DETECTION SYSTEM, DETECTION METHOD, AND PROGRAM

Abstract

A detection system (100A) is provided with: an acquisition unit (110A) that acquires a first log, which is a log of communication in a first network; a determination unit (120A) that determines whether or not the first log acquired by the acquisition unit (110A) includes abnormality information indicating abnormal communication in a second network; and a control unit (130A) that, when the determination unit (120A) has determined that the first log includes abnormality information, carries out control of notifying abnormality in the second network.

Description

[Technical field]

[0001] The present invention relates to a detection system, a detection method, and a program. [Background technology]

[0002] A monitoring and control device has been disclosed that is intended for industrial control systems and aims to quickly detect external attacks on the systems (see Patent Document 1).

[0003] Also, a data determination device has been disclosed that can detect attacks that embed attacking communications among communications defined as normal (see Patent Document 2). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2018-22296 A [Patent Document 2] International Publication No. 2016 / 114077 Summary of the Invention [Problem to be solved by the invention]

[0005] However, there is a problem in that it is not possible to properly detect cyber attacks that cross multiple networks.

[0006] The present invention provides a detection system that appropriately detects cyber-attacks that are carried out across multiple networks. [Means for solving the problem]

[0007] A detection system according to one embodiment of the present invention is a detection system including an acquisition unit that acquires a first log, which is a log of communication in a first network, a determination unit that determines whether the first log acquired by the acquisition unit contains abnormality information indicating abnormal communication in a second network, and a control unit that controls notification of an abnormality in the second network when the determination unit determines that the first log contains the abnormality information.

[0008] These comprehensive or specific aspects may be realized by an apparatus, a method, an integrated circuit, a computer program, or a recording medium such as a computer-readable CD-ROM, or may be realized by any combination of an apparatus, a method, an integrated circuit, a computer program, and a recording medium. Effect of the Invention

[0009] The detection system of the present invention can appropriately detect cyber attacks that are carried out across multiple networks. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a block diagram showing a configuration of an integrated anomaly detection system according to an embodiment. [Diagram 2] FIG. 2 is a block diagram showing a configuration of an anomaly detection system according to a related art. [Diagram 3] FIG. 3 is a first explanatory diagram showing the relationship between the integrated anomaly detection system according to the embodiment and an in-vehicle network and the like. [Figure 4] FIG. 4 is a second explanatory diagram showing the relationship between the integrated anomaly detection system according to the embodiment and the in-vehicle network and the like. [Diagram 5] FIG. 5 is a third explanatory diagram showing the relationship between the integrated anomaly detection system according to the embodiment and an in-vehicle network and the like. [Figure 6] FIG. 6 is an explanatory diagram showing a configuration of a customer information database according to the embodiment. [Figure 7]FIG. 7 is an explanatory diagram showing a frame format of ECHONET Lite (registered trademark) according to the embodiment. [Figure 8] FIG. 8 is an explanatory diagram showing a frame format of BACnet (registered trademark) according to the embodiment. [Figure 9] FIG. 9 is an explanatory diagram showing a log according to the present embodiment. [Figure 10] FIG. 10 is a flow diagram showing the processing of the integrated anomaly detection system according to the embodiment. [Figure 11] FIG. 11 is a block diagram showing a configuration of a detection system according to a modified example of the embodiment. [Figure 12] FIG. 12 is a flowchart showing the process of the detection system according to the modified example of the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] (Findings on which the present invention is based) The present inventor has found that the security technology described in the "Background Art" section has the following problems.

[0012] In recent years, facility networks such as those in factories have become targets of cyber attacks, and security measures are required. In addition, cars and buildings are now connected to the Internet, and IoT (Internet of Things) devices are now connected to home networks, so security measures are required in the same way as facility networks.

[0013] For example, a communication protocol such as CAN (registered trademark) (Controller Area Network) is used for an in-vehicle network. For example, a communication protocol such as BACnet (registered trademark) (Building Automation and Control Networking Protocol) is used for a building network. For example, a communication protocol such as ECHONET Lite (registered trademark) is used for a home network (which can also be said to be a network for IoT devices). In this way, each network uses its own dedicated protocol, and security measures according to each dedicated protocol are required.

[0014] For example, Patent Document 1 discloses a monitoring control device that targets industrial control systems and aims to quickly detect external attacks on the system. The monitoring control device quickly detects attacks on the monitoring control device and protects the system by learning, monitoring, and analyzing control command sequences in advance. The monitoring control device detects attacks on the system or abnormalities in the control device by monitoring control signals to the controlled object.

[0015] For example, Patent Document 2 discloses a data judgment device, a data judgment method, and a program, particularly a data judgment device, a data judgment method, and a program for detecting the intrusion of an attack into a network. Patent Document 2 provides a data judgment device that can detect an attack that hijacks a server that is permitted to communicate and mixes attacking communications into communications defined as normal.

[0016] In the future, security measures within a single dedicated protocol will no longer be sufficient; security measures against cyber attacks that cross from one dedicated protocol to another will be required.

[0017] For example, one example of a cyberattack may be launched from an IT (Information Technology) network used in an office or the like against an OT (Operation Technology) network, typically used in a factory, as well as networks for cars, homes, and buildings.In such cases, the moment the IT network becomes capable of communicating with the OT network, or the network for cars, homes, or buildings, an attack on the relevant network will be launched.

[0018] More specifically, in the above attack method, in order to infiltrate the building network, a program that exploits vulnerabilities in BACnet (registered trademark), a protocol dedicated to the building network, is downloaded to the car via the in-vehicle network. Then, when the car moves and connects to the building network, it is assumed that an attack will be launched from the car to the building network via the in-vehicle network.

[0019] In this way, it is conceivable that cyber attacks will occur across networks in multiple areas, such as cars, homes, and buildings.

[0020] The present invention provides a detection system that properly detects cyber attacks.

[0021] This detection system handles input from networks in multiple fields, such as cars, homes, and buildings, and instead of operating an independent anomaly detection system for each field, it integrates the information detection section and information notification section of the anomaly detection system to appropriately detect cyber attacks that cross networks in multiple fields. This makes it possible to prevent damage caused by cyber attacks before they occur.

[0022] A detection system according to one embodiment of the present invention is a detection system including an acquisition unit that acquires a first log, which is a log of communication in a first network, a determination unit that determines whether the first log acquired by the acquisition unit contains abnormality information indicating abnormal communication in a second network, and a control unit that controls notification of an abnormality in the second network when the determination unit determines that the first log contains the abnormality information.

[0023] According to the above aspect, the detection system determines whether or not the communication log in the first network contains information indicating anomalous communication in the second network, and thus can detect a cyber-attack that is carried out across multiple networks, including the first network and the second network, from the second network. In this way, the detection system can appropriately detect a cyber-attack that is carried out across multiple networks, including the first network and the second network.

[0024] For example, the acquisition unit may acquire a log of a first frame, which is a communication frame flowing through the first network, as the first log, and the judgment unit may make the judgment using information indicating an abnormality in the data contained in the first frame as the abnormality information.

[0025] According to the above aspect, the detection system can detect a cyber-attack by using information indicating an anomaly in data included in a communication frame transmitted through the first network, thereby making it easier for the detection system to appropriately detect a cyber-attack that is carried out across multiple networks.

[0026] For example, the information indicating an abnormality in the data may include information indicating that the first frame is a second frame, which is a communication frame flowing through the second network, has a frame format conforming to a communication protocol used in the second network, and includes a second frame having data in a field included in the second frame that is different from the appropriate data to be used in that field.

[0027] According to the above aspect, the detection system detects a cyber-attack by determining whether the first frame includes a second frame. Here, the second frame is data that has a frame format flowing through the second network but contains improper data, and can be easily detected by a determination process on the data included in the frame. Thus, the detection system can more easily and appropriately detect cyber-attacks that are carried out across multiple networks.

[0028] For example, the control unit may perform the control of displaying an image indicating the occurrence of an abnormality in the second network on a screen for notifying the user of the abnormality in the second network.

[0029] According to the above aspect, when the detection system detects abnormal communication in the second network in the first network, the detection system displays an image on a screen notifying the abnormal communication in the second network. The abnormal communication in the second network may be caused by a cyberattack on the second network. In this case, it is preferable to notify the monitor of the second network rather than the monitor of the first network of the abnormal communication in the second network, and the above screen display can notify the monitor of the second network. Thus, the detection system can appropriately detect a cyberattack carried out across multiple networks and contribute to notifying the monitor of the network that is the target of the cyberattack of the occurrence of the cyberattack.

[0030] For example, the acquisition unit may further acquire a second log which is a log of communication in the second network, and the determination unit may further determine whether the second log acquired by the acquisition unit contains abnormality information indicating abnormal communication in the first network, and may have a common detection unit which performs denial of service attack detection processing or signature-type fraud detection processing on both the first log and the second log acquired by the acquisition unit, and may determine that the log contains the abnormality information when the common detection unit detects a denial of service attack in the denial of service attack detection processing or detects fraudulent communication in the signature-type fraud detection processing.

[0031] According to the above aspect, the detection system efficiently executes detection processes for attacks that should be commonly detected across multiple networks (e.g., denial of service attack detection processes or signature-based fraud detection processes) collectively in a common detection unit. Thus, the detection system can more efficiently detect cyber attacks that are carried out across multiple networks.

[0032] For example, the second network may include one or more second networks, and the determination unit may have an individual detection unit that performs individual detection processing for each of the one or more second networks to detect anomalous communication in the second network for the first log acquired by the acquisition unit, and when the individual detection unit of a second network selected from the one or more second networks according to the content of the first log detects the anomalous communication in the individual detection processing, it may be determined that the first log contains the anomalous information.

[0033] According to the above aspect, the detection system performs detection processing of attacks that should be detected individually in each of the multiple networks, individually using individual detection units provided for each of the multiple networks. The individual detection units perform individual processing corresponding to attacks that may be made in the network corresponding to the individual detection unit. In other words, since there is no need to perform processing corresponding to attacks made in other networks but not in the network, the amount of processing to be performed is reduced, making the system more efficient. This can also contribute to reducing power consumption. Thus, the detection system can more efficiently detect cyber attacks that are made across multiple networks.

[0034] For example, the first network may be one selected from an in-vehicle network, a home network, and a building network, and the second network may include one or more of an in-vehicle network, a home network, or a building network, and may not include the first network.

[0035] According to the above aspect, the detection system can appropriately detect cyber attacks that are carried out across multiple networks, targeting an in-vehicle network, a home network, and a building network.

[0036] For example, the in-vehicle network may communicate according to the CAN (Controller Area Network) protocol, the home network may communicate according to the ECHONET Lite (registered trademark) protocol, and the building network may communicate according to the BACnet (registered trademark) protocol.

[0037] According to the above aspect, the detection system can appropriately detect cyber-attacks that are carried out across multiple networks, targeting an in-vehicle network that uses the CAN protocol, a home network that uses the ECHONET Lite (registered trademark) protocol, or a building network that uses the BACnet (registered trademark) protocol.

[0038] For example, the control unit may have linking information indicating that the second network is linked to the same user as the first network, and when performing the control, the control unit may identify the second network linked in the linking information to the same user as the user linked in the linking information to the first network related to the first log acquired by the acquisition unit, and notify the same user of an abnormality in the identified second network.

[0039] According to the above aspect, the detection system can appropriately detect cyber attacks that are carried out across multiple networks, targeting a first network and a second network that are linked to the same user by linking information.

[0040] For example, if the first network or the second network is an in-vehicle network, the linking information may include chassis information, IP address, or telephone number of a vehicle having the in-vehicle network; if the first network or the second network is a home network, the linking information may include address information, IP address, email address, telephone number, or facsimile number of a house having the home network; and if the first network or the second network is a building network, the linking information may include address information, IP address, email address, telephone number, or facsimile number of a building having the building network.

[0041] According to the above aspect, the detection system can more easily and appropriately detect cyber attacks that cross multiple networks by linking the in-vehicle network, home network, and building network using vehicle identification information, IP address, or telephone number, or home or building address information, IP address, email address, telephone number, or facsimile number.

[0042] These comprehensive or specific aspects may be realized by an apparatus, a method, an integrated circuit, a computer program, or a recording medium such as a computer-readable CD-ROM, or may be realized by any combination of an apparatus, a method, an integrated circuit, a computer program, or a recording medium.

[0043] Hereinafter, the embodiment will be specifically described with reference to the drawings.

[0044] The embodiments described below are all comprehensive or specific examples. The numerical values, shapes, materials, components, component arrangement and connection forms, steps, and order of steps shown in the following embodiments are merely examples and are not intended to limit the present invention. Furthermore, among the components in the following embodiments, components that are not described in an independent claim showing a top concept are described as optional components.

[0045] (Embodiment) In this embodiment, a detection system that appropriately detects cyber attacks that are carried out across multiple networks will be described.

[0046] <System configuration> Hereinafter, the present embodiment will be described with reference to the drawings.

[0047] Fig. 1 is a configuration diagram of an integrated anomaly detection system 100 according to the present embodiment. In Fig. 1, the integrated anomaly detection system 100 is an integrated system that integrates the security of a vehicle, a home, or a building. The integrated anomaly detection system 100 corresponds to a detection system.

[0048] The integrated anomaly detection system 100 includes, as functional units, an information collection unit 110, an information detection unit 120, and an information notification unit 130. The functional units included in the integrated anomaly detection system 100 can be realized by a processor (e.g., a CPU (Central Processing Unit)) (not shown) executing a predetermined program using a memory (not shown).

[0049] The information collecting unit 110 includes a vehicle information collecting unit 111 , a home information collecting unit 112 , and a building information collecting unit 113 .

[0050] The information detection unit 120 includes a common information detection unit 121, a vehicle information detection unit 122, a home information detection unit 123, a building information detection unit 124, and an integrated information detection unit 125. Each of the vehicle information detection unit 122, the home information detection unit 123, and the building information detection unit 124 corresponds to an individual detection unit.

[0051] The information notification unit 130 includes an integrated information notification unit 131 , a vehicle information notification unit 132 , a home information notification unit 133 , a building information notification unit 134 , and a customer information database 135 .

[0052] The information collecting unit 110 is a functional unit that collects logs generated by devices connected to the network through communication. The information collecting unit 110 transfers the collected logs to the information detecting unit 120.

[0053] The vehicle information collecting unit 111 collects logs generated by devices connected to the in-vehicle network through communication. Note that, although a case where the communication protocol of the in-vehicle network is CAN will be described as an example, other communication protocols may be used. In this case, the logs collected by the vehicle information collecting unit 111 are logs of frames having the frame format of the CAN communication protocol.

[0054] The home information collection unit 112 collects logs generated by devices connected to the home network through communication. Note that, although a case where the communication protocol of the home network is ECHONET Lite (registered trademark) will be described as an example, other communication protocols may be used. In this case, the logs collected by the home information collection unit 112 are logs of frames having the frame format of the ECHONET Lite (registered trademark) protocol.

[0055] The building information collection unit 113 collects logs generated by devices connected to the building network through communication. Note that, although an example will be described in which the communication protocol of the building network is BACnet (registered trademark), other communication protocols may be used. In this case, the logs collected by the home information collection unit 112 are, for example, logs of frames having the frame format of the BACnet (registered trademark) protocol.

[0056] Note that one selected from the in-vehicle network, the home network, and the building network corresponds to the first network. Also, a network different from the first network among the in-vehicle network, the home network, and the building network corresponds to the second network. For example, when the first network is an in-vehicle network, the second network may be any of the home network, the building network, and the in-vehicle network different from the first network. The second network may include one or more second networks.

[0057] The log of communication in the first network, that is, one selected from the logs collected by the car information collecting unit 111, the logs collected by the home information collecting unit 112, and the logs collected by the building information collecting unit 113, corresponds to the first log. The log collected by the car information collecting unit 111, the logs collected by the home information collecting unit 112, and the logs collected by the building information collecting unit 113 that is not the first log corresponds to the second log.

[0058] The information detection unit 120 is a functional unit that monitors the log transferred from the information collection unit 110 and detects a security anomaly. In other words, the information detection unit 120 determines whether or not the first log acquired by the information collection unit 110 includes anomaly information indicating an abnormal communication in the second network. The anomaly information is, for example, information indicating an anomaly in data included in the first frame.

[0059] The anomaly information may include information indicating that the first frame includes a second frame, which is a communication frame flowing through the second network. In this case, the second frame has a frame format conforming to a communication protocol used in the second network, and has data in a field included in the second frame that is different from the appropriate data used in the field. Here, the appropriate data used in the field corresponds to the fixed value for a field that includes a fixed value. Also, the appropriate data used in the field corresponds to the possible values ​​for a field that has limited possible values.

[0060] The integrated information detection unit 125 plays the role of a dispatcher. Using the log transferred from the information collection unit 110, the integrated information detection unit 125 checks whether the communication data contains a frame having a frame format of a communication protocol used in any of the fields of the car, home, and building. Then, depending on the result of the check, the integrated information detection unit 125 controls which of the common information detection unit 121, the car information detection unit 122, the home information detection unit 123, and the building information detection unit 124 to send a detection request to. Then, when any of the common information detection unit 121, the car information detection unit 122, the home information detection unit 123, and the building information detection unit 124 detects an abnormality, the information detection unit 120 determines that the log contains abnormality information.

[0061] Specifically, the integrated information detection unit 125 checks the frame format of the communication protocol contained in the log transferred from the information collection unit 110 .

[0062] In addition, if the integrated information detection unit 125 determines that the log transferred from the information collection unit 110 contains data that matches the frame format of the CAN communication protocol, it provides the log to the vehicle information detection unit 122 and requests anomaly detection.

[0063] In addition, if the integrated information detection unit 125 determines that the log transferred from the information collection unit 110 contains data that matches the frame format of ECHONET Lite (registered trademark), it provides the log to the home information detection unit 123 and requests anomaly detection.

[0064] Furthermore, when the integrated information detection unit 125 detects that data matching the BACnet (registered trademark) frame format is present in the log transferred from the information collection unit 110, it provides the log to the building information detection unit 124 and makes an anomaly detection request.

[0065] If the integrated information detection unit 125 determines that the log transferred from the information collection unit 110 contains information that may indicate a security anomaly common to vehicle, home, and building networks, such as a denial of service attack, it provides the log to the common information detection unit 121 and makes a detection request.

[0066] Furthermore, the integrated information detection unit 125 requests the information notification unit 130 to notify the security anomaly. The notification request may include information indicating whether the car, the home, or the building is the target of attack (also referred to as target information), which is determined from the detection results from the common information detection unit 121, the car information detection unit 122, the home information detection unit 123, or the building information detection unit 124. The notification request may also include setting information such as filtering that should be added to prevent damage from malware, etc.

[0067] The common information detection unit 121 detects security anomalies common to all networks of vehicles, homes, and buildings, such as denial of service attacks, or performs signature detection of security attacks common to all fields. The common information detection unit 121 is also called a common detection unit.

[0068] The vehicle information detection unit 122 detects a security anomaly according to a dedicated protocol used in the vehicle-mounted network.

[0069] The home information detection unit 123 detects a security anomaly in accordance with a dedicated protocol used in the home network.

[0070] The building information detection unit 124 detects security anomalies according to a dedicated protocol used in the building network.

[0071] The information notification unit 130 is a functional unit that issues a warning notification of a security anomaly. In other words, when the information detection unit 120 determines that the first log contains anomaly information, the information notification unit 130 performs control to notify of an anomaly in the second network. As the above control, for example, the information notification unit 130 performs control to display an image showing the occurrence of an anomaly in the second network on a screen (not shown) for notifying of the anomaly in the second network. The above screen is, for example, a display screen of a monitoring device of the second network connected to the second network, and is expected to be visually recognized by a monitor of the second network.

[0072] Specifically, the information notification unit 130 receives a notification request from the information detection unit 120 (i.e., the integrated information detection unit 125) and controls the notification of a security anomaly warning based on the notification request. The information notification unit 130 has a customer information database 135 in which information on the car, home, or building of a user who uses the anomaly detection system is registered.

[0073] The customer information database 135 includes linking information indicating a user to which the in-vehicle network, the home network, or the building network is linked. In other words, the linking information is information indicating that the second network is linked to the same user as the first network.

[0074] The integrated information notification unit 131 queries the customer information database 135 and acquires information indicating the notification destination of a security anomaly (also referred to as notification destination information). The integrated information notification unit 131 performs control to identify a second network linked in the linking information to the same user as the user linked in the linking information to the first network related to the first log collected by the information collection unit 110, and to notify the same user of an anomaly in the identified second network. Through this control, a notification of the anomaly is displayed on a screen for notifying the user of the anomaly in the identified second network.

[0075] The vehicle information notification unit 132 notifies the vehicle according to the notification destination information acquired by the information notification unit 130. Specifically, the vehicle information notification unit 132 controls to notify the user about the vehicle by transmitting notification information through an interface (e.g., a Web API) that notifies the vehicle. Through this control, a notification of the abnormality is displayed on a screen for notifying the user of an abnormality in the in-vehicle network.

[0076] The home information notification unit 133 notifies the home according to the notification destination information acquired by the information notification unit 130. Specifically, the home information notification unit 133 controls to notify the user about the home by transmitting notification information through an interface (e.g., a Web API) that notifies the home. Through this control, a notification of the abnormality is displayed on a screen for notifying the user of an abnormality in the home network.

[0077] The building information notification unit 134 notifies the building according to the notification destination information acquired by the information notification unit 130. Specifically, the building information notification unit 134 controls to notify the user about the building by sending notification information through an interface (e.g., a Web API) that notifies the building. Through this control, a notification of the abnormality is displayed on a screen for notifying the user of an abnormality in the building network.

[0078] FIG. 2 is a block diagram showing a configuration of an anomaly detection system 900 according to the related art.

[0079] As shown in FIG. 2, an anomaly detection system 900 according to the related art includes a vehicle anomaly detection system 200, a home anomaly detection system 210, and a building anomaly detection system 220.

[0080] The vehicle anomaly detection system 200, the home anomaly detection system 210, and the building anomaly detection system 220 are each operated independently for each network field.

[0081] Specifically, vehicle anomaly detection system 200 includes a vehicle information collection unit 201, a vehicle information detection unit 202, and a vehicle information notification unit 203. Home anomaly detection system 210 includes a home information collection unit 211, a home information detection unit 212, and a home information notification unit 213. Building anomaly detection system 220 includes a building information collection unit 221, a building information detection unit 222, and a building information notification unit 223. In this way, the anomaly detection system for each field includes an information collection unit that collects logs generated by communication by devices in the field, an information detection unit that monitors the logs generated by the communication and detects security anomalies, and an information notification unit that notifies of security anomalies, and is operated independently for each field, thereby operating anomaly detection system 900.

[0082] In the anomaly detection system 900, the vehicle anomaly detection system 200, the home anomaly detection system 210, and the building anomaly detection system 220 cannot detect cyber attacks across the fields of in-vehicle, home, and building due to their structures. Therefore, the anomaly detection system 900 cannot notify of security anomalies regarding the above-mentioned server attacks.

[0083] Hereinafter, the operation of the integrated anomaly detection system 100 according to this embodiment to detect an attack by an attacker will be described using a concrete example.

[0084] (1) Attack on the platform via car Fig. 3 is a first explanatory diagram showing the relationship between the integrated anomaly detection system 100 according to this embodiment and an in-vehicle network, etc. Specifically, Fig. 3 shows the integrated anomaly detection system 100, a car 301, a home 303, and a building 305. Also shown is an attacker 307 attempting to attack the home 303 via the car 301.

[0085] 3, the integrated anomaly detection system 100 is connected to a car 301 via a network 302, to a home 303 via a network 304, and to a building 305 via a network 306. The car 301, the home 303, and the building 305 are linked to one user in the integrated anomaly detection system 100. Some or all of the networks 302, 304, and 306 may be connected.

[0086] It is assumed that an attacker 307 downloads a program (malware) that exploits vulnerabilities in ECHONET Lite (registered trademark) to the car 301 in order to invade the home network of the home 303. In this case, the integrated anomaly detection system 100 collects and analyzes logs generated by the communication of the car 301 via the network 302.

[0087] Specifically, in the integrated anomaly detection system 100, the vehicle information collection unit 111 collects logs and transfers the collected logs to the information detection unit 120. In the information detection unit 120, the integrated information detection unit 125 inspects the communication data using the logs and detects data in the logs that matches the contents of the CAN frame format and data in the payload of the CAN frame format that matches the contents of the ECHONET Lite (registered trademark) frame format.

[0088] Based on the above detection result, the integrated information detection unit 125 issues a detection request to the vehicle information detection unit 122 and the home information detection unit 123. Specifically, the integrated information detection unit 125 issues a detection request by providing a log including data matching the contents of the CAN frame format to the vehicle information detection unit 122. In addition, the integrated information detection unit 125 issues a detection request by providing a log including data matching the contents of the ECHONET Lite (registered trademark) frame format in the payload of the CAN frame format to the home information detection unit 123.

[0089] The vehicle information detection unit 122 performs security anomaly detection for data that matches the contents of the CAN frame format, and returns a detection result indicating that no anomaly exists to the integrated information detection unit 125 .

[0090] The home information detection unit 123 detects that data in the payload of the CAN frame format that matches the contents of the ECHONET Lite (registered trademark) frame format is data that originates from malware that exploits vulnerabilities in ECHONET Lite (registered trademark), and returns the detection result to the integrated information detection unit 125.

[0091] The integrated information detection unit 125 receives detection results from the vehicle information detection unit 122 and the home information detection unit 123 , and transmits a security abnormality notification request for the home 303 to the information notification unit 130 .

[0092] In the information notification section 130, the integrated information notification section 131 queries the customer information database 135 and obtains information indicating the notification destination from the customer information database 135 as notification destination information.

[0093] The integrated information notification unit 131 selects information for identifying the home 303 that is the notification destination from the acquired notification destination information, and also determines the contents of the security warning.

[0094] The integrated information notifying unit 131 requests a notification to the home information notifying unit 133. The home information notifying unit 133 notifies the home 303, which is the notification destination indicated in the notification destination information acquired from the customer information database 135, of the setting contents to be performed in the home network, such as filtering.

[0095] The home 303 receives a security warning notification from the integrated anomaly detection system 100 via the network 304. Upon receiving the security warning notification, the home 303 sets filtering and other settings in the network of the home 303 according to the content of the warning.

[0096] After that, the car 301 drives to the home 303 and connects to the home network of the home 303. At this time, the malware that the attacker 307 has downloaded to the car 301 attempts to intrude into the home network of the home 303. This intrusion is prevented by the filtering of the home network of the home 303 that was set up above.

[0097] In this way, the integrated anomaly detection system 100 can prevent attacks on the home 303 by malware downloaded by an attacker 307 to the car 301.

[0098] (2) Attacks on buildings via vehicles Fig. 4 is a second explanatory diagram showing the relationship between the integrated anomaly detection system 100 according to this embodiment and an in-vehicle network, etc. Fig. 4 shows the integrated anomaly detection system 100, a car 401, and buildings 402, 404, and 406. Also shown is an attacker 408 attempting to launch an attack on any of the buildings 402, 404, and 406 via the car 401.

[0099] 4, the integrated anomaly detection system 100 is connected to a car 401 via a network 400, to a building 402 via a network 403, to a building 404 via a network 405, and to a building 406 via a network 407. The car 401, the building 402, the building 404, and the building 406 are linked to one user in the integrated anomaly detection system 100. Some or all of the networks 400, 403, 405, and 407 may be connected.

[0100] It is assumed that an attacker 408 downloads a program (malware) that exploits a vulnerability in BACnet (registered trademark) to the car 401 in order to infiltrate the building network of the building 402, 404, or 406. In this case, the integrated anomaly detection system 100 collects and analyzes logs generated by the communication of the car 401 via the network 400.

[0101] Specifically, in the integrated anomaly detection system 100 , the vehicle information collection unit 111 collects logs and transfers the collected logs to the information detection unit 120 .

[0102] In the information detection unit 120, the integrated information detection unit 125 inspects the communication data using the log and detects data in the log that matches the contents of the CAN frame format and data in the payload of the CAN frame format that matches the contents of the BACnet (registered trademark) frame format.

[0103] Based on the above detection results, the integrated information detection unit 125 issues a detection request to the vehicle information detection unit 122 and the building information detection unit 124. Specifically, the integrated information detection unit 125 issues a detection request by providing a log including data matching the contents of the CAN frame format to the vehicle information detection unit 122. In addition, the integrated information detection unit 125 issues a detection request by providing a log including data matching the contents of the BACnet (registered trademark) frame format in the payload of the CAN frame format to the building information detection unit 124.

[0104] The vehicle information detection unit 122 performs security anomaly detection for data that matches the contents of the CAN frame format, and returns a detection result indicating that no anomaly exists to the integrated information detection unit 125 .

[0105] The building information detection unit 124 detects that data in the payload of the CAN frame format that matches the contents of the BACnet (registered trademark) frame format is data that originates from malware that exploits vulnerabilities in BACnet (registered trademark), and returns the detection result to the integrated information detection unit 125.

[0106] The integrated information detection unit 125 receives detection results from the vehicle information detection unit 122 and the building information detection unit 124, and transmits a notification request for a security anomaly for the building to the information notification unit 130.

[0107] In the information notification section 130, the integrated information notification section 131 queries the customer information database 135 and obtains information indicating the notification destination from the customer information database 135 as notification destination information.

[0108] The integrated information notification unit 131 selects information for identifying the building to which the notification is to be sent from the acquired destination information, and also determines the contents of the security warning.

[0109] The integrated information notification unit 131 makes a notification request to the building information notification unit 134. The building information notification unit 134 notifies the building 402, building 404, and building 406, which are the notification destinations indicated in the notification destination information acquired from the customer information database 135, of the setting contents to be performed in the building network, such as filtering.

[0110] Building 402, building 404, and building 406 receive a security alert notification from integrated anomaly detection system 100 via network 403, network 405, and network 407, respectively. Building 402, building 404, and building 406 that have received the security alert notification configure filtering and other settings on their respective building networks according to the content of the alert.

[0111] Thereafter, the car 401 heads to any of the buildings 402, 404, and 406, and connects to the building network of the building 402, 404, or 406. At this time, the malware that the attacker 408 has downloaded to the car 401 attempts to intrude into the building networks of the buildings 402, 404, and 406. This intrusion is prevented by the filtering of the building networks set up above.

[0112] In this way, the integrated anomaly detection system 100 can prevent attacks on buildings 402, 404, and 406 using malware downloaded by an attacker 408 to car 401.

[0113] (3) Attacks on buildings via platforms and cars Fig. 5 is a third explanatory diagram showing the relationship between the integrated anomaly detection system 100 according to the present embodiment and an in-vehicle network, etc. Fig. 5 shows the integrated anomaly detection system 100, a home 501, a car 503, and a building 505. Also shown is an attacker 507 attempting to launch an attack on the building 505 via the home 501. Some or all of the networks 502, 504, and 506 may be connected.

[0114] 5, the integrated anomaly detection system 100 is connected to a home 501 via a network 502, to a car 503 via a network 504, and to a building 505 via a network 506. The home 501, the car 503, and the building 505 are linked to one user in the integrated anomaly detection system 100.

[0115] It is assumed that an attacker 507 downloads a program (malware) that exploits vulnerabilities in BACnet (registered trademark) into home 501 in order to invade the building network of building 505. In this case, the integrated anomaly detection system 100 collects and analyzes logs generated by communications in home 501 via network 502.

[0116] Specifically, in the integrated anomaly detection system 100 , the home information collection unit 112 collects logs and transfers the collected logs to the information detection unit 120 .

[0117] In information detection unit 120, integrated information detection unit 125 inspects communication data using a log and detects data in the log that matches the contents of the ECHONET Lite (registered trademark) frame format and data in the payload of the ECHONET Lite (registered trademark) frame format that matches the contents of the BACnet (registered trademark) frame format.

[0118] Based on the above detection results, the integrated information detection unit 125 issues detection requests to the home information detection unit 123 and the building information detection unit 124. Specifically, the integrated information detection unit 125 issues a detection request by providing a log including data matching the contents of the ECHONET Lite (registered trademark) frame format to the home information detection unit 123. In addition, the integrated information detection unit 125 issues a detection request by providing a log including data matching the contents of the BACnet (registered trademark) frame format in the payload of the ECHONET Lite (registered trademark) frame format to the building information detection unit 124.

[0119] The home information detection unit 123 performs security anomaly detection for data that matches the contents of the ECHONET Lite (registered trademark) frame format, and returns a detection result indicating that no anomaly exists to the integrated information detection unit 125 .

[0120] The building information detection unit 124 detects that data in the payload of the ECHONET Lite (registered trademark) frame format that matches the contents of the BACnet (registered trademark) frame format is data that originates from malware that exploits vulnerabilities in BACnet (registered trademark), and returns the detection result to the integrated information detection unit 125.

[0121] The integrated information detection unit 125 receives the detection results from the home information detection unit 123 and the building information detection unit 124, and transmits a notification request for a security anomaly for the building to the information notification unit .

[0122] In the information notification section 130, the integrated information notification section 131 queries the customer information database 135 and obtains information indicating the notification destination from the customer information database 135 as notification destination information.

[0123] The integrated information notification unit 131 selects information for identifying the building to which the notification is to be sent from the acquired destination information, and also determines the contents of the security warning.

[0124] The integrated information notification unit 131 sends a notification request to the building information notification unit 134. The building information notification unit 134 notifies the building 505, which is the notification destination indicated in the notification destination information acquired from the customer information database 135, of the setting contents to be performed in the building network, such as filtering.

[0125] The building 505 receives a security warning notification from the integrated anomaly detection system 100 via the network 506. The building 505 that has received the security warning notification performs settings such as filtering on the building network according to the content of the warning.

[0126] Thereafter, when the car 503 connects to the home network of the home 501, the car 503 may download the program (malware) that the attacker 507 has downloaded to the home 501. After that, when the car 503 heads to the building 505 and connects to the building network of the building 505, the malware that the attacker 507 has downloaded to the car 503 via the home 501 attempts to invade the building network of the building 505. This intrusion is prevented by the filtering of the building network set up above.

[0127] In this way, the integrated anomaly detection system 100 can prevent attacks on the building 505 using malware that an attacker 507 has downloaded to the car 503 via the home 501.

[0128] FIG. 6 is an explanatory diagram showing the configuration of customer information database 135 according to this embodiment.

[0129] The customer information database 135 includes the linking information shown in (a) of Fig. 6. The linking information is information that links, for each customer, a customer number that uniquely identifies the customer, a vehicle registration number that uniquely identifies a car linked to the customer, a house registration number that uniquely identifies a house linked to the customer, and a building registration number that uniquely identifies a building linked to the customer.

[0130] In addition, when a customer has multiple cars, houses, or buildings linked to it, multiple car registration numbers, multiple house registration numbers, or multiple building registration numbers are linked to one customer in customer information database 135.

[0131] For example, (a) of Figure 6 shows that a customer with customer registration number 00001 is linked to a car with car registration number C00001, a house with home registration number H00001, and a building with building registration number B00001.

[0132] The customer information database 135 also includes the vehicle detail information shown in (b) of Fig. 6. The vehicle detail information is information that links, for each vehicle, the vehicle registration number with the vehicle chassis number, IP address, telephone number, or the like, which serves as the destination of a security anomaly warning to the vehicle.

[0133] For example, (b) of Figure 6 shows that a vehicle with registration number C00001 is linked to the chassis number "Shinagawa 599 NN-MM," the IP address "210.160.XXX.XXX," and the telephone number "090-5432-XXXX."

[0134] Furthermore, customer information database 135 includes building detail information shown in (c) of Fig. 6. The building detail information is information that links, for each building, a building registration number with information such as an address, an IP address, an email address, a telephone number, or a FAX (facsimile) number that serves as a notification destination for a security anomaly alert to the building.

[0135] For example, (c) of Figure 6 shows that a car with building registration number B00001 is linked to the address "ABC Ginza, Chuo-ku, Tokyo," the IP address "60.66.XXX.XXX," the email address "admin@example.com," the telephone number "03-5148-XXXX," and the fax number "03-5148-XXXX."

[0136] The customer information database 135 may include house detail information (not shown). The house detail information, like the building detail information, is information that links the house registration number for each house with information such as an address, an IP address, an email address, a telephone number, or a FAX (facsimile) number that serves as a notification destination of a security anomaly alert to the house.

[0137] The customer information database 135, in other words, the linking information, may include identification information of a vehicle having the in-vehicle network if the first network or the second network is an in-vehicle network, may include address information of a house having the home network if the first network or the second network is a home network, or may include address information of a building having the building network if the first network or the second network is a building network.

[0138] The integrated information notification unit 131 can obtain information for sending a security abnormality warning notification to all vehicles, homes, or buildings linked to the customer from the customer number that identifies the customer and the type of vehicle, home, or building.

[0139] FIG. 7 is an explanatory diagram showing a frame format of ECHONET Lite (registered trademark).

[0140] As shown in (a) of FIG. 7, an ECHONET Lite (registered trademark) frame includes fields for a message header (EHD1, EHD2), a transaction ID (TID), a source object designation (SQOJ), a destination object designation (DEOJ), a service code (ESV), the number of properties to be processed (OPC), a property number (EPC), the number of bytes of property value data (PDC), and the property value data (EDT).

[0141] These fields may contain fixed values ​​or may have limited possible values.

[0142] For example, the message headers (EHD1, EHD2) are fields that contain fixed values.

[0143] For example, the transaction ID (TID) is a field that is often filled with 0x0000. The operation property count (OPC) is a field that is often filled with 0x01.

[0144] If the log data contains the contents of a field that includes a fixed value or a field whose possible values ​​are limited, the vehicle information detection unit 122 can determine that the log data contains an ECHONET Lite (registered trademark) frame.

[0145] FIG. 8 is an explanatory diagram showing the frame format of BACnet.

[0146] As shown in Fig. 8(a), a BACnet frame consists of a BACnet Virtual Link Layer (BVLL) header, a BACnet header, and a BACnet Application Protocol Data Unit (APDU), and the BVLL header includes fields for BACnet Virtual Link Control (BVLC) type, BVLC function, and BVLC length. The BACnet header includes fields for version and control.

[0147] These fields may contain fixed values ​​or may have limited possible values.

[0148] For example, the BVLC type field in the BVLL header and the version field in the BACnet header are fields that contain fixed values.

[0149] For example, the BVLC function field in the BVLL header and the control field in the BACnet header are fields with limited possible values.

[0150] If the log data contains the contents of a field that includes a fixed value or a field whose possible values ​​are limited, the building information detection unit 124 can determine that a BACnet frame is included.

[0151] Fig. 9 is an explanatory diagram showing a log of this embodiment. The log shown in Fig. 9 shows an example of a log collected by the information collecting unit 110 (i.e., the car information collecting unit 111, the home information collecting unit 112, or the building information collecting unit 113). One line shown in Fig. 9 shows one entry included in the log. One entry corresponds to one frame (a CAN frame, an ECHONET Lite (registered trademark) frame, or a BACnet (registered trademark) frame).

[0152] As shown in FIG. 9, one entry includes time information, header information, and payload information.

[0153] The time information is information indicating the time when the frame related to the entry was received (time information T1, T2 shown in FIG. 9). The time information is, for example, information indicating the time when the frame related to the entry was received in an hour, minute, and second format, specifically, information such as "January 1, 2021, 12:12:12."

[0154] The header information is information (header information H1, H2 shown in FIG. 9) indicating the header (see FIG. 7 or FIG. 8) of the frame related to the entry. The header information may be values ​​read from some or all of the fields included in the header of the frame, or may contain the binary data of the header as is.

[0155] The payload information is information (payload information P1, P2 shown in FIG. 9) indicating the payload of the frame related to the entry (data contained in the frame and located after the header) (see FIG. 7 or FIG. 8). The payload information may be values ​​read from some or all of the fields contained in the payload, or may contain the binary data of the payload as is. For example, the payload information may be data obtained by extracting only a predetermined number of bytes from the beginning of the payload.

[0156] <Processing Flowchart> The processing of the integrated anomaly detection system 100 configured as above will be described.

[0157] FIG. 10 is a flow diagram showing the processing of the integrated anomaly detection system 100 according to the present embodiment.

[0158] The process shown in FIG. 10 illustrates a process in which the integrated anomaly detection system 100 collects logs generated by a vehicle, home, or building through communication, detects a security anomaly, and notifies the vehicle, home, or building of the anomaly.

[0159] In step S100, the information collection unit 110 (that is, the car information collection unit 111, the home information collection unit 112, and the building information collection unit 113) receives a log indicating communication data.

[0160] In step S101, the integrated information detection unit 125 checks the communication data using the log received by the information collection unit 110 in step S100.

[0161] In step S102, the integrated information detection unit 125 attempts to determine the protocol of the communication data based on the inspection result in step S101. If the determination of the protocol of the communication data is successful (YES in step S102), the integrated information detection unit 125 performs the process of step S105, and if not (NO in step S102), the integrated information detection unit 125 performs the process of step S103.

[0162] In step S103, the integrated information detection unit 125 requests all the detection units (i.e., the common information detection unit 121, the vehicle information detection unit 122, the home information detection unit 123, and the building information detection unit 124, and so on below) to detect anomalies in the communication data by providing the logs to each of them. In response to the request, all the detection units execute anomaly detection processing of the communication data using the logs.

[0163] In step S104, each of all the detection units returns the result of the anomaly detection process executed in step S103 to the integrated information detection unit 125. After step S104, step S107 is executed.

[0164] In step S105, the integrated information detection unit 125 requests anomaly detection of the communication data by providing a log to a detection unit corresponding to the protocol of the communication data among all the detection units. At this time, the integrated information detection unit 125 does not provide a log to any detection unit other than the detection unit corresponding to the protocol of the communication data among all the detection units. In response to the request, the corresponding detection unit executes anomaly detection processing of the communication data using the log.

[0165] In step S106, the detection unit that executed the anomaly detection process in step S105 returns the result of the anomaly detection process executed in step S105 to the integrated information detection unit 125.

[0166] In step S107, the integrated information detection unit 125 generates a notification request for a security anomaly based on the detection result returned in step S104 or step S106. The notification request includes the target information and the setting information, as described above.

[0167] In step S108, the integrated information detection unit 125 provides the notification request generated in step S107 to the integrated information notification unit 131. The integrated information notification unit 131 acquires the provided notification request.

[0168] In step S109, the integrated information notification unit 131 searches the customer information database 135 using the target information included in the notification request acquired in step S108, and acquires notification destination information.

[0169] In step S110, the integrated information notifying unit 131 provides a notification request to one of the vehicle information notifying unit 132, the home information notifying unit 133, and the building information notifying unit 134 that is indicated in the notification destination information acquired in step S109.

[0170] In step S111, of the car information notifying unit 132, the home information notifying unit 133, and the building information notifying unit 134, the notifying unit that received the notification request in step S110 notifies the notification destination, that is, the car, the home, or the building, of a security warning.

[0171] (Effects of the embodiment) In the embodiment, rather than operating the anomaly detection system separately for each of the fields of the vehicle, the home, and the building, the system is characterized in that the information detection unit and the information notification unit are integrated, and the integrated information detection unit identifies the information detection unit that needs detection from the communication log collected from the information collection unit.

[0172] This configuration makes it possible to detect cyber attacks that span the fields of vehicles, homes, and buildings in the same amount of time as would be possible with an anomaly detection system operated independently for each field, making it possible to prevent damage before it occurs, thereby achieving fast and efficient security anomaly detection.

[0173] (Modification of the embodiment) In this modified example, another configuration of a detection system that appropriately detects cyber attacks that are carried out across multiple networks will be described.

[0174] FIG. 11 is a block diagram showing the configuration of a detection system 100A according to this modified example.

[0175] 11, detection system 100A includes, as functional units, an acquisition unit 110A, a determination unit 120A, and a control unit 130A. The functional units included in detection system 100A can be realized by a processor (e.g., a CPU) (not shown) included in detection system 100A executing a program using a memory (not shown).

[0176] The acquiring unit 110A acquires a first log, which is a log of communications in a first network.

[0177] The determining unit 120A determines whether or not the first log acquired by the acquiring unit 110A includes anomaly information indicating an abnormal communication in the second network.

[0178] When the determining unit 120A determines that the first log contains abnormality information, the control unit 130A performs control to notify of an abnormality in the second network.

[0179] Here, the acquisition unit 110A corresponds to the information collection unit 110 in the embodiment, and more specifically corresponds to one selected from the vehicle information collection unit 111, the home information collection unit 112, and the building information collection unit 113. Furthermore, the first network may be an in-vehicle network when the acquisition unit 110A is the vehicle information collection unit 111, may be a home network when the acquisition unit 110A is the home information collection unit 112, and may be a building network when the acquisition unit 110A is the building information collection unit 113.

[0180] The determination unit 120A corresponds to the information detection unit 120 in the embodiment. The second network may be a network different from the first network among an in-vehicle network, a home network, and a building network. For example, when the first network is an in-vehicle network, the second network may be any one of a home network, a building network, and an in-vehicle network different from the first network.

[0181] The control unit 130A corresponds to the information notification unit 130 in the embodiment.

[0182] For example, the acquisition unit 110A may acquire, as the first log, a log of a first frame that is a communication frame flowing through a first network. In this case, the determination unit 120A may make a determination using information indicating an abnormality in data included in the first frame as the abnormality information.

[0183] For example, the information indicating the data abnormality may include information indicating that the first frame includes a second frame that is a communication frame flowing through a second network. In this case, the second frame may have a frame format conforming to a communication protocol used in the second network, and may be a frame having data in a field included in the second frame that is different from appropriate data used in the field.

[0184] For example, as the above control, the control unit 130A may perform control to display an image indicating the occurrence of an abnormality in the second network on a screen for notifying the user of the abnormality in the second network.

[0185] For example, the acquisition unit 110A may further acquire a second log which is a log of communication in the second network. In this case, the determination unit 120A may further determine whether the second log acquired by the acquisition unit 110A includes abnormality information indicating abnormal communication in the first network, and may have a common detection unit that performs a denial of service attack detection process or a signature-based fraud detection process on both the first log and the second log acquired by the acquisition unit 110A, and may determine that the log includes abnormality information when the common detection unit detects a denial of service attack in the denial of service attack detection process or detects fraudulent communication in the signature-based fraud detection process.

[0186] For example, the second network may include one or more second networks. The determination unit 120A may have an individual detection unit that performs an individual detection process for each of the one or more second networks to detect abnormal communication in the second network for the first log acquired by the acquisition unit 110A, and may determine that the first log includes abnormal information when the individual detection unit of a second network selected from the one or more second networks according to the content of the log detects abnormal communication in the individual detection process.

[0187] For example, the first network may be one selected from an in-vehicle network, a home network, and a building network, and the second network may include one or more of the in-vehicle network, the home network, and the building network, but may not include the first network.

[0188] For example, the in-vehicle network may communicate according to the CAN (Controller Area Network) protocol, the home network may communicate according to the ECHONET Lite (registered trademark) protocol, and the building network may communicate according to the BACnet (registered trademark) protocol.

[0189] For example, the control unit 130A may have linking information indicating that the second network is linked to the same user as the first network. In this case, when performing control, the control unit 130A performs control to specify the second network linked in the linking information to the same user as the user linked in the linking information to the first network related to the first log acquired by the acquisition unit 110A, and to notify the same user of an abnormality in the specified second network.

[0190] For example, the linking information may include identification information of a vehicle having the in-vehicle network if the first network or the second network is an in-vehicle network, may include address information of a house having the home network if the first network or the second network is a home network, and may include address information of a building having the building network if the first network or the second network is a building network.

[0191] FIG. 12 is a flow diagram showing the process of the detection system 100A according to this modified example.

[0192] As shown in FIG. 12, in step S201, the detection system 100A (acquisition unit 110A) acquires a first log that is a log of communications in a first network.

[0193] In step S202, the detection system 100A (determination unit 120A) determines whether or not the acquired first log includes anomaly information indicating an abnormal communication in the second network.

[0194] In step S203, when the detection system 100A (controller 130A) determines that the first log contains anomaly information, it performs control to notify of an anomaly in the second network.

[0195] This enables the detection system 100A to appropriately detect cyber attacks that are carried out across multiple networks.

[0196] (Other variations) Although the present invention has been described based on the above-mentioned embodiments, the present invention is not limited to the above-mentioned embodiments. The following cases are also included in the present invention.

[0197] (1) In the above embodiment, the anomaly detection system targets a vehicle, a home, or a building. However, this is one aspect of the anomaly detection system of the present invention, and the system is not limited to the three types of vehicles, homes, and buildings, and may target other network fields, such as factories that use dedicated protocols such as Modbus.

[0198] (2) In the above embodiment, the information notification unit of the anomaly detection system sends a warning notification to the home or building, which is the final target of a cyber-attack, among the car, home, and building, but it may also send a warning notification to the car that contains the attacking program (malware).

[0199] (3) In the above embodiment, the information notification unit of the anomaly detection system issues a warning notification to a vehicle, home, or building to prevent cyber-attacks. The filtering information that constitutes the content of the warning notification may be information about the vehicle that is the source of the attack, or information about the program (malware) that is the content of the attack.

[0200] (4) In the above embodiment, the customer information database of the anomaly detection system uses, as examples of registered information about a vehicle, the vehicle identification number, IP address, and telephone number. However, any other identification information may be used as long as it can be used to identify the vehicle or to send notifications.

[0201] (5) In the above embodiment, the customer information database of the anomaly detection system uses, as examples of registered information about a home or building, an address, an IP address, an email address, a telephone number, and a fax number. However, any other identification information may be used as long as it can be used to identify a home or building or as a notification destination.

[0202] (6) In the above embodiment, the information notification unit of the anomaly detection system notifies vehicles, homes, and buildings of security anomalies via a Web API. However, the format of the notification via the Web API can be any type, such as a data description language such as JSON (JavaScript (registered trademark) Object Notation) or a markup language such as XML (Extensible Markup Language), and notification methods other than the Web API, such as email, may also be adopted.

[0203] (7) In the above embodiment, CAN is taken as an example of a communication protocol used in an in-vehicle network. However, other in-vehicle communication protocols, such as in-vehicle Ethernet, may also be used.

[0204] (8) In the above embodiment, ECHONET Lite (registered trademark) is used as an example of a communication protocol used in a home network. However, other home-oriented communication protocols such as DLNA (registered trademark) (Digital Living Network Alliance) may also be used.

[0205] (9) In the above embodiment, BACnet (registered trademark) is used as an example of a communication protocol used in a building network. However, other building-oriented communication protocols such as LONWORKS may also be used.

[0206] As described above, the detection system according to the above embodiment or the above modification determines whether or not a log of communication in the first network contains information indicating abnormal communication in the second network, and is therefore capable of detecting a cyber-attack carried out across multiple networks, including the first network and the second network, from the second network. In this way, the detection system can appropriately detect a cyber-attack carried out across multiple networks, including the first network and the second network.

[0207] In addition, the detection system can detect a cyber-attack using information indicating an anomaly in data included in a communication frame transmitted through the first network, thereby making it easier for the detection system to appropriately detect a cyber-attack that is carried out across multiple networks.

[0208] The detection system detects a cyber attack by determining whether the first frame includes a second frame. Here, the second frame is data that has a frame format flowing through the second network but includes improper data, and can be easily detected by a determination process for the data included in the frame. Thus, the detection system can more easily and appropriately detect cyber attacks that are carried out across multiple networks.

[0209] Furthermore, when the detection system detects abnormal communication in the second network in the first network, the detection system displays an image on a screen notifying the abnormal communication in the second network. The abnormal communication in the second network may be caused by a cyberattack against the second network. In this case, it is preferable to notify the monitor of the second network rather than the monitor of the first network of the abnormal communication in the second network, and the above-mentioned screen display can notify the monitor of the second network. Thus, the detection system can appropriately detect a cyberattack that is carried out across multiple networks and contribute to notifying the monitor of the network that is the target of the cyberattack of the occurrence of the cyberattack.

[0210] Furthermore, the detection system efficiently executes detection processes for attacks that should be commonly detected across multiple networks (for example, denial of service attack detection processes or signature-based fraud detection processes) collectively in a common detection unit, thereby enabling the detection system to more efficiently and appropriately detect cyber attacks that are carried out across multiple networks.

[0211] In addition, the detection system performs detection processing of attacks that should be detected individually in each of the multiple networks using individual detection units provided for each of the multiple networks. The individual detection units perform individual processing corresponding to attacks that may be made in the network corresponding to the individual detection unit. In other words, since there is no need to perform processing corresponding to attacks made in other networks but not in the network, the amount of processing to be performed is reduced, making the system more efficient. This can also contribute to reducing power consumption. Thus, the detection system can more efficiently detect cyber attacks that are made across multiple networks.

[0212] In addition, the detection system can appropriately detect cyber attacks that cross multiple networks, targeting in-vehicle networks, home networks, and building networks.

[0213] In addition, the detection system can appropriately detect cyber-attacks that cross multiple networks, targeting in-vehicle networks that use the CAN protocol, home networks that use the ECHONET Lite (registered trademark) protocol, or building networks that use the BACnet (registered trademark) protocol.

[0214] In addition, the detection system can appropriately detect cyber attacks that are carried out across multiple networks, targeting a first network and a second network that are linked to the same user by the linking information.

[0215] In addition, the detection system can link the in-vehicle network, home network, and building network using vehicle identification information, IP address, or telephone number, or home or building address information, IP address, email address, telephone number, or facsimile number, making it easier to properly detect cyber-attacks that span multiple networks.

[0216] In the above embodiment or the above modification, each component may be configured with dedicated hardware, or may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU or a processor reading and executing a software program recorded on a recording medium such as a hard disk or a semiconductor memory. Here, the software that realizes the detection system of the above embodiment or the above modification is a program such as the following.

[0217] In other words, this program causes a computer to execute a detection method that acquires a first log, which is a log of communication in a first network, determines whether the acquired first log contains abnormality information indicating abnormal communication in a second network, and, if it is determined that the first log contains the abnormality information, controls to notify of an abnormality in the second network.

[0218] Although the detection system according to one or more aspects has been described based on the embodiment, the present invention is not limited to this embodiment. As long as it does not deviate from the spirit of the present invention, various modifications conceived by a person skilled in the art to this embodiment and forms constructed by combining components in different embodiments may also be included within the scope of one or more aspects. [Industrial Applicability]

[0219] The anomaly detection system and method of the present invention will contribute to the development of an anomaly detection system that aims to prevent damage caused by cyber attacks across networks in multiple fields and to quickly and efficiently detect security anomalies. [Explanation of symbols]

[0220] 100 Integrated Anomaly Detection System 100A Detection System 110 Information Gathering Department 110A Acquisition Department 111, 201 Car Information Collection Department 112, 211 Home Information Collection Department 113, 221 Building Information Collection Department 120 Information Detection Unit 120A Judgment part 121 Common Information Detection Unit 122, 202 Vehicle information detection unit 123, 212 Home information detection unit 124, 222 Building Information Detection Unit 125 Integrated Information Detection Unit 130 Information Notification Department 130A Control Unit 131 Integrated Information Notification Department 132, 203 Vehicle information notification section 133, 213 Home Information and Notification Department 134, 223 Building Information and Notification Department 135 Customer Information Database 200 Vehicle Abnormality Detection System 210 Platform Anomaly Detection System 220 Building Anomaly Detection System 301, 401, 503 cars 302, 304, 306, 400, 403, 405, 407, 502, 504, 506 Network 303, 501 Home 305, 402, 404, 406, 505 Building 307, 408, 507 Attacker 900 Anomaly Detection System

Claims

1. an acquisition unit that acquires a first log that is a log of communications in a first network; a determination unit that determines whether or not the first log acquired by the acquisition unit includes abnormality information indicating abnormal communication in the second network; a control unit that performs control to notify an abnormality in the second network when the determination unit determines that the first log includes the abnormality information, The acquisition unit further acquiring a second log which is a log of communications in the second network; The determination unit further determining whether or not the second log acquired by the acquisition unit includes abnormality information indicating abnormal communication in the first network; a common detection unit that performs a denial of service attack detection process or a signature-based fraud detection process on both the first log and the second log acquired by the acquisition unit, When the common detection unit detects a denial of service attack in the denial of service attack detection process, or detects unauthorized communication in the signature-based unauthorized communication detection process, it is determined that the abnormality information is included in the log. Detection system.

2. An acquisition unit that acquires a first log which is a log of communications in a first network; a determination unit that determines whether or not the first log acquired by the acquisition unit includes abnormality information indicating abnormal communication in the second network; a control unit that performs control to notify an abnormality in the second network when the determination unit determines that the first log includes the abnormality information, The second network includes one or more second networks; The determination unit is an individual detection unit that performs an individual detection process for detecting abnormal communication in the second network for the first log acquired by the acquisition unit, for each of the one or more second networks; When the individual detection unit of a second network selected from the one or more second networks according to the content of the first log detects the abnormal communication in the individual detection process, it is determined that the first log contains the abnormality information. Detection system.

3. An acquisition unit that acquires a first log which is a log of communications in a first network; a determination unit that determines whether or not the first log acquired by the acquisition unit includes abnormality information indicating abnormal communication in the second network; a control unit that performs control to notify an abnormality in the second network when the determination unit determines that the first log includes the abnormality information, The control unit is having association information indicating that the second network is associated with the same user as the first network; When performing the above control, Identifying the second network associated in the association information with a user who is the same as a user associated in the association information with the first network related to the first log acquired by the acquisition unit; Control to notify of the identified abnormality in the second network. Detection system.

4. the acquisition unit acquires, as the first log, a log of a first frame that is a communication frame transmitted through the first network; The determination unit makes the determination using information indicating an abnormality in the data included in the first frame as the abnormality information. A detection system according to any one of claims 1 to 3.

5. The information indicating an anomaly in the data is The first frame includes information indicating that the second frame is a communication frame that flows through the second network, has a frame format conforming to a communication protocol used in the second network, and includes a second frame having data in a field included in the second frame that is different from appropriate data used in the field. The detection system of claim 4.

6. In order to notify of an abnormality in the second network, the control unit performs control to display on a screen an image indicating the occurrence of an abnormality in the second network. A detection system according to any one of claims 1 to 5.

7. The second network includes one or more second networks; The determination unit is an individual detection unit that performs an individual detection process for detecting abnormal communication in the second network for the first log acquired by the acquisition unit, for each of the one or more second networks; When the individual detection unit of a second network selected from the one or more second networks according to the content of the first log detects the abnormal communication in the individual detection process, it is determined that the first log contains the abnormality information. The detection system of claim 1 .

8. The first network is one selected from an in-vehicle network, a home network, and a building network; The second network includes at least one of an in-vehicle network, a home network, or a building network, and does not include the first network. A detection system according to any one of claims 1 to 7.

9. The in-vehicle network performs communication according to a Controller Area Network (CAN) protocol, The home network communicates according to the ECHONET Lite (registered trademark) protocol; The building network communicates according to the BACnet (registered trademark) protocol. The detection system of claim 8.

10. The control unit is having association information indicating that the second network is associated with the same user as the first network; When performing the above control, Identifying the second network associated in the association information with a user who is the same as a user associated in the association information with the first network related to the first log acquired by the acquisition unit; Control to notify of the identified abnormality in the second network. A detection system according to claim 1 or 2.

11. The linking information is When the first network or the second network is an in-vehicle network, the vehicle information, the IP address, or the telephone number of a vehicle having the in-vehicle network is included; When the first network or the second network is a home network, the address information, IP address, email address, telephone number or facsimile number of a house having the home network is included; When the first network or the second network is a building network, the address information, IP address, email address, telephone number, or facsimile number of the building having the building network is included. The detection system of claim 10.

12. Acquire a first log which is a log of communications in a first network; determining whether the acquired first log contains abnormality information indicating abnormal communication in the second network; When it is determined that the first log contains the abnormality information, control is performed to notify an abnormality in the second network; acquiring a second log which is a log of communications in the second network; determining whether the acquired second log includes abnormality information indicating abnormal communication in the first network; performing a denial of service attack detection process or a signature-based fraud detection process on both the acquired first log and the acquired second log; When a denial of service attack is detected in the denial of service attack detection process, or when an unauthorized communication is detected in the signature-based unauthorized communication detection process, it is determined that the abnormality information is included in the log. Detection method.

13. Acquiring a first log which is a log of communications in a first network; determining whether the acquired first log contains abnormality information indicating abnormal communication in the second network; When it is determined that the first log contains the abnormality information, control is performed to notify an abnormality in the second network; The second network includes one or more second networks; performing an individual detection process for each of the one or more second networks to detect abnormal communication in the second network with respect to the first log; When the individual detection process of a second network selected from the one or more second networks according to the content of the first log detects the abnormal communication, it is determined that the first log contains the abnormality information. Detection method.

14. Acquiring a first log which is a log of communications in a first network; determining whether the acquired first log contains abnormality information indicating abnormal communication in the second network; When it is determined that the first log contains the abnormality information, control is performed to notify an abnormality in the second network; having association information indicating that the second network is associated with the same user as the first network; When performing the above control, Identifying the second network associated with the same user as the user associated with the first network related to the acquired first log in the association information; Control to notify of the identified abnormality in the second network. Detection method.

15. A program for causing a computer to execute the detection method according to any one of claims 12 to 14.

Images