking event information and the passing event information are determined based on a second condition different from the first condition (S103). The aforementioned transit event information is output as the security log (S104), In the aforementioned communication device, The security log received from the security log output device is transmitted to an external device (30) (S22). How to send security logs.
18. A security log output program that can be executed on a security log output device (100), The system detects an incident and generates and outputs event information (S10, S11). By filtering the event information (S12), it is determined which event information to block (blocked event information) and which event information to allow (passed event information), and the passed event information is output as a security log. The security log is transmitted to the communication device (200) (S13), The filtering (S12) is performed as follows: Based on the first condition, the blocking event information and the passing event information are determined (S101), It is determined whether the specific event information included in the determined blocking event information satisfies the output change conditions (S102), If the output change condition is met, the blocking event information and the passing event information are determined based on a second condition different from the first condition (S103). The aforementioned transit event information is output as the security log (S104). The security log output device is instructed to perform a process that includes the following: A security log output program.
19. A security log filtering program that can be executed by a security log filtering device (110), By filtering the event information output from the event information generation unit (101, 105) including the security sensor (S12), it is determined which event information to block is the blocked event information and which event information to pass through is the pass-through event information, and the pass-through event information is output as a security log. The filtering (S12) is performed as follows: Based on the first condition, the blocking event information and the passing event information are determined (S101), It is determined whether the specific event information included in the determined blocking event information satisfies the output change conditions (S102), If the output change condition is met, the blocking event information and the passing event information are determined based on a second condition different from the first condition (S103). The aforementioned transit event information is output as the security log (S104). The security log filtering device is instructed to perform a process that includes the following: Security log filtering program.