Attack analysis device, attack analysis method, and program

Abstract

This attack analysis device (10) comprises: an acquisition unit (11) for acquiring in-vehicle network information that indicates the configuration of an in-vehicle network (20) including a plurality of external communication interfaces (21) and a plurality of control ECUs (22), and abnormality detection information that indicates abnormality detection results for an abnormality detected in one or more nodes of the in-vehicle network (20); an attack path estimation unit (12) for estimating, on the basis of the in-vehicle network information and abnormality detection information, an attack path in an attack on the in-vehicle network (20), the attack path for the attack including an entry point indicating an external communication interface (21) that is the point of intrusion of the attack to the in-vehicle network (20) and an attack target indicating a control ECU (22) that is the attack target of the attack; and an output unit (13) for outputting the attack path.

Description

[Technical field]

[0001] The present invention relates to an attack analysis device that analyzes cyber attacks against a network. [Background technology]

[0002] Conventionally, there is known a technique for analyzing a cyber attack (hereinafter, also simply referred to as an "attack") against an in-vehicle network mounted on a vehicle (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2015-026252 A Summary of the Invention [Problem to be solved by the invention]

[0004] When an attack occurs against an in-vehicle network, it is desirable to estimate the attack path of the attack, including the entry point, which is the point of entry of the attack into the in-vehicle network, and the attack target, which is the target of the attack.

[0005] Therefore, an object of the present disclosure is to provide an attack analysis device and the like that can estimate an attack path, including an entry point and an attack target, in an attack against an in-vehicle network. [Means for solving the problem]

[0006] An attack analysis device according to one embodiment of the present disclosure includes an acquisition unit that acquires in-vehicle network information indicating a configuration of an in-vehicle network including a plurality of external communication interfaces and a plurality of control ECUs, and anomaly detection information indicating anomaly detection results detected in one or more nodes in the in-vehicle network, an attack path estimation unit that estimates an attack path of an attack against the in-vehicle network based on the in-vehicle network information and the anomaly detection information, the attack path including an entry point indicating an external communication interface that is the point of entry of the attack into the in-vehicle network and an attack target indicating a control ECU that is the target of the attack, and an output unit that outputs the attack path.

[0007] An attack analysis method according to one embodiment of the present disclosure is an attack analysis method executed by a computer, which acquires in-vehicle network information indicating a configuration of an in-vehicle network including multiple external communication interfaces and multiple control ECUs, and anomaly detection information indicating anomaly detection results detected in one or more nodes in the in-vehicle network, and based on the in-vehicle network information and the anomaly detection information, estimates an attack path of an attack against the in-vehicle network, including an entry point indicating an external communication interface that is the point of entry of the attack into the in-vehicle network, and an attack target indicating a control ECU that is the target of the attack, and outputs the attack path.

[0008] A program according to one embodiment of the present disclosure is a program for causing a computer to execute an attack analysis process, the attack analysis process including a process of acquiring in-vehicle network information indicating a configuration of an in-vehicle network including a plurality of external communication interfaces and a plurality of control ECUs, and anomaly detection information indicating anomaly detection results detected in one or more nodes in the in-vehicle network, and estimating an attack path of an attack against the in-vehicle network based on the in-vehicle network information and the anomaly detection information, the attack path including an entry point indicating an external communication interface that is the point of entry of the attack into the in-vehicle network, and an attack target indicating a control ECU that is the target of the attack, and outputting the attack path. Effect of the Invention

[0009] According to an aspect of the present disclosure, an attack analysis device, etc. is provided that can estimate an attack path, including an entry point and an attack target, of an attack against an in-vehicle network. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a block diagram showing an example of a configuration of an attack monitoring system according to an embodiment. [Diagram 2] FIG. 2 is a block diagram illustrating an example of a configuration of an in-vehicle network according to an embodiment. [Diagram 3] FIG. 3 is a block diagram illustrating an example of a configuration of the integrated ECU according to the embodiment. [Figure 4] FIG. 4 is a schematic diagram illustrating an example of an anomaly detection list according to the embodiment. [Diagram 5] FIG. 5 is a schematic diagram illustrating an example of an external communication event list according to the embodiment. [Figure 6] FIG. 6 is a schematic diagram illustrating an example of an external communication event history according to the embodiment. [Figure 7] FIG. 7 is a schematic diagram illustrating an example of a vehicle control event list according to the embodiment. [Figure 8] FIG. 8 is a schematic diagram illustrating an example of a vehicle control event history according to the embodiment. [Figure 9] FIG. 9 is a block diagram illustrating an example of a configuration of an attack analysis device according to an embodiment. [Figure 10] FIG. 10 is a schematic diagram illustrating an example of the configuration of an attack path estimation result table according to the embodiment. [Figure 11] FIG. 11 is a schematic diagram illustrating an example of an attack path history according to the embodiment. [Figure 12] FIG. 12 is a sequence diagram of an attack monitoring process according to the embodiment. [Figure 13] FIG. 13 is a flowchart of the attack analysis process according to the embodiment. [Figure 14] FIG. 14 is a flowchart of the entry point estimation process according to the embodiment. [Figure 15] FIG. 15 is a flowchart of the entry point estimation process according to the embodiment. [Figure 16] FIG. 16 is a flowchart of an attack target estimation process according to the embodiment. [Figure 17] FIG. 17 is a flowchart of an attack target estimation process according to the embodiment. [Figure 18] FIG. 18 is a schematic diagram illustrating an example of the configuration of an attack path estimation result table according to the embodiment. [Figure 19] FIG. 19 is a flowchart of an attack path estimation process according to the embodiment. [Figure 20] FIG. 20 is a flowchart of an attack path reliability calculation process according to the embodiment. [Figure 21] FIG. 21 is a schematic diagram illustrating an example of the configuration of an attack path estimation result table according to the embodiment. [Figure 22] FIG. 22 is a schematic diagram illustrating an example of the configuration of an attack path estimation result table according to the embodiment. [Diagram 23] FIG. 23 is a flowchart of the first display control process according to the embodiment. [Figure 24] FIG. 24 is a schematic diagram illustrating an example of a screen displayed by the display device according to the embodiment. [Diagram 25] FIG. 25 is a flowchart of the second display control process according to the embodiment. [Figure 26] FIG. 26 is a schematic diagram illustrating an example of a screen displayed by the display device according to the embodiment. [Figure 27] FIG. 27 is a block diagram showing an example of a configuration of an integrated ECU according to a modified example. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] (How one aspect of the present disclosure was achieved) The inventors considered that, when an attack occurs against an in-vehicle network mounted on a vehicle, in order to perform analysis of the attack, such as analyzing the attack and comparing the attack with past cases, it is important to estimate the attack path of the attack, including an entry point indicating an external communication interface that is the point of entry of the attack into the in-vehicle network, and an attack target indicating a control ECU that is the target of the attack. This is because if the attack path can be estimated, the cost of the analysis work can be reduced.

[0012] On the other hand, since the anomaly detection results detected at each node of the in-vehicle network may include undetected anomalies or falsely detected anomalies, it may be difficult to estimate the attack path only from the anomaly detection information indicating the anomaly detection results detected at each node of the in-vehicle network.

[0013] Therefore, the inventors conducted extensive research and experiments to find a method for estimating an attack path with relatively high accuracy.

[0014] As a result, the inventors have found that by using the configuration of the in-vehicle network and anomaly detection information, it is possible to estimate the attack path with relatively high accuracy.

[0015] Based on this knowledge, the inventors conducted further studies and experiments and arrived at the attack analysis device, attack analysis method, and program according to the present disclosure below.

[0016] An attack analysis device according to one embodiment of the present disclosure includes an acquisition unit that acquires in-vehicle network information indicating a configuration of an in-vehicle network including a plurality of external communication interfaces and a plurality of control ECUs, and anomaly detection information indicating anomaly detection results detected in one or more nodes in the in-vehicle network, an attack path estimation unit that estimates an attack path of an attack against the in-vehicle network based on the in-vehicle network information and the anomaly detection information, the attack path including an entry point indicating an external communication interface that is the point of entry of the attack into the in-vehicle network and an attack target indicating a control ECU that is the target of the attack, and an output unit that outputs the attack path.

[0017] According to the attack analysis device having the above configuration, when an attack occurs on the in-vehicle network, the attack path can be estimated with relatively high accuracy by using the configuration of the in-vehicle network indicated by the in-vehicle network information and the anomaly detection information. In this way, according to the attack analysis device having the above configuration, the attack path including the entry point and the attack target in the attack on the in-vehicle network can be estimated.

[0018] In addition, the acquisition unit further acquires an external communication event history indicating a history of communication events performed by the in-vehicle network with the outside, and a vehicle control event history indicating a history of vehicle control events performed by a vehicle equipped with the in-vehicle network, and the attack analysis device further includes an entry point estimation unit that estimates the entry point based on the in-vehicle network information, the anomaly detection information, and the external communication event history, and an attack target estimation unit that estimates the attack target based on the in-vehicle network information, the anomaly detection information, and the vehicle control event history, and the attack path estimation unit may estimate the attack path based on the entry point estimated by the entry point estimation unit and the attack target estimated by the attack target estimation unit.

[0019] The attack analysis device having the above configuration can estimate an entry point more accurately based on the in-vehicle network information, anomaly detection information, and an external communication event history, and can estimate an attack target more accurately based on the in-vehicle network information, anomaly detection information, and a vehicle control event history. As a result, the attack analysis device can estimate an attack path more accurately.

[0020] In addition, the entry point estimation unit may calculate an entry point risk indicating the reliability of each of the multiple external communication interfaces as an entry point, and estimate the entry point based on each of the calculated entry point risks, and the attack target estimation unit may calculate an attack target risk indicating the reliability of each of the multiple control ECUs as an attack target, and estimate the attack target based on each of the calculated attack target risks.

[0021] This allows the entry point estimation to reflect the reliability as an entry point calculated for each of the multiple external communication interfaces, and the attack target estimation to reflect the reliability as an attack target calculated for each of the multiple control ECUs.

[0022] The present invention may further include an attack path reliability calculation unit that calculates an attack path reliability indicating the reliability of the attack path as an attack path based on the entry point risk of the entry point calculated by the entry point estimation unit and the attack target risk of the attack target calculated by the attack target estimation unit, and the output unit may further output the attack path reliability.

[0023] This makes it possible to output information indicating the reliability of the attack path as an attack path.

[0024] The output unit may also be provided with a display control unit that outputs a display control signal including the attack path, which controls a display device to display a configuration diagram showing the configuration of the in-vehicle network, and to display the attack path in the configuration diagram in a display manner different from other parts.

[0025] This allows a user of the attack analysis device to visually recognize the attack path.

[0026] An attack analysis method according to one embodiment of the present disclosure is an attack analysis method executed by a computer, which acquires in-vehicle network information indicating a configuration of an in-vehicle network including multiple external communication interfaces and multiple control ECUs, and anomaly detection information indicating anomaly detection results detected in one or more nodes in the in-vehicle network, and based on the in-vehicle network information and the anomaly detection information, estimates an attack path of an attack against the in-vehicle network, including an entry point indicating an external communication interface that is the point of entry of the attack into the in-vehicle network, and an attack target indicating a control ECU that is the target of the attack, and outputs the attack path.

[0027] According to the above attack analysis method, when an attack occurs on the in-vehicle network, the attack path can be estimated with relatively high accuracy by using the configuration of the in-vehicle network indicated by the in-vehicle network information and the anomaly detection information. In this way, according to the above attack analysis method, the attack path including the entry point and the attack target in the attack on the in-vehicle network can be estimated.

[0028] A program according to one embodiment of the present disclosure is a program for causing a computer to execute an attack analysis process, the attack analysis process including a process of acquiring in-vehicle network information indicating a configuration of an in-vehicle network including a plurality of external communication interfaces and a plurality of control ECUs, and anomaly detection information indicating anomaly detection results detected in one or more nodes in the in-vehicle network, and estimating an attack path of an attack against the in-vehicle network based on the in-vehicle network information and the anomaly detection information, the attack path including an entry point indicating an external communication interface that is the point of entry of the attack into the in-vehicle network, and an attack target indicating a control ECU that is the target of the attack, and outputting the attack path.

[0029] According to the above program, when an attack is made on the in-vehicle network, the attack path can be estimated with relatively high accuracy by using the configuration of the in-vehicle network indicated by the in-vehicle network information and the anomaly detection information. In this way, according to the above program, the attack path including the entry point and the attack target in the attack on the in-vehicle network can be estimated.

[0030] A specific example of an attack analysis device according to an aspect of the present disclosure will be described below with reference to the drawings. Each embodiment shown here shows a specific example of the present disclosure. Therefore, the numerical values, shapes, components, the arrangement and connection of the components, as well as the steps (processes) and the order of the steps shown in the following embodiments are merely examples and are not intended to limit the present disclosure. In addition, each figure is a schematic diagram and is not necessarily an exact illustration. In each figure, the same reference numerals are used for substantially the same configurations, and duplicated explanations are omitted or simplified.

[0031] (Embodiment) An attack analysis device according to an embodiment of the present invention is described below. The attack analysis device is a device that estimates an attack path in an attack against an in-vehicle network installed in a vehicle.

[0032] <Configuration> FIG. 1 is a block diagram showing an example of the configuration of an attack monitoring system 1 that monitors attacks against an in-vehicle network 20 mounted on a vehicle 30, using an attack analysis device 10 according to an embodiment.

[0033] As shown in FIG. 1, the attack monitoring system 1 includes a monitoring server 40, a vehicle 30, an in-vehicle network 20, and an external network 50.

[0034] The monitoring server 40 is a so-called computer device, and includes a processor (not shown), a memory (not shown), a communication interface (not shown), a storage device (not shown), and a display (not shown).

[0035] The monitoring server 40 realizes the attack analysis device 10 and the display device 41 by the processor executing the programs stored in the memory.

[0036] The vehicle 30 has a communication function and is equipped with the in-vehicle network 20. The vehicle 30 is, for example, an automobile.

[0037] The external network 50 is a wide area network such as the Internet, and includes the attack analysis device 10 and the in-vehicle network 20 as its connection destinations.

[0038] FIG. 2 is a block diagram showing an example of the configuration of the in-vehicle network 20. As shown in FIG.

[0039] As shown in FIG. 2, the in-vehicle network 20 includes a plurality of external communication interfaces, a plurality of control ECUs (Electronic Control Units), and an integrated ECU 24.

[0040] Here, in Fig. 2, the multiple external communication interfaces correspond to external communication IF_A21A, external communication IF_B21B, external communication IF_C21C, and external communication IF_D21D. Hereinafter, each of the multiple external communication interfaces may be referred to as external communication IF21. Also, in Fig. 2, the multiple control ECUs correspond to ECU_A22A, ECU_B22B, ECU_C22C, and ECU_D22D. Hereinafter, each of the multiple control ECUs may be referred to as ECU22.

[0041] The multiple external communication IFs 21 may include, for example, a telematics communication unit (TCU: Telematic Control Unit), an in-vehicle infotainment system, an external application execution device, or a communication device that communicates with a charging station, an OBD (On-Board Diagnostics) port, etc.

[0042] Each of the multiple external communication IFs 21 includes an IDS (Intrusion Detection System) that detects an abnormality in the external communication IF 21. Here, the external communication IF_A 21A includes an IDS_A 23A, the external communication IF_B 21B includes an IDS_B 23B, the external communication IF_C 21C includes an IDS_C 23C, and the external communication IF_D 21D includes an IDS_D 23D.

[0043] The multiple external communication IFs 21 are connected to the integrated ECU 24 via a CAN (Controller Area Network) 25 or Ethernet (registered trademark) 26 .

[0044] The multiple ECUs 22 may include, for example, a control ECU that controls the driving of the vehicle 30, an ADAS control ECU that controls an ADAS (Advanced Driver-Assistance System), an air conditioner control ECU that controls an air conditioner, and the like.

[0045] Each of the ECUs 22 includes an IDS that detects an abnormality in the ECU 22. Here, the ECU_A 22A includes an IDS_E 23E, the ECU_B 22B includes an IDS_F 23F, the ECU_C 22C includes an IDS_G 23G, and the ECU_D 22D includes an IDS_H 23H.

[0046] The multiple ECUs 22 are connected to the integrated ECU 24 via a CAN 25 or Ethernet (registered trademark) 26 .

[0047] FIG. 3 is a block diagram showing an example of the configuration of the integrated ECU 24. As shown in FIG.

[0048] As shown in FIG. 3, a gateway 29, a security master 27, a vehicle control event management unit 28, an IDS_I 23I, an IDS_J 23J, but Integrated ECU24 Included in .

[0049] The integrated ECU 24 is a so-called computer device, and includes a processor (not shown), a memory (not shown), and a communication interface (not shown).

[0050] The integrated ECU 24 realizes a gateway 29, a security master 27, a vehicle control event management unit 28, and IDS_I 23I and IDS_J 23J that detect abnormalities in the integrated ECU 24 by the processor executing the programs stored in the memory.

[0051] The gateway 29 is equipped with IDS_K 23K and IDS_L 23L for detecting abnormalities in the gateway 29 .

[0052] Hereinafter, each of the multiple IDSs included in the in-vehicle network 20 may be referred to as an IDS 23.

[0053] When the IDS 23 included in the in-vehicle network 20 detects an abnormality, the security master 27 generates anomaly detection information indicating the abnormality detection result detected in one or more nodes in the in-vehicle network 20. Then, when the security master 27 generates the anomaly detection information, it transmits the generated anomaly detection information to the attack analysis device 10 together with in-vehicle network information indicating the configuration of the in-vehicle network 20, a vehicle control event history described below, and an external communication event history described below.

[0054] Here, the node refers to the plurality of external communication IFs 21, the gateway 29, and the plurality of ECUs 22.

[0055] FIG. 4 is a schematic diagram showing an example of an anomaly detection list, which is an example of anomaly detection information generated by the security master 27. As shown in FIG.

[0056] 4, the anomaly detection list is a table that associates, for each node included in the in-vehicle network 20, the classification of the node, a timestamp indicating the date and time when an anomaly was detected by the IDS that detects the anomaly of the node, whether or not an anomaly was detected by the IDS that detects the anomaly of the node, and an anomaly detection score output from the IDS that detects the anomaly of the node. Here, the anomaly detection score is a score indicating the degree of anomaly of the anomaly detected by the IDS, and the greater the degree of anomaly, the greater the score value. In the first embodiment, the external communication IF 21 is classified as an entry node, and the ECU 22 is classified as a target node.

[0057] When one IDS 23 detects an abnormality, the security master 27 generates an abnormality detection list for the abnormalities detected by the IDSs 23 included in the in-vehicle network 20 within a predetermined period T1 (e.g., 2 minutes) starting from the detection.

[0058] When the same IDS 23 detects anomalies multiple times within a given period T1, the security master 27 may generate anomaly detection list for only the first anomaly detected among the multiple anomalies, for example, in order to treat a series of consecutive attacks as a single attack.

[0059] From the anomaly detection list shown in Figure 4, for example, the IDS of the external communication IF_B, which is classified as an entry node, detected an anomaly at 10:32:10 on August 30, 2020. detection You can see that the score is 60.

[0060] Returning to FIG. 3, the description of the integrated ECU 24 will be continued.

[0061] The vehicle control event management unit 28 stores a predetermined external communication event list and a predetermined vehicle control event list, and generates, updates, and manages an external communication event history indicating the history of communication events that the in-vehicle network 20 has performed with the outside, and a vehicle control event history indicating the history of vehicle control events that the vehicle 30 has performed, based on the stored external communication event list and vehicle control event list.

[0062] FIG. 5 is a schematic diagram showing an example of an external communication event list stored in the vehicle control event management unit 28. As shown in FIG.

[0063] 5, the external communication event list is a table that associates, for each external communication event indicating a communication event that the in-vehicle network 20 performs with the outside, the classification of the external communication event, the risk and sub-risk indicating the degree of danger of a cyber-attack due to the external communication event, and the preferred route which is a comment related to the external communication event. Here, the risk and sub-risk are scores that increase as the degree of danger of a cyber-attack increases.

[0064] From the external communication event list shown in FIG. 5, for example, it can be seen that the risk and sub-risk of the external communication event "connected to new IP address" classified as "establishment of external communication" are 3 and 3, respectively.

[0065] FIG. 6 is a schematic diagram showing an example of an external communication event history that is generated, updated, and managed by the vehicle control event management unit 28. As shown in FIG.

[0066] 6, the external communication event history is a table that associates, for each external communication event that has occurred, the date and time when the external communication event occurred, an external communication event ID that identifies the external communication event, an external communication IFID that identifies the external communication IF 21 that communicated with the outside in the external communication event, and an external communication event risk that indicates the risk of the external communication event. Here, the external communication event risk is expressed by combining the risks and sub-risks in the external communication event list.

[0067] From the external communication event history shown in Figure 6, for example, it can be seen that the external communication event "An external device was connected to the OBD port" is an event that occurred on August 30, 2020 at 10:32:00, was communicated with the outside world via external communication IF21 identified by external communication IFID "IF01", and has an external communication event risk of 3-2.

[0068] FIG. 7 is a schematic diagram showing an example of a vehicle control event list stored in the vehicle control event management unit 28. As shown in FIG.

[0069] 7, the vehicle control event list is a table that associates, for each vehicle control event indicating a vehicle control event performed by the vehicle 30, the classification of the vehicle control event, the risk and sub-risk indicating the seriousness of the threat to the safety of the vehicle 30 in the case where the vehicle control event is the result of a cyber-attack, and the "preferred route" which is a comment related to the vehicle control event. Here, the risk and sub-risk are each scores that increase as the seriousness of the threat to safety increases.

[0070] From the vehicle control event list shown in Figure 7, it can be seen that, for example, the vehicle control event "Acceleration, steering, and deceleration instructions have been issued," which is classified as "Control instructions," has a risk and sub-risk of 3 and 1, respectively.

[0071] FIG. 8 is a schematic diagram showing an example of a vehicle control event history that is generated, updated, and managed by the vehicle control event management unit 28. As shown in FIG.

[0072] 8, the vehicle control event history is a table that associates, for each vehicle control event that has occurred, the date and time when the vehicle control event occurred, a vehicle control event ID that identifies the vehicle control event, an ECU ID that identifies the ECU 22 that has caused the vehicle control event, and a vehicle control event risk that indicates the risk of the vehicle control event. Here, the vehicle control event risk is expressed by combining the risks and sub-risks in the vehicle control event list.

[0073] From the vehicle control event history shown in Figure 8, for example, it can be seen that the vehicle control event "The air conditioner operation has changed" is an event that occurred at 10:30:15 on August 30, 2020, that occurred in ECU22 identified by ECUID "ECU02", and that has a vehicle control event risk of 1-2.

[0074] Returning to FIG. 3, the description of the integrated ECU 24 will be continued.

[0075] As described above, when the IDS 23 included in the in-vehicle network 20 detects an abnormality, the security master 27 generates abnormality detection information and transmits the generated abnormality detection information to the attack analysis device 10 together with the in-vehicle network information, the vehicle control event history, and the external communication event history.

[0076] At this time, the security master 27 does not necessarily need to transmit all of the external communication event history managed by the vehicle control event management unit 28 to the attack analysis device 10. Here, it is explained that the security master 27 transmits to the attack analysis device 10 the external communication event history of the communication events that the in-vehicle network 20 performed with the outside during a predetermined period T2 before and after the detection of the abnormality (for example, a total of 10 minutes consisting of 5 minutes before the detection and 5 minutes after the detection). Also, at this time, the security master 27 does not necessarily need to transmit to the attack analysis device 10 all of the vehicle control event history managed by the vehicle control event management unit 28. Here, it is explained that the security master 27 transmits to the attack analysis device 10 the vehicle control event history of the vehicle control events that the vehicle 30 performed during the predetermined period T2 before and after the detection of the abnormality.

[0077] FIG. 9 is a block diagram showing an example of the configuration of the attack analysis device 10. As shown in FIG.

[0078] As shown in FIG. 9, the attack analysis device 10 includes an acquisition unit 11, an entry point estimation unit 14, an attack target estimation unit 15, an attack path estimation unit 12, an attack path estimation result table management unit 17, an attack path reliability calculation unit 16, and an output unit 13.

[0079] The acquisition unit 11 acquires in-vehicle network information, abnormality detection information, external communication event history, and vehicle control event history transmitted from the security master 27.

[0080] The entry point estimation unit 14 estimates an entry point indicating an external communication IF 21 that is an intrusion point into the in-vehicle network 20 in an attack on the in-vehicle network 20, based on the in-vehicle network information, the abnormality detection information, and the external communication event history acquired by the acquisition unit 11. At this time, the entry point estimation unit 14 estimates an entry point indicating an external communication IF 21 that is an intrusion point into the in-vehicle network 20 in an attack on the in-vehicle network 20, based on the in-vehicle network information, the abnormality detection information, and the external communication event history acquired by the acquisition unit 11. point An entry point risk indicating the reliability as a security is calculated, and an entry point is estimated based on each of the calculated entry point risks.

[0081] The entry point estimation performed by the entry point estimation unit 14 will be described in detail later with reference to a flowchart and the like.

[0082] The attack target estimation unit 15 estimates an attack target indicating an ECU 22 that is the target of an attack on the in-vehicle network 20, based on the in-vehicle network information, the abnormality detection information, and the vehicle control event history acquired by the acquisition unit 11. At this time, the attack target estimation unit 15 calculates an attack target risk indicating the reliability as an attack target for each of the multiple ECUs 22, and estimates the attack target based on each of the calculated attack target risks.

[0083] The details of the attack target estimation performed by the attack target estimation unit 15 will be described later with reference to a flowchart and the like.

[0084] The attack path estimation unit 12 estimates an attack path including an entry point and an attack target in an attack on the in-vehicle network 20, based on the in-vehicle network information and anomaly detection information acquired by the acquisition unit 11. In the first embodiment, the attack path estimation unit 12 will be described as estimating an attack path based on the entry point estimated by the entry point estimation unit 14, the attack target estimated by the attack target estimation unit 15, the in-vehicle network information acquired by the acquisition unit 11, and the anomaly detection information acquired by the acquisition unit 11.

[0085] The details of the attack path estimation performed by the attack path estimation unit 12 will be described later using a flowchart and the like.

[0086] The attack path reliability calculation unit 16 calculates an attack path reliability indicating the reliability of the attack path estimated by the attack path estimation unit 12 as an attack path based on the entry point risk of the entry point calculated by the entry point estimation unit 14 and the attack target risk of the attack target calculated by the attack target estimation unit 15.

[0087] The calculation of the attack path reliability performed by the attack path reliability calculation unit 16 will be described in detail later with reference to a flowchart and the like.

[0088] When the acquisition unit 11 acquires anomaly detection information, the attack path estimation result table management unit 17 generates an attack path estimation result table based on the anomaly detection information acquired by the acquisition unit 11. Then, the attack path estimation result table management unit 17 sequentially updates and manages the generated attack path estimation result table based on various signals output from the entry point estimation unit 14, the attack target estimation unit 15, the attack path estimation unit 12, or the attack path reliability calculation unit 16.

[0089] Fig. 10 is a schematic diagram showing an example of an attack path estimation result table generated by the attack path estimation result table management unit 17. Here, the attack path estimation result table shown in Fig. 10 is a schematic diagram showing an example of an attack path estimation result table in an initial state that is generated by the attack path estimation result table management unit 17 when the acquisition unit 11 acquires anomaly detection information, and is an example of an attack path estimation result table that has not yet been updated.

[0090] As shown in FIG. 10, the attack path estimation result table is a table that associates, for each node included in the in-vehicle network 20, the classification of the node, a timestamp indicating the date and time when an abnormality was detected by the IDS that detects an abnormality in the node, whether or not an abnormality was detected by the IDS that detects an abnormality in the node, an abnormality detection score output from the IDS that detects an abnormality in the node, an estimation result indicating an abnormal state of the node estimated by the entry point estimation unit 14 when the node is the external communication IF 21, or an estimation result indicating an abnormal state of the node estimated by the attack target estimation unit 15 when the node is the ECU 22, an entry point risk of the node calculated by the entry point estimation unit 14 when the node is the communication IF 21, or a risk indicating an attack target risk of the node calculated by the attack target estimation unit 15 when the node is the ECU 22, an attack path indicating whether or not the node corresponds to the attack path estimated by the attack path estimation unit 12, and an attack path reliability of the attack path calculated by the attack path reliability calculation unit 16. Here, the estimation result and risk value estimated by the attack target estimation unit 15 or the entry point estimation unit 14, and the method of estimating the attack path estimated by the attack path estimation unit 12 will be described later.

[0091] As shown in FIG. 10, in the initial attack path estimation result table, no information is recorded in the estimation result, risk, attack path, and attack path reliability.

[0092] The attack path estimation result table that is successively updated by the attack path estimation result table management unit 17 will be described later.

[0093] Returning to FIG. 9, the explanation of the attack analysis device 10 will be continued.

[0094] The attack path estimation result table management unit 17 further generates and manages an attack path history indicating the history of attack paths estimated by the attack path estimation unit 12 .

[0095] FIG. 11 is a schematic diagram showing an example of an attack path history managed by the attack path estimation result table management unit 17. As shown in FIG.

[0096] As shown in FIG. 11, the attack path history is a table that associates, for each attack path estimated by the attack path estimation unit 12, an abnormality notification ID that identifies the abnormality notification corresponding to that attack path, the attack path reliability calculated for that attack path by the attack path reliability calculation unit 16, the entry point of that attack path, the entry point risk calculated for that entry point by the entry point estimation unit 14, the attack target of that attack path, and the attack target risk calculated for that attack target by the attack target estimation unit 15.

[0097] Returning to FIG. 9, the explanation of the attack analysis device 10 will be continued.

[0098] The output unit 13 outputs the attack path estimated by the attack path estimation unit 12. In the embodiment, the output unit 13 will be described as including a display control unit 18 that outputs a display control signal including the attack path to the display device 41.

[0099] When the attack path estimation unit 12 estimates an attack path, the display control unit 18 outputs a display control signal including the attack path, which controls the display device 41 to display a configuration diagram showing the configuration of the in-vehicle network and to display the attack path in a different display method from other parts in the configuration diagram. At this time, the display control unit 18 may further output the display control signal as a display control signal that controls the display device 41 to display, for example, information related to the estimation result by the attack path estimation unit 12, the estimation result by the entry point estimation unit 14, the estimation result by the attack target estimation unit 15, and / or the calculation result by the attack path reliability calculation unit 16 in a table format. Here, the display control unit 18 will be described as further outputting the display control signal as a display control signal that controls the display device 41 to display the attack path history managed by the attack path estimation result table management unit 17 in a table format.

[0100] A specific example of a screen displayed by the display device 41 controlled by the display control signal output from the display control unit 18 will be described later.

[0101] <Operation> The operation of the attack monitoring system 1 configured as above will be described below with reference to the drawings.

[0102] Fig. 12 is a sequence diagram of the attack monitoring process performed by the attack monitoring system 1. Fig. 13 is a flowchart of the attack analysis process performed by the attack analysis device 10 in the attack monitoring process performed by the attack monitoring system 1.

[0103] As shown in FIG. 12, when the IDS 23 included in the in-vehicle network 20 detects an abnormality during the attack monitoring process, the IDS 23 notifies the security master 27 of the detection of the abnormality.

[0104] When the IDS23 notifies the security master 27 of the detection of an abnormality, the security master 27 generates abnormality detection information (here, an abnormality detection list) and requests the vehicle control event management unit 28 to transmit the vehicle control event history and the external communication event history within a predetermined period T2 before and after the IDS23 detected the abnormality.

[0105] Then, the vehicle control event management unit 28 transmits the requested vehicle control event history and external communication event history to the security master 27.

[0106] Then, the security master 27 acquires the vehicle control event history and the external communication event history, and transmits the generated anomaly detection information to the attack analysis device 10 together with the in-vehicle network information, the acquired vehicle control event history, and the acquired external communication event history.

[0107] When the security master 27 transmits the abnormality detection information, the attack analysis device 10 analysis Start processing.

[0108] As shown in Figure 12 and Figure 13, the attack analysis In the process, the acquisition unit 11 acquires the abnormality detection information, the in-vehicle network information, the vehicle control event history, and the external communication event history transmitted from the security master 27 (step S10).

[0109] Next, the entry point estimation unit 14 estimates an entry point based on the in-vehicle network information, the abnormality detection information, and the external communication event history acquired by the acquisition unit 11 (step S20). At this time, the entry point estimation unit 14 calculates an entry point risk for each of the multiple external communication IFs 21 in the entry point estimation process. The entry point estimation unit 14 estimates the entry point by performing an entry point estimation process described later.

[0110] Next, the attack target estimation unit 15 estimates an attack target based on the in-vehicle network information, the abnormality detection information, and the vehicle control event history acquired by the acquisition unit 11 (step S30). At this time, the attack target estimation unit 15 calculates an attack target risk for each of the multiple ECUs 22 in the attack target estimation process. The attack target estimation unit 15 estimates the attack target by performing an attack target estimation process described later.

[0111] Next, the attack path estimation unit 12 estimates an attack path based on the entry point estimated by the entry point estimation unit 14, the attack target estimated by the attack target estimation unit 15, the in-vehicle network information acquired by the acquisition unit 11, and the anomaly detection information acquired by the acquisition unit 11 (step S40). The attack path estimation unit 12 estimates the attack path by performing an attack path estimation process described later.

[0112] Next, the attack path reliability calculation unit 16 calculates an attack path reliability for the attack path estimated by the attack path estimation unit 12 based on the entry point risk of the entry point calculated by the entry point estimation unit 14 and the attack target risk of the attack target calculated by the attack target estimation unit 15 (step S50). The attack path reliability calculation unit 16 calculates this attack path reliability by performing an attack path reliability calculation process described later.

[0113] Next, the output unit 13 outputs a display control signal including the attack path estimated by the attack path estimation unit 12 to the display device 41 (step S60).

[0114] When the output unit 13 outputs a display control signal, the attack analysis device 10 analysis End processing.

[0115] When the display control signal is output from the output unit 13, the display device 41 displays an image based on the display control signal.

[0116] When the display device 41 displays an image based on the display control signal, the attack monitoring system 1 ends its attack monitoring process.

[0117] 14 and 15 are flowcharts of the entry point estimation process performed by the entry point estimation unit 14. In FIG.

[0118] As shown in Figures 14 and 15, when the entry point estimation process is started, the entry point estimation unit 14 acquires the in-vehicle network information, abnormality detection information, and external communication event history acquired by the acquisition unit 11, and selects one external communication IF21 from the multiple external communication IFs 21 included in the in-vehicle network 20 by referring to the in-vehicle network information (step S80).

[0119] Then, the entry point estimation unit 14 detects an abnormal detection By referring to the information, it is checked whether the IDS 23 included in the selected external communication IF 21 has detected an abnormality (step S100).

[0120] In the processing of step S100, if the IDS23 equipped in the selected external communication IF21 detects an abnormality (step S100: Yes), the entry point estimation unit 14 refers to the external communication event history to check whether an external communication event has occurred in which the selected external communication IF21 communicated with the outside (step S101).

[0121] In the processing of step S101, if an external communication event occurs in which the selected external communication IF21 communicates with the outside (step S101: Yes), the entry point estimation unit 14 estimates the abnormal state of the selected external communication IF21 to be “abnormality detected (high risk of attack)” and calculates the entry point risk of the external communication IF21 to be 5 (step S102).

[0122] In the process of step S101, when an external communication event in which the selected external communication IF 21 communicates with the outside has not occurred (step S101: No), the entry point estimation unit 14 detection With reference to the information and the external communication event history, it is checked whether the IDS 23 immediately following the selected external communication IF 21 has detected an abnormality (step S103).

[0123] In the processing of step S103, if the IDS23 immediately following the selected external communication IF21 detects an abnormality (step S103: Yes), the entry point estimation unit 14 estimates the abnormal state of the selected external communication IF21 to be "abnormality detected" and calculates the entry point risk of the external communication IF21 to be 4 (step S104).

[0124] In the processing of step S103, if the IDS23 immediately following the selected external communication IF21 does not detect an abnormality (step S103: No), the entry point estimation unit 14 estimates the abnormal state of the selected external communication IF21 to be a "false positive detection" and calculates the entry point risk of the external communication IF21 to be 2 (step S105).

[0125] In the processing of step S100, if the IDS23 equipped in the selected external communication IF21 does not detect an abnormality (step S100: No), the entry point estimation unit 14 refers to the external communication event history to check whether an external communication event has occurred in which the selected external communication IF21 communicated with the outside (step S106).

[0126] In the processing of step S106, if an external communication event occurs in which the selected external communication IF21 communicates with the outside (step S106: Yes), the entry point estimation unit 14 refers to the abnormality notification information and the external communication event history to check whether the IDS23 immediately following the selected external communication IF21 has detected an abnormality (step S107).

[0127] In the processing of step S107, if the IDS23 immediately following the selected external communication IF21 detects an abnormality (step S107: Yes), the entry point estimation unit 14 estimates the abnormal state of the selected external communication IF21 to be "undetected" and calculates the entry point risk of the external communication IF21 to be 3 (step S108).

[0128] In the processing of step S107, if the IDS23 immediately following the selected external communication IF21 does not detect an abnormality (step S107: No), the entry point estimation unit 14 estimates the abnormal state of the selected external communication IF21 to be “no attack (event occurs)” and calculates the entry point risk of the external communication IF21 to be 1 (step S109).

[0129] In the processing of step S106, if an external communication event has not occurred in which the selected external communication IF21 communicates with the outside (step S106: No), the entry point estimation unit 14 estimates the abnormal state of the selected external communication IF21 to be “no attack” and calculates the entry point risk of the external communication IF21 to be 0 (step S110).

[0130] When the processing of step S102, step S104, step S105, step S108, step S109, or step S110 is completed, the entry point estimation unit 14 refers to the in-vehicle network information to check whether or not there is an unselected external communication IF 21 that has not yet been selected in the entry point estimation processing among the multiple external communication IFs 21 included in the in-vehicle network 20 (step S111).

[0131] In the process of step S111, if there is an unselected external communication IF 21 (step S111: Yes), the entry point estimation unit 14 selects one external communication IF 21 from the unselected external communication IFs 21 (step S81), and proceeds to the process of step S100.

[0132] In the process of step S111, if there is no unselected external communication IF 21 (step S111: No), the entry point estimation unit 14 selects the external communication IF 21 having the largest calculated entry point risk (step S112).

[0133] If there are multiple external communication IFs 21 selected in the processing of step S112 (step S113: Yes), the entry point estimation unit 14 checks whether the entry point risks of those external communication IFs 21 are 1, 3, or 5 (step S114).

[0134] In the process of step S114, if the entry point risk is one of 1, 3, and 5 (step S114: Yes), the entry point estimation unit 14 refers to the external communication event history, and selects the entry point IF 21 with the highest score of the associated external communication event risk among those external communication IFs 21. big That is, the external communication IF 21 that is most likely to be at risk of being subjected to a cyber attack due to the associated external communication event is estimated to be the entry point (step S115).

[0135] In the processing of step S114, if the entry point risk is not one of 1, 3, or 5 (step S114: No), the entry point estimation unit 14 checks whether the entry point risk of those external communication IFs 21 is 2 or 4 (step S116).

[0136] In the processing of step S116, if the entry point risk is 2 or 4 (step S116: Yes), the entry point estimation unit 14 refers to the anomaly detection information and estimates that the external communication IF21 with the highest associated anomaly detection score among those external communication IFs 21 is the entry point (step S117).

[0137] In the processing of step S116, if the entry point risk is not 2 or 4 (step S116: No), the entry point estimation unit 14 refers to the abnormality detection information and the in-vehicle network information and estimates that the external communication IF21 that can provide the shortest connection to the intermediate node where the abnormality was detected is the entry point (step S118).

[0138] If there are not multiple external communication IFs 21 selected in the processing of step S112 (step S113: No), that is, if there is only one external communication IF 21 selected, the entry point estimation unit 14 estimates that external communication IF 21 as the entry point (step S119).

[0139] When the process of step S115, the process of step S117, the process of step S118, or the process of step S119 is completed, the entry point estimation unit 14 outputs the estimated entry point as an estimation result of the entry point estimation process (step S120).

[0140] When the process of step S120 ends, the entry point estimation unit 14 ends the entry point estimation process.

[0141] 16 and 17 are flowcharts of the attack target estimation process performed by the attack target estimation unit 15.

[0142] As shown in Figures 16 and 17, when the attack target estimation process is started, the attack target estimation unit 15 acquires the in-vehicle network information, abnormality detection information, and vehicle control event history acquired by the acquisition unit 11, and selects one ECU 22 from the multiple ECUs 22 included in the in-vehicle network 20 by referring to the in-vehicle network information (step S90).

[0143] Then, the attack target estimation unit 15 detects an abnormal detectionBy referring to the information, it is checked whether the IDS 23 included in the selected ECU 22 has detected an abnormality (step S200).

[0144] In the processing of step S200, if the IDS 23 equipped in the selected ECU 22 detects an abnormality (step S200: Yes), the attack target estimation unit 15 refers to the vehicle control event history to check whether a vehicle control event has occurred by the selected ECU 22 (step S201).

[0145] In the processing of step S201, if a vehicle control event occurs due to the selected ECU 22 (step S201: Yes), the attack target estimation unit 15 estimates the abnormal state of the selected ECU 22 to be "abnormality detected (high attack risk)" and calculates the attack target risk of the ECU 22 to be 5 (step S202).

[0146] In the process of step S201, when a vehicle control event by the selected ECU 22 does not occur (step S201: No), the attack target estimation unit 15 detection By referring to the information and the vehicle control event history, it is determined whether or not the IDS 23 immediately preceding the selected ECU 22 has detected an abnormality (step S203).

[0147] In the processing of step S203, if the IDS23 immediately preceding the selected ECU22 detects an abnormality (step S203: Yes), the attack target estimation unit 15 estimates the abnormal state of the selected ECU22 to be "abnormality detected" and calculates the attack target risk of the ECU22 to be 4 (step S204).

[0148] In the processing of step S203, if the IDS23 immediately preceding the selected ECU22 does not detect an abnormality (step S203: No), the attack target estimation unit 15 estimates the abnormal state of the selected ECU22 to be a "false positive detection" and calculates the attack target risk of the ECU22 to be 2 (step S205).

[0149] In the processing of step S200, if the IDS 23 equipped in the selected ECU 22 does not detect an abnormality (step S200: No), the attack target estimation unit 15 refers to the vehicle control event history to check whether a vehicle control event has occurred by the selected ECU 22 (step S206).

[0150] In the processing of step S206, if a vehicle control event occurs due to the selected ECU 22 (step S206: Yes), the attack target estimation unit 15 refers to the abnormality notification information and the vehicle control event history to check whether the IDS 23 immediately preceding the selected ECU 22 has detected an abnormality (step S207).

[0151] In the processing of step S207, if the IDS23 immediately preceding the selected ECU22 detects an abnormality (step S207: Yes), the attack target estimation unit 15 estimates the abnormal state of the selected ECU22 to be "undetected" and calculates the attack target risk of the ECU22 to be 3 (step S208).

[0152] In the processing of step S207, if the IDS23 immediately preceding the selected ECU22 does not detect an abnormality (step S207: No), the attack target estimation unit 15 estimates the abnormal state of the selected ECU22 to be "no attack (event present)" and calculates the attack target risk of the ECU22 to be 1 (step S209).

[0153] In the processing of step S206, if a vehicle control event has not occurred due to the selected ECU 22 (step S206: No), the attack target estimation unit 15 estimates the abnormal state of the selected ECU 22 to be "no attack" and calculates the attack target risk of the ECU 22 to be 0 (step S210).

[0154] When the processing of step S202, step S204, step S205, step S208, step S209, or step S210 is completed, the attack target estimation unit 15 refers to the in-vehicle network information to check whether or not there is an unselected ECU 22 among the multiple ECUs 22 included in the in-vehicle network 20 that has not yet been selected in the attack target estimation processing (step S211).

[0155] In the process of step S211, if there is an unselected ECU 22 (step S211: Yes), the attack target estimation unit 15 selects one ECU 22 from the unselected ECUs 22 (step S91), and proceeds to the process of step S200.

[0156] In the process of step S211, if there is no unselected ECU 22 (step S211: No), the attack target estimation unit 15 selects the ECU 22 with the highest calculated attack target risk (step S212).

[0157] If there are multiple ECUs 22 selected in the process of step S212 (step S213: Yes), the attack target estimation unit 15 checks whether the attack target risks of those ECUs 22 are 1, 3, or 5 (step S214).

[0158] In the process of step S214, if the attack target risk is one of 1, 3, and 5 (step S214: Yes), the attack target estimation unit 15 refers to the vehicle control event history and, among those ECUs 22, selects the ECU 22 with the highest score of the associated vehicle control event risk. big That is, the ECU 22 whose associated vehicle control event poses the highest threat to the safety of the vehicle 30 is estimated to be the attack target (step S215).

[0159] In the processing of step S214, if the attack target risk is not 1, 3, or 5 (step S214: No), the attack target estimation unit 15 checks whether the attack target risk of those ECUs 22 is 2 or 4 (step S216).

[0160] In the processing of step S216, if the attack target risk is 2 or 4 (step S216: Yes), the attack target estimation unit 15 refers to the abnormality detection information and estimates that the ECU 22 with the highest associated abnormality detection score among those ECUs 22 is the attack target (step S217).

[0161] In the processing of step S216, if the attack target risk is not 2 or 4 (step S216: No), the attack target estimation unit 15 refers to the anomaly detection information and the in-vehicle network information and estimates that the ECU 22 that can be connected in the shortest distance to the intermediate node where the anomaly was detected is the attack target (step S218).

[0162] If there are not multiple ECUs 22 selected in the process of step S212 (step S213: No), that is, if there is only one ECU 22 selected, the attack target estimation unit 15 estimates that ECU 22 as an attack target (step S219).

[0163] When the process of step S215, the process of step S217, the process of step S218, or the process of step S219 is completed, the attack target estimation unit 15 outputs the estimated attack target as an estimation result of the attack target estimation process (step S220).

[0164] When the process of step S220 ends, the attack target estimation unit 15 ends the attack target estimation process.

[0165] FIG. 18 is a schematic diagram showing an example of an attack path estimation result table updated by the attack path estimation result table management unit 17 after the entry point estimation unit 14 executes the entry point estimation process and the attack target estimation unit 15 executes the attack target estimation process.

[0166] As shown in FIG. 18, when the entry point estimation unit 14 executes an entry point estimation process and the attack target estimation unit 15 executes an attack target estimation process, the attack path estimation result table management unit 17 records the abnormal state of each external communication IF 21 estimated by the entry point estimation unit 14 or the abnormal state of each ECU 22 estimated by the attack target estimation unit 15 as an estimation result in the attack path estimation result table, and updates the attack path estimation result table by recording the entry point risk of each external communication IF 21 calculated by the entry point estimation unit 14 or the attack target risk of each ECU 22 calculated by the attack target estimation unit 15 as a risk.

[0167] FIG. 19 is a flowchart of the attack path estimation process performed by the attack path estimation unit 12.

[0168] As shown in FIG. 19, when the attack path estimation process is started, the attack path estimation unit 12 acquires the in-vehicle network information and anomaly detection information acquired by the acquisition unit 11, the entry point estimated by the entry point estimation unit 14, and the attack target estimated by the attack target estimation unit 15 (step S300).

[0169] Then, the attack path estimation unit 12 refers to the configuration of the in-vehicle network 20 indicated by the in-vehicle network information, and calculates each of one or more paths connecting the entry point and the attack target as attack path candidates (step S310).

[0170] When one or more attack path candidates are calculated, the attack path estimation unit 12 refers to the anomaly detection information and estimates the attack path candidate with the largest number of IDSs 23 that have detected anomalies as the attack path from among the one or more attack path candidates (step S320). Here, if there are multiple attack path candidates with the largest number of IDSs 23 that have detected anomalies, the attack path estimation unit 12 estimates each of the multiple attack path candidates as an attack path.

[0171] When the process of step S320 ends, the attack path estimation unit 12 ends the attack path estimation process.

[0172] FIG. 20 is a flowchart of the attack path reliability calculation process performed by the attack path reliability calculation unit 16.

[0173] As shown in FIG. 20, when the attack path reliability calculation process is started, the attack path reliability calculation unit 16 obtains the entry point risk of the entry point calculated by the entry point estimation unit 14 and the attack target risk of the attack target calculated by the attack target estimation unit 15 (step S400).

[0174] Then, the attack path reliability calculation unit 16 calculates the average of the acquired entry point risk of the entry point and the attack target risk of the attack target as the attack path reliability (step S410).

[0175] After calculating the attack path reliability, the attack path reliability calculation unit 16 checks whether the attack path estimation unit 12 has estimated a plurality of attack paths (step S420).

[0176] In the process of step S420, if there are multiple attack paths estimated by the attack path estimation unit 12 (step S420: Yes), the attack path reliability calculation unit 16 corrects the attack path reliability by the number of attack paths (step S430). Here, the attack path reliability calculation unit 16 is described as correcting the attack path reliability by dividing the attack path reliability by the number of attack paths. However, as long as the attack path reliability calculation unit 16 can correct the attack path reliability by the number of attack paths, it is not necessarily limited to the configuration of correcting the attack path reliability by dividing the attack path reliability by the number of attack paths.

[0177] When the process of step S430 ends, the attack path reliability calculation unit 16 ends the attack path reliability calculation process.

[0178] In the process of step S410, the attack path reliability calculation unit 16 has been described as calculating the average of the entry point risk of the entry point and the attack target risk of the attack target as the attack path reliability. In contrast, the attack path reliability calculation unit 16 may calculate the attack path reliability by other methods. For example, the attack path reliability calculation unit 16 may refer to the configuration of the in-vehicle network 20 indicated by the in-vehicle network information acquired by the acquisition unit 11 and the anomaly detection information acquired by the acquisition unit 11, and calculate a numerical value greater than 0.0 and less than or equal to 1.0 as the attack path reliability, which is obtained by dividing the "number of IDSs 23 that detected anomalies on the attack path" by the "total number of IDSs 23 on the attack path."

[0179] 21 and 22 are schematic diagrams showing an example of the attack path estimation result table updated by the attack path estimation result table management unit 17 after the attack path estimation process is executed by the attack path estimation unit 12 and the attack path reliability calculation process is executed. Here, Fig. 21 is a schematic diagram showing an example of the attack path estimation result table in a case where the attack path estimation unit 12 estimates one attack path, and Fig. 22 is a schematic diagram showing an example of the attack path estimation result table in a case where the attack path estimation unit 12 estimates multiple (here, two) attack paths.

[0180] As shown in Figures 21 and 22, when the attack path estimation process is executed by the attack path estimation unit 12 and the attack path reliability calculation process is executed, the attack path estimation result table management unit 17 updates the attack path estimation result table by recording a mark on the node corresponding to the attack path for each attack path estimated by the attack path estimation unit 12 and recording the attack path reliability calculated by the attack path reliability calculation unit 16.

[0181] FIG. 23 is a flowchart of the first display control process performed by the display control unit 18.

[0182] As shown in FIG. 23, when the first display control process is started, the display control unit 18 acquires the in-vehicle network information acquired by the acquisition unit 11, the attack path estimated by the attack path estimation unit 12, and the attack path history managed by the attack path estimation result table management unit 17 (step S500).

[0183] Then, the display control unit 18 refers to the configuration of the in-vehicle network 20 indicated by the in-vehicle network information and calculates a display control signal to display an in-vehicle network configuration diagram showing the configuration of the in-vehicle network on the display device 41 (step S510).

[0184] Furthermore, the display control unit 18 refers to the attack path and calculates a display control signal so as to display the attack path on the display device 41 in a display method different from that for other parts (step S520).

[0185] Furthermore, the display control unit 18 calculates a display control signal so as to display the attack path history in table format on the display device 41 (step S530).

[0186] Then, the display control unit 18 outputs the calculated display control signal to the display device 41 (step S540).

[0187] When the process of step S540 ends, the display control unit 18 ends the first display control process.

[0188] FIG. 24 is a schematic diagram showing an example of a screen displayed by the display device 41 controlled by a display control signal output by the display control unit 18 executing the first display process.

[0189] As shown in FIG. 24, the display device 41 is controlled by a display control signal output from the display control unit 18 to display (1) an in-vehicle network configuration diagram in which the attack paths estimated by the attack path estimation unit 12 are displayed in a manner different from other paths, and (2) for each of one or more attack paths estimated in the past by the attack path estimation unit 12, a table-format list in which the abnormality notification ID identifying the abnormality notification corresponding to that attack path, the attack path reliability of that attack path, the entry point of that attack path, the entry point risk of that entry point, the attack target of that attack path, and the attack target risk of that attack target are associated with each other.

[0190] It should be noted that the display control unit 18 may perform a second display control process instead of the first display control process.

[0191] FIG. 25 is a flowchart of the second display control process performed by the display control unit 18.

[0192] As shown in FIG. 25, the second display control process is a process in which the process of step S505 is executed instead of the process of step S500 from the first display control process, and the processes of steps S531 and S532 are executed between the processes of steps S530 and S540.

[0193] Therefore, the following description will focus on the process in steps S505, S531, and S532.

[0194] As shown in FIG. 25, when the second display control process is started, the display control unit 18 acquires the in-vehicle network information and anomaly detection information acquired by the acquisition unit 11, the attack path estimated by the attack path estimation unit 12, and the attack path history managed by the attack path estimation result table management unit 17 (step S505), and proceeds to processing of step S510.

[0195] When the process of step S530 ends, the display control unit 18 refers to the anomaly detection information and checks whether or not there is an IDS 23 that has detected an anomaly and is not included in the attack path (step S531).

[0196] In the processing of step S530, if there is an IDS23 that has detected an abnormality and is not included in the attack path (step S531: Yes), the display control unit 18 calculates a display control signal so as to display the node including the relevant IDS on the display device 41 in a display method different from the attack path and other parts (step S532).

[0197] In the process of step S530, if there is no IDS 23 that is not included in the attack path and has detected an abnormality (step S531: No), or if the process of step S532 ends, the process proceeds to step S540.

[0198] When the process of step S540 ends, the display control unit 18 ends the second display control process.

[0199] FIG. 26 is a schematic diagram showing an example of a screen displayed by the display device 41 controlled by a display control signal output by the display control unit 18 executing the second display process.

[0200] As shown in FIG. 26, the display device 41 is controlled by a display control signal output from the display control unit 18 to display (1) an in-vehicle network configuration diagram in which the attack paths estimated by the attack path estimation unit 12 are displayed in a manner different from other paths, and further, nodes including IDS 23 that have detected an abnormality and are not included in the attack path are displayed in a manner different from both the attack path and other parts, and (2) for each of one or more attack paths estimated in the past by the attack path estimation unit 12, a table-format list in which an abnormality notification ID that identifies the abnormality notification corresponding to the attack path, the attack path reliability of the attack path, the entry point of the attack path, the entry point risk of the entry point, the attack target of the attack path, and the attack target risk of the attack target are associated with each other.

[0201] <Consideration> As described above, the attack analysis device 10 can estimate an attack path including an entry point and an attack target in the case of an attack on the in-vehicle network 20. This allows a user of the attack analysis device 10 to reduce the cost of analyzing an attack, such as analyzing the attack and comparing the attack with past cases, in the case of an attack on the in-vehicle network 20.

[0202] Furthermore, as described above, the attack analysis device 10 can display an in-vehicle network configuration diagram in which an estimated attack path is displayed in a different manner from other paths on the display device 41. This allows a user of the attack analysis device 10 to visually recognize the estimated attack path.

[0203] (supplement) As described above, the embodiment has been described as an example of the technology disclosed in this application. However, the present disclosure is not limited to this embodiment. As long as it does not deviate from the gist of the present disclosure, various modifications conceived by a person skilled in the art to this embodiment and forms constructed by combining components in different embodiments may also be included within the scope of one or more aspects of the present disclosure.

[0204] (1) In the embodiment, the attack analysis device 10 has been described as being realized by the monitoring server 40 that exists outside the in-vehicle network 20. However, the attack analysis device 10 does not necessarily need to be limited to being realized by the monitoring server 40, and further does not need to be limited to being realized in a device outside the in-vehicle network 20. As an example, the attack analysis device 10 may be realized by an integrated ECU included in the in-vehicle network 20.

[0205] 27 is a block diagram showing an example of a configuration of the integrated ECU 24A according to a modified example. The integrated ECU 24A is, for example, a so-called computer device, and includes a processor (not shown) and a memory (not shown). The processor executes a program stored in the memory to realize the attack analysis device 10.

[0206] (2) Some or all of the components included in the attack analysis device 10 may be realized as dedicated or general-purpose circuits.

[0207] Some or all of the components included in the attack analysis device 10 may be configured, for example, from one system LSI (Large Scale Integration). The system LSI is an ultra-multifunctional LSI manufactured by integrating multiple components on one chip, and specifically, is a computer system including a microprocessor, a ROM (Read Only Memory), a RAM (Random Access Memory), etc. A computer program is stored in the ROM. The system LSI achieves its functions by the microprocessor operating in accordance with the computer program.

[0208] Here, we refer to it as a system LSI, but it may also be called an IC, LSI, super LSI, or ultra LSI depending on the level of integration. Also, the method of integration is not limited to LSI, but may be realized by a dedicated circuit or a general-purpose processor. It is also possible to use an FPGA (Field Programmable Gate Array) that can be programmed after the LSI is manufactured, or a reconfigurable processor that can reconfigure the connections and settings of the circuit cells inside the LSI.

[0209] Furthermore, if a new integrated circuit technology that can replace LSI appears due to the progress of semiconductor technology or a derivative technology, it is possible to integrate the functional blocks using that technology. The application of biotechnology is also a possibility.

[0210] (3) One aspect of the present disclosure is not only the attack analysis device 10 but also a method for analyzing characteristic components included in the attack analysis device 10 as steps. Attack Analysis Another aspect of the present disclosure may be a computer program that causes a computer to execute each of the characteristic steps included in the attack analysis method. Another aspect of the present disclosure may be a computer-readable non-transitory recording medium on which such a computer program is recorded. [Industrial Applicability]

[0211] The present disclosure is widely applicable to attack analysis devices that analyze cyber attacks against networks. [Explanation of symbols]

[0212] 1. Attack Monitoring System 10 Attack Analysis Device 11 Acquisition Department 12 Attack Path Estimation Department 13 Output section 14 Entry point estimation section 15 Attack target estimation unit 16 Attack Path Reliability Calculation Unit 17 Attack path estimation result table management section 18 Display control section 20 In-vehicle network 21 External communication interface (external communication IF) 21A External communication IF_A 21B External communication IF_B 21C External communication IF_C 21D External communication IF_D 22 Control ECU (ECU) 22A ECU_A 22B ECU_B 22C ECU_C 22D ECU_D 23 IDS 23A IDS_A 23B IDS_B 23C IDS_C 23D IDS_D 23E IDS_E 23F IDS_F 23G IDS_G 23H IDS_H 23I IDS_I 23J IDS_J 23K IDS_K 23L IDS_L 24, 24A Integrated ECU 25 CAN 26 Ethernet 27 Security Master 28 Vehicle Control Event Management Department 29 Gateway 30 Vehicles 40 Monitoring Server 41 Display device 50 External Network

Claims

1. an acquisition unit that acquires in-vehicle network information indicating a configuration of an in-vehicle network including a plurality of external communication interfaces and a plurality of control ECUs, and abnormality detection information indicating an abnormality detection result detected in one or more nodes in the in-vehicle network; an attack path estimation unit that estimates an attack path of an attack against the in-vehicle network based on the in-vehicle network information and the anomaly detection information, the attack path including an entry point indicating an external communication interface that is an entry point of the attack into the in-vehicle network and an attack target indicating a control ECU that is an attack target of the attack; an output unit that outputs the attack path, The acquisition unit further acquires an external communication event history indicating a history of communication events performed by the in-vehicle network with the outside, and a vehicle control event history indicating a history of vehicle control events performed by a vehicle equipped with the in-vehicle network, The attack analysis device further comprises: an entry point estimation unit that estimates the entry point based on the in-vehicle network information, the abnormality detection information, and the external communication event history; an attack target estimation unit that estimates the attack target based on the in-vehicle network information, the abnormality detection information, and the vehicle control event history; The attack path estimation unit estimates the attack path based on the entry point estimated by the entry point estimation unit and the attack target estimated by the attack target estimation unit. Attack analysis equipment.

2. the entry point estimation unit calculates an entry point risk indicating a reliability as the entry point for each of the plurality of external communication interfaces, and estimates the entry point based on each of the calculated entry point risks; The attack target estimation unit calculates an attack target risk indicating a reliability of each of the control ECUs as an attack target, and estimates the attack target based on each of the calculated attack target risks. The attack analysis device according to claim 1 .

3. Further, an attack path reliability calculation unit is provided which calculates an attack path reliability indicating a reliability of the attack path for the attack path based on the entry point risk of the entry point calculated by the entry point estimation unit and the attack target risk of the attack target calculated by the attack target estimation unit, The output unit further outputs the attack path reliability. The attack analysis device according to claim 2 .

4. The output unit includes a display control unit that outputs a display control signal including the attack path, the display control signal being for controlling a display device to display a configuration diagram showing a configuration of the in-vehicle network and to display the attack path in the configuration diagram in a display method different from that of other parts. The attack analysis device according to any one of claims 1 to 3.

5. 1. A computer-implemented method for attack analysis, comprising: Acquire in-vehicle network information indicating a configuration of an in-vehicle network including a plurality of external communication interfaces and a plurality of control ECUs, and abnormality detection information indicating an abnormality detection result detected in one or more nodes in the in-vehicle network; based on the in-vehicle network information and the anomaly detection information, estimating an attack path of the attack against the in-vehicle network, the attack path including an entry point indicating an external communication interface that is a point of entry of the attack into the in-vehicle network and an attack target indicating a control ECU that is an attack target of the attack; Outputting the attack path; Acquire an external communication event history indicating a history of communication events performed by the in-vehicle network with the outside, and a vehicle control event history indicating a history of vehicle control events performed by a vehicle equipped with the in-vehicle network; Estimating the entry point based on the in-vehicle network information, the abnormality detection information, and the external communication event history; Estimating the attack target based on the in-vehicle network information, the anomaly detection information, and the vehicle control event history; Estimating the attack path based on the estimated entry point and the estimated attack target. Attack analysis method.

6. A program for causing a computer to execute an attack analysis process, The attack analysis process includes: Acquire in-vehicle network information indicating a configuration of an in-vehicle network including a plurality of external communication interfaces and a plurality of control ECUs, and abnormality detection information indicating an abnormality detection result detected in one or more nodes in the in-vehicle network; based on the in-vehicle network information and the anomaly detection information, estimating an attack path of the attack against the in-vehicle network, the attack path including an entry point indicating an external communication interface that is a point of entry of the attack into the in-vehicle network and an attack target indicating a control ECU that is an attack target of the attack; Outputting the attack path; Acquire an external communication event history indicating a history of communication events performed by the in-vehicle network with the outside, and a vehicle control event history indicating a history of vehicle control events performed by a vehicle equipped with the in-vehicle network; Estimating the entry point based on the in-vehicle network information, the abnormality detection information, and the external communication event history; Estimating the attack target based on the in-vehicle network information, the anomaly detection information, and the vehicle control event history; and estimating the attack path based on the estimated entry point and the estimated attack target. program.

Images