Information notification method and information notification device

Abstract

To provide an information notification method etc., capable of suppressing damage caused by incidents by preferentially handling an incident increasing the damage in the future.SOLUTION: An information notification method comprises: acquiring incident information on a plurality of incidents occurring when an object to be monitored receives a security attack in a past first period; determining, based upon the acquired incident information, occurrence trends of the incidents by kinds to the object to be monitored in a future second period for each kind of the incidents and priority levels of provisional handling or permanent handling on the incidents by the kinds; and then reporting the occurrence trends and priority levels determined for each kind of the incidents.SELECTED DRAWING: Figure 10

Description

[Technical field]

[0001] The present disclosure relates to an information notification method and an information notification device. [Background technology]

[0002] Patent Document 1 discloses an alert notification device that performs cluster analysis based on the characteristics of an incident that has occurred, determines which incidents are more likely to be abnormal based on the analysis results as having a high priority, and issues an alert. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2019-175070 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, the technology disclosed in Patent Document 1 is primarily intended to assign high priority to incidents that are more likely to be abnormal among a large number of reported incidents, and is unable to assign high priority to incidents that are likely to cause further damage. [Means for solving the problem]

[0005] An information notification method according to one embodiment of the present disclosure acquires incident information on a plurality of incidents that occurred due to security attacks on a monitored target during a first period in the past, and based on the acquired incident information, determines, for each type of incident, a tendency for incidents of that type to occur in the monitored target during a future second period in a future period, and a priority for a temporary or permanent response to that type of incident, and presents the occurrence tendency and the priority determined for each type of incident.

[0006] In addition, these general or specific aspects may be realized by a system, an apparatus, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM, or may be realized by any combination of a system, a method, an integrated circuit, a computer program, and a non-transitory recording medium. Effect of the Invention

[0007] According to the above aspect, it becomes possible to prioritize responding to incidents that are likely to cause more damage in the future, thereby making it possible to reduce damage caused by incidents. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a schematic diagram of an information notification system according to an embodiment. [Diagram 2] FIG. 2 is a block diagram illustrating an example of a hardware configuration of an information processing device according to an embodiment. [Diagram 3] FIG. 3 is a block diagram illustrating an example of a hardware configuration of a vehicle according to an embodiment. [Figure 4] FIG. 4 is a block diagram illustrating an example of a functional configuration of an information notification system according to an embodiment. [Diagram 5] FIG. 5 is a table showing a specific example of incident statistical information. [Figure 6] FIG. 6 is a table showing another example of the incident statistical information. [Figure 7] FIG. 7 is a table showing another example of the incident statistical information. [Figure 8] FIG. 8 is a table illustrating another example of the incident statistical information. [Figure 9] FIG. 9 is a graph showing the change over time in the number of occurrences of incident information. [Figure 10] FIG. 10 is a sequence diagram showing an example of an information notification method in the information notification system according to the embodiment. [Figure 11]FIG. 11 is a sequence diagram showing an example of an information notification method in the information notification system according to the first modification. [Figure 12] FIG. 12 is a sequence diagram showing an example of an information notification method in an information notification system according to the second modification. [Figure 13] FIG. 13 is a sequence diagram showing an example of an information notification method in an information notification system according to the third modification. [Figure 14] FIG. 14 is a diagram showing an example of a probability density function in which the index indicating the occurrence tendency is used as a random variable. [Figure 15] FIG. 15 is a diagram showing an example in which the distribution is expressed as a range including a plurality of possible index values ​​for an index indicating a development tendency. [Figure 16] FIG. 16 is a diagram showing an example in which the distribution is expressed by a plurality of possible index values ​​for the index indicating the occurrence tendency. [Figure 17] FIG. 17 is a diagram for explaining a first example of a method for determining a priority in the fourth modification. [Figure 18] FIG. 18 is a diagram for explaining a second example of the method of determining the priority in the fourth modification. [Figure 19] FIG. 19 is a diagram for explaining a third example of the method of determining the priority in the fourth modification. [Figure 20] FIG. 20 is a diagram for explaining a fourth example of the method for determining the priority in the fourth modification. [Figure 21] FIG. 21 is a diagram for explaining a fifth example of the method for determining the priority in the fourth modification. [Figure 22] FIG. 22 is a diagram for explaining a sixth example of the method of determining the priority in the fourth modification. [Diagram 23] FIG. 23 is a diagram for explaining a seventh example of the method for determining the priority in the fourth modification. [Figure 24] FIG. 24 is a diagram for explaining an eighth example of the method for determining the priority in the fourth modification. In FIG. [Diagram 25] FIG. 25 is a sequence diagram showing an example of an information notification method in an information notification system according to the fourth modification. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] (Findings on which this disclosure is based) When a vulnerability in information security is found in a device such as a vehicle, there is a possibility that the same type of security attack may occur in that device or in other devices of the same model. For this reason, in order to minimize the damage caused by security attacks, a SIRT (Security Incident Response Team) is established. The Security Incident Response Team will decide on a temporary or permanent response at an early stage and Japan should take measures against cyber attacks.

[0010] However, a provisional response, for example, is a degradation of functionality (stopping functionality), which has a large impact on end users. Therefore, when there is not enough information to make a decision, it is difficult to decide to implement a provisional response as a response to a security attack. In addition, in the case of a permanent response, there is an issue that it is difficult to respond to multiple incidents simultaneously because the number of SIRT personnel is limited.

[0011] An information notification method according to one aspect of the present disclosure includes: An information notification method executed by an information notification device, Incident information is obtained for a number of incidents that occurred during a first period in the past due to security attacks on a monitored object, and based on the obtained incident information, a tendency for incidents of that type to occur in the monitored object during a future second period in a future period and a priority for a temporary or permanent response to that type of incident are determined for each type of incident, and the tendency for incidents to occur and the priority determined for each type of incident are presented.

[0012] An information notification method according to a first aspect of the present disclosure acquires incident information on a plurality of incidents that occurred due to security attacks on a monitored object during a first period in the past, and, based on the acquired incident information, determines, for each type of incident, a tendency for incidents of that type to occur in the monitored object during a future second period in the monitored object, and a priority for a temporary or permanent response to that type of incident, and presents the occurrence tendency and the priority determined for each type of incident.

[0013] This provides the basis for easily and accurately judging whether or not to implement a provisional response, and the priority of a permanent response. For example, when a SIRT receives a notification, it can quickly implement a provisional or permanent response, and easily determine whether to implement a provisional response or the priority of a permanent response. This allows the SIRT to prioritize responses to incidents that have a large impact on security, even with limited personnel.

[0014] An information notification method according to a second aspect of the present disclosure is an information notification method according to the first aspect, wherein the higher the priority, the earlier the temporary or permanent response will be carried out, and the higher the priority is determined based on the occurrence trend, the greater the future damage caused by a security attack.

[0015] This makes it possible to prioritize responding to incidents that could result in significant future damage from security attacks, even with limited personnel.

[0016] An information notification method according to a third aspect of the present disclosure is the information notification method according to the second aspect, wherein the occurrence trend relates to a change over time in the number of occurrences of incidents for each type.

[0017] As a result, for example, a SIRT that receives a notification can easily grasp the trends in future incident information occurrences.

[0018] An information notification method according to a fourth aspect of the present disclosure is an information notification method according to the third aspect, wherein the occurrence trend is a slope of the change over time at a first time within the second period, and the priority is determined to be higher the greater the slope.

[0019] According to this, the higher the response priority is determined for an incident with a steeper gradient and an increasing trend, so that it is possible to encourage incidents with a steeper gradient and an increasing trend to be responded to with higher priority.

[0020] An information notification method according to a fifth aspect of the present disclosure is an information notification method according to the third aspect, wherein the occurrence trend is a curve showing the change over time in the second period, and the priority is determined to be higher as the maximum value of the curve is larger.

[0021] According to this, the larger the maximum value of the curve, the higher the response priority is determined, so that it is possible to encourage incidents with larger maximum values ​​of the curve to be given higher priority in response.

[0022] An information notification method according to a sixth aspect of the present disclosure is the information notification method according to the third aspect, wherein the occurrence trend is a curve showing the change over time in the second period, and the priority is determined to be higher the longer the period on the curve in which the number of occurrences is greater than a predetermined number.

[0023] According to this, the longer the period over which an incident exceeds a specified number of occurrences, the higher the response priority is determined, thereby encouraging incidents that have been occurring for a longer period of time to be given higher priority in response.

[0024] An information notification method according to a seventh aspect of the present disclosure is the information notification method according to the third aspect, wherein the occurrence trend is a total number of incidents occurring in the second time period, and the priority is determined to be higher the larger the total number is.

[0025] According to this, the higher the total number of occurrences of incident information in the second time period, the higher the response priority of the incident is determined, which encourages incidents with a larger total number of occurrences of incident information in the second time period to be given higher priority in response.

[0026] An information notification method according to an eighth aspect of the present disclosure is an information notification method according to the third aspect, wherein the occurrence trend is a total number of incidents occurring in the second time period, and the priority is determined to be higher the larger the total amount of damage calculated by multiplying the total number by the amount of damage caused by the occurrence of one incident is.

[0027] According to this, the greater the total amount of damage caused by an incident, the higher the response priority is determined, which makes it possible to encourage incidents with greater total amount of damage to be given higher priority in response.

[0028] An information notification method according to a ninth aspect of the present disclosure is an information notification method according to any one of the first to eighth aspects, wherein the occurrence tendency includes a distribution of a plurality of index values ​​that may be determined in the determination for an indicator indicating the occurrence tendency.

[0029] Therefore, the priority can be determined taking into consideration the accuracy of prediction of the occurrence tendency.

[0030] An information notification method according to a tenth aspect of the present disclosure is the information notification method according to the ninth aspect, wherein the distribution is expressed by a probability density function in which an index indicating the occurrence tendency is a random variable.

[0031] Therefore, the priority can be determined taking into account the occurrence probability of the occurrence tendency.

[0032] An information notification method according to an eleventh aspect of the present disclosure is the information notification method according to the ninth aspect, wherein the distribution is represented by a first range including the multiple index values.

[0033] Therefore, the priority can be determined taking into account the distribution of occurrence trends.

[0034] An information notification method according to a twelfth aspect of the present disclosure is an information notification method according to any one of the ninth to eleventh aspects, wherein the priority is determined to be higher the larger the expected value based on the distribution.

[0035] An information notification method according to a thirteenth aspect of the present disclosure is an information notification method according to any one of the ninth to eleventh aspects, in which the priority is determined to be higher the greater the maximum value among the multiple index values.

[0036] An information notification method according to a fourteenth aspect of the present disclosure is an information notification method according to any one of the ninth to eleventh aspects, in which the priority is determined to be higher the greater the variance in the distribution.

[0037] An information notification method according to a fifteenth aspect of the present disclosure is an information notification method according to any one of the ninth to eleventh aspects, wherein the priority is a ratio calculated based on the distribution, and is determined to be higher the greater the ratio of index values ​​equal to or greater than a first threshold value distributed in the index.

[0038] An information notification method according to a sixteenth aspect of the present disclosure is an information notification method according to any one of the ninth to eleventh aspects, wherein the priority is determined using a machine learning model generated by machine learning in which a plurality of occurrence tendencies corresponding to a plurality of first incident information that occurred in a past third period are input, and a first evaluation value determined for each of the plurality of occurrence tendencies is used as correct answer data.

[0039] An information notification method according to a seventeenth aspect of the present disclosure is an information notification method according to any one of the ninth to eleventh aspects, wherein the priority order based on the priority is determined using a machine learning model generated by machine learning using input of a plurality of occurrence trends corresponding to a plurality of first incident information that occurred in a past third period, and using the priority order determined for each of the plurality of occurrence trends as correct answer data.

[0040] An information notification method according to an 18th aspect of the present disclosure is an information notification method according to any one of the 9th to 11th aspects, wherein the determination further includes calculating a second evaluation value by ranking the multiple incidents according to the magnitude of at least two values ​​out of an expected value based on the distribution, a maximum value among the multiple index values, a variance in the distribution, a proportion calculated based on the distribution, the proportion of index values ​​equal to or greater than a first threshold in the index, and an evaluation value determined using a machine learning model based on a plurality of occurrence trends corresponding to a plurality of first incident information that occurred in a third period in the past; calculating a second evaluation value for each incident by adding up the at least two second evaluation values ​​calculated for each of the multiple incidents; and determining the priority level so that the priority level is higher as the third evaluation value is larger.

[0041] An information notification method according to a 19th aspect of the present disclosure is an information notification method according to any one of the 9th to 11th aspects, wherein the determination further includes calculating a fourth evaluation value for each of the plurality of incidents, and in calculating the fourth evaluation value, for a corresponding incident, determining a fifth evaluation value corresponding to the magnitude of at least two of the following values: an expected value based on the distribution; a maximum value among the plurality of index values; a variance in the distribution; a proportion calculated based on the distribution, wherein the proportion of index values ​​equal to or greater than a first threshold value are distributed in the index; and an evaluation value determined using a machine learning model based on a plurality of occurrence tendencies corresponding to a plurality of first incident information that occurred in a third period in the past, and calculating the fourth evaluation value by adding up the at least two fifth evaluation values, and determining the priority such that the higher the fourth evaluation value, the higher the priority.

[0042] An information notification method according to a twentieth aspect of the present disclosure is an information notification method according to any one of the first to eighth aspects, wherein the determination involves determining, for each type of incident and for each model of monitored object, a tendency for incidents of that type and model to occur in the monitored object during a second future period, and a priority of temporary or permanent response to incidents of that type and model.

[0043] Therefore, the priority of a temporary or permanent response can be determined for each type of incident and each model of the monitored object.

[0044] An information notification method according to a 21st aspect of the present disclosure is an information notification method according to any one of the first to eighth aspects, wherein the determination further includes calculating a total amount of damage for each type of incident by multiplying the total number of occurrences of incident information of that type by the amount of damage caused by the occurrence of incident information of that type, and determining the priority to be higher as the total amount of damage is larger.

[0045] This makes it possible to determine priorities according to the total amount of damage.

[0046] An information notification method according to a 22nd aspect of the present disclosure is an information notification method according to any one of the first to eighth aspects, further comprising: calculating an index value relating to the number of occurrences of a type of incident in the second period based on the occurrence trend of the type of incident determined for each type of incident; and notifying the recommendation of the interim response when the index value exceeds a reference value.

[0047] Therefore, if the index value regarding the number of occurrences in the second period exceeds the reference value, a recommendation for a provisional response can be notified.

[0048] An information notification method according to a 23rd aspect of the present disclosure is the information notification method according to the 10th aspect, further comprising: calculating a sixth evaluation value based on the occurrence tendency of the incident type determined for each incident type; and notifying the recommendation of the interim response when the sixth evaluation value exceeds a reference value.

[0049] Therefore, when the fifth evaluation value exceeds the reference value, a recommendation for a provisional measure can be notified.

[0050] An information notification method according to a 24th aspect of the present disclosure is an information notification method according to any one of the 1st to 22nd aspects, wherein the occurrence tendency is determined using a machine learning model generated by machine learning in which a plurality of first incident information items that occurred in a third period in the past is input, and the occurrence tendency based on a plurality of second incident information items that occurred in a fourth period in the past that is later than the third period is used as correct answer data.

[0051] Therefore, it is possible to use machine learning models to predict future trends in incident information occurrence.

[0052] An information notification method according to a 25th aspect of the present disclosure is an information notification method according to any one of the 1st to 22nd aspects, and further determines a total amount of damage caused by a security attack in the second period using a machine learning model generated by machine learning using a plurality of first incident information occurring in a third period in the past as input and a total amount of damage based on a plurality of second incident information occurring in a fourth period in the past that is later than the third period as correct answer data.

[0053] This makes it possible to use machine learning models to predict the total damage caused by future security attacks.

[0054] An information notification method according to a 26th aspect of the present disclosure is an information notification method according to any one of the 1st to 22nd aspects, wherein the occurrence tendency is determined using a correlation between a plurality of first incident information items that occurred in a third period in the past and an actual occurrence tendency based on a plurality of second incident information items that occurred in a fourth period in the past that is later than the third period.

[0055] This makes it possible to predict occurrence trends based on past performance.

[0056] An information notification method according to a 27th aspect of the present disclosure is an information notification method according to any one of the 1st to 22nd aspects, further determining a total amount of damage caused by a security attack in the second period by using a correlation between a plurality of first incident information items that occurred in a third period in the past and an actual total amount of damage based on a plurality of second incident information items that occurred in a fourth period in the past that is later than the third period.

[0057] This makes it possible to predict the total amount of damage caused by future security attacks based on past performance.

[0058] An information notification device according to a 28th aspect of the present disclosure includes an acquisition unit that acquires incident information on a plurality of incidents that occurred in a first period in the past due to a security attack on a monitoring target, a determination unit that determines, for each type of incident based on the acquired incident information, a tendency for incidents of that type to occur in the monitoring target in a second future period and a priority of a temporary or permanent response to the incidents of that type, and a presentation unit that presents the tendency for incidents to occur and the priority determined for each type of incident.

[0059] This provides the basis for easily and accurately judging whether or not to implement a provisional response, and the priority of a permanent response. For example, when a SIRT receives a notification, it can quickly implement a provisional or permanent response, and easily determine whether to implement a provisional response or the priority of a permanent response. This allows the SIRT to prioritize responses to incidents that have a large impact on security, even with limited personnel.

[0060] In addition, these general or specific aspects may be realized by a system, a method, an integrated circuit, a computer program, or a non-transitory recording medium such as a computer-readable CD-ROM, or may be realized by any combination of a system, a method, an integrated circuit, a computer program, and a non-transitory recording medium.

[0061] Hereinafter, an information notification method and an information processing device according to an embodiment of the present disclosure will be specifically described with reference to the drawings.

[0062] Note that the embodiments described below each show a specific example of the present disclosure. The numerical values, shapes, materials, components, the arrangement and connection of the components, steps, and the order of steps shown in the following embodiments are merely examples and are not intended to limit the present disclosure. Furthermore, among the components in the following embodiments, components that are not described in an independent claim showing a top concept are described as optional components.

[0063] (Embodiment) Hereinafter, an embodiment will be described with reference to FIGS. 1 to 10. FIG.

[0064] [composition] FIG. 1 is a schematic diagram of an information notification system according to an embodiment.

[0065] 1 shows a security monitoring device 100, an information notification device 200, a vehicle 400, a communication network 300, and a base station 310 of a mobile communication network. The security monitoring device 100, the information notification device 200, and the vehicle 400 are communicatively connected via the communication network 300 so as to be able to transmit and receive information to and from each other.

[0066] The security monitoring device 100 is a device that monitors the state of the vehicle 400, and may have the functions of a monitoring center (SOC (Security Operation Center)) and a SIRT, for example. As a function of the monitoring center, the security monitoring device 100 periodically acquires log information from the vehicle 400 and monitors the state of the vehicle 400 based on the acquired log information. Specifically, the security monitoring device 100 determines whether or not there has been a security attack on the vehicle 400 based on the log information. The security monitoring device 100 can determine whether or not there has been a security attack on the vehicle 400 in almost real time by shortening the period until the next acquisition of log information from the vehicle 400. When the security monitoring device 100 determines that there has been a security attack on the vehicle 400, it transmits incident information obtained by the determination to the information notification device 200.

[0067] Furthermore, as a function of the SIRT, the security monitoring device 100 acquires notification information indicating a predicted occurrence tendency and priority from the information notification device 200, and presents the notification information to the SIRT personnel. The security monitoring device 100 accepts input of response information generated by developing the response information with reference to the notification information from the SIRT personnel, and transmits the response information to the vehicle 400.

[0068] The monitoring center function and the SIRT function of the security monitoring device 100 may be realized by separate devices. In other words, in this case, a first device having the monitoring center function acquires log information from the vehicle 400 and outputs the generated incident information to the information notification device 200. A second device having the SIRT function acquires notification information from the information notification device 200 and outputs the generated response information to the vehicle 400.

[0069] 1 shows one vehicle 400, the information notification system 1 may include multiple vehicles 400. That is, the security monitoring device 100 may periodically acquire log information from each of the multiple vehicles 400, determine the presence or absence of a security attack on each vehicle 400, and transmit incident information obtained for each vehicle 400 to the information notification device 200. When the security monitoring device 100 determines that there has been a security attack on the vehicle 400, it generates incident information, and when it determines that there has been no security attack on the vehicle 400, it does not generate incident information. The security monitoring device 100 is configured by a computer such as a server.

[0070] The information notification device 200 is a device that determines, for each type of incident information based on multiple pieces of past incident information, a future occurrence tendency of incident information of that type and a priority of a provisional or permanent response to the incident information of that type, and notifies the determined occurrence tendency and priority. The information notification device 200 acquires incident information from the security monitoring device 100, and estimates a future occurrence tendency of incident information for each type of incident information based on the acquired incident information. The information notification device 200 is configured by a computer such as a server.

[0071] The vehicle 400 is an autonomous vehicle capable of autonomous driving. The vehicle 400 includes a presentation unit that presents information. The vehicle 400 controls the operation of the vehicle 400 in response to a received instruction. Specifically, the vehicle 400 may present information on the presentation unit or control an operation related to the driving of the vehicle 400 (hereinafter, referred to as driving operation) in response to the instruction. The vehicle 400 may be, for example, a vehicle used for a car sharing service or a vehicle used for a taxi service. The vehicle 400 is not limited to an autonomous vehicle capable of autonomous driving, and may be an automobile equipped with a driving assistance function such as an ADAS function.

[0072] In this embodiment, the security monitoring device 100 and the information notification device 200 are configured as separate entities, but the present invention is not limited to this and may be configured as an integrated device. In other words, the security monitoring device 100 may have the functions of the information notification device 200.

[0073] FIG. 2 is a block diagram illustrating an example of a hardware configuration of an information notification device according to an embodiment.

[0074] As shown in FIG. 2, the information notification device 200 includes, as its hardware configuration, a CPU (Central Processing Unit) 21, a main memory 22, a storage 23, and a communication IF (Interface) 24.

[0075] The CPU 21 is a processor that executes programs stored in the storage 23 or the like.

[0076] The main memory 22 is a volatile storage area used as a work area when the CPU 21 executes a program.

[0077] The storage 23 is a non-volatile storage area that holds programs, incident information, and the like.

[0078] The communication IF 24 is a communication interface that communicates with the security monitoring device 100 via the communication network 300. The communication IF 24 is, for example, a wired LAN interface. The communication IF 24 may be a wireless LAN interface. The communication IF 24 is not limited to a LAN interface, and may be any communication interface that can establish a communication connection with a communication network.

[0079] FIG. 3 is a block diagram illustrating an example of a hardware configuration of a vehicle according to an embodiment.

[0080] As shown in FIG. 3, the vehicle 400 includes, as its hardware configuration, a TCU (Telematics Control Unit) 41, a plurality of ECUs 42, and a storage 43.

[0081] The TCU 41 is a communication unit that allows the vehicle 400 to perform wireless communication with the communication network 300. The TCU 41 is a communication unit that includes a cellular module that complies with the standards of the mobile communication network.

[0082] The multiple ECUs 42 are control circuits that execute control of devices included in the vehicle 400. The devices included in the vehicle 400 include, for example, an engine, a motor, a meter, a transmission, a brake, a steering wheel, a power window, and an air conditioner. At least one of the multiple ECUs 42 is a control circuit that controls the autonomous driving of the vehicle 400. The multiple ECUs 42 may be provided corresponding to each of these various devices. Although not shown here, each of the multiple ECUs 42 may include a storage unit (non-volatile storage area) that stores a program executed by each ECU 42. The storage unit is, for example, a non-volatile memory.

[0083] The storage 43 is a non-volatile storage area that holds control programs and the like. The storage 43 is, for example, a hard disk drive (HDD), a solid state drive (SSD), This can be achieved by using a standard 10Gb / s 20Gb / s 1 ...

[0084] Next, a functional configuration of the information notification device 200 and the vehicle 400 of the information notification system 1 will be described. Fig. 4 is a block diagram showing an example of a functional configuration of the information notification system according to the embodiment. Note that the communication network 300 is omitted in Fig. 4.

[0085] First, the functional configuration of the information notification device 200 will be described.

[0086] The information notification device 200 includes a communication unit 210 , an acquisition unit 220 , a determination unit 230 , a notification unit 240 , and a storage unit 250 .

[0087] The communication unit 210 transmits and receives information to and from the security monitoring device 100 via the communication network 300. Specifically, the communication unit 210 receives incident information from the security monitoring device 100. The incident information received by the communication unit 210 is stored in the storage unit 250. The communication unit 210 also transmits notification information to the security monitoring device 100. The communication unit 210 is realized by the communication IF 24.

[0088] FIG. 5 is a table showing a specific example of incident statistical information.

[0089] The incident statistical information is information generated based on incident information that occurred during a past first period due to a security attack on vehicle 400 as a monitoring target. As shown in FIG. 5, the incident statistical information stored in memory unit 250 includes an ID, date, incident type, and number of occurrences. The incident statistical information is statistical information regarding incident information generated based on a plurality of accumulated incident information. The ID is, for example, information that identifies incidents of the same type that occurred on the same day. The date indicates the date on which the incident occurred. The incident type indicates the type of incident that occurred, and is indicated by, for example, a number. The number of occurrences indicates the number of incidents of the same type that occurred on the same day.

[0090] FIG. 6 is a table showing another example of information included in the incident statistical information.

[0091] In FIG. 5, the incident statistical information includes the date on which the incident occurred as information regarding the time of occurrence of the incident. However, instead, as shown in FIG. 6, the incident statistical information may include the date and time when the incident occurred.

[0092] FIG. 7 is a table showing another example of information included in the incident statistical information.

[0093] The incident type in Figure 5 is indicated by a number indicating the incident type, but is not limited to this. As shown in Figure 7, the incident type may be indicated by information indicating the characteristics of the incident, such as the attack method and its impact, and the feasibility of the attack.

[0094] FIG. 8 is a table showing another example of information included in the incident statistical information.

[0095] In Fig. 5, the incident statistical information includes the number of occurrences indicating the number of incidents of the same type that occurred on the same day, but is not limited to this and may also include the frequency of occurrence as shown in Fig. 8. The frequency of occurrence may be defined in stages according to the number of incidents that occurred in a day, for example, and may be classified into five stages of frequency: "very low," "low," "normal," "high," and "very high." The number of frequency stages is not limited to five stages, and may be two to four stages, or six or more stages.

[0096] The vehicle 400 that is the target of a security attack is an example of a monitoring target. The monitoring target is not limited to the vehicle 400, but may be any device that is equipped with a computer and has a function of being able to communicate with an external network. In other words, the monitoring target may be applied not only to vehicle monitoring, but also to IoT monitoring, server monitoring, building monitoring, factory monitoring, and monitoring of moving objects such as airplanes and ships.

[0097] Returning to the explanation using FIG.

[0098] The acquisition unit 220 acquires a plurality of pieces of incident information that occurred due to a security attack on the vehicle 400 during a first period in the past from the storage unit 250. Note that the acquisition unit 220 is not limited to acquiring a plurality of pieces of incident information that occurred during the first period from the storage unit 250, and may acquire a plurality of pieces of incident information from the security monitoring device 100, or may acquire incident statistical information.

[0099] Based on the acquired multiple pieces of incident information or incident statistical information, the determination unit 230 determines, for each type of incident information, the occurrence tendency of incident information of the type in the vehicle 400 in a second future period and the priority of a provisional response or permanent response to the incident information of the type. Specifically, the determination unit 230 first determines the occurrence tendency of incident information of the type in a second future period (hereinafter referred to as a "predicted occurrence tendency"), and then determines the priority of a provisional response or permanent response to the incident information of the type. The predicted occurrence tendency relates to a change over time in the number of occurrences of incident information of each type.

[0100] FIG. 9 is a graph showing the change over time in the number of occurrences of incident information.

[0101] For example, the predicted occurrence trend is the slope at the first time t1 in the second period in the change over time of the number of occurrences of incident information by type. In other words, the predicted occurrence trend is the slope of the tangent at the first time t1 in the graph of the change over time. Furthermore, for example, the predicted occurrence trend may be a curve (graph) showing the change over time of the number of occurrences of incidents in the second period. Furthermore, for example, the predicted occurrence trend may be the total number of occurrences of incident information in the second period. In other words, the predicted occurrence trend may be the area between the curve showing the number of occurrences in the second period in FIG. 9 and the straight line showing the number of occurrences is 0 (that is, the area of ​​the hatched portion in FIG. 9).

[0102] The predicted occurrence tendency may be determined, for example, using machine learning. In this case, the predicted occurrence tendency is determined using a machine learning model generated by machine learning using a plurality of pieces of first incident information occurring in a third period in the past as input and a record of the occurrence tendency based on a plurality of pieces of second incident information occurring in a fourth period in the past after the third period as correct answer data.

[0103] The predicted occurrence tendency may be determined, for example, using a rule-based model, in which case the predicted occurrence tendency is determined using a correlation between a plurality of pieces of first incident information that occurred in a third period in the past and an actual occurrence tendency based on a plurality of pieces of second incident information that occurred in a fourth period in the past that is later than the third period.

[0104] After determining the predicted occurrence tendency, the determination unit 230 determines a priority for each type based on the occurrence tendency of the incident information for each type such that the greater the future damage caused by a security attack, the higher the priority. A higher priority indicates that a provisional response or a permanent response will be performed in the order of priority. The priority may be determined such that the higher the slope of the predicted occurrence tendency is, the higher the priority is. The priority may be determined such that the higher the maximum value of the curve as the predicted occurrence tendency is, the higher the priority is. The priority may be determined such that the longer the period in which the curve as the predicted occurrence tendency has a value greater than a predetermined occurrence number, the higher the priority is. The priority may be determined such that the higher the total number of occurrences of incident information in a second period as the predicted occurrence tendency is, the higher the priority is.

[0105] Returning to the explanation using FIG.

[0106] The notification unit 240 notifies the security monitoring device 100 of the predicted occurrence tendency and priority determined for each type of incident information. Specifically, the notification unit 240 transmits notification information indicating the predicted occurrence tendency and priority to the security monitoring device 100 via the communication unit 210.

[0107] The acquiring unit 220, the deciding unit 230 and the notifying unit 240 are realized by the CPU 21, the main memory 22 and the like. The storing unit 250 is realized by the storage 23.

[0108] [Operation] FIG. 10 is a sequence diagram showing an example of an information notification method in the information notification system according to the embodiment.

[0109] The vehicle 400 transmits log information to the security monitoring device 100 (S11). The log information includes, for example, the control state of the vehicle 400, detection values ​​of sensors equipped in the vehicle 400, and the like.

[0110] The security monitoring device 100 detects that a security attack has been made on the vehicle 400 based on the log information (S12).

[0111] The security monitoring device 100 generates the above-mentioned incident information based on the security attack, and transmits the incident information to the information notification device 200 (S13).

[0112] The information notification device 200 receives the incident information (S14).

[0113] The information notification device 200 stores the received incident information in the storage unit 250 (S15).

[0114] The information notification device 200 executes step S16 and step S17 in a loop for each type of incident.

[0115] The information notification device 200 reads out incident information of the type to be processed from the storage unit 250 (S16). The incident information read out here is multiple pieces of incident information generated by security attacks that occurred in a first period in the past.

[0116] The information notification device 200 determines a predicted occurrence tendency based on a plurality of pieces of incident information generated due to security attacks that occurred in a first past period (S17).

[0117] The information notification device 200 determines the priority of each type of incident based on the predicted occurrence tendency (S18).

[0118] The information notification device 200 notifies the security monitoring device 100 of the predicted occurrence tendency and the priority (S19).

[0119] The security monitoring device 100 refers to the acquired predicted occurrence tendency and priority information to determine whether or not to implement a provisional response for each incident type, and the content of the response, or prioritizes permanent responses. The security monitoring device 100 accepts input of response information generated by SIRT personnel, which is response information for causing the vehicle 400 to execute a provisional response or permanent response to respond to an incident for each type, and transmits the accepted response information to the vehicle 400 (S20).

[0120] The priority may be a relative priority among a plurality of incident types, or may be an absolute priority calculated by comparison with a predetermined criterion.

[0121] The provisional response is, for example, a response to stop a function including a vulnerability that caused a security attack or a function affected by the vulnerability. If there are multiple provisional response methods corresponding to the target incident type, the provisional response method may be determined using the priority of each incident type.

[0122] A permanent solution is, for example, a solution that involves executing a software update to overcome the vulnerability that caused the security attack.

[0123] [Effects, etc.] The information notification method of this embodiment acquires multiple pieces of incident information that occurred due to security attacks on vehicle 400 (monitoring target) during a first period in the past, and based on the acquired multiple pieces of incident information, determines, for each type of incident information, the occurrence tendency (predicted occurrence tendency) of incident information of that type in vehicle 400 (monitoring target) during a future second period, and a priority of a temporary or permanent response to the incident information of that type, and notifies the predicted occurrence tendency and priority determined for each type of incident information.

[0124] This provides the basis for easily and accurately judging whether or not to implement a provisional response, and the priority of a permanent response. For example, when a SIRT receives a notification, it can easily determine whether to implement a provisional response and the priority of a permanent response, and can quickly implement a provisional or permanent response. This allows incidents with a large impact on security to be prioritized, even with limited personnel.

[0125] In the information notification method according to the present embodiment, the higher the priority, the earlier the provisional or permanent response will be performed, and the higher the priority is determined based on the occurrence trend, the greater the future damage caused by a security attack. This allows even limited personnel to prioritize responses to incidents that will cause great future damage from security attacks.

[0126] In addition, in the information notification method according to the present embodiment, the predicted occurrence tendency relates to the change over time in the number of occurrences of incident information by type. Therefore, for example, a SOC or SIRT that receives the notification can easily grasp the future occurrence tendency of incident information. This enables efficient monitoring and response, such as changing personnel allocation.

[0127] In the information notification method according to the present embodiment, the predicted occurrence tendency is a slope of the change over time at the first time in the second period. The priority is determined to be higher as the slope is larger. This allows the incident with a larger slope and an increasing tendency to be given a higher response priority, so that it is possible to encourage incidents with a larger slope and an increasing tendency to be given a higher response priority.

[0128] Furthermore, in the information notification method according to the present embodiment, the predicted occurrence tendency is a curve showing a change over time in the second period. Furthermore, the priority is determined to be higher as the maximum value of the curve is larger. In this way, the incident with the larger maximum value of the curve is determined to have a higher response priority, so that it is possible to encourage incidents with the larger maximum value of the curve to be handled with higher priority.

[0129] In the information notification method according to the present embodiment, the priority is determined so that the longer the period in the curve where the number of occurrences is greater than the predetermined number, the higher the priority of the response is determined. This makes it possible to encourage incidents that have been occurring for a longer period of time greater than the predetermined number of occurrences to be given higher priority in response.

[0130] Furthermore, in the information notification method according to the present embodiment, the predicted occurrence tendency is the total number of occurrences of the incident information in the second time period. The priority is determined to be higher as the total number is larger. In this way, the higher the total number of occurrences of an incident in the second time period, the higher the response priority is determined, so that it is possible to encourage a higher priority response for an incident with a larger total number of occurrences in the second time period.

[0131] Furthermore, in the information notification method according to the present embodiment, the predicted occurrence tendency is determined using a machine learning model generated by machine learning using a plurality of pieces of first incident information that occurred in a third period in the past as input and an actual occurrence tendency based on a plurality of pieces of second incident information that occurred in a fourth period in the past after the third period as correct answer data. Therefore, the occurrence tendency of future incident information can be predicted using the machine learning model.

[0132] In the information notification method according to the present embodiment, the occurrence tendency is determined using a correlation between a plurality of pieces of first incident information that occurred in a third period in the past and a plurality of pieces of second incident information that occurred in a fourth period in the past that is later than the third period. Therefore, the occurrence tendency can be predicted based on the past results.

[0133] [Variations] (1) Variation 1 In the above embodiment, incident information is read for each type of incident (S16), a predicted occurrence tendency is determined (S17), and a priority is determined for each type of incident, but the present invention is not limited to this.

[0134] Fig. 11 is a sequence diagram showing an example of an information notification method in an information notification system according to Modification 1. In Fig. 11, the same processes as those in the embodiment are denoted by the same reference numerals as those in Fig. 10, and the description thereof will be omitted.

[0135] 11, for example, incident information may be read (S16) and a predicted occurrence tendency may be determined (S17) for each type of incident for each model of vehicle 400 (i.e., monitored object), and a priority may be determined for each type of incident. In other words, a predicted occurrence tendency and a priority may be determined for each model and each type of incident. Similarly, a predicted occurrence tendency and a priority may be determined for each type of incident and each model.

[0136] (2) Variation 2 In the above embodiment, the priority is determined based on the predicted occurrence tendency, but it may be determined based on the total damage amount that is further calculated from the predicted occurrence tendency.

[0137] Fig. 12 is a sequence diagram showing an example of an information notification method in an information notification system according to Modification 2. In Fig. 12, the same processes as those in the embodiment are denoted by the same reference numerals as those in Fig. 10, and the description thereof will be omitted.

[0138] After step S17, the information notification device 200 determines the total damage amount for each type of incident. For example, the information notification device 200 calculates the total damage amount (total damage impact degree) by multiplying the total number of occurrences of incident information of that type by the damage amount (damage impact degree) caused by the occurrence of one incident information of that type.

[0139] In addition, the total amount of damage may be calculated using a machine learning model generated by machine learning using multiple first incident information that occurred during a third period in the past as input and the actual total amount of damage based on multiple second incident information that occurred during a fourth period in the past that is later than the third period as correct answer data.

[0140] The total amount of damage may also be determined using a correlation between a plurality of first incident information occurring in a third period in the past and the actual total amount of damage based on a plurality of second incident information occurring in a fourth period in the past that is later than the third period.

[0141] The information notification device 200 determines the priority so that the greater the total damage amount (total damage impact degree), the higher the priority (S18a).

[0142] The information notification device 200 notifies the security monitoring device 100 of the predicted occurrence tendency, the priority, and the total damage impact degree (S19a).

[0143] According to this, the greater the total amount of damage caused by an incident, the higher the response priority is determined, which makes it possible to encourage incidents with greater total amount of damage to be given higher priority in response.

[0144] (3) Variation 3 Fig. 13 is a sequence diagram showing an example of an information notification method in an information notification system according to Modification 3. In Fig. 13, the same processes as those in the embodiment are denoted by the same reference numerals as those in Fig. 10, and the description thereof will be omitted.

[0145] After step S17, the information notification device 200 determines whether the future occurrence number is greater than a reference value (S17b).

[0146] If the future occurrence number is greater than the reference value (Yes in S17b), the information notification device 200 notifies the security monitoring device 100 of the recommendation to implement a provisional response (S17c); if not (No in S17b), the information notification device 200 performs the following process.

[0147] In addition to determining whether the future number of occurrences is greater than a reference value, it may be determined whether the occurrence probability obtained by dividing the number of occurrences of incidents by the number of units of each model is greater than a threshold value. In this case, if the occurrence probability is greater than the threshold value, step S17c is performed, and if not, the following process is performed. In addition to determining whether the future number of occurrences is greater than a reference value, it may be determined whether the future total amount of damage is greater than a threshold value by calculating the total amount of damage for each type of incident. In this case, if the total amount of damage is greater than the threshold value, step S17c is performed, and if not, the following process is performed.

[0148] In this way, the information notification device 200 calculates an index value for the number of occurrences of the type of incident in the second period based on the occurrence tendency of the type of incident determined for each type of incident. As described above, the index value is the future number of occurrences, the future occurrence probability, the future total damage amount, etc.

[0149] (4) Variation 4 In the fourth modification, the occurrence tendency of one type of incident information may include a distribution of multiple index values ​​that may be determined in an index indicating the occurrence tendency. Specifically, the index indicating the occurrence tendency is any one of (i) a slope at a first time t1 in the second period in a change over time in the number of occurrences of incident information for each type, (ii) a maximum value of a curve (graph) indicating a change over time in the number of occurrences of incidents in the second period, (iii) a period in which the number of occurrences is greater than a predetermined number in a curve (graph) indicating a change over time in the number of occurrences of incidents in the second period, and (iv) a total number of occurrences of incident information in the second period.

[0150] The distribution of multiple index values ​​may be expressed by a probability density function in which an index indicating an occurrence trend corresponding to the distribution is a random variable, as shown in Fig. 14. Fig. 14 is a diagram showing an example of a probability density function in which an index indicating an occurrence trend is a random variable. In the probability density function, the horizontal axis indicates the occurrence trend, and the vertical axis indicates the occurrence probability of the corresponding occurrence trend. For example, if the occurrence trend is a slope at a first time t1 within a second period in a temporal change in the number of occurrences of incident information by type, the probability density function indicates the relationship between the slope and the density of the occurrence probability of the slope.

[0151] Furthermore, the distribution of multiple index values ​​may be expressed as a range including multiple index values ​​that the index indicating the occurrence tendency corresponding to the distribution can take, as shown in Fig. 15. Fig. 15 is a diagram showing an example in which a distribution is expressed as a range including multiple index values ​​that the index indicating the occurrence tendency can take. The multiple points in Fig. 15 respectively indicate multiple index values ​​that the index indicating the occurrence tendency can take. The range including multiple index values ​​is shown, for example, as a range from the minimum value to the maximum value of the multiple index values.

[0152] Furthermore, the distribution of the multiple index values ​​may be the distribution of the multiple index values ​​itself, as shown in Fig. 16. Fig. 16 is a diagram showing an example in which the distribution is represented by multiple index values ​​that the index indicating the occurrence tendency can take. The multiple points in Fig. 16 each represent multiple index values ​​that the index indicating the occurrence tendency can take.

[0153] Next, a method for determining a priority when the distribution of a plurality of index values ​​is expressed by a probability density function will be described.

[0154] FIG. 17 is a diagram for explaining a first example of a method for determining a priority in the fourth modification. FIG. 17 shows an expected value E1 of the occurrence tendency in the probability density function f1 of incident information of the type No. 1, an expected value E2 of the occurrence tendency in the probability density function f2 of incident information of the type No. 2, and an expected value E3 of the occurrence tendency in the probability density function f3 of incident information of the type No. 3. The priority may be determined so that the higher the expected value based on the probability density function is, the higher the priority. In the example of FIG. 17, the expected value E2 is larger than the expected value E1, and the expected value E1 is larger than the expected value E3. Therefore, the priority of the incident information of No. 2 may be determined so that it is higher than the priority of the incident information of No. 1, and the priority of the incident information of No. 1 may be determined so that it is higher than the priority of the incident information of No. 3. The incident information of No. 1, the incident information of No. 2, and the incident information of No. 3 are different types of incident information. The priority of the incident information indicates the priority for a provisional response or a permanent response to the incident information.

[0155] Fig. 18 is a diagram for explaining a second example of the method for determining the priority of the fourth modification. Fig. 18 shows a maximum value MAX1 of the domain of the occurrence tendency in the probability density function f1 of the incident information of No. 1, a maximum value MAX2 of the domain of the occurrence tendency in the probability density function f2 of the incident information of No. 2, and a maximum value MAX3 of the domain of the occurrence tendency in the probability density function f3 of the incident information of No. 3. The priority may be determined so that the higher the maximum value of the domain of the occurrence tendency in the probability density function is, the higher the priority. In the example of Fig. 18, the maximum value MAX1 is larger than the maximum value MAX2, and the maximum value MAX2 is larger than the maximum value MAX1. Therefore, the priority of the incident information of No. 1 may be determined to be higher than the priority of the incident information of No. 2, and the priority of the incident information of No. 2 may be determined to be higher than the priority of the incident information of No. 3.

[0156] FIG. 19 is a diagram for explaining a third example of the method for determining the priority of the fourth modification. FIG. 19 shows the variance V1 of the occurrence tendency in the probability density function f1 of the incident information of No. 1, the variance V2 of the occurrence tendency in the probability density function f2 of the incident information of No. 2, and the variance V3 of the occurrence tendency in the probability density function f3 of the incident information of No. 3. Note that the variances V1, V2, and V3 in FIG. 19 are schematic diagrams rather than strict illustrations. The priority may be determined so that the priority is higher as the variance based on the probability density function is larger. In the example of FIG. 19, the variance V3 is larger than the variance V1, and the variance V1 is larger than the variance V2. Therefore, the priority of the incident information of No. 3 may be determined so that the priority is higher than the priority of the incident information of No. 1, and the priority of the incident information of No. 1 may be determined so that the priority is higher than the priority of the incident information of No. 2. In this way, by determining the priority so that the priority is higher as the variance is larger, the priority can be determined so that the priority is higher as the variation in the occurrence tendency is larger. In other words, the priority can be determined so that the priority is higher as the risk of the occurrence tendency is larger.

[0157] Fig. 20 is a diagram for explaining a fourth example of the method for determining priority in Modification 4. Fig. 20 shows the occurrence probability (e.g., 15%) that the occurrence tendency in the probability density function f1 of incident information No. 1 is equal to or greater than the threshold Th1, the occurrence probability (e.g., 30%) that the occurrence tendency in the probability density function f2 of incident information No. 2 is equal to or greater than the threshold Th1, and the occurrence probability (e.g., 5%) that the occurrence tendency in the probability density function f3 of incident information No. 3 is equal to or greater than the threshold Th1. The priority may be determined so that it is higher as the occurrence probability of a random variable equal to or greater than the threshold Th1 in the probability density function increases.

[0158] FIG. 21 is a diagram for explaining a fifth example of the method for determining a priority in the fourth modification. The fifth example is an example of a method for determining a priority using a machine learning model. The machine learning model is generated by machine learning in which a plurality of occurrence tendencies corresponding to a plurality of first incident information occurring in a past third period are input, and an evaluation value determined for each of the plurality of occurrence tendencies is used as correct answer data. The evaluation value in the correct answer data is an example of a first evaluation value. The evaluation value in the correct answer data may be, for example, a value evaluated by a person, or may be a score based on at least one of an expected value, a maximum value, and a variance for calculating a priority determined based on the above-mentioned probability density function. By inputting the occurrence tendencies corresponding to incident information into the machine learning model, an evaluation value corresponding to the incident information is calculated. Then, the priority is determined to be higher as the calculated evaluation value is larger.

[0159] FIG. 22 is a diagram for explaining a sixth example of the method for determining priority in the fourth modification. The sixth example is another example of the method for determining priority using a machine learning model. The machine learning model is generated by machine learning in which a plurality of occurrence tendencies corresponding to a plurality of first incident information of different types that occurred in a past third period are input, and the priority determined for each of the plurality of occurrence tendencies is used as correct answer data. The priority in the correct answer data may be, for example, a rank determined by a person, or may be a rank determined based on a priority determined based on the above-mentioned probability density function. The priority is determined such that the higher the priority, the higher the rank. By inputting a plurality of occurrence tendencies corresponding to a plurality of incident information of different types into the machine learning model, a priority corresponding to each incident information is determined.

[0160] FIG. 23 is a diagram for explaining a seventh example of the method for determining the priority of the fourth modification. In the seventh example, evaluation values ​​corresponding to each of the expected value, maximum value, and variance values ​​specified in the first to third examples are calculated. This evaluation value is an example of the second evaluation value. For example, as shown in FIG. 23, for the incident information No. 1, the evaluation value of the expected value E1 is calculated to be 2 points because it is the second largest value among the expected values ​​E1 to E3, the evaluation value of the maximum value MAX1 is calculated to be 3 points because it is the first largest value among the maximum values ​​MAX1 to MAX3, and the evaluation value of the variance V1 is calculated to be 2 points because it is the second largest value among the variances V1 to V3. Similarly, the evaluation values ​​are calculated for the expected value E2, maximum value MAX2, and variance V2 of the incident information No. 2, and the evaluation values ​​are calculated for the expected value E3, maximum value MAX3, and variance V3 of the incident information No. 3. In this way, the evaluation values ​​corresponding to each value are calculated by ranking a plurality of incident information of the expected value, maximum value, and variance values.

[0161] Then, the evaluation value of the expected value, the evaluation value of the maximum value, and the evaluation value of the variance calculated for each type of incident information are added up to calculate a score for each type. The score is an example of a third evaluation value. As a result, the score of incident information No. 1 is calculated to be 7 points, the score of incident information No. 2 is calculated to be 6 points, and the score of incident information No. 3 is calculated to be 5 points.

[0162] In the seventh example, an example of calculating evaluation values ​​corresponding to the expected value, maximum value, and variance identified in the first to third examples has been described. However, in addition to the expected value, maximum value, and variance, evaluation values ​​corresponding to at least two values ​​may be calculated based on the proportion of index values ​​equal to or greater than threshold value Th1 calculated based on the distributions in the fourth to sixth examples, and at least two of the evaluation values ​​determined using a machine learning model.

[0163] In this way, in determining the priority, the information notification device 200 calculates a second evaluation value by ranking a plurality of incidents according to the magnitude of at least two values ​​among the expected value based on the probability density function, the maximum value of the domain of the random variable, the variance in the probability density function, the ratio, and the evaluation value determined using the machine learning model.The information notification device 200 then calculates a third evaluation value for each incident by adding up at least two second evaluation values ​​calculated for each of the plurality of incidents.In addition, here, the priority is determined so that the larger the third evaluation value is, the higher the priority is.

[0164] FIG. 24 is a diagram for explaining an eighth example of the method for determining the priority of the fourth modification. In the eighth example, evaluation values ​​corresponding to each of the expected value, maximum value, and variance values ​​specified in the first to third examples are calculated. This evaluation value is an example of the fourth evaluation value. Each of the expected value, maximum value, and variance values ​​is classified into a plurality of ranks according to the magnitude of the value, and an evaluation value according to the classified rank is calculated as an evaluation value corresponding to the value. For example, in FIG. 24, each of the expected value, maximum value, and variance values ​​is classified into three ranks, large, medium, and small, according to the magnitude of the value. In the incident information of No. 1, the expected value E1 is classified as medium, so the evaluation value of the expected value E1 is calculated to be 2 points. Similarly, the maximum value MAX1 is classified as large, so the evaluation value of the maximum value MAX1 is calculated to be 5 points. Similarly, the variance V1 is classified as medium, so the evaluation value of the variance V1 is calculated to be 2 points.

[0165] Then, the evaluation value of the expected value E1, the evaluation value of the maximum value MAX1, and the evaluation value of the variance V1 calculated for the incident information of type No. 1 are added together to calculate a score. As a result, the score of the incident information of No. 1 is calculated to be 9 points. Note that, although FIG. 24 illustrates an example of a method for calculating the score of the incident information of type No. 1, scores are calculated in the same manner for incident information of other types. The score is an example of the fourth evaluation value.

[0166] In the eighth example, an example of calculating evaluation values ​​corresponding to the expected value, maximum value, and variance identified in the first to third examples has been described. However, in addition to the expected value, maximum value, and variance, evaluation values ​​corresponding to at least two values ​​may be calculated based on the proportion of index values ​​equal to or greater than threshold value Th1 calculated based on the distributions in the fourth to sixth examples, and at least two of the evaluation values ​​determined using a machine learning model.

[0167] In this way, in determining the priority, the information notification device 200 calculates a fourth evaluation value for each of a plurality of incidents. In calculating the fourth evaluation value, for a corresponding incident, (i) a fifth evaluation value corresponding to the magnitude of at least two values ​​among the expected value based on the probability density function, the maximum value of the domain of the random variable in the probability density function, and the variance in the probability density function is determined, and (ii) the fourth evaluation value is calculated by adding up at least two fifth evaluation values.

[0168] Note that the priority determination methods in the first to eighth examples have been described as examples in which the occurrence tendency is represented by a probability density distribution function as in FIG. 14, but they may also be similarly applied to the case in which the occurrence tendency is represented by a range including multiple index values ​​as in FIG. 15, and the case in which the occurrence tendency is represented by multiple index values ​​themselves as in FIG. 16.

[0169] For example, when the priority determination method in the first example is applied to a distribution represented by a range, the median of the entire range representing the distribution may be calculated as the expected value. Also, when the priority determination method in the first example is applied to a distribution represented by multiple index values ​​themselves, the average of the multiple index values ​​may be calculated as the expected value. In other words, in the first example, the priority is determined so that the higher the expected value based on the distribution of multiple index values ​​that may be determined in the index indicating the occurrence tendency is, the higher the priority is determined.

[0170] For example, when the priority determination method in the second example is applied to a distribution represented by a range, the maximum value of the range representing the distribution may be calculated as the maximum value. Also, when the priority determination method in the second example is applied to a distribution represented by a plurality of index values ​​themselves, the maximum value of the plurality of index values ​​may be calculated as the maximum value. In other words, in the second example, the priority is determined so that the greater the maximum value of the plurality of index values ​​that may be determined in the index indicating the occurrence tendency, the higher the priority is determined.

[0171] For example, when the method for determining priority in the third example is applied to a distribution represented by a range, the size (width) of the range representing the distribution may be calculated as the variance. That is, in the third example, the priority is determined so that the priority is higher as the variance in the distribution of multiple index values ​​that may be determined in the index indicating the occurrence tendency is larger.

[0172] Also, for example, when the method for determining priority in the fourth example is applied to a distribution represented by a range, the proportion of the range that is equal to or greater than the threshold Th1 in the entire range representing the distribution may be calculated instead of the occurrence probability of the occurrence tendency in the probability density function being equal to or greater than the threshold Th1. Also, when the method for determining priority in the fourth example is applied to a distribution represented by a plurality of index values ​​themselves, the number of evaluation values ​​that are equal to or greater than the threshold Th1 among the plurality of evaluation values ​​may be calculated instead of the occurrence probability of the occurrence tendency in the probability density function being equal to or greater than the threshold Th1. In this way, the priority is a proportion calculated based on the distribution of a plurality of index values ​​that may be determined in an index indicating an occurrence tendency, and may be determined so that the priority is higher as the proportion of index values ​​equal to or greater than the threshold Th1 is larger in the index.

[0173] Fig. 25 is a sequence diagram showing an example of an information notification method in an information notification system according to Modification 4. In Fig. 25, the same processes as those in the embodiment are denoted by the same reference numerals as those in Fig. 10, and the description thereof will be omitted.

[0174] After step S17, the information notification device 200 determines whether the occurrence probability of being equal to or greater than the reference θ is greater than a reference value (N%) (S17d).

[0175] If the future occurrence number is greater than the reference value (Yes in S17d), the information notification device 200 notifies the security monitoring device 100 of the recommendation to implement a provisional response (S17c), otherwise (No in S17d), the information notification device 200 performs the following process.

[0176] In this way, the information notification device 200 calculates the sixth evaluation value based on the occurrence tendency of the type of incident determined for each type of incident. The sixth evaluation value is, for example, an occurrence probability that is equal to or greater than the reference θ. Note that the sixth evaluation value is not limited to the occurrence probability as described above, and may be a value (for example, an expected value, a maximum value, a variance, a score (second evaluation value, third evaluation value, or fifth evaluation value)) that correlates with the priority when the above-mentioned priority is determined based on a probability density function. Then, the information notification device 200 may notify a recommendation for a provisional response when the sixth evaluation value exceeds the reference value, and may skip the notification of the recommendation for a provisional response when the sixth evaluation value is equal to or less than the reference value.

[0177] The priority may be indicated not only by a numerical value or a ranking, but also by a rank classified based on the numerical value. The priority may be indicated by ranks classified into a plurality of stages, such as a first rank corresponding to a first range, a second rank corresponding to a second range, and a third rank corresponding to a third range. The first rank has a higher priority than the second rank, and the second rank has a higher priority than the third rank. The first range is a range from a first value to a second value smaller than the first value, the second range is a range from a third value smaller than the second value to a fourth value smaller than the third value, and the third range is a range from a fifth value smaller than the fourth value to a sixth value smaller than the fifth value.

[0178] (5) Variation 5 In each of the above embodiments, each component may be configured with dedicated hardware, or may be realized by executing a software program suitable for each component. Each component may be realized by a program execution unit such as a CPU or a processor reading and executing a software program recorded on a recording medium such as a hard disk or a semiconductor memory. Here, the software for realizing the information notification device 200 of each of the above embodiments is a program such as the following.

[0179] In other words, this program causes a computer to execute an information notification method that acquires multiple pieces of incident information that occurred as a result of a security attack on a monitored object during a first period in the past, and based on the acquired multiple pieces of incident information, determines, for each type of incident information, a tendency for incident information of that type to occur in the monitored object during a future second period in a future period, and a priority of a temporary or permanent response to that type of incident information, and notifies the occurrence tendency and the priority determined for each type of incident information.

[0180] Although the information processing method according to one or more aspects of the present disclosure has been described based on the embodiment, the present disclosure is not limited to this embodiment. As long as it does not deviate from the gist of the present disclosure, various modifications conceived by a person skilled in the art to the present embodiment and forms constructed by combining components in different embodiments may also be included within the scope of the present disclosure. [Industrial Applicability]

[0181] INDUSTRIAL APPLICABILITY The present disclosure is useful as an information notification method that can provide information for easily and accurately determining whether or not a provisional response can be implemented and the response priority of a permanent response. [Explanation of symbols]

[0182] 1. Information notification system 21 CPU 22 Main memory 23. Storage 24 Communication Interface 41 TCU 42 ECU 43 Storage 100 Security monitoring equipment 200 Information notification device 210 Communications Department 220 Acquisition Department 230 Decision Section 240 Notification Department 250 Storage section 300 Communication Network 310 base station 400 vehicles

Claims

1. An information notification method executed by an information notification device, comprising: Acquire incident information on a plurality of incidents that occurred due to security attacks on the monitoring target during a first past period; determining, for each type of incident, a tendency for the incident to occur in the monitoring target during a second future period and a priority of a provisional or permanent response to the incident; Present the occurrence tendency and the priority determined for each type of incident Information notification method.

2. The higher the priority, the earlier the provisional or permanent response will be performed. The higher the priority is determined based on the occurrence trend, the greater the future damage caused by a security attack. The information notification method according to claim 1 .

3. The occurrence trend is a change over time in the number of incidents by type. The information notification method according to claim 2.

4. the occurrence tendency is a slope of the change over time at a first time within the second period, The priority is determined so that the greater the gradient, the higher the priority. The information notification method according to claim 3.

5. the occurrence trend is a curve showing the change over time in the second period, The priority is determined so that the greater the maximum value of the curve, the higher the priority. The information notification method according to claim 3.

6. the occurrence trend is a curve showing the change over time in the second period, The priority is determined so that the longer the period in the curve where the number of occurrences is greater than a predetermined number, the higher the priority. The information notification method according to claim 3.

7. The occurrence trend is a total number of incidents occurring during the second period, The priority is determined so that the greater the total number, the higher the priority. The information notification method according to claim 3.

8. The occurrence trend is a total number of incidents occurring during the second period, The priority is determined so that the greater the total damage amount calculated by multiplying the total number by the damage amount caused by the occurrence of one incident, the higher the priority is. The information notification method according to claim 3.

9. The development trend includes a distribution of a plurality of index values ​​that may be determined in the determination for an index indicating the development trend. The information notification method according to any one of claims 1 to 3.

10. The distribution is expressed by a probability density function in which the index indicating the occurrence tendency is a random variable. The information notification method according to claim 9.

11. The distribution is represented by a first range that includes the plurality of index values. The information notification method according to claim 9.

12. The priority is determined so that the greater the expected value based on the distribution, the higher the priority. The information notification method according to claim 9.

13. The priority is determined so that the greater the maximum value among the plurality of index values, the higher the priority. The information notification method according to claim 9.

14. The priority is determined to be higher as the variance in the distribution increases. The information notification method according to claim 9.

15. The priority is a ratio calculated based on the distribution, and is determined so as to be higher as the ratio of index values ​​equal to or greater than a first threshold value becomes larger. The information notification method according to claim 9.

16. The priority is determined using a machine learning model generated by machine learning using a plurality of occurrence tendencies corresponding to a plurality of pieces of first incident information that occurred in a past third period as input and a first evaluation value determined for each of the plurality of occurrence tendencies as correct answer data. The information notification method according to claim 9.

17. The priority order based on the priority is determined using a machine learning model generated by machine learning using a plurality of occurrence trends corresponding to a plurality of pieces of first incident information that occurred in a past third period as input and using the priority order determined for each of the plurality of occurrence trends as correct answer data. The information notification method according to claim 9.

18. The decision further includes: a second evaluation value is calculated by ranking the multiple incidents according to the magnitude of at least two values ​​selected from an expected value based on the distribution, a maximum value among the multiple index values, a variance in the distribution, a ratio calculated based on the distribution, the ratio of index values ​​equal to or greater than a first threshold value, and an evaluation value determined using a machine learning model based on multiple occurrence trends corresponding to multiple first incident information items that occurred in a past third period; calculating a third evaluation value for each of the plurality of incidents by adding up at least two second evaluation values ​​calculated for each of the plurality of incidents; The priority is determined so as to be higher as the third evaluation value is larger. The information notification method according to claim 9.

19. The decision further includes: Calculating a fourth evaluation value for each of the plurality of incidents; In calculating the fourth evaluation value, for the corresponding incident, determining a fifth evaluation value corresponding to the magnitude of at least two of the following values: an expected value based on the distribution; a maximum value among the plurality of index values; a variance in the distribution; a ratio calculated based on the distribution, the ratio of index values ​​that are equal to or greater than a first threshold value among the index values; and an evaluation value determined using a machine learning model based on a plurality of occurrence tendencies corresponding to a plurality of first incident information that occurred in a third period in the past; calculating the fourth evaluation value by adding up at least two of the fifth evaluation values; The priority is determined so as to be higher as the fourth evaluation value is larger. The information notification method according to claim 9.

20. In the determination, for each type of incident and for each model of the monitored object, a tendency of incidents of the type and the model in the monitored object in a future second period and a priority of a provisional response or a permanent response to the incidents of the type and the model are determined. The information notification method according to any one of claims 1 to 8.

21. The determination further includes calculating a total amount of damage for each type of incident by multiplying the total number of occurrences of the type of incident information by the amount of damage caused by the occurrence of the type of incident information; The priority is determined so that the greater the total damage amount, the higher the priority. The information notification method according to any one of claims 1 to 8.

22. moreover, calculating an index value relating to the number of occurrences of each type of incident during the second period based on the occurrence tendency of each type of incident determined for each type of incident; When the index value exceeds a reference value, the recommendation of the interim measure is notified. The information notification method according to any one of claims 1 to 8.

23. moreover, calculating a sixth evaluation value based on the occurrence tendency of the incident type determined for each incident type; When the sixth evaluation value exceeds a reference value, the recommendation of the provisional action is notified. The information notification method according to claim 10.

24. The occurrence tendency is determined using a machine learning model generated by machine learning using a plurality of pieces of first incident information that occurred in a third period in the past as input, and using actual occurrence tendency results based on a plurality of pieces of second incident information that occurred in a fourth period in the past that is later than the third period as correct answer data. The information notification method according to any one of claims 1 to 8.

25. moreover, A machine learning model is generated by machine learning using a plurality of pieces of first incident information that occurred in a past third period as input, and a total amount of damage based on a plurality of pieces of second incident information that occurred in a past fourth period after the third period as correct answer data, to determine a total amount of damage caused by a security attack in the second period. The information notification method according to any one of claims 1 to 8.

26. The occurrence tendency is determined using a correlation between a plurality of pieces of first incident information that occurred in a third period in the past and an occurrence tendency performance based on a plurality of pieces of second incident information that occurred in a fourth period in the past that is later than the third period. The information notification method according to any one of claims 1 to 8.

27. moreover, A correlation between a plurality of pieces of first incident information occurring in a third period in the past and an actual total amount of damage based on a plurality of pieces of second incident information occurring in a fourth period in the past after the third period is used to determine a total amount of damage caused by the security attack in the second period. The information notification method according to any one of claims 1 to 8.

28. an acquisition unit that acquires incident information on a plurality of incidents that have occurred due to security attacks on a monitoring target during a past first period; a determination unit that determines, for each type of incident, a tendency for the incident to occur in the monitoring target during a second future period and a priority of a provisional or permanent response to the incident; a presentation unit that presents the occurrence tendency and the priority determined for each type of incident. Information notification device.

Images